Android device abnormal process detection and analysis method based on isolated forest and large language model

Abstract

The invention discloses an Android equipment abnormal process detection and analysis method based on an isolated forest and a large language model. The method comprises the following steps: collecting process data of Android equipment; performing unsupervised anomaly detection on the process data by using an isolated forest algorithm, performing real-time anomaly evaluation on each process by constructing a plurality of isolated trees, calculating an anomaly score of each process, and outputting a Boolean anomaly mark according to global distribution, wherein the isolated forest algorithm stabilizes the proportion of the abnormal process within a predetermined range by controlling model parameters; performing secondary analysis on the process of the exception mark by utilizing a large language model, and generating exception type identification, exception reason description and optimization suggestions; and outputting an analysis result, wherein the analysis result comprises a detailed report and a visual chart of the abnormal process. Through combination of unsupervised anomaly detection and AI analysis, research and judgment, the problems of information leakage and the like caused by background abnormal power consumption, abnormal wake-up and resource consumption are solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of anomaly detection, and particularly relates to an Android device abnormal process detection and analysis method based on an isolated forest and a large language model. BACKGROUND

[0002] With the continuous expansion of the mobile application ecosystem, government and enterprise, financial institutions and mainstream application stores have higher requirements for terminal security and compliance management. However, the current Android platform still has a significant blind spot in the management of background behavior. A large number of third-party applications take advantage of hidden background strategies to implement malicious operations without the user's awareness, resulting in frequent abnormal wake-up events and abnormal power consumption in the background. Traditional screening mechanisms that rely on static permission declarations and simple white lists cannot effectively identify these dynamic, low-frequency and highly concealed behaviors, so that potential risk applications can still bypass the audit and go on the market.

[0003] At the same time, the large-scale custom terminal (COPE) scenario of government and enterprise and bank puts forward higher requirements for the energy consumption and behavior supervision of key office applications (such as WeChat for Enterprise, DingTalk, OA, etc.). The existing mobile device management (MDM / EMM) scheme focuses on application installation control and network strategy configuration, and lacks fine-grained monitoring capability for process-level energy consumption, wake-up frequency and background network activity. When the office application appears abnormal wake-up or resource consumption in the background, the traditional manual log collection and periodic audit method is long in cycle and poor in timeliness, and it is difficult to discover and remotely issue freezing, frequency limiting or strategy update in the first time, resulting in a long security window period and failing to meet the increasingly strict industry compliance and supervision requirements.

[0004] More attention should be paid to the fact that attackers have begun to use AI-enhanced accessibility (Accessibility) permissions to implement new penetration. By disguising as "intelligent customer service" "voice assistant" and other seemingly reasonable scenarios, the malicious application can continuously monitor interface events, inject global gestures, and silently start Activity in the background after the user grants the accessibility permission in the installation stage, achieving long-term mounting without exposing the foreground icon. Once the accessibility permission is obtained, the attacker can complete the automatic clicking of the background keep-alive pop-up window, high-frequency task scheduling and screen content reading in a very short time, and then continuously consume system resources and steal sensitive information such as WeChat messages and OA approval details in the background. Since the accessibility event stream is considered as a trusted input by the system, traditional detection methods based on traffic features or permission white lists cannot detect such behaviors, which brings continuous resource consumption and data leakage risks to the terminal, and also poses a serious challenge to the compliance audit of government and enterprise, financial scenarios. SUMMARY

[0005] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and provide an Android device abnormal process detection and analysis method based on isolated forest and large language model, which solves the problems of abnormal power consumption, abnormal wake-up and resource consumption of Android devices, and information leakage caused by abnormal processes through unsupervised anomaly detection and AI analysis and judgment.

[0006] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0007] In the first aspect, the present application provides an Android device abnormal process detection and analysis method based on isolated forest and large language model, comprising the following steps:

[0008] Collecting process data of the Android device, wherein the process data at least includes process package name, front and background running time, energy consumption data, unit time energy consumption and device power percentage;

[0009] Using isolated forest algorithm to perform unsupervised anomaly detection on the process data, constructing multiple isolated trees to perform real-time anomaly evaluation on each process, calculating the anomaly score of each process and outputting a Boolean type anomaly label according to the global distribution, wherein the isolated forest algorithm controls the model parameters to stabilize the proportion of abnormal processes within a predetermined range;

[0010] Using a large language model to perform secondary analysis on the abnormal labeled processes, generating abnormal type identification, abnormal reason description and optimization suggestions; specifically: first, identifying the process type based on the energy consumption, wake-up frequency, CPU occupancy rate and network activity characteristics of the process, wherein the process type includes malicious programs, resource consumption abnormal processes, frequent wake-up processes and advertising SDK sneaking traffic processes; second, generating abnormal reason description according to the process behavior pattern and historical data pattern, and distinguishing between real abnormal and false alarm; finally, providing targeted optimization suggestions according to the process type and abnormal influence, supporting batch analysis of multiple abnormal processes, and generating a report containing abnormal process information, abnormal reason description and optimization suggestions, and the report is saved in CSV and JSON formats;

[0011] Outputting the analysis result, including detailed report and visual chart of abnormal processes.

[0012] As a preferred technical scheme, the energy consumption data includes foreground energy consumption, background energy consumption, foreground unit time energy consumption, background unit time energy consumption and total unit time energy consumption.

[0013] As a preferred technical solution, the isolation forest algorithm is used as the core engine for unsupervised anomaly detection, and the design goal is to control the proportion of abnormal processes at about 10% without labeled data, providing high-quality and processable abnormal sample basis for subsequent large language model analysis. The algorithm constructs multiple isolation trees, randomly selects features and split points in each tree, and recursively partitions multi-dimensional process data. Abnormal processes are usually isolated to leaf nodes in fewer split times due to their sparse distribution in feature space and deviation from normal patterns, so their average path length in all isolation trees is shorter. The system calculates the anomaly score of each process according to the path length, and the higher the anomaly score, the more likely the process is abnormal.

[0014] In order to adapt to the hardware characteristics and application scenarios of different Android devices, the isolation forest algorithm supports dynamic adjustment of multiple key hyperparameters, including the number of isolation trees, the maximum depth of a single tree, and the determination threshold of anomaly score. By adjusting these parameters, the system can maintain the stability and accuracy of anomaly detection under different devices, different system versions, and different application load conditions. For example, the number of trees can be increased appropriately on high-performance devices to improve detection accuracy, while the tree depth can be reduced on resource-constrained devices to save computational overhead. This parameter adaptive mechanism ensures the robustness and scalability of the algorithm in various terminal environments, providing a reliable and stable data basis for in-depth analysis of subsequent large language models.

[0015] As a preferred technical solution, the anomaly score calculation formula of the isolation forest algorithm is as follows:

[0016]

[0017] where S(x) is the anomaly score of data point x, E(h(x)) is the average path length of data point x in all isolation trees, and c(n) is a constant based on the number of data points n, used to normalize the path length. The path length of abnormal points is shorter, so their anomaly score is higher.

[0018] As a preferred technical solution, the analysis of the large language model includes:

[0019] The research and judgment process of the large language model is a multi-stage intelligent reasoning process deeply integrating field knowledge. First, the model identifies the abnormal type based on the multi-dimensional feature data of the process, including energy consumption, wake-up frequency, CPU occupancy, network activity, etc. The abnormal type not only includes malicious programs, resource consumption abnormalities, frequent wake-ups, and ad SDK traffic stealing, but more importantly, the model can understand and judge the application type (such as games, social media, tools, and system services) to which the process belongs based on its large training corpus, and call the normal behavior pattern knowledge of the type of application as a benchmark for comparison.

[0020] On this basis, the large language model does not simply output a classification label, but generates a detailed and readable natural language description to explain the abnormal reason. The description closely combines the actual behavior of the process with the context of its deviation from the normal mode of the type, for example, for a process identified as "e-commerce", if it shows abnormally high background energy consumption and network activity, the model will infer and generate a causal analysis such as "the process is continuously performing high-frequency network data interaction in the background, far exceeding the normal background behavior pattern of similar applications, suspected to exist behaviors such as traffic stealing or frequent user data reporting", thus transforming abstract data anomalies into concrete business logic risks.

[0021] Finally, the large language model provides highly targeted optimization suggestions based on the identified abnormal type and root cause. These suggestions go beyond the general "end process" or "limit network" and are concretized into actionable instruction sets, such as: for suspected malicious programs, suggest "immediately freeze the process and scan its permission granting situation, focusing on high-risk permissions such as accessibility services or background pop-up windows"; for resource consumption abnormal applications, suggest "optimize its background task scheduling strategy, limit its execution of non-urgent synchronization tasks only when the device is charging and idle". This research and judgment process greatly improves the operability of the detection results, transforming the anomaly score output by the unsupervised algorithm into an action guide that can be directly executed by the user or device management strategy.

[0022] As a preferred technical solution, the output step includes generating reports in CSV and JSON formats, and generating PNG charts and interactive HTML reports through matplotlib and seaborn.

[0023] As a preferred technical solution, the abnormal process distribution chart is used to show the abnormal distribution of each process in different device types or operating system versions; the energy consumption and abnormal score relationship chart is used to reflect the correlation between process energy consumption data and abnormal score; and the abnormal process type statistical chart is used to show the number and proportion of different types of abnormal processes.

[0024] In a second aspect, the application provides an Android device abnormal process detection and analysis system based on an isolated forest and a large language model, which is applied to the Android device abnormal process detection and analysis method based on an isolated forest and a large language model and includes a data collection module, an unsupervised evaluation module, a large model research and judgment module, and a visualization module.

[0025] The data collection module is configured to collect process data of an Android device, and the process data at least includes a process package name, a front and background runtime length, energy consumption data, energy consumption per unit time, and a device power percentage.

[0026] The unsupervised evaluation module is configured to perform unsupervised anomaly detection on the process data by using an isolated forest algorithm, to perform real-time anomaly evaluation on each process by constructing multiple isolated trees, to calculate an anomaly score of each process, and to output a Boolean type anomaly label according to a global distribution, wherein the isolated forest algorithm stabilizes a proportion of abnormal processes in a predetermined range by controlling model parameters.

[0027] The large model research and judgment module is configured to perform secondary analysis on the abnormal labeled processes by using a large language model, to generate abnormal type identification, abnormal reason description, and optimization suggestions, and specifically, to identify a process type based on energy consumption, wake-up frequency, CPU occupancy, and network activity characteristics of the process, wherein the process type includes a malicious program, an abnormal resource consumption process, a frequent wake-up process, and an advertisement SDK traffic-stealing process; to generate an abnormal reason description according to a process behavior pattern and a historical data pattern, and to distinguish a real abnormality from a false alarm; and to provide targeted optimization suggestions according to the process type and an abnormal influence, to support batch analysis of multiple abnormal processes, and to generate a report including abnormal process information, abnormal reason description, and optimization suggestions, and to save the report in CSV and JSON formats.

[0028] The visualization module is configured to output analysis results, including a detailed report and a visual chart of abnormal processes.

[0029] In a third aspect, the application provides an electronic device, which includes:

[0030] at least one processor; and

[0031] a memory connected to the at least one processor in communication; wherein

[0032] the memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the Android device abnormal process detection and analysis method based on an isolated forest and a large language model.

[0033] Fourthly, the present invention provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the aforementioned method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models.

[0034] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0035] 1. This invention combines the Isolation Forest algorithm with a large language model, employing an unsupervised anomaly detection method to efficiently and accurately identify dynamic, low-frequency, and subtle abnormal behaviors. Traditional anomaly detection methods typically rely on manual annotation and preset thresholds, making them unsuitable for various complex application scenarios. In contrast, this invention, through unsupervised learning, does not depend on manual annotation, can directly process large-scale real-time datasets, and automatically adapts to the characteristics of different devices and applications, greatly improving the system's flexibility and versatility.

[0036] 2. This invention, through the introduction of a large language model, provides intelligent anomaly cause analysis and optimization suggestions based on anomaly detection. This innovative method, combining deep learning and natural language processing technologies, can generate detailed descriptions of anomaly causes, distinguish between genuine anomalies and false alarms, and provide targeted optimization suggestions for anomaly processes, greatly reducing the occurrence of false alarms and false negatives. Compared with traditional rule-based detection methods, the large language model can perform intelligent reasoning based on the contextual information of process behavior, significantly improving the accuracy and operability of the system. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart of an embodiment of the present invention regarding an abnormal process detection and analysis method for Android devices based on isolated forests and large language models;

[0039] Figure 2 This is a block diagram of an Android device abnormal process detection and analysis system based on isolated forest and large language model, according to an embodiment of the present invention.

[0040] Figure 3 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0041] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0042] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0043] like Figure 1 As shown in this embodiment, an abnormal process detection and analysis method for Android devices based on isolated forests and large language models includes the following steps:

[0044] S1. Collect process data from the Android device, specifically:

[0045] It directly connects to the real-time runtime environment of the terminal, collecting real process data from the Android device under test as the analysis object. The raw data fields collected on-site include: process package name, foreground_duration and background_duration, foreground_energy and background_energy, and the calculated foreground_energy_per_hour, background_energy_per_hour, and total_energy_per_hour. It also records the current device battery percentage (charge), the anomaly score (anomaly_score) output in real time by the Isolation Forest algorithm, and the boolean anomaly flag (is_anomaly).

[0046] The aforementioned process data covers various application types such as games, social networking, systems, and tools, and is compatible with multiple domestic mobile phone brands, device models, and system versions. The unified data format ensures that subsequent test results are reproducible and auditable.

[0047] S2. Unsupervised anomaly assessment is performed on the collected process data. Multiple isolated forests are constructed to perform real-time anomaly assessment for each process, calculating an anomaly score for each process and outputting a Boolean anomaly label based on the global distribution. The isolated forest algorithm controls model parameters to stabilize the proportion of anomalous processes within a predetermined range. This assessment is completed without any manual annotation or preset thresholds. It automatically calculates anomaly score (anomaly_score) for each process data point and outputs a Boolean label (is_anomaly) based on the global distribution, stabilizing the anomaly ratio at approximately 10%, thus achieving a lightweight end-to-end detection process.

[0048] Isolation Forest is an unsupervised anomaly detection algorithm based on a tree model. Its core idea is to "isolate" data points by constructing a series of random isolation trees. Unlike traditional methods that rely on the distance or density of data points, Isolation Forest gradually segments the dataset by randomly selecting features and split values ​​to form a tree structure. Anomalies, due to their rarity and distinctiveness, are more easily isolated, thus exhibiting shorter path lengths in Isolation Forests.

[0049] The working principle of Isolation Forest is based on two key assumptions. First, scarcity: outliers are sparsely distributed in the data space and are more isolated than normal points. Second, isolation: outliers are easier to isolate than normal points, so their paths in the tree structure are shorter and they can be quickly separated. Isolation Forest divides data points into different leaf nodes through a series of randomly partitioned decision trees. Outliers often require fewer partitions to reach the leaf nodes, thus exhibiting shorter path lengths.

[0050] The specific calculation process of an isolation forest begins by randomly selecting features and split points within each isolated tree, dividing the data points into two subsets. Then, each subset is randomly divided again until all data points are completely isolated or the maximum tree depth is reached. Within each tree, the path length of each data point is recorded; data points with shorter paths are considered more likely to be outliers. By calculating the average path length across all isolated trees, an anomalous score is obtained for each data point, with points having shorter paths identified as outliers.

[0051] The formula for calculating the outlier score in the Isolation Forest algorithm is as follows:

[0052]

[0053] Where S(x) is the outlier score of data point x, E(h(x)) is the average path length of data point x across all isolated trees, and c(n) is a constant based on the number of data points n, used to normalize the path length. Outliers have shorter path lengths, and therefore higher outlier scores.

[0054] Compared to traditional density- or distance-based anomaly detection methods, Isolation Forests offer significant advantages, particularly in handling high-dimensional, large-scale data. Their main advantages include: First, Isolation Forests are an unsupervised learning method, requiring no manual data labeling and allowing direct application to large-scale real-time datasets; second, they are computationally efficient because they construct multiple random trees, avoiding the computational overhead of traditional methods; furthermore, Isolation Forests are insensitive to data distribution patterns and can effectively detect various types of anomalous behavior, especially dynamic, low-frequency, and subtle anomalies, such as malicious application background operations and abnormal energy consumption.

[0055] In this embodiment, the Isolation Forest algorithm is used for unsupervised anomaly evaluation of multidimensional feature data collected from Android devices, as follows:

[0056] First, multi-dimensional data of the process is collected in real time by accessing the device environment. This data includes information such as the process's package name, foreground / background runtime, and energy consumption, which are then used to form a feature vector.

[0057] Then, the Isolation Forest algorithm uses these feature vectors to construct multiple isolated trees for real-time anomaly assessment of processes. An anomaly score is calculated for each process, and processes with higher scores are marked as anomalies and subjected to further analysis. In this way, the system can automatically filter out potential anomalous processes and provide reliable foundational data for subsequent analysis.

[0058] The Isolation Forest algorithm can stably control the proportion of anomalous processes to approximately 10%, meaning the system can efficiently and accurately identify hidden abnormal behaviors without manual annotation. Furthermore, Isolation Forest can adapt to the characteristics of different devices and applications, ensuring reliability in various environments.

[0059] Finally, the parameter settings of Isolation Forest are also flexible. Although it is unsupervised, certain hyperparameters still need to be adjusted in practical applications, such as the number of trees, the maximum tree depth, and the threshold for anomaly scores. With appropriate parameter adjustments, Isolation Forest can achieve optimal anomaly detection results on different devices and in different scenarios.

[0060] S3. Utilize a large language model to perform secondary analysis on the anomaly labeling process, generating anomaly type identification, anomaly cause description, and optimization suggestions.

[0061] After the Isolation Forest algorithm performs initial screening of abnormal processes, this embodiment further utilizes a Large Language Model (LLM) to conduct secondary analysis and judgment on the screened abnormal processes, providing more accurate identification and analysis of abnormal behavior. This process combines natural language processing technology, enabling the identification of abnormal process types, analysis of abnormal causes, and provision of targeted optimization suggestions, further improving the system's detection capabilities and accuracy.

[0062] The large language model first processes the characteristic data of abnormal processes, including energy consumption, wake-up frequency, CPU utilization, and network activity. Based on known abnormal behavior patterns, the large language model can determine the behavior type of the process through in-depth analysis of multi-dimensional data. This analysis can identify whether the process is malicious, has abnormal resource consumption, frequent wake-up events, or is illegally consuming traffic through an advertising SDK. Process type identification provides crucial evidence for subsequent anomaly cause analysis and supports the generation of optimization strategies and false alarm screening.

[0063] After identifying the abnormal process type, the large language model further generates a description of the anomaly's cause. The model can automatically generate detailed explanations of the anomaly's cause based on the process's specific behavioral patterns and historical data patterns. For example, if a process frequently wakes up and consumes a large amount of energy, the model might generate a description like, "This process frequently wakes up in the background and consumes a lot of energy, possibly due to unoptimized background tasks; it is recommended to optimize process scheduling." These descriptions help device administrators understand the mechanism of the anomaly, providing detailed information support for subsequent processing. Simultaneously, the model can also identify false alarms by comparing process behavior to normal operations, reducing false alarms caused by similar process behavior.

[0064] After completing the anomaly analysis, the large language model provides targeted optimization suggestions for each abnormal process based on its type and impact. For example, for detected malicious programs, the model might suggest immediately freezing the process and reviewing the application's permissions, especially accessibility permissions. For processes with excessive power consumption or frequent wake-ups, the model might suggest that developers optimize background process scheduling to reduce unnecessary wake-up events, thereby reducing device power consumption. Through these optimization suggestions, the system can help device administrators take measures to reduce the impact of abnormal processes and improve the overall performance and energy efficiency of the device.

[0065] To improve processing efficiency, this invention also supports batch processing. It can analyze multiple abnormal processes in batches and automatically generate reports containing information about the abnormal processes, descriptions of the causes of the abnormalities, and optimization suggestions. These reports are output in CSV and JSON formats for easy subsequent auditing and processing. The reports detail the analysis results for each abnormal process, helping equipment managers quickly understand the abnormal situation of the equipment and take appropriate measures. Through batch processing and report generation, this invention not only improves the efficiency of abnormal process identification but also enhances the maintainability and scalability of the system.

[0066] S4. Output the analysis results, including detailed reports and visualizations of the abnormal processes.

[0067] To enhance the operability and interpretability of anomaly detection results, this embodiment provides a data visualization-based result display function. By using tools such as matplotlib and seaborn, the system can graphically display multi-dimensional data such as detected abnormal process information, energy consumption data, and anomaly scores, helping users to understand the detection results more intuitively.

[0068] First, multi-dimensional charts are generated to display the distribution of abnormal processes, the relationship between energy consumption and abnormality scores, and abnormal statistics for different process types. These charts allow users to clearly see the degree of abnormality of each process and its impact on system energy consumption. For example, the graph showing the relationship between abnormality scores and energy consumption helps users understand whether high-energy-consuming processes are related to abnormal behavior, thus providing guidance for device optimization and adjustments.

[0069] Furthermore, this embodiment also supports the generation of interactive reports, which users can access through a browser and interact with the charts. The interactive report supports functions such as zooming in and out, filtering data, and viewing specific data points, enabling users to flexibly view and analyze different data dimensions. The report is output in index.html format, making it easy to view on different devices, and supports customized display of charts and data.

[0070] Specifically, this embodiment provides the following types of visualization charts: An abnormal process distribution chart shows the abnormal distribution of various processes across different device types or operating system versions, helping users identify potential abnormal patterns. An energy consumption and abnormal score relationship chart allows users to view the relationship between process energy consumption data and abnormal scores, identifying which processes are consuming excessive system resources while malfunctioning. An abnormal process type statistics chart displays the number and proportion of different types of abnormal processes, helping users identify the most common abnormal behaviors in the system.

[0071] In addition, the interactive report includes multiple data statistics and analysis functions. For example, users can filter data by fields such as process package name, process type, or anomaly score to quickly locate abnormal processes that require attention. Users can also view detailed information about abnormal processes, including descriptions of the causes of the anomalies and optimization suggestions, further improving the accuracy of subsequent decision-making.

[0072] This visualization not only provides accurate anomaly detection results but also helps users quickly identify problems and take effective countermeasures. This feature enhances system operability, enabling equipment administrators to respond quickly, thereby improving equipment security and stability.

[0073] This invention innovatively introduces a large language model to conduct in-depth analysis of abnormal processes identified by isolated forests. It not only accurately identifies the types of abnormal processes and generates detailed descriptions of the causes of the anomalies, but also provides intelligent analysis and customized optimization suggestions. This technology overcomes the limitations of traditional rule-based detection methods, offering greater intelligence, accuracy, and operability. The anomaly judgment function of the large language model is particularly innovative and deserves special protection. Furthermore, by leveraging the analysis results and optimization suggestions generated by the large language model, this invention provides equipment administrators with practical guidance. While intelligently identifying different types of abnormal behavior, it effectively improves the system's intelligence level, reduces misoperation and the need for manual intervention. Its innovation in intelligent analysis and optimization constitutes another key aspect of this invention.

[0074] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0075] Based on the same ideas as the Android device abnormal process detection and analysis method based on isolated forest and large language model in the above embodiments, the present invention also provides an Android device abnormal process detection and analysis system based on isolated forest and large language model. This system can be used to execute the above-described Android device abnormal process detection and analysis method based on isolated forest and large language model. For ease of explanation, the structural diagram of the embodiment of the Android device abnormal process detection and analysis system based on isolated forest and large language model only shows the parts related to the embodiments of the present invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0076] Please see Figure 2In another embodiment of this application, an Android device abnormal process detection and analysis system 100 based on isolated forest and large language model is provided. The system includes a data acquisition module 101, an unsupervised evaluation module 102, a large model judgment module 103, and a visualization module 104.

[0077] The data acquisition module 101 is used to collect process data of the Android device. The process data includes at least the process package name, foreground and background runtime, energy consumption data, energy consumption per unit time, and device battery percentage.

[0078] The unsupervised evaluation module 102 is used to perform unsupervised anomaly detection on the process data using the isolated forest algorithm. It constructs multiple isolated trees to perform real-time anomaly evaluation on each process, calculates the anomaly score of each process, and outputs a Boolean anomaly label according to the global distribution. The isolated forest algorithm stabilizes the proportion of abnormal processes within a predetermined range by controlling the model parameters.

[0079] The large-scale model analysis module 103 is used to perform secondary analysis on the abnormally marked processes using a large language model, generating anomaly type identification, anomaly cause description, and optimization suggestions. Specifically, it first identifies the process type based on the process's energy consumption, wake-up frequency, CPU utilization, and network activity characteristics. The process types include malicious programs, processes with abnormal resource consumption, processes that frequently wake up, and processes that use advertising SDKs to steal traffic. Secondly, it generates anomaly cause descriptions based on process behavior patterns and historical data patterns, while distinguishing between real anomalies and false alarms. Finally, it provides targeted optimization suggestions based on the process type and the impact of the anomaly. It supports batch analysis of multiple abnormal processes and generates a report containing abnormal process information, anomaly cause descriptions, and optimization suggestions. The report is saved in CSV and JSON formats.

[0080] The visualization module 104 is used to output analysis results, including detailed reports and visualization charts of abnormal processes.

[0081] It should be noted that the Android device abnormal process detection and analysis system based on isolated forest and large language model of the present invention corresponds one-to-one with the Android device abnormal process detection and analysis method based on isolated forest and large language model of the present invention. The technical features and beneficial effects described in the embodiments of the Android device abnormal process detection and analysis method based on isolated forest and large language model are applicable to the embodiments of Android device abnormal process detection and analysis based on isolated forest and large language model. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0082] Furthermore, in the implementation of the Android device abnormal process detection and analysis system based on isolated forest and large language model in the above embodiments, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or for the convenience of software implementation. That is, the internal structure of the Android device abnormal process detection and analysis system based on isolated forest and large language model is divided into different program modules to complete all or part of the functions described above.

[0083] Please see Figure 3 In one embodiment, an electronic device is provided that implements an Android device abnormal process detection and analysis method based on isolated forest and large language model. The electronic device 200 may include a first processor 201, a first memory 202 and a bus, and may also include a computer program stored in the first memory 202 and executable on the first processor 201, such as an Android device abnormal process detection and analysis program 203 based on isolated forest and large language model.

[0084] The first memory 202 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory 202 can be an internal storage unit of the electronic device 200, such as the portable hard drive of the electronic device 200. In other embodiments, the first memory 202 can also be an external storage device of the electronic device 200, such as a plug-in portable hard drive, SmartMediaCard (SMC), SecureDigital (SD) card, FlashCard, etc., equipped on the electronic device 200. Furthermore, the first memory 202 can include both internal and external storage units of the electronic device 200. The first memory 202 can be used not only to store application software and various types of data installed on the electronic device 200, such as the code of the Android device abnormal process detection and analysis program 203 based on isolated forest and large language model, but also to temporarily store data that has been output or will be output.

[0085] In some embodiments, the first processor 201 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor 201 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory 202 and calls data stored in the first memory 202 to perform various functions of the electronic device 200 and process data.

[0086] Figure 3 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 3 The structure shown does not constitute a limitation on the electronic device 200, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0087] The Android device abnormal process detection and analysis program 203 based on isolated forest and large language model, stored in the first memory 202 of the electronic device 200, is a combination of multiple instructions. When run in the first processor 201, it can achieve the following:

[0088] Collect process data of Android devices, including at least the process package name, foreground and background runtime, energy consumption data, energy consumption per unit time, and device battery percentage.

[0089] The isolated forest algorithm is used to perform unsupervised anomaly detection on the process data. Multiple isolated trees are constructed to perform real-time anomaly evaluation on each process. The anomaly score of each process is calculated and a Boolean anomaly label is output according to the global distribution. The isolated forest algorithm controls the model parameters to stabilize the proportion of abnormal processes within a predetermined range.

[0090] This paper utilizes a large language model to perform secondary analysis on anomaly-marked processes, generating anomaly type identification, anomaly cause description, and optimization suggestions. Specifically, it first identifies process types based on energy consumption, wake-up frequency, CPU utilization, and network activity characteristics. These process types include malicious programs, processes with abnormal resource consumption, processes with frequent wake-ups, and processes that illegally consume traffic via advertising SDKs. Second, it generates anomaly cause descriptions based on process behavior patterns and historical data patterns, while distinguishing between genuine anomalies and false alarms. Finally, it provides targeted optimization suggestions based on process type and anomaly impact. The paper supports batch analysis of multiple anomaly processes and generates reports containing anomaly process information, anomaly cause descriptions, and optimization suggestions, which are saved in CSV and JSON formats.

[0091] Output analysis results, including detailed reports and visualizations of abnormal processes.

[0092] Furthermore, if the modules / units integrated in the electronic device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0093] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0094] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for detecting and analyzing abnormal processes on Android devices based on isolated forests and large language models, characterized in that, Includes the following steps: Collect process data of Android devices, including at least the process package name, foreground and background runtime, energy consumption data, energy consumption per unit time, and device battery percentage. The isolated forest algorithm is used to perform unsupervised anomaly detection on the process data. Multiple isolated trees are constructed to perform real-time anomaly evaluation on each process. The anomaly score of each process is calculated and a Boolean anomaly label is output according to the global distribution. The isolated forest algorithm controls the model parameters to stabilize the proportion of abnormal processes within a predetermined range. This paper utilizes a large language model to perform secondary analysis on anomaly-marked processes, generating anomaly type identification, anomaly cause description, and optimization suggestions. Specifically, it first identifies process types based on energy consumption, wake-up frequency, CPU utilization, and network activity characteristics. These process types include malicious programs, processes with abnormal resource consumption, processes with frequent wake-ups, and processes that illegally consume traffic via advertising SDKs. Second, it generates anomaly cause descriptions based on process behavior patterns and historical data patterns, while distinguishing between genuine anomalies and false alarms. Finally, it provides targeted optimization suggestions based on process type and anomaly impact. The paper supports batch analysis of multiple anomaly processes and generates reports containing anomaly process information, anomaly cause descriptions, and optimization suggestions, which are saved in CSV and JSON formats. Output analysis results, including detailed reports and visualizations of abnormal processes.

2. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1, characterized in that, The energy consumption data includes front-end energy consumption, back-end energy consumption, front-end energy consumption per unit time, back-end energy consumption per unit time, and total energy consumption per unit time.

3. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1, characterized in that, The Isolation Forest algorithm is used as the core engine for unsupervised anomaly detection. Its design goal is to stably control the proportion of anomalous processes at 10% without the need for labeled data, providing a high-quality and processable anomalous sample foundation for subsequent large language model analysis. The algorithm constructs multiple isolation trees and randomly selects features and split points in each tree to recursively segment multidimensional process data. Because anomalous processes are sparsely distributed in the feature space and deviate from normal patterns, they can usually be isolated to leaf nodes with fewer splits, resulting in a shorter average path length across all isolation trees. The system calculates the anomaly score for each process based on the path length; the higher the anomaly score, the more likely the process is to be anomalous. To adapt to the hardware characteristics and application scenarios of different Android devices, the Isolation Forest algorithm supports dynamic adjustment of several key hyperparameters, including the number of isolated trees, the maximum depth of a single tree, and the threshold for anomaly score determination. By adjusting these parameters, the system can maintain the stability and accuracy of anomaly detection under different devices, different system versions, and different application loads.

4. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1 or 3, characterized in that, The formula for calculating the outlier score in the Isolation Forest algorithm is as follows: Where S(x) is the outlier score of data point x, E(h(x)) is the average path length of data point x in all isolated trees, and c(n) is a constant based on the number of data points n, used to normalize the path length. Outliers have shorter path lengths, so their outlier scores are higher.

5. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1, characterized in that, The analysis of the large language model includes: The judgment process of the large language model is a multi-stage intelligent reasoning process that deeply integrates domain knowledge. First, the model identifies the abnormal types of the process based on its multi-dimensional feature data, including energy consumption, wake-up frequency, CPU utilization, and network activity. The abnormal types not only include explicit categories such as malicious programs, abnormal resource consumption, frequent wake-ups, and advertising SDKs stealing traffic, but more importantly, the model can understand and judge the application type to which the process belongs based on its huge training corpus, and accordingly call the knowledge of the normal behavior patterns that the application of this type should have as a benchmark for comparison. Building on this, the large language model does not simply output classification labels, but generates detailed and readable natural language descriptions to explain the causes of anomalies; these natural language descriptions are closely linked to the context of the process’s actual behavior deviating from its normal pattern. Finally, the large language model provides highly targeted optimization suggestions based on the identified anomaly types and root causes. These suggestions go beyond general "terminating processes" or "restricting networks" and are instead visualized as a set of actionable instructions. For suspected malicious programs, it suggests "immediately freezing the process and scanning its permission granting status, with a focus on reviewing high-risk permissions such as accessibility services or background pop-ups." For applications with abnormal resource consumption, it suggests "optimizing their background task scheduling strategy and restricting them to only execute non-urgent synchronization tasks when the device is charging and idle." 6. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1, characterized in that, The output steps include generating reports in CSV and JSON formats, as well as generating PNG charts and interactive HTML reports using matplotlib and seaborn.

7. The method for detecting and analyzing abnormal processes in Android devices based on isolated forests and large language models according to claim 1, characterized in that, The abnormal process distribution chart is used to show the abnormal distribution of each process in different device types or operating system versions; the energy consumption and abnormal score relationship chart is used to show the correlation between process energy consumption data and abnormal scores; the abnormal process type statistics chart is used to show the number and proportion of different types of abnormal processes.

8. An Android device abnormal process detection and analysis system based on isolated forest and large language model, characterized in that, The Android device abnormal process detection and analysis method based on isolated forest and large language model, as described in any one of claims 1-7, includes a data acquisition module, an unsupervised evaluation module, a large model judgment module, and a visualization module. The data acquisition module is used to collect process data of the Android device. The process data includes at least the process package name, foreground and background runtime, energy consumption data, energy consumption per unit time, and device battery percentage. The unsupervised evaluation module is used to perform unsupervised anomaly detection on the process data using the isolated forest algorithm. It constructs multiple isolated trees to perform real-time anomaly evaluation on each process, calculates the anomaly score of each process, and outputs a Boolean anomaly label based on the global distribution. The isolated forest algorithm controls the model parameters to stabilize the proportion of abnormal processes within a predetermined range. The large-scale model analysis module is used to perform secondary analysis on the anomaly-marked processes using a large language model, generating anomaly type identification, anomaly cause description, and optimization suggestions. Specifically, it first identifies the process type based on process energy consumption, wake-up frequency, CPU utilization, and network activity characteristics. The process types include malicious programs, processes with abnormal resource consumption, processes with frequent wake-ups, and processes that use advertising SDKs to steal traffic. Second, it generates anomaly cause descriptions based on process behavior patterns and historical data patterns, while distinguishing between real anomalies and false alarms. Finally, it provides targeted optimization suggestions based on process type and anomaly impact, supports batch analysis of multiple anomaly processes, and generates reports containing anomaly process information, anomaly cause descriptions, and optimization suggestions. The reports are saved in CSV and JSON formats. The visualization module is used to output analysis results, including detailed reports and visualization charts of abnormal processes.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the Android device abnormal process detection and analysis method based on isolated forest and large language model as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the Android device abnormal process detection and analysis method based on isolated forest and large language model as described in any one of claims 1-7.

Images