Security Protection System and Verification Algorithm for Smart Terminals Based on Dynamic Behavioral Characteristics

Abstract

This invention belongs to the field of security protection system technology, and particularly relates to a smart terminal security protection system and verification algorithm based on dynamic behavior characteristics. It includes a multi-source dynamic behavior perception module, used for real-time collection of dynamic behavior data of the smart terminal based on dual-dimensional perception at the terminal kernel layer and application layer, employing a lightweight sampling mechanism. The dynamic behavior data includes process lifecycle behavior data, network session interaction data, user biometric-related operation data, hardware resource timing data, and user operation behavior timing data. Furthermore, the multi-source dynamic behavior perception module has a built-in load adaptive adjustment unit that dynamically switches the collection accuracy and sampling frequency according to the terminal's CPU load and memory usage. This invention provides a system that combines accurate security protection with lightweight terminal operation, dynamically adapts to behavioral changes in multiple scenarios, improves the accuracy of anomaly identification and the ability to respond to unknown attacks, and simultaneously achieves full-process security protection and dual data security assurance.

Description

Technical Field

[0001] This invention belongs to the field of security protection system technology, and in particular relates to a smart terminal security protection system and verification algorithm based on dynamic behavior characteristics. Background Technology

[0002] With the widespread adoption of smart terminals and the rapid development of mobile internet technology, terminal devices have become the core carriers for personal information storage and business interaction, making their security protection increasingly urgent. Existing smart terminal security protection technologies largely rely on static feature detection, such as virus signature matching and fixed permission verification. These technologies have significant limitations: static feature libraries require continuous manual updates, making it difficult to cope with new and unknown attacks and dynamic malicious behaviors. Furthermore, they are poorly adaptable to dynamic changes in normal terminal behavior, prone to misjudgments or missed detections, and cannot match the actual needs of users' operating habits and application operating modes that dynamically change with the scenario.

[0003] Meanwhile, existing protection solutions often employ fixed-frequency sampling patterns for behavioral data collection. Under high terminal loads, this can easily consume significant system resources, leading to terminal lag and increased power consumption. Conversely, under low loads, the sampling accuracy is insufficient, failing to precisely capture fine-grained abnormal behavioral characteristics. Furthermore, existing solutions suffer from limited feature extraction dimensions, lagging baseline model updates, and highly independent encryption mechanisms for data transmission and storage, lacking edge-end collaborative optimization. This makes it difficult to balance security and system efficiency, failing to meet the lightweight, real-time, and highly reliable security protection requirements of smart terminals. Therefore, there is an urgent need to improve existing technologies and address related shortcomings. Based on this research, we present a smart terminal security protection system and verification algorithm based on dynamic behavioral characteristics. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a smart terminal security protection system and verification algorithm based on dynamic behavioral characteristics. This system combines precise security protection with lightweight terminal operation, dynamically adapts to behavioral changes in multiple scenarios, improves the accuracy of anomaly identification and the ability to respond to unknown attacks, and simultaneously achieves full-process security protection and dual data security assurance. This invention aims to solve the problems existing in existing technologies.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A smart terminal security protection system based on dynamic behavioral characteristics includes:

[0007] The multi-source dynamic behavior perception module is used to collect dynamic behavior data of the smart terminal in real time based on dual-dimensional perception of the terminal kernel layer and application layer, and adopts a lightweight sampling mechanism. The dynamic behavior data includes process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data, and user operation behavior timing data. The multi-source dynamic behavior perception module has a built-in load adaptive adjustment unit that dynamically switches the acquisition accuracy and sampling frequency according to the terminal CPU load and memory usage.

[0008] The behavior feature enhancement preprocessing module is communicatively connected to the multi-source dynamic behavior perception module. It is used to perform outlier pruning, feature standardization and time sequence synchronization processing on the collected dynamic behavior data. It removes high-frequency interference data through wavelet threshold denoising algorithm, converts data into standardized features through Z-Score standardization, and aligns multi-dimensional data under different sampling frequencies / precisions to a unified UTC time axis through dynamic time warping algorithm to obtain a standardized feature sequence that meets the model input requirements.

[0009] The multi-scale dynamic feature extraction module is communicatively connected to the behavior feature enhancement preprocessing module. It is used to extract multi-scale dynamic core features from the standardized feature sequence by using a fusion network of temporal attention mechanism + temporal pyramid pooling unit combined with bidirectional gated recurrent unit and convolutional neural network. The multi-scale dynamic core features include short-term behavior fluctuation features, medium-term behavior pattern features, long-term behavior trend features and temporal correlation features.

[0010] The dynamic security decision module is connected to the multi-scale dynamic feature extraction module and is used to construct a multi-dimensional scenario-based behavior baseline library. It outputs the terminal security status decision result by combining feature similarity matching and anomaly measurement evaluation. The multi-dimensional scenario-based behavior baseline library is dynamically updated by combining online incremental learning, forgetting mechanism and transfer learning. It adapts to changes in terminal behavior under different scenarios and removes outdated behavior feature samples to ensure timeliness.

[0011] The graded protection execution module is communicatively connected to the dynamic security decision module and is used to execute graded protection operations based on the security status decision results. The graded protection operations include risk warning, permission restriction, suspicious process isolation, behavior log retention, and temporary control of terminal permissions.

[0012] The edge-to-edge collaborative encryption module communicates with each of the above modules and uses the national cryptographic SM4 algorithm to encrypt data transmitted between modules. It also uses the edge node to dynamically update the key and uses the national cryptographic SM3 algorithm to perform hash verification on the behavioral data stored locally on the terminal, thereby improving the dual security of data transmission and storage.

[0013] In a preferred embodiment, the multi-source dynamic behavior perception module includes a kernel-state behavior acquisition unit, an application-state behavior acquisition unit, and a biometric association unit;

[0014] The kernel-mode behavior acquisition unit is used to collect process creation / termination timing, system call types, and kernel resource allocation data.

[0015] The application behavior acquisition unit is used to collect application startup / exit frequency, inter-application data interaction volume, and third-party plugin call behavior.

[0016] The biometric association unit is used to collect fingerprint touch features, voice interaction features and facial unlocking timing features during user operation, and associate and bind them with user operation behavior data.

[0017] The adjustment rule of the load adaptive adjustment unit is as follows:

[0018] When the CPU load is ≤25% and the memory utilization is ≤35%, a high-precision acquisition mode is adopted. The sampling interval of the high-precision acquisition mode is 10ms and the sampling frequency is 20Hz.

[0019] When the CPU load is greater than 25% and less than 55%, or the memory utilization is greater than 35% and less than 65%, the standard acquisition mode is adopted. The sampling interval of the standard acquisition mode is 50ms and the sampling frequency is 10Hz.

[0020] When CPU load > 55% or memory utilization > 65%, a lightweight acquisition mode is adopted, with a sampling interval of 100ms and a sampling frequency of 5Hz.

[0021] In a preferred embodiment, the temporal synchronization processing of the behavior feature enhancement preprocessing module adopts a timestamp-aligned method to uniformly associate dynamic behavior data from different sources with the UTC time axis, ensuring the temporal consistency of multi-dimensional data; the threshold calculation formula of the wavelet threshold denoising algorithm is: , where σ is the noise standard deviation and N is the mathematical formula for data length.

[0022] As a preferred embodiment, the workflow of the multi-scale dynamic feature extraction module is as follows:

[0023] The temporal pyramid pooling unit divides the standardized feature sequence into temporal segments of different lengths and extracts the statistical features of each segment, including the mean, variance, and peak value.

[0024] Bidirectional gated recurrent units extract temporal dependencies of features, while convolutional neural networks extract local correlation features.

[0025] Temporal attention mechanisms assign different weights to temporal dependency features to strengthen key features;

[0026] Finally, statistical features, temporal dependency features, and local correlation features are spliced ​​and fused to obtain multi-scale dynamic core features.

[0027] As a preferred implementation, the construction process of the multi-dimensional scenario-based behavior baseline library includes:

[0028] Collect dynamic behavior data of terminals operating normally in various scenarios such as office, entertainment and outdoor, and construct a scenario-based initial baseline library after preprocessing and feature extraction;

[0029] The baseline feature distribution is updated by incorporating new normal behavior samples through online incremental learning.

[0030] By using transfer learning, baseline features from similar terminals can be adapted to the current terminal, thus shortening the baseline library construction cycle.

[0031] By periodically removing behavioral feature samples that have exceeded the preset time limit through a forgetting mechanism, the timeliness of the baseline database is ensured.

[0032] A smart terminal security verification algorithm based on dynamic behavior characteristics is applied to the aforementioned smart terminal security protection system based on dynamic behavior characteristics. The algorithm includes the following steps:

[0033] S1. Multi-source dynamic behavior perception: Based on the dual dimensions of terminal kernel layer and application layer, a lightweight sampling mechanism is used to collect process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data and user operation behavior timing data in real time. The load adaptive adjustment unit dynamically switches the collection accuracy and sampling frequency according to the terminal CPU load and memory usage.

[0034] S2. Feature Enhancement Preprocessing: Wavelet threshold denoising algorithm is used to denoise the acquired dynamic behavior data; Z-Score normalization (Z= (where x is the original data, μ is the data mean, and σ is the data standard deviation) is converted into standardized features; the multi-dimensional data is aligned to a unified UTC time axis using a dynamic time warping algorithm to obtain a standardized feature sequence;

[0035] S3. Multi-scale feature extraction: The standardized feature sequence is input into the fusion network. The temporal segment statistical features are extracted through the temporal pyramid pooling unit, the temporal dependency features are extracted through the bidirectional gated recurrent unit, the local correlation features are extracted through the convolutional neural network, the key features are strengthened by the temporal attention mechanism, and finally the multi-scale dynamic core features are spliced ​​and fused.

[0036] S4. Security Status Decision Verification: Call the multi-dimensional scenario-based behavior baseline library to calculate the feature matching degree and anomaly degree; set the matching degree threshold, similarity threshold and anomaly degree threshold, combine the three to judge the terminal security status, and output the security decision result.

[0037] S5. Tiered Protection and Baseline Update: Execute corresponding tiered protection operations based on security decision results; at the same time, complete online incremental learning through a batch-updated stochastic gradient descent algorithm, integrate newly added normal behavior samples into the baseline library, adapt to the baseline features of similar terminals through transfer learning, and remove outdated samples through a forgetting mechanism to achieve dynamic updates of the baseline library.

[0038] In a preferred embodiment, the feature matching degree in step S4 is calculated by weighted fusion of cosine similarity and Euclidean distance, and the anomaly degree is calculated by deviation coefficient, as shown in the following formula:

[0039] Feature matching degree: Match = α × CosSim + (1-α) ×

[0040] Improved cosine similarity: CosSim=

[0041] Deviation coefficient: Dev=

[0042] Deviation coefficient: Dev=

[0043] Where Match represents the feature matching degree, α is the weight coefficient (range [0.3, 0.7]), CosSim is the improved cosine similarity, EuDist is the Euclidean distance, MaxDist is the preset maximum Euclidean distance threshold, X is the multi-scale dynamic core feature, Y is the baseline feature, and ε is the minimum value (range [0.3, 0.7]). ), n is the feature dimension, X_i is the i-th feature component of X, Y_i is the i-th feature component of Y, max(Y) is the maximum value of the baseline feature, and min(Y) is the minimum value of the baseline feature.

[0044] In a preferred embodiment, the online incremental learning in step S5 employs a batch-updated stochastic gradient descent algorithm, with the update formula as follows:

[0045] θ_new=θ_old-η× ×Σ∇L(θ_old, x_b, y_b)

[0046] Where θ_new represents the updated model parameters, θ_old represents the original model parameters, η represents the learning rate, B represents the batch size, x_b represents the feature data of the b-th sample in the batch, y_b represents the label of the b-th sample in the batch, and ∇L represents the gradient of the loss function.

[0047] In a preferred embodiment, the safety status determination rule in step S4 is as follows:

[0048] When Match ≥ 0.8, Sim ≥ 0.8, and Dev ≤ 0.2, it is considered a safe state;

[0049] When 0.6≤Match<0.8 or 0.6≤Sim<0.8 or 0.2<Dev≤0.4, it is determined to be a warning state;

[0050] When Match < 0.6, Sim < 0.6, and Dev > 0.4, it is considered a dangerous state.

[0051] In a preferred embodiment, the weight calculation of the temporal attention mechanism in step S3 uses the Softmax function, with the specific formula as follows:

[0052] a_i = Softmax(e_i) = , where a_i is the attention weight of the i-th temporal feature, e_i is the energy value of the i-th temporal feature, the energy value is calculated from the output features and weight matrix of the bidirectional gated recurrent unit, and j is the total number of temporal features.

[0053] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0054] In the solution of the present invention:

[0055] This invention achieves dual-dimensional behavioral data collection at the kernel and application layers through the collaborative design of a multi-source dynamic behavior perception module and a load adaptive adjustment unit. At the same time, it dynamically switches the sampling accuracy and frequency according to the terminal's CPU load and memory usage. This not only solves the defects of the existing fixed sampling mode, which is "high load consumes resources and low load lacks accuracy", but also achieves comprehensive and accurate collection of behavioral data, providing high-quality data support for subsequent security verification, and taking into account both the real-time protection requirements and the lightweight operation requirements of the terminal.

[0056] This invention employs a fusion network combining a temporal attention mechanism, a temporal pyramid pooling unit, a bidirectional gated recurrent unit, and a convolutional neural network to extract multi-scale dynamic core features. Combined with a dynamic update mechanism (online incremental learning + forgetting mechanism + transfer learning) for a multi-dimensional scenario-based behavior baseline library, it effectively solves the problems of single feature extraction dimensions and poor adaptability of baseline models in existing technologies. It can accurately identify multiple types of security risks such as short-term behavior fluctuations, mid-term pattern deviations, and long-term trend anomalies, significantly improving the accuracy of abnormal behavior identification and the ability to respond to unknown attacks.

[0057] This invention combines national cryptographic algorithm encryption with dynamic key updates for edge nodes through an edge-to-edge collaborative encryption module. Simultaneously, it employs SM4 encryption and SM3 hash verification for transmitted data and locally stored data, respectively. Combined with differentiated protection strategies from a tiered protection execution module, this solution addresses the security vulnerabilities of existing schemes, such as a single encryption mechanism and delayed key updates. It also achieves end-to-end protection, including risk warning, access control, attack blocking, and behavior tracing. While enhancing the dual security of terminal data transmission and storage, it reduces the impact of excessive protection on normal user experience, thus improving the practicality and flexibility of the protection solution. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings are described as follows:

[0059] Figure 1 This is a schematic diagram of the intelligent terminal security protection system of the present invention;

[0060] Figure 2 This is a schematic diagram of the smart terminal security verification algorithm of the present invention. Detailed Implementation

[0061] The embodiments described below are merely some embodiments of the present invention and do not represent all embodiments consistent with the present invention. Exemplary embodiments will now be described with reference to the accompanying drawings:

[0062] This invention relates to a smart terminal security protection system and verification algorithm based on dynamic behavioral characteristics, comprising:

[0063] The multi-source dynamic behavior perception module is used to perceive the terminal from two dimensions: the terminal kernel layer and the application layer. It adopts a lightweight sampling mechanism to collect dynamic behavior data of the smart terminal in real time. The dynamic behavior data includes process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data, and user operation behavior timing data. The multi-source dynamic behavior perception module has a built-in load adaptive adjustment unit that dynamically switches the acquisition accuracy and sampling frequency according to the terminal CPU load and memory usage.

[0064] The behavior feature enhancement preprocessing module communicates with the multi-source dynamic behavior perception module and is used to perform outlier pruning, feature standardization and time sequence synchronization processing on the collected dynamic behavior data. It removes high-frequency interference data through wavelet threshold denoising algorithm, converts data into standardized features through Z-Score standardization, and aligns multi-dimensional data under different sampling frequencies / precisions to a unified UTC time axis through dynamic time warping algorithm to obtain a standardized feature sequence that meets the model input requirements.

[0065] The multi-scale dynamic feature extraction module communicates with the behavior feature enhancement preprocessing module. It is used to extract multi-scale dynamic core features from the standardized feature sequence by using a fusion network of temporal attention mechanism + temporal pyramid pooling unit combined with bidirectional gated recurrent unit and convolutional neural network. The multi-scale dynamic core features include short-term behavior fluctuation features, medium-term behavior pattern features, long-term behavior trend features and temporal correlation features.

[0066] The dynamic security decision module communicates with the multi-scale dynamic feature extraction module to build a multi-dimensional scenario-based behavior baseline library. It outputs the terminal security status decision results by combining feature similarity matching and anomaly measurement evaluation. The multi-dimensional scenario-based behavior baseline library is dynamically updated by combining online incremental learning, forgetting mechanism and transfer learning. It adapts to changes in terminal behavior under different scenarios and removes outdated behavior feature samples to ensure timeliness.

[0067] The graded protection execution module communicates with the dynamic security decision module and is used to execute graded protection operations based on the security status decision results. The graded protection operations include risk warning, permission restriction, suspicious process isolation, behavior log retention, and temporary control of terminal permissions.

[0068] The edge-to-edge collaborative encryption module communicates with each of the above modules and uses the national cryptographic SM4 algorithm to encrypt data transmitted between modules. It also uses the edge node to dynamically update the key and uses the national cryptographic SM3 algorithm to perform hash verification on the behavioral data stored locally on the terminal, thereby improving the dual security of data transmission and storage.

[0069] As a preferred embodiment, based on the above structure, the multi-source dynamic behavior perception module further includes a kernel-state behavior acquisition unit, an application-state behavior acquisition unit, and a biometric association unit.

[0070] The kernel-mode behavior acquisition unit is used to collect process creation / termination timing, system call types, and kernel resource allocation data;

[0071] The application behavior acquisition unit is used to collect information such as application startup / exit frequency, inter-application data interaction volume, and third-party plugin call behavior.

[0072] The biometric association unit is used to collect fingerprint touch features, voice interaction features and facial unlock timing features during user operations, and associate and bind them with user operation behavior data.

[0073] The adjustment rules of the load adaptive adjustment unit are as follows:

[0074] When the CPU load is ≤25% and the memory utilization is ≤35%, the high-precision acquisition mode is adopted. The sampling interval of the high-precision acquisition mode is 10ms and the sampling frequency is 20Hz.

[0075] When the CPU load is greater than 25% and less than or equal to 55%, or the memory utilization is greater than 35% and less than or equal to 65%, the standard acquisition mode is adopted. The sampling interval of the standard acquisition mode is 50ms and the sampling frequency is 10Hz.

[0076] When CPU load > 55% or memory utilization > 65%, a lightweight acquisition mode is adopted. The sampling interval in the lightweight acquisition mode is 100ms and the sampling frequency is 5Hz.

[0077] As a preferred embodiment, based on the above structure, the temporal synchronization processing of the behavior feature enhancement preprocessing module further adopts a timestamp-aligned method to uniformly associate dynamic behavior data from different sources with the UTC time axis, ensuring the temporal consistency of multi-dimensional data; the threshold calculation formula of the wavelet threshold denoising algorithm is: , where σ is the noise standard deviation and N is the mathematical formula for data length.

[0078] As a preferred embodiment, based on the above structure, the workflow of the multi-scale dynamic feature extraction module is further as follows:

[0079] The temporal pyramid pooling unit divides the standardized feature sequence into temporal segments of different lengths and extracts the statistical features of each segment, including the mean, variance, and peak value.

[0080] Bidirectional gated recurrent units extract temporal dependencies of features, while convolutional neural networks extract local correlation features.

[0081] Temporal attention mechanisms assign different weights to temporal dependency features to strengthen key features;

[0082] Finally, statistical features, temporal dependency features, and local correlation features are spliced ​​and fused to obtain multi-scale dynamic core features.

[0083] As a preferred implementation, based on the above structure, the further construction process of the multi-dimensional scenario-based behavior baseline library includes:

[0084] Collect dynamic behavior data of terminals operating normally in various scenarios such as office, entertainment and outdoor, and construct a scenario-based initial baseline library after preprocessing and feature extraction;

[0085] The baseline feature distribution is updated by incorporating new normal behavior samples through online incremental learning.

[0086] By using transfer learning, baseline features from similar terminals can be adapted to the current terminal, thus shortening the baseline library construction cycle.

[0087] By periodically removing behavioral feature samples that have exceeded the preset time limit through a forgetting mechanism, the timeliness of the baseline database is ensured.

[0088] The intelligent terminal security verification algorithm based on dynamic behavior characteristics is applied to an intelligent terminal security protection system based on dynamic behavior characteristics. The algorithm includes the following steps:

[0089] S1. Multi-source dynamic behavior perception: Based on the dual dimensions of terminal kernel layer and application layer, a lightweight sampling mechanism is used to collect process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data and user operation behavior timing data in real time. The load adaptive adjustment unit dynamically switches the collection accuracy and sampling frequency according to the terminal CPU load and memory usage.

[0090] S2. Feature Enhancement Preprocessing: Wavelet threshold denoising algorithm is used to denoise the acquired dynamic behavior data; Z-Score normalization (Z= (where x is the original data, μ is the data mean, and σ is the data standard deviation) is converted into standardized features; the multi-dimensional data is aligned to a unified UTC time axis using a dynamic time warping algorithm to obtain a standardized feature sequence;

[0091] S3. Multi-scale feature extraction: The standardized feature sequence is input into the fusion network. The temporal segment statistical features are extracted through the temporal pyramid pooling unit, the temporal dependency features are extracted through the bidirectional gated recurrent unit, the local correlation features are extracted through the convolutional neural network, the key features are strengthened by the temporal attention mechanism, and finally the multi-scale dynamic core features are spliced ​​and fused.

[0092] S4. Security Status Decision Verification: Call the multi-dimensional scenario-based behavior baseline library to calculate the feature matching degree and anomaly degree; set the matching degree threshold, similarity threshold and anomaly degree threshold, combine the three to judge the terminal security status, and output the security decision result.

[0093] S5. Tiered Protection and Baseline Update: Execute corresponding tiered protection operations based on security decision results; at the same time, complete online incremental learning through a batch-updated stochastic gradient descent algorithm, integrate newly added normal behavior samples into the baseline library, adapt to the baseline features of similar terminals through transfer learning, and remove outdated samples through a forgetting mechanism to achieve dynamic updates of the baseline library.

[0094] As a preferred embodiment, based on the above structure, in step S4, the feature matching degree is calculated by weighted fusion of cosine similarity and Euclidean distance, and the anomaly degree is calculated by deviation coefficient, as shown in the following formula:

[0095] Feature matching degree: Match = α × CosSim + (1-α) ×

[0096] Improved cosine similarity: CosSim=

[0097] Deviation coefficient: Dev=

[0098] Deviation coefficient: Dev=

[0099] Where Match represents the feature matching degree, α is the weight coefficient (range [0.3, 0.7]), CosSim is the improved cosine similarity, EuDist is the Euclidean distance, MaxDist is the preset maximum Euclidean distance threshold, X is the multi-scale dynamic core feature, Y is the baseline feature, and ε is the minimum value (range [0.3, 0.7]). ), n is the feature dimension, X_i is the i-th feature component of X, Y_i is the i-th feature component of Y, max(Y) is the maximum value of the baseline feature, and min(Y) is the minimum value of the baseline feature.

[0100] In a preferred embodiment, based on the above structure, the online incremental learning in step S5 further employs a batch-updated stochastic gradient descent algorithm, with the update formula as follows:

[0101] θ_new=θ_old-η× ×Σ∇L(θ_old, x_b, y_b)

[0102] Where θ_new represents the updated model parameters, θ_old represents the original model parameters, η represents the learning rate, B represents the batch size, x_b represents the feature data of the b-th sample in the batch, y_b represents the label of the b-th sample in the batch, and ∇L represents the gradient of the loss function.

[0103] As a preferred embodiment, based on the above structure, the safety status judgment rule in step S4 is further as follows:

[0104] When Match ≥ 0.8, Sim ≥ 0.8, and Dev ≤ 0.2, it is considered a safe state;

[0105] When 0.6≤Match<0.8 or 0.6≤Sim<0.8 or 0.2<Dev≤0.4, it is determined to be a warning state;

[0106] When Match < 0.6, Sim < 0.6, and Dev > 0.4, it is considered a dangerous state.

[0107] As a preferred embodiment, based on the above structure, the weight calculation of the temporal attention mechanism in step S3 further adopts the Softmax function, and the specific formula is as follows:

[0108] a_i = Softmax(e_i) = , where a_i is the attention weight of the i-th temporal feature, e_i is the energy value of the i-th temporal feature, the energy value is calculated from the output features and weight matrix of the bidirectional gated recurrent unit, and j is the total number of temporal features.

[0109] The working principle of this invention is as follows:

[0110] This invention obtains comprehensive dynamic behavior data through dual-dimensional perception at the terminal kernel layer and application layer. After feature enhancement preprocessing and multi-scale core feature extraction, it accurately matches the scenario-based behavior baseline library to achieve security decisions and execute hierarchical protection. At the same time, it relies on edge-end collaborative encryption to ensure data security and adapts to behavior changes through dynamic baseline updates.

[0111] The multi-source dynamic behavior perception module, combined with a load adaptive adjustment mechanism, dynamically switches the acquisition accuracy and frequency to capture multi-dimensional behavior data. After wavelet denoising, standardization, and time-series synchronous preprocessing, a standardized feature sequence is obtained. Then, multi-scale core features are extracted through a time-series pyramid pooling unit, a fusion network, and a time-series attention mechanism. The data is then input into the dynamic security decision module and evaluated against the scenario-based baseline features for both matching degree and deviation. The security status is output and differentiated operations are performed by the hierarchical protection module. The edge-end collaborative encryption module ensures data transmission and storage security throughout the process.

[0112] The security verification algorithm transforms the above process into a closed-loop execution logic of "perception-processing-decision-protection-update," sequentially completing the steps of multi-source dynamic behavior perception, feature enhancement preprocessing, multi-scale feature extraction, security status decision verification, and hierarchical protection and baseline update. The baseline update employs a combination of online incremental learning, transfer learning, and a forgetting mechanism. This approach absorbs newly added normal behavior samples and adapts to the baseline features of similar terminals while eliminating outdated samples to ensure timeliness. This allows the entire system to continuously improve the accuracy of abnormal behavior identification and the ability to respond to unknown attacks while maintaining lightweight terminal operation, forming a full-process, adaptive intelligent terminal security protection system.

[0113] The above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any equivalent changes, modifications, substitutions, and variations made by those skilled in the art based on the concept of the present invention and on the basis of the prior art through logical analysis, reasoning, or limited experiments shall be within the scope of protection defined by the claims.

Claims

1. An intelligent terminal security protection system based on dynamic behavior characteristics, characterized in that, include: The multi-source dynamic behavior perception module is used to collect dynamic behavior data of the smart terminal in real time based on dual-dimensional perception of the terminal kernel layer and application layer, and adopts a lightweight sampling mechanism. The dynamic behavior data includes process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data, and user operation behavior timing data. The multi-source dynamic behavior perception module has a built-in load adaptive adjustment unit that dynamically switches the acquisition accuracy and sampling frequency according to the terminal CPU load and memory usage. The behavior feature enhancement preprocessing module is communicatively connected to the multi-source dynamic behavior perception module. It is used to perform outlier pruning, feature standardization and time sequence synchronization processing on the collected dynamic behavior data. It removes high-frequency interference data through wavelet threshold denoising algorithm, converts data into standardized features through Z-Score standardization, and aligns multi-dimensional data under different sampling frequencies / precisions to a unified UTC time axis through dynamic time warping algorithm to obtain a standardized feature sequence that meets the model input requirements. The multi-scale dynamic feature extraction module is communicatively connected to the behavior feature enhancement preprocessing module. It is used to extract multi-scale dynamic core features from the standardized feature sequence by using a fusion network of temporal attention mechanism + temporal pyramid pooling unit combined with bidirectional gated recurrent unit and convolutional neural network. The multi-scale dynamic core features include short-term behavior fluctuation features, medium-term behavior pattern features, long-term behavior trend features and temporal correlation features. The dynamic security decision module is connected to the multi-scale dynamic feature extraction module and is used to construct a multi-dimensional scenario-based behavior baseline library. It outputs the terminal security status decision result by combining feature similarity matching and anomaly measurement evaluation. The multi-dimensional scenario-based behavior baseline library is dynamically updated by combining online incremental learning, forgetting mechanism and transfer learning. It adapts to changes in terminal behavior under different scenarios and removes outdated behavior feature samples to ensure timeliness. The graded protection execution module is communicatively connected to the dynamic security decision module and is used to execute graded protection operations based on the security status decision results. The graded protection operations include risk warning, permission restriction, suspicious process isolation, behavior log retention, and temporary control of terminal permissions. The edge-to-edge collaborative encryption module communicates with each of the above modules and uses the national cryptographic SM4 algorithm to encrypt data transmitted between modules. It also uses the edge node to dynamically update the key and uses the national cryptographic SM3 algorithm to perform hash verification on the behavioral data stored locally on the terminal, thereby improving the dual security of data transmission and storage.

2. The intelligent terminal security protection system based on dynamic behavior characteristics according to claim 1, characterized in that: The multi-source dynamic behavior perception module includes a kernel-state behavior acquisition unit, an application-state behavior acquisition unit, and a biometric feature association unit. The kernel-mode behavior acquisition unit is used to collect process creation / termination timing, system call types, and kernel resource allocation data. The application behavior acquisition unit is used to collect application startup / exit frequency, inter-application data interaction volume, and third-party plugin call behavior. The biometric association unit is used to collect fingerprint touch features, voice interaction features and facial unlocking timing features during user operation, and associate and bind them with user operation behavior data. The adjustment rule of the load adaptive adjustment unit is as follows: When the CPU load is ≤25% and the memory utilization is ≤35%, a high-precision acquisition mode is adopted. The sampling interval of the high-precision acquisition mode is 10ms and the sampling frequency is 20Hz. When the CPU load is greater than 25% and less than 55%, or the memory utilization is greater than 35% and less than 65%, the standard acquisition mode is adopted. The sampling interval of the standard acquisition mode is 50ms and the sampling frequency is 10Hz. When CPU load > 55% or memory utilization > 65%, a lightweight acquisition mode is adopted, with a sampling interval of 100ms and a sampling frequency of 5Hz.

3. The intelligent terminal security protection system based on dynamic behavioral characteristics according to claim 2, characterized in that: The time sequence synchronization processing of the behavior feature enhancement preprocessing module adopts a timestamp alignment-based method to uniformly associate dynamic behavior data from different sources to a UTC time axis, ensuring time consistency of multi-dimensional data; and the threshold calculation formula of the wavelet threshold denoising algorithm is: wherein σ is the noise standard deviation, and N is the data length.

4. The intelligent terminal security protection system based on dynamic behavioral characteristics according to claim 1, characterized in that: The workflow of the multi-scale dynamic feature extraction module is as follows: The temporal pyramid pooling unit divides the standardized feature sequence into temporal segments of different lengths and extracts the statistical features of each segment, including the mean, variance, and peak value. Bidirectional gated recurrent units extract temporal dependencies of features, while convolutional neural networks extract local correlation features. Temporal attention mechanisms assign different weights to temporal dependency features to strengthen key features; Finally, statistical features, temporal dependency features, and local correlation features are spliced ​​and fused to obtain multi-scale dynamic core features.

5. The intelligent terminal security protection system based on dynamic behavioral characteristics according to claim 1, characterized in that: The construction process of the multi-dimensional scenario-based behavior baseline library includes: Collect dynamic behavior data of terminals operating normally in various scenarios such as office, entertainment and outdoor, and construct a scenario-based initial baseline library after preprocessing and feature extraction; The baseline feature distribution is updated by incorporating new normal behavior samples through online incremental learning. By using transfer learning, baseline features from similar terminals can be adapted to the current terminal, thus shortening the baseline library construction cycle. By periodically removing behavioral feature samples that have exceeded the preset time limit through a forgetting mechanism, the timeliness of the baseline database is ensured.

6. A smart terminal security verification algorithm based on dynamic behavioral characteristics, characterized in that, The algorithm, applied to the smart terminal security protection system based on dynamic behavioral characteristics as described in any one of claims 1-5, includes the following steps: S1. Multi-source dynamic behavior perception: Based on the dual dimensions of terminal kernel layer and application layer, a lightweight sampling mechanism is used to collect process life cycle behavior data, network session interaction data, user biometric associated operation data, hardware resource timing data and user operation behavior timing data in real time. The load adaptive adjustment unit dynamically switches the collection accuracy and sampling frequency according to the terminal CPU load and memory usage. S2. Feature Enhancement Preprocessing: Wavelet threshold denoising algorithm is used to denoise the acquired dynamic behavior data; Z-Score normalization (Z= (where x is the original data, μ is the data mean, and σ is the data standard deviation) is converted into standardized features; the multi-dimensional data is aligned to a unified UTC time axis using a dynamic time warping algorithm to obtain a standardized feature sequence; S3. Multi-scale feature extraction: The standardized feature sequence is input into the fusion network. The temporal segment statistical features are extracted through the temporal pyramid pooling unit, the temporal dependency features are extracted through the bidirectional gated recurrent unit, the local correlation features are extracted through the convolutional neural network, the key features are strengthened by the temporal attention mechanism, and finally the multi-scale dynamic core features are spliced ​​and fused. S4. Security Status Decision Verification: Call the multi-dimensional scenario-based behavior baseline library to calculate the feature matching degree and anomaly degree; set the matching degree threshold, similarity threshold and anomaly degree threshold, combine the three to judge the terminal security status, and output the security decision result. S5. Tiered Protection and Baseline Update: Execute corresponding tiered protection operations based on security decision results; at the same time, complete online incremental learning through a batch-updated stochastic gradient descent algorithm, integrate newly added normal behavior samples into the baseline library, adapt to the baseline features of similar terminals through transfer learning, and remove outdated samples through a forgetting mechanism to achieve dynamic updates of the baseline library.

7. The intelligent terminal security verification algorithm based on dynamic behavioral features according to claim 6, characterized in that: In step S4, the feature matching degree is calculated by weighted fusion of cosine similarity and Euclidean distance, and the anomaly degree is calculated by deviation coefficient, as shown in the following formula: Feature matching degree: Match = α × CosSim + (1-α) × Improved cosine similarity: CosSim= Deviation coefficient: Dev= Deviation coefficient: Dev= Where Match represents the feature matching degree, α is the weight coefficient (range [0.3, 0.7]), CosSim is the improved cosine similarity, EuDist is the Euclidean distance, MaxDist is the preset maximum Euclidean distance threshold, X is the multi-scale dynamic core feature, Y is the baseline feature, and ε is the minimum value (range [0.3, 0.7]). ), n is the feature dimension, X_i is the i-th feature component of X, Y_i is the i-th feature component of Y, max(Y) is the maximum value of the baseline feature, and min(Y) is the minimum value of the baseline feature.

8. The intelligent terminal security verification algorithm based on dynamic behavioral features according to claim 6, characterized in that: The online incremental learning in step S5 employs a batch-updated stochastic gradient descent algorithm, with the update formula as follows: θ_new=θ_old-η× ×Σ∇L(θ_old,x_b,y_b) Where θ_new represents the updated model parameters, θ_old represents the original model parameters, η represents the learning rate, B represents the batch size, x_b represents the feature data of the b-th sample in the batch, y_b represents the label of the b-th sample in the batch, and ∇L represents the gradient of the loss function.

9. The intelligent terminal security verification algorithm based on dynamic behavioral features according to claim 6, characterized in that: The safety status determination rule in step S4 is as follows: When Match ≥ 0.8, Sim ≥ 0.8, and Dev ≤ 0.2, it is considered a safe state; When 0.6≤Match<0.8 or 0.6≤Sim<0.8 or 0.2<Dev≤0.4, it is determined to be a warning state; When Match < 0.6, Sim < 0.6, and Dev > 0.4, it is considered a dangerous state.

10. The intelligent terminal security verification algorithm based on dynamic behavioral features according to claim 6, characterized in that: In step S3, the weight calculation for the temporal attention mechanism uses the Softmax function, and the specific formula is as follows: a_i = Softmax(e_i) = , where a_i is the attention weight of the i-th temporal feature, e_i is the energy value of the i-th temporal feature, the energy value is calculated from the output features and weight matrix of the bidirectional gated recurrent unit, and j is the total number of temporal features.

Images