A mobile terminal detection method and system based on Bluetooth broadcast behavior monitoring

Abstract

The application relates to a mobile terminal detection method and system based on Bluetooth broadcast behavior monitoring, and belongs to the technical field of wireless communication and intelligent security protection. The method comprises the following steps: configuring initial parameters of a Bluetooth monitoring node, generating a dynamic parameter template based on historical equipment density distribution and environmental noise baseline data of a target area; capturing an original Bluetooth broadcast packet, generating a temporary identifier by performing hash desensitization on a device hardware address, filtering broadcast packets with a signal strength lower than a threshold, outputting a purified data stream and performing analysis, generating a broadcast feature matrix by aggregation according to devices; inputting the matrix into a layered behavior analysis model, calculating a basic suspicious degree through an edge layer lightweight network computing device, triggering a cloud deep network to generate an abnormal score list when the basic suspicious degree exceeds a preset threshold; executing a security protection response according to the list, and respectively optimizing a node scanning frequency and a model weight parameter of the dynamic parameter template based on a response verification result. The application improves the detection accuracy, environmental adaptability and resource utilization rate of abnormal equipment.

Description

Technical Field

[0001] This application relates to the fields of wireless communication and intelligent security technology, and in particular to a method and system for detecting mobile terminals based on Bluetooth broadcast behavior monitoring. Background Technology

[0002] With the rapid development of mobile internet and IoT technologies, Bluetooth technology, due to its low power consumption, low cost, and universality, has become a standard feature of various mobile terminals (such as smartphones, wearable devices, and smart hardware). Its broadcast mechanism is also widely used in near-field sensing, indoor positioning, crowd monitoring, and security early warning systems. Against this backdrop, deploying Bluetooth monitoring nodes to capture Bluetooth broadcast signals in the environment, thereby enabling the detection, identification, and behavior analysis of mobile terminals within the area, has become an important technical means in scenarios such as public safety, commercial operations, and intelligent management. Traditional Bluetooth monitoring solutions typically rely on fixed scanning frequencies, uniform signal thresholds, and static data processing rules for device discovery and basic statistical analysis.

[0003] However, in real-world, complex, and dynamic application environments, the significant differences in device density and environmental noise across different regions and time periods make it difficult for fixed monitoring parameters to adapt to real-time environmental changes. This can lead to wasted resources during low-density periods, while data omissions occur during high-density periods due to insufficient sampling. Furthermore, static signal filtering thresholds cannot effectively distinguish between valid signals and background interference, impacting data quality and the reliability of subsequent analysis. Moreover, existing methods often focus on shallow analysis of single-dimensional features (such as signal strength or broadcast frequency), lacking deep fusion modeling of the temporal patterns of device broadcasting behavior, spatial motion trajectories, and the correlations between multiple devices. This results in insufficient detection capabilities for complex anomalies such as spoofed devices and coordinated attacks. At the computational architecture level, while centralized analysis models can guarantee accuracy, they are limited by network bandwidth and cloud computing power, making it difficult to handle the high-concurrency data processing pressure brought by real-time monitoring of massive numbers of terminals. Conversely, relying solely on local lightweight computing may sacrifice detection accuracy due to limited model capabilities. In addition, most systems lack a continuous optimization mechanism based on actual security feedback, making it impossible to dynamically adjust perception strategies and analysis models. They are also unable to adapt to constantly changing environmental interference and new threat patterns, and are prone to performance degradation in long-term operation. Summary of the Invention

[0004] To address the aforementioned technical issues, this application provides a mobile terminal detection method and system based on Bluetooth broadcast behavior monitoring.

[0005] Firstly, this application provides a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, employing the following technical solution:

[0006] A mobile terminal detection method based on Bluetooth broadcast behavior monitoring, the mobile terminal detection method comprising:

[0007] Configure the initial parameters of the Bluetooth monitoring node, obtain historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template; wherein, the dynamic parameter template includes node scanning frequency, signal strength filtering threshold and rotating key pool;

[0008] The original Bluetooth broadcast packets in the environment are scanned based on the node scanning frequency;

[0009] The rotating key pool is used to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet to generate a temporary device identifier, and Bluetooth broadcast packets with signal strength lower than the signal strength filtering threshold are filtered out to output a clean data stream;

[0010] The broadcast time interval sequence and multi-node signal strength sequence in the purified data stream are analyzed, and the broadcast interval variance, signal attenuation slope and device displacement vector are calculated. The broadcast feature matrix is ​​generated by aggregating according to the device dimension.

[0011] The broadcast feature matrix is ​​input into a pre-trained hierarchical behavior analysis model, and the basic suspiciousness of the device is calculated through a lightweight edge layer network. When the basic suspiciousness of the device exceeds a preset threshold, a cloud-based deep network is triggered to generate an anomaly score list.

[0012] The security response operation is performed based on the anomaly score list, and the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model are optimized based on the security response verification results.

[0013] By adopting the above technical solutions, intelligent allocation of monitoring resources and sensing strategies is achieved based on dynamic parameter templates; compliance and high quality of data sources are ensured through hash desensitization and signal filtering; an unprecedented three-dimensional characterization of device behavior is achieved by constructing a broadcast feature matrix that integrates broadcast patterns, signal attenuation, and spatial displacement; a layered analysis model between the edge and cloud is used to ensure high-precision threat detection while achieving an efficient balance between computational load and network transmission; finally, a dual-path optimization mechanism based on security verification results drives the co-evolution of sensing parameters and analysis models, enabling the system to continuously self-optimize and adapt to complex dynamic environments. Compared with traditional monitoring solutions based on single features or fixed parameters, the technical solution of this application not only improves detection accuracy but also enhances the system's adaptive capabilities.

[0014] Secondly, this application provides a mobile terminal detection system based on Bluetooth broadcast behavior monitoring, which adopts the following technical solution:

[0015] A mobile terminal detection system based on Bluetooth broadcast behavior monitoring, the mobile terminal detection system comprising:

[0016] The dynamic parameter configuration module is used to configure the initial parameters of the Bluetooth monitoring node, obtain historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template; wherein, the dynamic parameter template includes node scanning frequency, signal strength filtering threshold and round-robin key pool;

[0017] The scanning module is used to scan the environment for raw Bluetooth broadcast packets based on the node scanning frequency;

[0018] The data purification module is used to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet using the rotating key pool to generate a temporary device identifier, and to filter broadcast packets with signal strength lower than the signal strength filtering threshold, and output a purified data stream.

[0019] The feature matrix generation module is used to parse the broadcast time interval sequence and multi-node signal strength sequence in the purified data stream, calculate the broadcast interval variance, signal attenuation slope and device displacement vector, and aggregate them according to the device dimension to generate a broadcast feature matrix.

[0020] The hierarchical analysis and decision module is used to input the broadcast feature matrix into the pre-trained hierarchical behavior analysis model, calculate the basic suspiciousness of the device through the edge layer lightweight network, and trigger the cloud deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds a preset threshold.

[0021] The closed-loop optimization feedback module is used to perform security response operations based on the anomaly score list, and optimize the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model based on the response verification results.

[0022] Thirdly, this application provides a computer-readable storage medium, which adopts the following technical solution:

[0023] A computer-readable storage medium storing a computer program that can be loaded by a processor and executed as in any of the methods in the first aspect.

[0024] In summary, this application includes at least one of the following beneficial technical effects: It achieves intelligent adaptation and privacy-compliant processing of monitoring resources through dynamic parameter templates, and improves data quality and security by combining signal filtering and hash desensitization. It constructs a broadcast feature matrix through multi-dimensional feature fusion, enabling a three-dimensional characterization of device behavior. The edge-cloud layered analysis model optimizes computational efficiency while ensuring detection accuracy. The dual-path optimization mechanism based on security feedback enables the system to continuously learn, significantly improving anomaly detection accuracy, environmental adaptability, and resource utilization, providing an efficient, reliable, and compliant mobile terminal detection method for scenarios such as public safety and regional monitoring. Attached Figure Description

[0025] Figure 1 This is a first flowchart of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0026] Figure 2 This is a second flowchart of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0027] Figure 3 This is a schematic diagram of the third process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0028] Figure 4 This is a schematic diagram of the fourth process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0029] Figure 5 This is a schematic diagram of the fifth process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, according to one embodiment of this application.

[0030] Figure 6 This is a schematic diagram of the sixth process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0031] Figure 7 This is a schematic diagram of the seventh process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, which is one embodiment of this application.

[0032] Figure 8 This is a schematic diagram of the eighth process of a mobile terminal detection method based on Bluetooth broadcast behavior monitoring, according to one embodiment of this application. Detailed Implementation

[0033] To make the purpose, technical solution, and advantages of this application clearer, the following description is provided in conjunction with the appendix. Figures 1-8The present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application.

[0034] This application discloses a mobile terminal detection method based on Bluetooth broadcast behavior monitoring.

[0035] Reference Figure 1 A mobile terminal detection method based on Bluetooth broadcast behavior monitoring, the mobile terminal detection method includes:

[0036] Step S101: Configure the initial parameters of the Bluetooth monitoring node, obtain the historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template; wherein, the dynamic parameter template includes the node scanning frequency, signal strength filtering threshold and rotating key pool;

[0037] Specifically, historical device density distribution reflects the activity level of devices in a region under normal conditions. For example, at airport security checkpoints, device density is much higher during peak hours than at night. If a fixed scanning frequency is used, it will waste computing resources at low densities and may lead to data omissions due to untimely scanning at high densities. Therefore, the system needs to dynamically adjust the node scanning frequency based on this historical data, increasing the scanning frequency during high-density periods to capture more and more timely device broadcast packets, and decreasing the frequency during low-density periods to save node energy consumption and computing overhead.

[0038] Secondly, the environmental noise baseline data refers to the background noise level constituted by the signal strength of non-target Bluetooth devices (such as legitimate personal devices, fixed Bluetooth beacons, etc.) within the area. A signal strength filtering threshold set based on this data can effectively distinguish between valid monitoring signals and background noise interference. Signals below this threshold will be initially judged as invalid signals due to excessive distance, significant penetration loss, or severe interference, thus performing the first screening at the data entry point and significantly improving the signal-to-noise ratio of subsequent data processing.

[0039] Finally, the rotating key pool design stems from the need for privacy protection and security compliance. The system pre-generates a set (pool) of asymmetric or symmetric encryption keys and rotates these keys at different time periods or on different monitoring nodes to perform hash operations on the original MAC addresses of the collected devices. The temporary device identifiers generated in this way are both reversible (internal to the system, the same device can be associated with the corresponding key) and irreversible (externally, the intercepted identifier cannot be used to deduce the real MAC address), thus achieving unique device tracking while meeting the legal requirements for anonymization.

[0040] In summary, the dynamic parameter template is essentially an intelligent configuration solution that integrates environmental awareness, resource optimization, and privacy protection rules, providing a precise, efficient, and compliant action guide for subsequent data collection.

[0041] Step S102: Scan the raw Bluetooth broadcast packets in the environment based on the node scanning frequency;

[0042] The Bluetooth monitoring node actively listens to the Bluetooth broadcast channel within its radio frequency range and captures the original Bluetooth broadcast packets based on the node scanning frequency specified in the dynamic parameter template.

[0043] Step S103: Use the rotating key pool to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet to generate a temporary device identifier, and filter Bluetooth broadcast packets with signal strength lower than the signal strength filtering threshold to output a clean data stream;

[0044] Specifically, in these broadcast packets, the device hardware address (MAC) is the unique physical identifier of the device on the network, and directly processing it poses a risk of privacy leakage. Therefore, the system calls the currently valid key in the rotating key pool to perform a cryptographic hash operation (such as SHA-256) on the MAC address. The hash function has one-way property, ensuring that the temporary identifier cannot be restored to the original MAC; and the key rotation mechanism means that the temporary identifier generated by the same device at different times or at different nodes will change dynamically, further increasing the difficulty for external attackers to conduct long-term tracking and correlation analysis, thus achieving hash desensitization.

[0045] Simultaneously, the system reads the received signal strength indicator value from the broadcast packet and compares it in real time with the signal strength filtering threshold in the dynamic parameter template. Any broadcast packet with a signal strength below this threshold will be judged as invalid or unreliable data and discarded directly. The underlying logic of this filtering operation is that an excessively weak signal usually means that the device is too far from the monitoring node, or that there is severe obstruction and multipath interference in its signal propagation path. In this case, the measured signal strength value is extremely unstable, and the location, distance, and other characteristics calculated based on it will have a large error. Introducing this into subsequent analysis will only introduce noise and affect the accuracy of the judgment.

[0046] Through the aforementioned "de-identification" and "filtering" processes, the original broadcast packets are transformed into a series of standardized data records containing only key information such as temporary device identifiers, precise timestamps, and effective signal strength, forming a high-quality purified data stream. This data stream is the cornerstone for the reliable operation of all subsequent advanced feature extraction and analysis models.

[0047] Step S104: Analyze the broadcast time interval sequence and multi-node signal strength sequence in the purified data stream, calculate the broadcast interval variance, signal attenuation slope and device displacement vector, and aggregate them according to the device dimension to generate a broadcast feature matrix;

[0048] Specifically, it delves into the hidden device behavior patterns and motion status information in the purification data stream from two dimensions: time series and spatial domain.

[0049] First, the system reassembles the cleaned data stream using temporary device identifiers as indexes. For each tracked device, the timestamps of all broadcast packets captured by the same monitoring node within a certain period are extracted, forming a broadcast interval sequence. Normal Bluetooth devices (such as mobile phones and wearable devices) typically exhibit a certain periodicity in their broadcast behavior or follow a specific protocol stack pattern. Calculating the variance of this sequence quantifies the stability of its broadcast intervals. Abnormal, manipulated, or maliciously counterfeited devices may exhibit broadcast intervals that fluctuate drastically (high variance) or follow abnormal patterns (low variance but not conforming to the normal device model). These are important temporal characteristics for identifying counterfeit devices or abnormal behavior.

[0050] Secondly, in areas where multiple Bluetooth monitoring nodes are deployed, broadcast packets from the same device will be captured by nodes at different locations, forming a signal strength sequence for the same device across different nodes. By analyzing the relationship between the signal strength of the same device and time at different nodes, a curve of signal attenuation over time can be fitted, the slope of which reflects the radial movement trend (approaching or moving away) of the device relative to the monitoring node.

[0051] More importantly, by utilizing the signal strength values ​​of the same device received by multiple nodes at different spatial locations at the same time (a multi-node signal strength sequence), combined with known node coordinates, differential calculations using wireless signal propagation models (such as logarithmic path loss models) or trilateration algorithms can be performed to calculate the device's displacement vector in two-dimensional or three-dimensional space. This vector contains not only the magnitude of the displacement but also its direction, providing a clear view of the device's movement trajectory and speed changes.

[0052] Finally, the system combines the three core features calculated for each device (broadcast interval variance reflecting broadcast behavior patterns, signal attenuation slope reflecting signal propagation characteristics, and device displacement vector reflecting physical spatial movement) into a multi-dimensional device feature vector. Then, it aligns the feature vectors of all active devices within the current time window according to a unified time benchmark and arranges them into a two-dimensional broadcast feature matrix. Each row of this matrix represents a device, and each column represents a specific behavior or state feature, thus transforming a dynamic and complex environmental monitoring problem into a structured mathematical representation problem that can be processed by machine learning models.

[0053] Step S105: Input the broadcast feature matrix into the pre-trained hierarchical behavior analysis model, calculate the basic suspiciousness of the device through the edge layer lightweight network, and trigger the cloud deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds the preset threshold.

[0054] The logic behind this step lies in adopting a layered computing architecture that coordinates "edge and cloud" to achieve the optimal balance between computing efficiency and model accuracy.

[0055] In this embodiment, the broadcast feature matrix is ​​first input into a lightweight edge-layer network deployed locally (at the edge, such as a Bluetooth monitoring node or local gateway), for example, a streamlined Long Short-Term Memory network. This network is designed to quickly and efficiently perform initial screening of the device's real-time behavior. It analyzes the real-time patterns of each device feature vector in the feature matrix and outputs a basic suspicion score between 0 and 1. This score represents the probability that the device is initially identified as abnormal based on its current behavioral characteristics.

[0056] Next, setting a preset threshold (e.g., 0.7) is crucial for controlling the overall system's response sensitivity. When the basic suspiciousness of a device does not exceed this threshold, the system determines it to be normal or low-risk, without further consuming cloud resources, thus greatly reducing network transmission pressure and cloud computing load, demonstrating the efficiency of edge computing. Only when the basic suspiciousness of a device exceeds this threshold, meaning its behavior pattern has shown sufficiently high initial signs of anomaly, will the system trigger a more complex analysis process: uploading the feature sequences of the device's current and historical time windows to the cloud.

[0057] Specifically, a more powerful and complex deep network, such as a graph attention network, is deployed in the cloud. The advantage of this deep network lies in its ability to analyze not only the temporal characteristics of individual devices but also, through an attention mechanism, to model and analyze the hidden correlations between the behaviors of different devices within the same spatiotemporal environment represented by the broadcast feature matrix (e.g., whether multiple devices exhibit potential attack patterns such as coordinated movement or synchronized broadcasting). The cloud-based GAT network integrates deep temporal analysis and graph structure correlation analysis to make a final judgment on highly suspicious devices, generating a more accurate anomaly score list containing all triggered devices. This hierarchical mechanism cleverly achieves on-demand allocation of computing resources, leaving the initial filtering of massive numbers of devices at the edge and sending only high-value suspicious targets to the cloud for deep correlation analysis, thereby optimizing the overall system performance while ensuring detection accuracy.

[0058] Step S106: Perform security response operations based on the anomaly score list, and optimize the node scanning frequency parameters of the dynamic parameter template and the weight parameters of the hierarchical behavior analysis model based on the security response verification results.

[0059] The final effect (verification result) of a security operation is used as a "calibration signal" to optimize the front-end perception parameters and the back-end analysis model, enabling the entire system to continuously learn and adapt to environmental changes.

[0060] Specifically, based on the generated list of anomaly scores, the system takes corresponding security responses, such as triggering audible and visual alarms, pushing alarm information to security personnel, or linking with access control systems. Subsequently, the system collects the verification results of this response, that is, through manual confirmation or other reliable means, determines whether the alarm is a "real threat" or a "false alarm." This verification result is a key driving force for system evolution.

[0061] Furthermore, if the verification result is a "false alarm," it may mean that signal interference in the current environment is increasing, or the filtering threshold is too sensitive. The system will appropriately increase the tolerance range of the signal strength filtering threshold to filter out more low-intensity signals caused by occasional interference, thereby "reducing scan sensitivity" and reducing similar false alarms in the future. If the verification result is a "real threat," especially in a specific area (high-threat area), the system will shorten the node scanning frequency in that area, using denser sampling to capture more detailed behavioral data of potential threat devices and improve monitoring granularity.

[0062] Furthermore, if it is a false alarm, the feature vector corresponding to the falsely reported device is added to the negative sample training set for retraining or fine-tuning the weights of the edge layer LSTM network. This allows the network to better distinguish such "seemingly abnormal but actually normal" patterns in the future, improving the model's generalization ability and anti-interference capabilities, and reducing false alarms. If it is a real threat, the feature vector of the threatening device is added to the positive sample training set to strengthen the weights of the cloud-based GAT network, especially enhancing its ability to identify and correlate these newly emerging threat behavior patterns. This makes the model more sensitive and accurate in identifying similar threat patterns in the future.

[0063] Through this separation and targeted optimization based on verification results, targeting both "perception parameters" and "analysis models," the system forms a complete closed loop from perception, analysis, decision-making to feedback optimization. It can continuously adapt to new environmental noise, new equipment types, and evolving potential threat patterns, achieving continuous and autonomous improvement in detection efficiency.

[0064] In the above embodiments, intelligent allocation of monitoring resources and perception strategies is achieved based on dynamic parameter templates; compliance and high quality of data sources are ensured through hash desensitization and signal filtering; an unprecedented three-dimensional characterization of device behavior is achieved by constructing a broadcast feature matrix that integrates broadcast patterns, signal attenuation, and spatial displacement; a layered analysis model at the edge and cloud levels ensures high-precision threat detection while achieving an efficient balance between computational load and network transmission; finally, a dual-path optimization mechanism based on security verification results drives the co-evolution of perception parameters and analysis models, enabling the system to continuously self-optimize and adapt to complex dynamic environments. Compared to traditional monitoring schemes with single features or fixed parameters, the technical solution of this application not only improves detection accuracy but also enhances the system's adaptive capabilities.

[0065] Reference Figure 2 As one implementation of step S101, the steps of configuring the initial parameters of the Bluetooth monitoring node, obtaining historical device density distribution and environmental noise baseline data of the target area, and calculating and generating a dynamic parameter template include:

[0066] Step S201: Read the historical equipment density distribution dataset of the target area and extract the peak density time period and the distribution ratio of equipment types;

[0067] This involves in-depth analysis of past operational data from the monitored area to create a precise profile of the macroscopic patterns and microscopic components of equipment activity. Essentially, this step transforms raw counting data into structured knowledge that characterizes two key dimensions: "when is it busiest" and "which equipment is the primary driver," laying the foundation for shifting parameter generation from "experience-based presets" to "data-driven."

[0068] Specifically, the historical device density distribution dataset is not simply a count of devices, but a time-series database that records the changes in the number of Bluetooth devices detected in a specific area (such as an airport security checkpoint or a shopping mall entrance) over a long period (such as several weeks or months) at different time granularities (such as every hour). The system reads this dataset and performs time-series analysis, with the core objective of identifying peak density periods—the time windows when device activity is most frequent and monitoring load is highest. For example, in subway stations during commuting hours, peak density periods are significantly different from those at night. This quantitative understanding is the fundamental basis for subsequently dynamically adjusting monitoring resources (such as scanning frequency) to ensure that the system has sufficient sensing capabilities during "busy" times and avoids resource idleness during "off-peak" times.

[0069] Furthermore, the system not only focuses on quantity but also delves into the distribution ratio of device types. Different types of Bluetooth devices (such as smartphones, wearable bracelets, Bluetooth headsets, and IoT beacons) have different hardware characteristics, broadcast protocol stacks, and broadcast behavior patterns. For example, some low-power devices may have longer broadcast intervals and weaker signals. By analyzing the proportion of each type of device in historical data, the system can understand the "ecosystem" formed by devices in the area, providing data support for subsequently assigning appropriate monitoring weights (i.e., device type weight coefficients) to different types of devices.

[0070] Step S202: Obtain the signal interference intensity spectrum from the environmental noise baseline database and identify the main interference frequency bands;

[0071] This involves identifying and quantifying the inherent, non-target signal interference background in the monitoring environment to guide the system in setting reasonable signal reception thresholds. In complex indoor and outdoor environments, the radio frequency signals received by Bluetooth monitoring nodes are a mixture of target device broadcast signals and various environmental noises. These noise sources may include other legitimate 2.4GHz band devices (such as Wi-Fi routers and wireless keyboards), industrial equipment interference, and even electromagnetic reflections and multipath effects caused by building structures.

[0072] In this embodiment, the environmental noise baseline database records the signal interference intensity spectrum at various frequency points at different locations and times within the target area through long-term, silent monitoring (without active test interference). This spectrum represents the distribution of signal strength as a function of frequency. The system acquires and analyzes this spectrum, with the core task of identifying the main interference frequency bands—those bands with persistently high background noise. For example, if a large number of Wi-Fi networks using fixed channels are deployed in an area, the occupied frequency bands will appear as obvious noise peaks in the intensity spectrum. Identifying these frequency bands is crucial because if the broadcast signal of the target Bluetooth device falls on a strong interference frequency band, its signal-to-noise ratio will deteriorate sharply, and the measured signal strength values ​​will be severely distorted and unstable.

[0073] The results of this analysis provide an objective environmental reference for setting the signal strength filtering threshold. This ensures that the threshold setting is no longer a blind, fixed value, but a scientific assessment of the current electromagnetic environment's "background noise" level. This ensures that the filtered signals are truly severely interfered with and unreliable, rather than simply judging the quality of a signal based on its strength.

[0074] Step S203: Calculate the initial value and adaptive adjustment coefficient of the node scanning frequency based on the peak density time period and the distribution ratio of equipment types;

[0075] The node scanning frequency determines the number of times a monitoring node listens to the Bluetooth broadcast channel per unit time, directly affecting the timeliness of its detection of new devices and updates to device status. By establishing a dynamic calculation model, the scanning behavior of Bluetooth monitoring nodes can intelligently match the intensity and characteristics of device activity, achieving an optimal balance between monitoring efficiency and resource consumption.

[0076] Specifically, the system first uses historical data from peak density periods as a benchmark, as this represents the highest load scenario the system needs to handle. When calculating the initial value of the node scanning frequency, the system establishes a function model positively correlated with peak device density to ensure a sufficiently high scanning frequency to reduce packet loss during peak device usage. More importantly, an adaptive adjustment coefficient is introduced, driven by the distribution ratio of device types. As mentioned earlier, different device types have varying "sensitivities" to scanning frequency due to differences in their broadcast characteristics. For example, slightly increasing the scanning frequency may have little effect on low-power devices with long broadcast intervals, but it can significantly improve the capture rate for smartphones with frequent broadcasts. Therefore, the system presets an empirical device type weighting coefficient for each type of device, reflecting the relative scanning intensity required to capture such devices.

[0077] In this embodiment, by weighting and summing the weights of various devices with their proportion in historical data, the system obtains a comprehensive adjustment coefficient. The final node scanning frequency parameter is the product of this initial value and this adjustment coefficient. This allows the scanning frequency to not only respond to macroscopic changes in the number of devices ("more" or "fewer"), but also to finely adapt to microscopic changes in the device composition ("what type is dominant"). For example, in areas where smartwatches account for a high proportion, even if the total number of devices is the same, the system may adopt a different scanning strategy than when mobile phones account for a high proportion, thereby achieving more accurate resource allocation.

[0078] Step S204: Determine the dynamic range of the signal strength filtering threshold based on the signal interference intensity spectrum and the main interference frequency bands;

[0079] The signal strength filtering threshold is used to remove broadcast packets of poor quality and low reliability at the source of data acquisition. The problem with traditional fixed thresholds is that environmental noise fluctuates; a threshold that is reasonable in a quiet environment may filter out too much valid signal during sudden interference. Therefore, this solution proposes determining the dynamic range of the signal strength filtering threshold.

[0080] Specifically, the system uses a relatively high percentile (e.g., the 90th percentile) of noise intensity within the main interference frequency band as a baseline threshold. This means the system anticipates that background noise will exceed this value 10% of the time, therefore, the signal-to-noise ratio of any broadcast packet with a signal strength below this threshold is highly likely to be compromised. However, a single baseline is insufficient. The system further analyzes the variance of noise intensity fluctuations, which characterizes the stability of environmental noise. Based on this variance, a tolerance range is calculated.

[0081] Ultimately, the filtering threshold is no longer a single point, but a dynamic range. Its lower limit is the baseline threshold minus the tolerance, and its upper limit is the baseline value plus the tolerance. This range design reflects the system's intelligence: when environmental noise is relatively stable (small variance), the tolerance range is narrow, and the filtering standard is strict and precise; when environmental noise fluctuates drastically (large variance), the tolerance range automatically widens, and the filtering standard becomes more flexible to accommodate legitimate fluctuations in signal strength caused by brief interference. In this way, the system can maintain high signal quality standards under normal conditions while avoiding the "false kill" of a large amount of valid data due to overly stringent filtering in harsh electromagnetic environments, significantly improving the environmental adaptability and overall reliability of the data acquisition process.

[0082] Step S205: Based on the preset privacy protection strategy and key rotation cycle rules, generate a rotating key pool, including multiple encryption keys and time segmentation index rules;

[0083] This step involves building the underlying cryptographic infrastructure for the privacy protection compliance and long-term security of the entire monitoring system. Through the pre-setting, management and periodic rotation of keys, a dynamic and crack-resistant key environment is provided for the anonymization of device identifiers.

[0084] Specifically, to protect user privacy during monitoring, irreversible hashing of device hardware addresses is required. This hashing process relies on encryption keys to ensure its security strength. Generating a rotating key pool means creating a set (pool) of encryption keys conforming to high-strength encryption standards (such as AES-256) in batches during initial system deployment or periodic maintenance. Using multiple keys instead of a single key is a key aspect of security design.

[0085] Furthermore, these keys are paired with time-segmented indexing rules, which are mapping tables (indexing rules) that divide time (e.g., a 24-hour day) into several consecutive time periods (time segments) and explicitly specify which key in the key pool should be used for each time period. This combination of "pool" and "rules" constitutes the complete meaning of the rotating key pool. Its core logical advantages are: First, key rotation: The system automatically looks up the indexing rules based on the current time and switches to the corresponding key. This ensures that the key used for de-identification is automatically changed periodically. Second, attack window limitation: Even if the key used in a certain time period is theoretically cracked, the harm is limited to the data generated in that time period, because the system has switched to the new key in the next time period, and attackers cannot use the old key to crack new data, nor can they correlate data from different time periods. Third, operational manageability: The rules for key generation, distribution, and rotation can be centrally formulated and managed, eliminating the need for complex online operations each time a rotation occurs. This step, from a cryptographic perspective, ensures that the privacy de-identification mechanism is not static and fragile, but dynamic and possesses defense-in-depth capabilities, meeting the security and compliance requirements of long-term deployment.

[0086] Step S206: Integrate node scanning frequency parameters, signal strength filtering threshold range, and rotating key pool to construct a dynamic parameter template.

[0087] Through the aforementioned steps, the system has generated three core parameters: node scanning frequency parameters that guide "when and at what frequency to scan," signal strength filtering threshold ranges that define "what signal quality is acceptable," and a rotating key pool that specifies "how to securely anonymize data." These parameters are interconnected and mutually supportive, jointly determining the behavior patterns, data quality, and security compliance of Bluetooth monitoring nodes.

[0088] The above implementation changes the static and experience-based configuration mode of traditional monitoring systems. By deeply mining the "historical device density distribution" and "environmental noise baseline," parameter generation is based on objective and quantitative data-driven principles. Specifically, the node scanning frequency can intelligently follow the tidal patterns of device activity and the composition of device types, optimizing resource efficiency while ensuring monitoring coverage; the signal strength filtering threshold can flexibly adapt to dynamic interference in the electromagnetic environment, enhancing the system's robustness while ensuring data quality; and a pre-set, time-bound rotating key pool provides sustainable and high-strength cryptographic security for the entire system's privacy protection. Finally, by integrating these intelligently generated parameters into a unified dynamic parameter template, centralized, agile, and intelligent policy deployment and management of large-scale Bluetooth monitoring networks are achieved.

[0089] Reference Figure 3As a further implementation of the mobile terminal detection method, after the step of constructing the dynamic parameter template, the method further includes:

[0090] Step S301: Real-time acquisition of current environmental electromagnetic spectrum data of the target area, and extraction of noise interference feature vectors in areas overlapping with the Bluetooth broadcast channel spectrum;

[0091] Traditional Bluetooth monitoring nodes passively listen to the Bluetooth broadcast channel, ignoring electromagnetic interference from other devices in the same frequency band (such as Wi-Fi, Zigbee, microwave oven leakage, and industrial equipment noise) that affects their performance, resulting in a sharp decline in performance in complex radio frequency environments.

[0092] In this embodiment, the system scans the 2.4-2.4835GHz industrial, scientific, and medical frequency band at a period of 100ms using a software-defined radio (SDR) module deployed on Bluetooth monitoring nodes. The acquisition process employs multi-node synchronous sampling technology, ensuring spatiotemporal data consistency through GPS clock synchronization. Each node is equipped with a wideband log-periodic antenna, and the received signal is converted into an IQ quadrature signal stream after 16-bit ADC conversion. Unlike traditional Bluetooth scanning that only focuses on device broadcasts, this solution acquires the electromagnetic energy distribution across all channels (such as Wi-Fi channel overlap and microwave oven harmonic interference), providing a raw spectrum snapshot for subsequent noise analysis. For example, in a subway station scenario, it can simultaneously capture the 2402MHz impulse noise generated by the train traction system and the 2427MHz continuous carrier wave from passenger mobile phone hotspots.

[0093] Next, the entire frequency band is divided into finely divided sub-channels, and the mean power spectral density of each sub-channel is calculated, reflecting the steady-state background noise level at each frequency point. The energy entropy of specific decomposition layer coefficients is extracted by wavelet packet decomposition to quantify the disorder of burst interference. The spectral kurtosis value of each sub-channel is calculated through spectral kurtosis analysis to identify non-Gaussian noise components (such as frequency hopping interference from ZigBee devices), thereby constructing a multi-dimensional noise interference feature vector, including baseband energy, burst interference entropy, non-Gaussian factor, and the PSD peak value of key sub-channels, achieving the transformation from the raw spectrum to quantifiable noise features.

[0094] Step S302: Compare the deviation between the noise interference feature vector and the environmental noise baseline data;

[0095] The underlying logic of this step involves using mathematical methods to accurately measure the degree of deviation of the current electromagnetic environment from the normal state established by long-term historical observations, thereby quantifying the severity of environmental interference. During the initial deployment or long-term operation, the system collects massive amounts of noise interference feature vectors during normal periods without safety threats, training an environmental noise baseline data model. This model is typically characterized as a statistical distribution, such as a multivariate Gaussian distribution, that these historical feature vectors follow in a multidimensional space, with the mean vector and covariance matrix as its core parameters.

[0096] In this embodiment, the deviation between the two can be calculated using the Mahalanobis distance model. The system presets a dynamic threshold, which is set based on the statistical characteristics of the baseline distribution (such as 3 standard deviations), corresponding to a very high confidence probability. The comparison process involves comparing the real-time calculated Mahalanobis distance with this threshold to determine whether it is necessary to initiate adaptive adjustment of system parameters.

[0097] Step S303: When the deviation exceeds the dynamic threshold, generate spectrum adaptive compensation parameters;

[0098] When the deviation exceeds the dynamic threshold, it indicates that the current electromagnetic environment has deteriorated to a point where it can significantly affect the reliability of Bluetooth monitoring (such as causing a large number of signal losses or false alarms). At this time, the system needs to generate spectrum adaptive compensation parameters. Based on the degree of environmental anomaly, a set of strategic adjustment coefficients can be automatically calculated to adapt to the current interference and maintain or restore the core performance (security and effectiveness) of the monitoring system.

[0099] Specifically, the compensation parameters are generated using a dual-loop control algorithm: the feedforward loop quickly calculates a preliminary compensation coefficient based on the absolute magnitude of the deviation; the greater the deviation, the greater the adjustment (coefficient), reflecting the system's immediate response to sudden environmental changes. The feedback loop is more refined, dynamically adjusting the weights calculated by the feedforward loop by referencing the actual improvement in key system indicators (such as false alarm rate and device recognition rate) after recent (e.g., recent) applications of the compensation parameters. Ultimately, the generated compensation parameters form a parameter matrix containing at least two core coefficients: one affecting the frequency of the round-robin key pool update, and the other a scaling factor affecting the signal strength filtering threshold. These two coefficients target the system's privacy and security defenses and data quality defenses, respectively, and their specific values ​​are determined by the aforementioned dual-loop control algorithm.

[0100] For example, under persistent broadband interference, the system may determine that the current environment is more susceptible to sniffing, and thus generate a key update coefficient greater than 1 to enhance security; at the same time, to combat signal attenuation, a threshold scaling factor less than 1 is generated to relax the signal reception threshold. For instance, in an industrial motor interference scenario, the system generates β_key=1.3 (to accelerate key rotation) and γ_rssi=0.8 (to lower the signal filtering threshold).

[0101] Step S304: Adjust the update frequency and signal strength filtering threshold of the rotating key pool based on the spectrum adaptive compensation parameters to obtain the updated dynamic parameter template and synchronize it to all Bluetooth monitoring nodes.

[0102] Specifically, the update frequency of the rotating key pool is pre-set by the security policy to ensure basic privacy protection. A compensation parameter (such as β_key) acts as a multiplicative factor to directly adjust this cycle. When environmental interference is high and the system's perceived risk increases (β_key > 1), the update cycle is shortened, and key rotation is accelerated. This means that even if an attacker attempts to sniff and perform correlation analysis under complex electromagnetic noise cover, the time period of data anonymized by the same key that they can collect is significantly shortened, thereby significantly increasing the difficulty and cost of attacks and dynamically improving the system's security resilience.

[0103] The original signal strength filtering threshold is set based on the noise baseline in a calm environment and is used to filter signals with acceptable signal-to-noise ratios (SNR). Compensation parameters (such as γ_rssi) act as a scaling factor on this original threshold. In environments with strong interference (γ_rssi < 1), the system appropriately relaxes (raises) the threshold for received signal strength. This is because the absolute signal strength value of the same Bluetooth broadcast signal may be submerged and lowered in strong background noise. If a strict calm environment threshold is still used, many valid device signals with temporarily reduced SNRs will be falsely filtered out, leading to monitoring blind spots. By dynamically relaxing the threshold, the system can retain as many valid signals as possible under harsh electromagnetic conditions, maintaining monitoring coverage, although this may introduce a small amount of noise. However, this trade-off ensures the system's availability. These two adjustments are a concrete manifestation of the system's dynamic rebalancing between security and effectiveness.

[0104] Next, the cloud or a master node encapsulates the adjusted parameters into a data packet with a timestamp and digital signature. This packet is then distributed to all Bluetooth monitoring nodes via an efficient network protocol (potentially combining wired backhaul and wireless broadcasting such as LoRa). Upon receiving the parameter packet, each node first verifies the signature to ensure its legitimacy, and then completes a hot update of the parameters within a very short time window (e.g., tens of milliseconds)—that is, replacing the old parameters in memory with the new parameters without interrupting the monitoring service.

[0105] It should be noted that the system also needs to design a version conflict resolution mechanism, such as always adopting the latest valid parameters with the latest timestamp, to deal with the problem of out-of-order arrival of different version parameter packets due to network latency. Through this entire synchronization mechanism, the system ensures that the entire closed loop from environmental awareness and central decision-making to edge execution can be completed within seconds or even milliseconds, enabling large-scale Bluetooth monitoring networks to make rapid, coordinated, and consistent adaptive adjustments to drastic changes in the external electromagnetic environment.

[0106] The above implementation solves the problem of sudden performance drop in Bluetooth monitoring systems in complex wireless environments, improves the device recognition rate, tracking stability and overall robustness of the system in various high-dynamic radio frequency scenarios (such as transportation hubs, industrial parks and commercial centers), and avoids the waste of resources caused by always using the most conservative configuration to deal with the worst situation through the adaptive mechanism, thus realizing intelligent and lean system operation and maintenance.

[0107] Reference Figure 4 As one implementation of step S103, the steps of using a round-robin key pool to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet to generate a temporary device identifier, and filtering Bluetooth broadcast packets with signal strength below the signal strength filtering threshold to output a clean data stream include:

[0108] Step S401: Read the original Bluetooth broadcast packet set and extract the device hardware address field and signal strength value contained therein;

[0109] Bluetooth devices (such as mobile phones and smartwatches) periodically send Bluetooth broadcast packets at regular intervals when in standby or broadcast mode. This is a standardized data frame structure that carries device information at the physical and data link layers. The system continuously listens to the wireless channel through deployed monitoring nodes (such as Bluetooth sniffers), decodes these captured raw radio frequency signals, and forms a structured set of raw Bluetooth broadcast packets.

[0110] Specifically, from these data packets, the system precisely extracts two crucial core fields: the device hardware address and the signal strength value. The MAC address is a unique physical identifier for a network device, typically consisting of 48 bits, and is the fundamental basis for subsequent device differentiation and behavior tracking. However, precisely because of its uniqueness and persistence, direct processing can lead to serious privacy compliance risks. The signal strength value (usually expressed as RSSI, Received Signal Strength Indication) is the broadcast signal power strength measured by the receiving end. Its value is closely related to factors such as the distance between the device and the monitoring node, obstructions in the propagation path, and environmental interference.

[0111] Step S402: Invoke the pre-generated rotating key pool and obtain the target hash key according to the current time window index;

[0112] This involves introducing a pre-configured, dynamically changing key management system to combat cryptographic attacks targeting fixed hash keys and the risk of long-term tracking.

[0113] Specifically, during the initialization or configuration phase, the system pre-generates a set of multiple independent cryptographic keys, known as a round-robin key pool. Each key in the pool serves as a secret parameter for subsequent hash operations. The core of the round-robin strategy lies in its "dynamic" and "planned" nature. The system determines which key to use based on the current time window index. This index is typically driven by a reliable system clock, for example, defining the start of each hour as a new time window, or using more granular minute-level segmentation. The index value acts as a pointer to retrieve the target hash key to be used in the current time period from the key pool.

[0114] The logical advantages of the above mechanism are as follows: First, by using time-bound binding, it automates and periodically changes keys without manual intervention, improving system maintainability and security. Second, because keys rotate according to a preset schedule, even if a key is leaked or subjected to brute-force attacks within a certain time window, its impact is strictly limited to that time window. Once the index is updated, the system switches to the next key, rendering all previous attack efforts futile. This effectively prevents attackers from using long-term hash accumulation to correlate and analyze the behavior of the same device at different times, greatly enhancing the robustness and proactive defense capabilities of the entire de-identification system.

[0115] Step S403: Perform a salted hash operation on the device hardware address using the target hash key to generate an irreversible temporary device identifier;

[0116] This step is the core cryptographic operation for achieving privacy desensitization. Its logic is to transform the original unique identifier (MAC address) into another proxy identifier that is equally unique but cannot be traced back to the original value through an irreversible transformation process, while ensuring the security strength of the transformation process through multiple protections.

[0117] Specifically, the system does not simply hash the MAC address; instead, it employs an enhanced hashing mode with a key and random numbers. First, the salt value means that the system generates a random number (salt value) for each or batch of operations and concatenates it with the original device hardware address. The purpose of adding a random salt value is to ensure that even if the same MAC address is hashed multiple times, the hash results will be drastically different depending on the salt value. This effectively defends against rainbow table attacks.

[0118] Then, the system uses a structure such as HMAC (Hash-based Message Authentication Code) to input the concatenated string along with the target hash key obtained in the second step into a secure cryptographic hash function (such as SHA-256) for computation. The HMAC mechanism ensures that the entire hashing process is deeply bound to the key, and the result depends not only on the input data (MAC address + salt value) but also strictly on the currently used secret key.

[0119] Ultimately, this process generates a fixed-length, seemingly random string—a temporary device identifier. "Irreversible" is a fundamental characteristic of hash functions, meaning that the original MAC address or salt value cannot theoretically be derived from this temporary identifier; "temporary" reflects its lifespan being limited by the key rotation cycle. Thus, internally, the system can legally correlate the behavior of the same device at different times by recording the mapping relationship between keys, salt values, and time windows. For external entities or potential data interceptors, these temporary identifiers are merely a series of uncorrelated, untraceable anonymous data points, thereby perfectly achieving a balance between privacy protection and behavioral analysis at the technical level.

[0120] Step S404: Compare the signal strength value with the signal strength filtering threshold in the dynamic parameter template, and discard Bluetooth broadcast packets that are lower than the signal strength filtering threshold;

[0121] In this process, the raw data is screened according to the environmental adaptation standard, and observation data with low signal-to-noise ratio and poor reliability are removed to ensure that the data source on which the subsequent analysis depends has sufficient reliability and accuracy.

[0122] Specifically, the signal strength value extracted from the original packet is a variable greatly affected by the environment. The signal attenuates with increasing distance during propagation (path loss) and fluctuates drastically due to obstructions from walls, people, or other wireless devices. The filtering threshold in the dynamic parameter template is not a fixed value, but a threshold dynamically calculated by the system based on historically collected environmental noise baseline data (such as the range of stable, legitimate device signal strengths in the background) and monitoring strategies. The system compares the measured signal strength value of each broadcast packet with this threshold in real time. Any broadcast packet below this threshold is discarded.

[0123] Understandably, excessively low signal strength usually indicates that the device is too far from the monitoring node. In this case, the signal propagation path is complex, and multipath effects and interference noise may have become dominant, leading to highly unstable and erroneous measured signal strength values. Introducing such data into subsequent positioning, trajectory tracking, or behavioral pattern analysis would introduce significant noise and errors, severely interfering with model judgments and potentially causing false alarms. Through this threshold filtering, the system essentially performs a "reliability" check based on physical layer signal quality at the data entry point. It sacrifices some coverage capability for distant, weak-signal devices in exchange for high reliability of data within the core areas of interest (i.e., areas with guaranteed signal quality) throughout the entire monitoring area.

[0124] Step S405: Integrate the temporary device identifier with the metadata of the filtered Bluetooth broadcast packets to generate a structured clean data stream;

[0125] Through the aforementioned steps, the system has prepared two types of key information for each valid broadcast event: first, an anonymous identity credential transformed through cryptography, i.e., a temporary device identifier; and second, metadata related to the event, such as a precise broadcast timestamp (used to calculate timing behavior), a signal strength value verified through filtering (used for spatial analysis), and the time interval between preceding and following broadcast packets (used to analyze broadcast behavior patterns). The integration operation means that the system encapsulates these scattered data fields into an independent, self-describing structured data unit according to a predefined structure (such as a JSON object, a Protobuf message, or a custom binary format). Each unit is uniquely associated with one valid broadcast event.

[0126] Subsequently, the system arranges and organizes these massive amounts of data units in chronological order (usually according to the broadcast timestamps), thereby generating a continuous, time-series, structured, cleaned data stream. Understandably, "cleaned" means that the data stream has removed privacy-sensitive fields and low-quality signals; "structured" means that the data stream has a strict internal format that can be efficiently parsed by programs.

[0127] Step S406: Update the index value of the rotating key pool according to the preset cycle to trigger key rotation.

[0128] In particular, the periodic and automated key switching continuously injects "fresh blood" into the third step of cryptographic hashing, ensuring that its ability to resist cryptographic analysis attacks does not diminish over time.

[0129] In this embodiment, the system drives the key management state transition according to a preset period (e.g., every hour, every 24 hours, or after reaching a certain number of key usages). The period setting needs to balance security and system overhead: too short a period results in frequent key rotations, which, while providing high security, may increase the system management burden and cause brief processing delays during rotations; too long a period increases the key exposure window, leading to accumulated risks. When rotation conditions are met (e.g., the system clock reaches the hour, or the current key has been signed and processed through more than one million hash operations), the system performs an update operation: incrementing the index value pointing to the rotation key pool (usually combined with modulo operations to ensure the index circulates within the pool size). This change in index value means that the next time window or the next batch of data processing will automatically obtain a completely new target hash key from the key pool. Triggering key rotation is an atomic state transition event that ensures all subsequent newly entered device hardware addresses will be hash-de-identified using the new key, generating a temporary device identifier sequence completely different from the previous period.

[0130] Understandably, this technical solution forces potential attackers to crack the current key within a limited and ever-shrinking time window, significantly increasing the difficulty and cost of the attack. Meanwhile, automated rotation ensures the system can operate long-term without human intervention, maintaining the continuity and consistency of security protection, and enabling the entire privacy protection strategy to adapt to long-term deployment and the need to combat persistent threats.

[0131] In the above implementation, the dynamic binding mechanism based on the rotating key pool and time window index realizes the automated and periodic updating of privacy-de-identifying keys, fundamentally avoiding the security risk of static key systems being easily cracked and tracked over a long period of time. Through hash operations with salt values, combined with keys and random numbers, multiple cryptographic protections are applied to each device identifier, ensuring that the generated temporary device identifiers have high irreversibility and short-term uniqueness. While effectively protecting user privacy, this preserves the technical feasibility for legitimate behavior association analysis within the system. By processing dynamic threshold filtering in parallel with the above de-identification process, quality screening is completed synchronously at the source of data generation, ensuring that the structured and cleaned data stream on which subsequent analysis depends has both high privacy security and signal reliability.

[0132] Reference Figure 5 As one implementation of step S104, the steps of parsing the broadcast time interval sequence and multi-node signal strength sequence in the purified data stream, calculating the broadcast interval variance, signal attenuation slope, and device displacement vector, and aggregating them by device dimension to generate a broadcast feature matrix include:

[0133] Step S501: Read the purified data stream and extract the broadcast timestamp sequence of each device and the signal strength sequence of multiple monitoring nodes.

[0134] Specifically, the clean data stream is a continuous, structured collection of time-series data, in which each record contains broadcast event information of a device at a specific time and captured by a specific monitoring node. The core fields include temporary device identifier, precise broadcast timestamp, and signal strength value measured at that node.

[0135] In this embodiment of the application, the system first uses the temporary device identifier as the key index to reorganize and classify the data stream, and aggregates all records that are scattered at different time points, come from different monitoring nodes, and belong to the same device.

[0136] Then, for each device, the system extracts two core sequences: First, the broadcast timestamp sequence, which is a list of all broadcast events of that device ordered chronologically. This sequence is the cornerstone for analyzing the temporal regularity of the device's broadcast behavior. Second, the signal strength sequence from multiple monitoring nodes. Since multiple nodes are deployed in the monitoring area, the same broadcast packet from the same device will be received by nodes in different locations, thus forming a set of signal strength observations from different spatial locations at the same time point. Arranging these observations from different nodes in chronological order constitutes a multidimensional signal strength sequence. This sequence not only reflects the change in signal strength over time but also contains the spatial geometric relationship and time-varying information between the device and multiple fixed reference points (monitoring nodes) in the network.

[0137] Therefore, the essence of this step is to reorganize the linear data flow into a device-centric, spatiotemporally interwoven three-dimensional data view, thus preparing the data for subsequent mining of in-depth features from the time and space dimensions.

[0138] Step S502: Calculate the time variance of the interval between adjacent Bluetooth broadcast packets based on the broadcast timestamp sequence to obtain the broadcast interval variance;

[0139] This step aims to quantify the stability and regularity of device broadcasting behavior from a time perspective. Its logic lies in capturing broadcast cycle anomalies caused by the behavior of the device's underlying communication protocol stack or human manipulation.

[0140] In some embodiments, the broadcast behavior of a normal Bluetooth device (such as a smartphone) is typically driven by a specific pattern of the operating system or Bluetooth protocol stack, and may exhibit a relatively stable periodicity (e.g., periodic broadcasting to save power) or a predictable aperiodic pattern triggered by specific events. The system calculates the time difference between every two consecutive broadcast events from the device's broadcast timestamp sequence, thus obtaining an interval time series. Calculating the variance of this series is a measure of the data dispersion. A low variance value indicates that the device's broadcast intervals are very stable, conforming to patterns of certain standards or common applications; a high variance value indicates that the broadcast intervals fluctuate wildly and lack regularity. This wild fluctuation may stem from various anomalies: for example, the device may be performing malicious scanning or attempting to connect, disrupting the normal broadcast rhythm; or the device may be a fake, malicious beacon controlled by simple hardware, whose broadcast timing cannot perfectly simulate the complex protocol stack behavior of a real device.

[0141] Therefore, the broadcast interval variance, as a numerical feature, can effectively abstract the behavior pattern of the device in the time dimension, transforming the "regularity" that is difficult to describe directly into a comparable and calculable indicator, providing a key basis for identifying counterfeit or controlled devices that exhibit abnormalities in broadcast timing.

[0142] Step S503: Based on the signal strength sequence of the same device at multiple monitoring nodes, fit the slope value of the signal strength decay over time to obtain the signal decay slope.

[0143] This step aims to quantify the motion trend of the device relative to the overall monitoring network from the perspective of the physical characteristics of signal propagation. Its logic lies in using the inherent attenuation characteristics of radio waves propagating in space to invert the radial motion state of the device.

[0144] In some embodiments, the distance between a Bluetooth device and multiple monitoring nodes at fixed locations changes as the device moves through space. According to the attenuation model of radio wave propagation, there is a definite mathematical relationship (usually logarithmic) between received signal strength (RSSI) and propagation distance in free space or a specific environment. Therefore, as the device moves, the sequence of signal strength received by each node exhibits a systematic change.

[0145] To comprehensively assess the overall movement trend of the equipment, the system first averages the signal strength values ​​of the equipment across all nodes at each time point to obtain an observed value representing the overall signal strength of the equipment at that moment. Then, with time as the horizontal axis and the average signal strength as the vertical axis, the system uses fitting methods such as linear regression to obtain a trend line that best represents the change of signal strength over time. The slope of this trend line, i.e., its first derivative, is called the signal attenuation slope value. A significant negative slope indicates that the average signal strength of the equipment is continuously weakening, which usually means that the equipment is moving away from the core area covered by the monitoring node network; conversely, a positive slope means that the equipment is moving closer.

[0146] This step does not rely on precise positioning calculations. It can quickly and easily determine whether the device is entering, leaving, or loitering in the monitored area by simply analyzing the trend of the signal strength sequence. It provides a macroscopic and robust motion trend indicator for judging intent (such as tailing, loitering, or rapid crossing).

[0147] Step S504: Calculate the device displacement vector based on the signal strength difference values ​​of multiple nodes and the geographical coordinates of the nodes;

[0148] The precise calculation of the device's actual physical movement within a specific time period, from a spatial geometric perspective, involves transforming the observed wireless signal strength into the device's displacement in a Cartesian coordinate system through a propagation model and geometric relationships. Specific steps include: obtaining the signal strength difference values ​​of the target device at three non-collinear monitoring nodes; constructing a set of distance equations based on the signal propagation attenuation model and node coordinates; and solving the distance equations to obtain the magnitude and orientation angle of the device's displacement vector.

[0149] The above steps utilize a more refined observation value, namely the multi-node signal strength difference value, which refers to the change in signal strength of the same device at the same monitoring node at two different time points. This difference value more directly reflects the change in distance between the device and the node. The system selects at least three non-collinear (not on the same straight line) monitoring nodes, using their known and precise geographical coordinates as fixed anchor points in space. Combining a radio signal propagation attenuation model (e.g., converting the signal strength difference into a distance change), a constraint equation regarding the change in device position can be established for each node. Multiple such constraint equations constitute a set of distance equations.

[0150] Next, by solving this system of equations (common methods include the difference form of trilateration or optimization algorithms), the displacement vector of the device between these two time points can be calculated. This vector contains not only the magnitude (distance) of the movement but also the direction angle, providing a precise description of the device's motion in two-dimensional or three-dimensional space. Compared to signal attenuation slope, the device displacement vector provides quantitative and directional information about spatial motion, directly characterizing the device's speed and trajectory (e.g., whether it moves directly towards a restricted area or meanders around the entrance). It is a key spatial feature for achieving high-precision identification of abnormal behaviors (such as rapid sprints or irregular wandering).

[0151] Step S505: Combine the broadcast interval variance, signal attenuation slope, and device displacement vector of the same device into a feature vector of the device;

[0152] Among them, the complementary feature indicators extracted from different dimensions (temporal regularity, signal trend, spatial accuracy) in the aforementioned steps are integrated into a unified mathematical representation that can comprehensively describe the overall behavioral state of the device in the current time period.

[0153] Specifically, the broadcast interval variance, signal attenuation slope, and device displacement vector reveal different aspects of device behavior. The variance describes the regularity of its "communication heartbeat"; the attenuation slope summarizes its overall "approaching / moving away" trend relative to the monitoring network; and the displacement vector precisely depicts the details of its "physical movement." Looking at any single feature in isolation only provides partial information and may be subject to interference (for example, a stationary malicious device may have an abnormal broadcast variance, but its displacement vector may be zero).

[0154] Subsequently, the system combines these three scalar or vector features in a fixed order through a combination operation, forming a higher-dimensional device feature vector. This vector constitutes a point in a multi-dimensional feature space. In this space, the behavior patterns of normal devices typically cluster in specific regions (e.g., moderate variance, near-zero slope, small displacement vector magnitude, and random direction), while the behavior patterns of abnormal devices "float" to the edge of the feature space or abnormal regions due to their deviation in one or more dimensions. Therefore, this combined feature vector provides a rich, complementary, and highly discriminative input for subsequent machine learning models, serving as a core bridge for abstracting individual device behaviors from raw data into learnable patterns for the model.

[0155] Step S506: Align the feature vectors of all devices within the current time window according to the time axis to generate a two-dimensional broadcast feature matrix.

[0156] The purpose of this step is to solve the data misalignment problem caused by the asynchronous nature of device broadcasting in actual monitoring scenarios, and to integrate the individual characteristics of all monitored devices into a global, structured data snapshot for batch analysis and model inference.

[0157] In real-world environments, broadcasts from different devices are independent and asynchronous, and their respective feature vectors are calculated at slightly different points in time. To perform cross-device group behavior analysis or batch anomaly detection, a unified current time window (e.g., the past 5 seconds) needs to be defined, and the system collects the device feature vectors calculated by all active devices within this time window. However, some devices may generate feature vectors earlier in this time window, while others may generate them later.

[0158] To address this time synchronization issue, the system performs timeline alignment. By selecting a reference time point (usually the end of the window or a fixed sampling point), the feature vectors of all devices at that reference time or the most recently updated feature vector are used as their representatives for that time window. For devices that first appear at a later time point within the window, their previous features are filled with default values ​​(such as zero) to ensure that all devices have a corresponding row in the matrix.

[0159] Finally, the system aligns the feature vectors of all devices and arranges them into a two-dimensional broadcast feature matrix, with each device as a row and each feature dimension (variance, slope, components of the displacement vector, etc.) as a column. Each row of this matrix represents the overall state of a device at that moment, and each column represents the performance of all devices on a specific behavioral attribute. This structured matrix format perfectly matches the input data format requirements of modern deep learning frameworks (such as convolutional neural networks and graph neural networks), enabling the system to process the full state of all devices within the entire monitoring area at the same time point. This provides an ideal data foundation for detecting cluster anomalies, identifying spatial correlations between devices, or performing efficient batch parallel computations.

[0160] In the above implementation, the broadcast interval variance was used to deeply explore the temporal behavior regularity of the device at the communication protocol layer, the signal attenuation slope was used to quickly grasp the movement trend of the device relative to the overall monitoring network, and the device displacement vector was used to accurately calculate the quantitative movement trajectory of the device in physical space. These three features, from three orthogonal and complementary dimensions of time, signal trend, and spatial geometry, respectively, provide a three-dimensional characterization of device behavior. Finally, by aligning the multidimensional feature vectors of individual devices according to the time window, a unified "two-dimensional broadcast feature matrix" was generated, successfully transforming complex, asynchronous, and multi-source real-time Bluetooth monitoring data into a structured, standardized mathematical model rich in spatiotemporal semantic information. This model not only greatly improves the accuracy and interpretability of subsequent anomaly detection algorithms in identifying abnormal behaviors of single devices (such as spoofing, attacks, and abnormal loitering), but also lays a solid foundation for implementing efficient batch computing and mining group association patterns between devices (such as cooperative movement and aggregation behavior), thus achieving a technological breakthrough from single-point signal perception to intelligent cognition of group behavior in scenarios such as security monitoring and passenger flow analysis.

[0161] Reference Figure 6 As one implementation of step S105, the steps of inputting the broadcast feature matrix into a pre-trained hierarchical behavior analysis model, calculating the basic suspiciousness of the device through a lightweight edge layer network, and triggering a cloud-based deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds a preset threshold include:

[0162] Step S601: Extract the feature vector of a single device from the broadcast feature matrix;

[0163] The broadcast feature matrix is ​​a two-dimensional structured data table. Each row represents a monitored device, and each column represents a specific behavioral feature of the device (such as broadcast interval variance, signal attenuation slope, displacement vector components, etc.). This matrix encapsulates a panoramic view of the device behavior in the entire environment within the current time window.

[0164] Step S602: Perform dimensionality reduction and compression on the feature vector of a single device to generate a low-dimensional feature representation;

[0165] Through mathematical transformation, while preserving key information about device behavior to the greatest extent, the data dimension and scale that subsequent neural network models need to process are significantly reduced, thereby adapting to the limited processing power and storage space of edge devices.

[0166] Specifically, the goal of dimensionality reduction is to find a low-dimensional subspace within the original high-dimensional feature space, such that the projection of data into this subspace retains as much of its original structural information relevant to the "suspicion" judgment as possible. A commonly used method is principal component analysis (PCA). During offline training, the system uses a large amount of historical device behavior data to calculate a feature compression matrix (i.e., principal component directions). During online execution, the system loads this pre-trained feature compression matrix and multiplies it with the feature vector of the current device, outputting a low-dimensional feature representation with reduced dimensions. This low-dimensional feature representation captures information from the directions with the largest variance in the original data—those best distinguishing different behavior patterns—while discarding dimensions with small variance that may represent noise or redundant information. This process not only significantly reduces the volume of input data, lowers the computational complexity and memory usage of the model, but also plays a role in denoising and enhancing feature robustness to some extent.

[0167] Step S603: Input the low-dimensional feature representation within the current time window into the pre-trained lightweight temporal neural network in the edge layer, and output a preliminary suspicion score;

[0168] Specifically, a neural network model optimized for edge environments and capable of capturing temporal dependencies in behavior is used to dynamically evaluate the device's behavioral patterns over recent consecutive time periods, generating a preliminary anomaly probability estimate. The specific steps include: configuring a lightweight temporal neural network as a dual-branch structure containing one-dimensional convolutional layers and long short-term memory units; processing feature space patterns through the convolutional branch and capturing temporal dependencies through the memory unit branch; merging the dual-branch outputs and activating the fully connected layer to generate a preliminary suspicion score.

[0169] Specifically, the dual-branch structure includes: a convolutional branch, which can use a one-dimensional convolutional kernel with a width of 3 and a stride of 1, and the output feature map is compressed by max pooling; a memory unit branch, which sets the hidden layer size to 8 and the dropout rate to 0.2; and a fusion layer, which concatenates the convolutional branch feature map with the hidden state of the memory unit, and the input is a fully connected layer with 4 neurons.

[0170] Understandably, whether a device’s behavior is suspicious is often not determined by its state at a single instant, but by the evolution of its behavior patterns over a period of time. The low-dimensional feature representation within the current time window is actually a feature sequence arranged in chronological order.

[0171] In this embodiment, to analyze such temporal patterns, the system deploys a pre-trained lightweight temporal neural network, a two-branch structure combining one-dimensional convolutional layers and long short-term memory units. The one-dimensional convolutional layers excel at capturing local spatial patterns or short-term dependencies in feature sequences; for example, they can identify specific patterns of sudden increases and decreases in signal strength at several consecutive time points. The long short-term memory units are specifically designed to process sequential data, remembering long-term contextual information to understand the evolution of behavior, such as determining whether a device maintains an abnormal broadcast interval over a long period. These two branches analyze the input sequence at different scales (short-term local patterns and long-term dependencies), then fuse their outputs, and finally perform a comprehensive judgment through a fully connected layer.

[0172] It should be noted that this lightweight temporal neural network is trained on a large amount of labeled data in the cloud or on a high-performance server, and then streamlined and optimized (e.g., quantization, pruning) before being deployed to edge devices. Therefore, it is pre-trained and lightweight. It maps the temporal behavioral feature sequence of a device to a scalar value between 0 and 1, i.e., a preliminary suspicion score. This score quantifies the degree to which the device's behavior pattern deviates from the "normal" baseline within the current observation window. It is the first round of intelligent judgment that the edge device can make based on local and recent information.

[0173] Step S604: Combine the preliminary suspicion score with the equipment's historical behavior records to calculate the basic suspicion score of the equipment;

[0174] This step incorporates historical context information. Its logic is to overcome the potential for momentary misjudgments arising from relying solely on current window data. By combining the device's long-term behavioral baseline, it achieves dynamic calibration and smoothing of the suspicion assessment, improving the stability and accuracy of the judgment. Specific steps include: querying locally stored historical device behavior records to extract the most recent M basic suspicion scores; calculating the offset between the current preliminary suspicion score and the historical average score; and dynamically weighting and fusing historical and current data based on the offset to output the device's basic suspicion score.

[0175] Understandably, an anomaly exhibited by a device within the current time window could be a real threat or just a temporary, accidental anomaly (such as a temporary change in broadcast pattern caused by user operation of the phone).

[0176] In this embodiment, to distinguish between these two situations, the system needs to introduce a longer-term perspective. The device's historical behavior record locally stores the device's behavioral trajectory over a past period, particularly its calculated baseline suspicion scores. The system queries this record, for example, extracting the most recent M scores, and calculates the offset between the current preliminary suspicion score and the average of these historical scores. This offset reflects the degree of deviation of the current behavior from its historical norm. Based on this offset, the system performs dynamic weighted fusion: if the offset is large, indicating a significant abrupt change in the current behavior, the system assigns a higher weight to the current preliminary score and reduces the weight of historical records, allowing the device's baseline suspicion score to quickly respond to such a change; if the offset is small, indicating that the current behavior is still within the historical fluctuation range, the system increases the weight of historical records to smooth the current score and suppress false alarms that may be caused by momentary interference.

[0177] This fusion mechanism endows the system with the ability to "memorize" and "learn" the baseline behavior of each device, making its assessment results not isolated and one-sided, but continuous and context-aware. The calculated basic suspiciousness of the device is a more robust anomaly probability indicator calibrated with historical information.

[0178] Step S605: When the basic suspicion level of the device exceeds the preset threshold, the cloud-based deep analysis process is triggered.

[0179] The logic behind this step lies in implementing an efficient hierarchical filtering and resource allocation mechanism, which allows the edge side to undertake the real-time preliminary screening of massive numbers of devices, while only reporting highly suspicious targets to the cloud for more resource-intensive in-depth analysis, thereby optimizing the overall system efficiency.

[0180] In some embodiments, the preset threshold is a carefully tuned threshold that balances the detection rate and false alarm rate, and defines the boundary for autonomous decision-making at the edge. The system compares the continuously calculated basic suspiciousness of the device with this threshold. If the basic suspiciousness does not exceed the threshold, the edge determines the device as low-risk or normal, and the process terminates locally without consuming any network or cloud computing resources. Only when the basic suspiciousness exceeds this threshold does it mean that the device's behavior pattern has been consistently abnormal enough to warrant high attention, and the lightweight model and historical context at the edge are insufficient to make a final decision, or a broader global information (such as correlations with other devices, more complex models) needs to be considered.

[0181] At this point, the edge node triggers a deep analysis process in the cloud. This typically involves uploading more detailed feature sequences, historical records, and other contextual information about the device to the cloud. The cloud, with its powerful computing and storage resources, can run more complex and in-depth analysis models (such as neural networks and large-scale machine learning models) to perform global correlation analysis and deep pattern recognition on device behavior, ultimately making a high-confidence judgment or generating a more detailed threat report. This "edge initial screening - cloud deep confirmation" triggering mechanism is the essence of the edge computing paradigm. It ensures system scalability, significantly improving system throughput in scenarios monitoring tens of thousands of devices, allowing network bandwidth and cloud computing resources to be focused on truly high-value threat analysis.

[0182] Step S606: Receive the device basic suspiciousness and associated broadcast feature matrix reported by the edge layer;

[0183] In this process, after performing local lightweight analysis, the edge computing nodes calculate a basic suspiciousness score for each monitored device. This score, ranging from 0 to 1, represents the likelihood that the device will be judged as abnormal based on local, real-time information. Simultaneously, the edge nodes also correlate and cache the original data source used to calculate this score—the broadcast feature matrix describing the device's spatiotemporal behavior details within the current time window.

[0184] Step S607: Select a deep network execution node based on the current cloud computing load status;

[0185] The cloud typically consists of a cluster of multiple computing nodes (servers or virtual machines) that collectively support the operation of complex models such as deep networks. The current cloud computing load status of each node is dynamic, including but not limited to CPU utilization, memory usage, GPU usage, and network I / O.

[0186] In this embodiment, when the cloud receives a task request from the edge that requires in-depth analysis (triggered by a basic suspicion level exceeding a preset threshold), it does not randomly or fixedly assign the task to a particular node. Instead, it monitors the load status of all available nodes in real time and runs a load scoring model for comprehensive evaluation. This model quantifies the busyness of each node; for example, it calculates a load score by combining CPU and memory usage.

[0187] Subsequently, the system selects the node with the lowest current load score as the deep network execution node to undertake the task. This dynamic selection mechanism ensures that computing tasks are always assigned to the most "idle" or resource-rich node, thereby optimizing the utilization of computing resources and load balancing within the cluster. This avoids the imbalance where some nodes are overloaded due to handling complex tasks while others are idle, ensuring the stability and quality of service of the system when facing sudden, large-scale reports of suspicious targets.

[0188] Step S608: Extract the long-term behavior trajectory features of the target device from the device's historical behavior records;

[0189] In particular, by tracing the behavior patterns of devices over a longer period of time, a reliable and personalized reference baseline is provided for judging whether their current behavior is truly abnormal.

[0190] Specifically, a centralized historical behavior database is maintained in the cloud, storing summaries or complete trajectories of the behavioral characteristics of all monitored devices over historical periods (such as days or weeks). When in-depth analysis of a target device is required, the system uses its temporary device identifier as an index to extract its corresponding long-term behavioral trajectory features from this database. These features may include statistical measures or time-series models such as the frequency with which the device appears in different areas at different times in history (such as weekdays, nights, and weekends), the typical distribution of its movement speed, and regular patterns of broadcasting behavior. For example, if a device suddenly appears in a sensitive area it has never appeared in before in the early morning, even if its instantaneous behavioral characteristics are not obvious, it may be deemed highly suspicious based on its historical trajectory.

[0191] Step S609: Spatiotemporally align and fuse the broadcast feature matrix with the long-term behavioral trajectory features to generate an enhanced feature tensor;

[0192] The broadcast feature matrix reported from the edge characterizes the target device's high temporal resolution behavioral details (such as precise displacement and real-time signal changes) within a very short time window (e.g., seconds to minutes). In contrast, long-term behavioral trajectory features extracted from historical databases typically have a long time span and lower resolution, representing more statistical regularities or trend summaries. Directly concatenating these two types of features with different scales and granularities makes it difficult for the model to learn effectively; therefore, spatiotemporal alignment and fusion are necessary.

[0193] Specifically, the broadcast feature matrix is ​​interpolated along the time axis to align with the temporal resolution of long-term behavioral trajectories, making them comparable in the time dimension. Then, an attention mechanism is used to weightedly fuse current broadcast features and historical trajectory features. For example, when the current behavior is rapid movement, the attention mechanism may focus more on patterns related to "movement" in the historical trajectory, while weakening other irrelevant historical data. Through this intelligent weighted fusion, the system generates a three-dimensional enhanced feature tensor. This tensor is a multi-dimensional array (typically including: device × time × fused feature dimension), which organically integrates the device's short-term fine-grained dynamics and long-term macro-level patterns, forming a global, context-aware feature representation that includes both "what is happening now" and "how this differs from its past typical behavior."

[0194] Step S610: Process the enhanced feature tensor through the deep spatiotemporal convolutional network in the deep network execution node, and output the anomaly score list.

[0195] Among them, the augmented feature tensor is a typical three-dimensional spatiotemporal data with three dimensions: device, time, and feature. Deep spatiotemporal convolutional networks are ideal tools for processing this type of data. Its core is a 3D convolutional layer, which uses a three-dimensional convolutional kernel that can simultaneously perform sliding scans and feature extraction in both time and space (here, space refers to the "pattern space" composed of feature dimensions).

[0196] The specific steps include: configuring a deep spatiotemporal convolutional network containing alternating stacked 3D convolutional layers and spatiotemporal pooling layers; using the sigmoid activation function in the final fully connected layer to generate anomaly probability scores in the 0-1 range; and generating an anomaly score list arranged in descending order of probability. The deep spatiotemporal convolutional network includes: a 3D convolutional kernel size of (3,3,3), with the number of channels increasing layer by layer from 16 to 128; spatiotemporal pooling layers using max pooling with a pooling window of (2,2,2); and an output layer with a Dropout rate of 0.5 to prevent overfitting.

[0197] In this embodiment, the network progressively abstracts and integrates low-level local spatiotemporal patterns through multiple alternating stacked 3D convolutional layers and spatiotemporal pooling layers to form a high-level global semantic understanding. Finally, the network maps the learned high-level features to a scalar between 0 and 1, i.e., an anomaly probability score, through a fully connected layer. This score, based on normal and anomalous patterns learned from massive amounts of data, provides a final quantitative evaluation of the device behavior represented by the input tensor. For a batch of target devices requiring analysis, the cloud processes them in parallel, outputting an anomaly score list containing all devices and their corresponding scores, sorted by score from highest to lowest. This allows security personnel to immediately focus on the highest-risk targets.

[0198] In the above implementation, edge nodes are no longer merely data collectors, but possess real-time, intelligent preliminary analysis and decision-making capabilities. This enables efficient initial filtering of massive numbers of devices, submitting only highly suspicious targets to the cloud, significantly reducing network transmission pressure and cloud computing load, while achieving rapid local response. This solution, while ensuring anomaly detection accuracy, achieves globally optimal allocation of computing, network, and storage resources, providing a practical edge computing solution for real-time, intelligent security analysis in large-scale IoT terminal monitoring scenarios.

[0199] In practical applications, this solution fully leverages the advantages of the cloud in computing power, data storage, and complex model operation, forming efficient collaboration with edge computing to jointly build a hierarchical, intelligent, and rapidly responsive large-scale Bluetooth device monitoring and security analysis system, thereby improving the ability to detect and handle new, complex, and latent security threats.

[0200] Reference Figure 7 As one implementation of step S106, the steps of performing a security response operation based on the anomaly score list and optimizing the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model based on the security response verification results include:

[0201] Step S701: Generate a device priority queue by sorting the abnormal rating list in descending order of the rating values.

[0202] The cloud-based deep analysis module outputs an anomaly score list containing the identifiers of multiple devices under analysis and their corresponding anomaly scores. This score is a probability value (usually between 0 and 1) that represents the likelihood of abnormal behavior of the device, calculated by a complex model.

[0203] However, in resource-constrained real-world security scenarios, it's impossible to indiscriminately and forcefully intervene in all devices with scores greater than zero. Therefore, the system first sorts the devices in the list in descending order based on their scores. The device with the highest score means its behavior pattern matches the known threat or anomaly pattern most closely, posing the greatest potential risk, and thus should receive the highest priority. Through this sorting process, the system transforms the originally unordered list into an ordered queue of device priorities. This allows the response system to follow the principle of "prioritizing the most important and urgent cases," precisely directing resources such as alarm handling, manual inspections, or automated interception to targets most likely to cause substantial harm. This improves the overall efficiency and effectiveness of security response, preventing the loss of optimal opportunities to address high-risk targets due to uneven resource allocation or chaotic response order.

[0204] Step S702: Based on the preset security response strategy library, perform hierarchical security response operations according to the device priority queue;

[0205] This step involves translating priority assessment into the execution of specific security actions. Based on the severity of the risk, differentiated and tiered response strategies are implemented to effectively control the risk while minimizing disruption to normal activities and optimizing resource consumption.

[0206] Specifically, the system maps device priority queues to different levels of security response operations based on a pre-defined security response grading strategy library. For example, devices at the top of the queue with extremely high scores (e.g., scores ≥ 0.8) may be identified as high-threat devices, and the system will automatically trigger the most severe response, such as linking video systems for location tracking or even activating access control systems for physical interception to prevent them from approaching core areas. Devices with medium scores (e.g., scores 0.5 ≤ < 0.8) may be identified as medium-threat devices, and the system may take measures such as communication blocking to interrupt potential malicious data leakage or command reception channels, limiting their destructive capabilities. For devices with low scores but still of concern (e.g., scores 0.3 ≤ < 0.5), a low-threat response that records device behavior logs may be triggered for continuous observation without immediate intervention, avoiding unnecessary interference from false alarms. This tiered response mechanism achieves a balance between risk and response costs.

[0207] Step S703: Collect security response verification result data, including device behavior correction status and false alarm indicators;

[0208] Since the security response actions initiated by the system cannot guarantee 100% accuracy based on the anomaly score, security response verification result data is collected to obtain feedback information after execution. Verification typically comes from on-site inspections by security personnel, video review, or confirmation from other reliable sources.

[0209] Specifically, the collected data mainly includes two aspects: First, the device behavior correction status, which refers to whether the device's subsequent behavior has returned to normal or stopped suspicious activity after a response measure (such as a warning or blocking) has been taken. For example, a device that has been flagged and had its communication blocked will have a true "behavior correction status" if it subsequently stops abnormal broadcasting. Second, a false alarm flag, which is a crucial Boolean label used to mark whether a response is a "false alarm." If security personnel verify that the device identified as high-risk and blocked by the system is actually authorized personnel or harmless equipment, then the alarm will be marked as a false alarm.

[0210] Step S704: Based on the security response verification result data, calculate the node scanning frequency optimization coefficient and generate the weight update gradient of the hierarchical behavior analysis model;

[0211] Among these methods, the overall false alarm tendency of the system reflected in the verification results is used to reversely adjust the "sensitivity" of data collection, optimize the quality of input data from the source, and reduce the probability of similar misjudgments in the future.

[0212] In this embodiment, based on security response verification results data, particularly statistical information on false alarm identifiers, the system can assess the rationality of the current scanning frequency setting. Specifically, the system will count the proportion of devices marked as false alarms to the total number of responses over a period of time. If the false alarm rate remains high, it may mean that the current scanning frequency is set too sensitively, collecting too many redundant or low-quality signals, causing the analysis module to "overreact."

[0213] At this point, the system needs to calculate a scan frequency optimization coefficient less than 1 (e.g., 0.8) to lower the subsequent scan frequency. Conversely, if there are almost no false alarms, but it is later found that a real threat was missed, it may be necessary to calculate a coefficient greater than 1 (e.g., 1.2) to increase the scan frequency.

[0214] Furthermore, the decision-making power of hierarchical behavior analysis models (such as lightweight networks at the edge and deep networks in the cloud) depends on the millions or even more connection weights within them. The training process essentially involves continuously adjusting these weights to minimize the error between the predicted output and the true label. Specific steps include: constructing a validation result-feature association matrix, labeling the mapping relationship between the device behavior correction state and the broadcast feature matrix; calculating the gradient of the loss function of the hierarchical behavior analysis model using the backpropagation algorithm, and outputting the weight update gradient tensor.

[0215] In this embodiment, the system associates the original input data (i.e., its broadcast feature matrix) corresponding to the verified device with the verification result (whether it is a real threat or a false alarm) to form a labeled training sample. Then, using machine learning optimization techniques such as backpropagation, the system compares the model's current prediction output for these samples with the true verification label to calculate the prediction error (loss). Next, the algorithm reverse-engineers the model to analyze which weights contribute to this error and calculates the direction and magnitude of adjustment for each weight, i.e., the weight update gradient. This gradient is a tensor that indicates the direction in which all model parameters need to be moved to become more accurate.

[0216] Step S705: Apply the node scan frequency optimization coefficient to update the node scan frequency parameter of the dynamic parameter template, and load the weights to update the gradient to the hierarchical behavior analysis model.

[0217] Specifically, the dynamic parameter template is updated by applying the scanning frequency optimization coefficient. The calculated node scanning frequency optimization coefficient is multiplied (e.g., multiplied) with the current node scanning frequency parameter in the dynamic parameter template to generate a new frequency value, which is then updated in the dynamic parameter template. The updated template is then redistributed to the front-end Bluetooth monitoring nodes, thereby changing their data acquisition behavior.

[0218] Secondly, the calculated weight update gradient is input into the model's optimizer (such as SGD, Adam, etc.). The optimizer applies the gradient to the model's current weights according to a specific learning rate, performing a small-scale incremental parameter update. This update method is usually online learning or fine-tuning. Unlike a complete retraining, it has low computational cost and high speed, enabling the model to continuously adapt to new data distributions and threat patterns without interrupting service.

[0219] Once these two updates are completed, the system will generate a version identifier for the new configuration and model and synchronize it to all relevant edge nodes and cloud servers to ensure that the entire system upgrades to the new state in a coordinated manner.

[0220] In the above implementation, the anomaly scoring and ranking are transformed into a priority queue, enabling precise and efficient deployment of security resources. A tiered response mechanism ensures that the intensity of risk response matches the threat level, maximizing resource utilization while effectively controlling risks. More importantly, this technical solution establishes a dual-path optimization mechanism based on action verification feedback: one path analyzes macro-level indicators such as the false alarm rate to reverse-optimize the scanning frequency parameters of the front-end data collection, adjusting system sensitivity from the data source; the other path correlates verification results with original feature data to generate model weight update gradients, micro-tuning the judgment logic of the core analysis model. Ultimately, by securely applying these optimizations and simultaneously updating the dynamic parameter template and hierarchical behavior analysis model, the entire system can learn from the actual effects of each security response, continuously iterating and evolving its data collection strategy and intelligent analysis capabilities. This reduces the system's long-term false alarm rate and operating costs, and further enables it to dynamically adapt to new threats and complex environmental changes.

[0221] Reference Figure 8 As a further implementation of the mobile terminal detection method, after the step of generating the anomaly score list, the method further includes:

[0222] Step S801: Filter the set of device identifiers in the abnormal rating list whose rating values ​​exceed the high-risk threshold, and determine them as the target abnormal device set;

[0223] The system pre-sets a high-risk threshold (e.g., 0.8) determined through rigorous statistical analysis and business considerations. This threshold is based on an analysis of the correlation between score distribution and actual threats in historical security incident data, aiming to filter out devices with highly significant abnormal behavior patterns and an extremely low probability of false alarms. The filtering process uses this threshold as a discrimination boundary to filter the score list. The identifiers of the filtered devices (usually temporary identifiers that have undergone hash-based anonymization to protect privacy) are aggregated into a device identifier set.

[0224] Step S802: Based on the pre-configured Bluetooth monitoring node topology map, retrieve the broadcast behavior characteristics of each target abnormal device in the target abnormal device set in the adjacent area;

[0225] Among them, by utilizing a monitoring network composed of multiple interconnected nodes deployed in space, the activity traces of the target abnormal device are actively collected in a wider geographical area, laying the data foundation for depicting its complete behavioral map.

[0226] In this embodiment, the Bluetooth monitoring node topology map accurately depicts the deployment locations and relative relationships of all monitoring nodes in physical space using a graph theory model, defining the signal coverage range of each node and the adjacency relationships (i.e., adjacent areas) between nodes. When analyzing a high-risk target, the system first locates the "source" node that initially detected the target based on the topology map, and then automatically retrieves other monitoring nodes within all its adjacent areas (typically defined as areas where signals can overlap or are physically close). The system initiates collaborative query requests to these nodes to retrieve the broadcast behavior characteristics of the target device (matched by its de-identified identifier) ​​captured by these adjacent nodes within the same or similar time window.

[0227] Specifically, broadcast behavior characteristics are multi-dimensional, including not only basic signal strength and timestamps, but also the statistical characteristics of broadcast interval sequences (reflecting behavioral patterns), the attenuation slope of multi-node received signal strength indication (reflecting motion trends), and more refined displacement vectors based on angle of arrival (reflecting precise movement).

[0228] Step S803: Integrate the broadcast behavior features of the same target abnormal device from multiple regions to construct a spatiotemporal matrix of device trajectory;

[0229] The system utilizes algorithms such as Kalman filtering to synchronize and calibrate timestamps from different regions, compensating for minor clock drifts, and uniformly transforms device location estimates (based on signal strength or angle of arrival) from different nodes into a common spatial grid coordinate system. For missing grid data caused by node coverage blind spots or signal loss, the system can employ spatial statistical methods such as Kriging interpolation to reasonably estimate and fill the missing data based on the data distribution patterns of surrounding known points.

[0230] Finally, all the aligned, calibrated, and completed data are integrated to construct a structured spatiotemporal matrix of device trajectories. The three core dimensions of this matrix are: time dimension (continuous time slices), spatial dimension (discrete grid coordinates), and feature dimension (integrated feature vectors, such as displacement, signal changes, etc.).

[0231] Step S804: Based on the device trajectory spatiotemporal matrix as input, the co-occurrence frequency and signal propagation path between devices are analyzed through graph neural network to calculate the device correlation strength matrix;

[0232] The system constructs a dynamic graph model with devices as nodes. If two devices frequently appear simultaneously within a similar time and spatial range, an "edge" is formed between them. The co-occurrence frequency (calculated using Jaccard similarity, etc.) serves as the edge weight, quantifying the strength of this spatial association. Furthermore, the system analyzes the characteristics of signal propagation paths between devices, such as whether the signal attenuation pattern is abnormal when crossing obstacles. This can serve as circumstantial evidence to determine whether devices are in the same physical group or affected by the same signal source.

[0233] In this embodiment, the graph neural network (GNN) is a deep learning model specifically designed for processing graph-structured data. Through a message-passing mechanism, it allows each device node to aggregate feature information from its neighboring nodes (i.e., other devices co-occurring with it). After multiple iterations, the feature representation of each node not only includes its own behavior but also encodes the topology and association strength information of its local network. The GNN can automatically learn complex association patterns; for example, it can identify multiple devices that, despite having different movement paths, maintain stable signal associations and spatiotemporal co-occurrence, potentially indicating a coordinated cluster. The output of this step is a device association strength matrix characterizing the collaborative relationships between devices, quantitatively revealing the potential, imperceptible group associations among all high-risk devices within the monitoring area.

[0234] Step S805: Identify device clustering patterns based on the device association strength matrix and generate potential threat propagation paths;

[0235] Among these features, the system automatically identifies tightly clustered groups (aggregation patterns) with potential threats from complex device associations, and predicts the possible spread paths of threats based on network structure and propagation dynamics, thus realizing the transformation from post-event response to pre-event prediction.

[0236] Specifically, the system uses community detection algorithms (such as the Louvain algorithm) to analyze the device association strength matrix. This algorithm automatically groups closely connected nodes in the graph into the same "community" or "group" by optimizing indicators such as modularity. These identified clustering patterns are subsets of devices that are internally tightly connected but relatively sparsely connected to the outside. They are likely to correspond to groups with collaborative behaviors, such as tracking gangs or cooperative detection teams.

[0237] Secondly, the system considers this cluster as a potential "source of infection," and other devices in the graph that interact with it via signals or are spatially close to it as "susceptible" nodes. Drawing inspiration from epidemiological SI models and incorporating random walk algorithms, the system simulates the most probable propagation paths of threats (such as malware spread and coordinated attack command transmission) within this dynamic network of devices. Through multiple simulations, the system can generate multiple potential threat diffusion paths originating from the "source of infection" and ranked by probability. This essentially transforms a static correlation graph into a dynamic risk propagation prediction model, providing invaluable decision-making support for early deployment and targeted defense by security forces.

[0238] Step S806: Dynamically update the preset security response strategy library based on the potential threat propagation path;

[0239] Specifically, the system inputs the potential threat propagation path topology map into a multi-objective optimization decision model. This model needs to formulate or adjust security response strategies under the constraints of limited security resources (such as patrol personnel, movable barriers, and signal jamming equipment) in order to maximize the effect of intercepting or suppressing threat propagation, while minimizing response costs and delays.

[0240] In the embodiments of this application, the specific strategy updates may include: prioritizing the deployment of automated inspection robots or security personnel to key intersection nodes on the diffusion path; upgrading the monitoring level of identified or potentially "susceptible" devices on the path from passive listening to active detection, and initiating scans more frequently to obtain more detailed status information; and even pre-setting or activating physical interception facilities (such as enhanced access control) at the end of the path prediction or key channels.

[0241] It's important to note that these strategies are not fixed but can be continuously optimized based on a reinforcement learning framework. Using historical success rates as "rewards," the system learns which resource combinations and response methods are most effective under different threat propagation patterns. This gives the entire security system the ability to dynamically adapt and continuously improve.

[0242] Step S807: Extract cross-device collaborative features from the device association strength matrix and device clustering patterns, and feed them back to the training dataset of the hierarchical behavior analysis model.

[0243] Specifically, the cross-regional association features, such as the device association strength matrix and clustering pattern identifiers generated by the cross-regional analysis, are encapsulated together with the corresponding original device data and used as new training samples, which are then fed back into the training dataset of the hierarchical behavior analysis model.

[0244] In subsequent model retraining or incremental learning processes, these new samples will be used to adjust the model's weight parameters. To ensure that the model learns to identify new group threat patterns without forgetting its previously mastered ability to identify individual anomalies, the system employs advanced continuous learning methods such as elastic weight consolidation algorithms. In this way, the model can continuously evolve, its input feature dimensions can be expanded (for example, adding "association with high-risk clusters" as one of the input features), and its judgment logic can be deepened.

[0245] In the above implementation, discrete Bluetooth monitoring nodes are woven into a sensing network with collective intelligence. This not only detects anomalies in individual devices but also clarifies the relationships between devices, enabling accurate judgment of the threat's trajectory. Thus, in security scenarios in large and complex locations, a technological breakthrough has been achieved, moving from individual anomaly alarms to collective situational awareness and proactive defense, thereby enhancing the overall ability to respond to organized and intelligent security threats.

[0246] This application also discloses a mobile terminal detection system based on Bluetooth broadcast behavior monitoring.

[0247] A mobile terminal detection system based on Bluetooth broadcast behavior monitoring, specifically comprising:

[0248] The dynamic parameter configuration module is used to configure the initial parameters of the Bluetooth monitoring node, obtain historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template. The dynamic parameter template includes node scanning frequency, signal strength filtering threshold and rotating key pool.

[0249] The scanning module is used to scan raw Bluetooth broadcast packets in the environment based on node scanning frequency;

[0250] The data cleanup module is used to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet using a round-robin key pool to generate a temporary device identifier, and to filter broadcast packets with signal strength lower than the signal strength filtering threshold, and output a cleaned data stream.

[0251] The feature matrix generation module is used to parse the broadcast time interval sequence and multi-node signal strength sequence in the clean data stream, calculate the broadcast interval variance, signal attenuation slope and device displacement vector, and aggregate them according to the device dimension to generate a broadcast feature matrix.

[0252] The hierarchical analysis and decision module is used to input the broadcast feature matrix into the pre-trained hierarchical behavior analysis model, calculate the basic suspiciousness of the device through the edge layer lightweight network, and trigger the cloud deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds the preset threshold.

[0253] The closed-loop optimization feedback module is used to perform security response operations based on the anomaly score list, and optimize the node scanning frequency parameters of the dynamic parameter template and the weight parameters of the hierarchical behavior analysis model based on the response verification results.

[0254] The mobile terminal detection system based on Bluetooth broadcast behavior monitoring according to the embodiments of this application can implement any of the above methods, and the specific working process of each module in the system can refer to the corresponding process in the above method embodiments.

[0255] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for example, the division of a certain module is merely a logical functional division, and in actual implementation there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0256] This application also discloses a computer-readable storage medium.

[0257] A computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above in any of the methods for detecting a mobile terminal based on Bluetooth broadcast behavior monitoring.

[0258] The computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device; the program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0259] The above are all preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is only one example of a series of equivalent or similar features.

Claims

1. A mobile terminal detection method based on Bluetooth broadcast behavior monitoring, characterized in that, The mobile terminal detection method includes: Configure the initial parameters of the Bluetooth monitoring node, obtain historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template; wherein, the dynamic parameter template includes node scanning frequency, signal strength filtering threshold and rotating key pool; The original Bluetooth broadcast packets in the environment are scanned based on the node scanning frequency; The rotating key pool is used to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet to generate a temporary device identifier, and Bluetooth broadcast packets with signal strength lower than the signal strength filtering threshold are filtered out to output a clean data stream; The broadcast time interval sequence and multi-node signal strength sequence in the purified data stream are analyzed, and the broadcast interval variance, signal attenuation slope and device displacement vector are calculated. The broadcast feature matrix is ​​generated by aggregating according to the device dimension. The broadcast feature matrix is ​​input into a pre-trained hierarchical behavior analysis model, and the basic suspiciousness of the device is calculated through a lightweight edge layer network. When the basic suspiciousness of the device exceeds a preset threshold, a cloud-based deep network is triggered to generate an anomaly score list. The security response operation is performed according to the anomaly score list, and the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model are optimized based on the security response verification results. The steps for configuring the initial parameters of the Bluetooth monitoring node, obtaining historical device density distribution and environmental noise baseline data of the target area, and calculating and generating a dynamic parameter template include: Read the historical device density distribution dataset of the target area and extract the peak density periods and the distribution ratio of device types; the historical device density distribution dataset is a time series database that records the changes in the number of Bluetooth devices detected in a specific area at different time granularities over a long period of time. Obtain the signal interference intensity spectrum from the environmental noise baseline database and identify the main interference frequency bands; Based on the peak density period and the distribution ratio of device types, the initial value of the node scanning frequency and the product of the adaptive adjustment coefficient are calculated to obtain the node scanning frequency parameter. Specifically, a function model positively correlated with the peak device density is established based on historical data of the peak density period to calculate the initial value of the node scanning frequency. Corresponding device type weight coefficients are assigned according to different device types, and the weight coefficients of each device type are weighted and summed with the proportion of the device type in the historical data to obtain the adaptive adjustment coefficient. Based on the signal interference intensity spectrum and the main interference frequency bands, the dynamic range of the signal intensity filtering threshold is determined; Based on preset privacy protection policies and key rotation cycle rules, a rotating key pool is generated, including multiple encryption keys and time segmentation index rules; By integrating the node scanning frequency parameters, signal strength filtering threshold range, and rotating key pool, a dynamic parameter template is constructed.

2. The mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 1, characterized in that, Following the step of constructing the dynamic parameter template, the following is also included: Real-time acquisition of current environmental electromagnetic spectrum data of the target area, and extraction of noise interference feature vectors in areas overlapping with the Bluetooth broadcast channel spectrum; Compare the deviation of the noise interference feature vector from the environmental noise baseline data; When the deviation exceeds the dynamic threshold, adaptive spectrum compensation parameters are generated. Based on the spectrum adaptive compensation parameters, the update frequency and signal strength filtering threshold of the rotating key pool are adjusted to obtain the updated dynamic parameter template, which is then synchronized to all Bluetooth monitoring nodes.

3. The mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 1, characterized in that, The steps of using the round-robin key pool to perform hash de-identification on the device hardware address in the original Bluetooth broadcast packet to generate a temporary device identifier, and filtering Bluetooth broadcast packets with signal strength lower than the signal strength filtering threshold to output a clean data stream include: Read the raw Bluetooth broadcast packet set and extract the device hardware address field and signal strength value contained therein; Call the pre-generated rotating key pool and obtain the target hash key based on the current time window index; The target hash key is used to perform a salted hash operation on the device hardware address to generate an irreversible temporary device identifier; Compare the signal strength value with the signal strength filtering threshold in the dynamic parameter template, and discard Bluetooth broadcast packets that are lower than the signal strength filtering threshold; The temporary device identifier is integrated with the filtered Bluetooth broadcast packet metadata to generate a structured, clean data stream; The index value of the rotating key pool is updated according to a preset period to trigger key rotation.

4. The mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 3, characterized in that, The steps of parsing the broadcast time interval sequence and multi-node signal strength sequence in the purified data stream, calculating the broadcast interval variance, signal attenuation slope, and device displacement vector, and aggregating them by device dimension to generate a broadcast feature matrix include: Read the purified data stream and extract the broadcast timestamp sequence of each device and the signal strength sequence of multiple monitoring nodes; The time variance between adjacent Bluetooth broadcast packets is calculated based on the broadcast timestamp sequence to obtain the broadcast interval variance. Based on the signal strength sequence of the same device at multiple monitoring nodes, the slope value of signal strength decay over time is fitted to obtain the signal decay slope. The device displacement vector is calculated based on the signal strength difference values ​​of multiple nodes and the geographical coordinates of the nodes; The broadcast interval variance, signal attenuation slope, and device displacement vector of the same device are combined to form the device's feature vector; Align the feature vectors of all devices within the current time window along the time axis to generate a two-dimensional broadcast feature matrix.

5. The mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 4, characterized in that, The steps of inputting the broadcast feature matrix into a pre-trained hierarchical behavior analysis model, calculating the basic suspiciousness of the device through a lightweight edge layer network, and triggering a cloud-based deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds a preset threshold include: Based on the broadcast feature matrix, extract the feature vector of each individual device; Dimensionality reduction and compression are performed on the feature vectors of a single device to generate a low-dimensional feature representation; The low-dimensional feature representation within the current time window is input into a pre-trained lightweight temporal neural network in the edge layer, and an initial suspicion score is output. By combining the preliminary suspicion score with the device's historical behavior records, the basic suspicion score of the device is calculated. When the basic suspicion level of the device exceeds a preset threshold, a cloud-based in-depth analysis process is triggered. Receive the basic suspiciousness of the device and the associated broadcast feature matrix reported by the edge layer; Select the deep network execution node based on the current cloud computing load status; Extract long-term behavioral trajectory features of the target device from its historical behavior records; The broadcast feature matrix is ​​spatiotemporally aligned and fused with long-term behavioral trajectory features to generate an enhanced feature tensor. The enhanced feature tensor is processed by a deep spatiotemporal convolutional network in the deep network execution node, and an anomaly score list is output.

6. The mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 1, characterized in that, The steps of performing security response operations based on the anomaly score list and optimizing the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model based on the security response verification results include: Based on the abnormal rating list, generate a device priority queue by sorting the rating values ​​in descending order; Based on a preset security response strategy library, hierarchical security response operations are performed according to the device priority queue; Collect security response verification result data, including device behavior correction status and false alarm indicators; Based on the security response verification results data, the node scanning frequency optimization coefficient is calculated and the weight update gradient of the hierarchical behavior analysis model is generated; The node scanning frequency parameters of the dynamic parameter template are updated using the node scanning frequency optimization coefficients, and the weight update gradients are loaded into the hierarchical behavior analysis model.

7. A mobile terminal detection method based on Bluetooth broadcast behavior monitoring according to claim 6, characterized in that, The step of generating the list of anomaly scores also includes: The set of device identifiers whose scores exceed the high-risk threshold in the abnormal score list is selected as the target abnormal device set. Based on a pre-configured Bluetooth monitoring node topology map, the broadcast behavior characteristics of each target abnormal device in the target abnormal device set in the adjacent area are retrieved; By integrating the broadcast behavior characteristics of the same abnormal device from multiple regions, a spatiotemporal matrix of device trajectories is constructed. Based on the device trajectory spatiotemporal matrix as input, the co-occurrence frequency and signal propagation path between devices are analyzed by graph neural network, and the device correlation strength matrix is ​​calculated. Based on the device association strength matrix, device clustering patterns are identified, and potential threat propagation paths are generated; The preset security response strategy library is dynamically updated based on the potential threat propagation path. Cross-device collaborative features are extracted from the device association strength matrix and device clustering patterns and fed back into the training dataset of the hierarchical behavior analysis model.

8. A mobile terminal detection system based on Bluetooth broadcast behavior monitoring, characterized in that, A mobile terminal detection system for performing a Bluetooth broadcast behavior monitoring method according to any one of claims 1 to 7, the mobile terminal detection system comprising: The dynamic parameter configuration module is used to configure the initial parameters of the Bluetooth monitoring node, obtain historical device density distribution and environmental noise baseline data of the target area, and calculate and generate a dynamic parameter template; wherein, the dynamic parameter template includes node scanning frequency, signal strength filtering threshold and round-robin key pool; The scanning module is used to scan the environment for raw Bluetooth broadcast packets based on the node scanning frequency; The data purification module is used to perform hash desensitization on the device hardware address in the original Bluetooth broadcast packet using the rotating key pool to generate a temporary device identifier, and to filter broadcast packets with signal strength lower than the signal strength filtering threshold, and output a purified data stream. The feature matrix generation module is used to parse the broadcast time interval sequence and multi-node signal strength sequence in the purified data stream, calculate the broadcast interval variance, signal attenuation slope and device displacement vector, and aggregate them according to the device dimension to generate a broadcast feature matrix. The hierarchical analysis and decision module is used to input the broadcast feature matrix into the pre-trained hierarchical behavior analysis model, calculate the basic suspiciousness of the device through the edge layer lightweight network, and trigger the cloud deep network to generate an anomaly score list when the basic suspiciousness of the device exceeds a preset threshold. The closed-loop optimization feedback module is used to perform security response operations based on the anomaly score list, and optimize the node scanning frequency parameter of the dynamic parameter template and the weight parameter of the hierarchical behavior analysis model based on the response verification results.

9. A computer-readable storage medium, characterized in that: The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 7.

Images