AI-based methods and systems for detecting abnormal behavior in cloud phones

Abstract

This invention relates to the field of machine learning and anomaly detection technology, specifically to an AI-based method and system for detecting abnormal behavior in cloud mobile phones. The method includes: collecting raw user click data on the cloud mobile phone instance side, and organizing the raw user click data in a structured manner according to time sequence to construct a click event sequence; based on the click event sequence, performing spatial normalization encoding, time interval embedding, and contextual semantic representation on each click event to generate a click behavior sequence, and inputting the click behavior sequence into a Transformer encoder to extract high-order feature representations of the click behavior; and generating an anomaly score based on the high-order feature representations using an autoregressive time series prediction model to quantify the degree to which the current behavior deviates from the normal pattern. This invention introduces machine learning technology, particularly utilizing a Transformer encoder to extract high-order features from the click event sequence, and combines this with an autoregressive time series prediction model to dynamically model normal behavior patterns.

Description

Technical Field

[0001] This invention relates to the field of machine learning and anomaly detection technology, specifically to an AI-based method and system for detecting abnormal behavior in cloud mobile phones. Background Technology

[0002] With the widespread application of cloud phone technology, the security detection of user interaction behavior has become a crucial link in ensuring the reliability of cloud services and data security. However, traditional machine learning methods for detecting abnormal behavior typically rely on fixed rules, static thresholds, or simple statistical features, making it difficult to effectively address the complex dynamic changes in temporal rhythm, spatial trajectory, and contextual semantics of abnormal behaviors such as automated scripts and bot clicks in cloud phone environments. In particular, existing methods lack the ability to deeply model long-range dependencies, multimodal interaction features, and behavioral evolution patterns in click event sequences, resulting in low detection accuracy, high false positive rates, and difficulty in adapting to different users' operating habits when faced with diverse malicious operations. Summary of the Invention

[0003] The purpose of this invention is to address the problems existing in the background technology by proposing an AI-based method and system for detecting abnormal behavior of cloud mobile phones.

[0004] The technical solution of this invention: A cloud phone abnormal behavior detection method based on AI, comprising: S1. Collect raw user click data on the cloud phone instance side, and organize the raw user click data in a structured manner according to the time sequence to construct a click event sequence; S2. Based on the click event sequence, each click event is spatially normalized, embedded with time intervals, and semantically represented in context to generate a click behavior sequence. The click behavior sequence is then input into the Transformer encoder to extract high-order feature representations of the click behavior. S3. Based on high-order feature representation, an autoregressive time series prediction model is used to generate anomaly scores to quantify the degree to which the current behavior deviates from the normal pattern. S4. Based on the abnormal score, extract the local abnormal density change features, identify the boundary adsorption point set of abnormal behavior segments, use the boundary adsorption point set as the starting anchor point of the sliding window, perform statistical analysis on the abnormal score within the sliding window, and generate stable abnormal indicators for classifying click behavior. S5. Trigger corresponding control strategies based on the click behavior classification results.

[0005] As a further improvement to this technical solution, in step S1, the raw user click data is collected on the cloud phone instance side, and the raw user click data is structured and organized in chronological order to construct a click event sequence, including the following steps: S1.1 In the cloud phone instance, a click listening interface is registered through the system input subsystem to capture user touch operations in real time; when a touch press event is detected, the acquisition mechanism is triggered to obtain the raw touch event data stream, and touch events with click semantics are filtered from the raw touch event data stream as the user click raw data; S1.2 Extract key raw fields based on user click raw data, including at least click coordinates, timestamp, click interval and interface context information, to generate initial click events; preprocess the initial click events, and perform time standardization on the preprocessed initial click events; sort the time-standardized click events according to the timestamp to generate a continuous click event sequence.

[0006] As a further improvement to this technical solution, in step S2, a click behavior sequence is generated and input into the Transformer encoder to extract high-order feature representations of the click behavior, including the following steps: S2.1 Based on the click event sequence, each event is decomposed into fields, and spatial features are extracted separately. Time characteristics and contextual semantic features This forms a multimodal input subspace; S2.2, Based on spatial features A two-dimensional spatial discrete partitioning function is constructed to map continuous coordinates to a discrete grid, and a learnable embedding matrix is ​​used. Perform a lookup table mapping to obtain the spatial embedding vector. ; S2.3, Targeting Time Characteristics Encoding is performed using a nonlinear mapping function to generate a time embedding vector. ; S2.4, Contextual semantic features Input semantic encoding function to generate semantic embedding vector ; S2.5 Embedding the space into a vector Temporal embedding vector Semantic embedding vectors The data is then stitched together to generate a unified click behavior vector. It is used to characterize the multimodal integrated information of a single click; S2.6, Based on a unified click behavior vector Introducing positional encoding to generate enhanced behavior vectors ; S2.7, Based on Enhanced Behavior Vectors Form an enhanced click behavior sequence Click behavior sequence The input is a Transformer encoder, which generates a high-order representation sequence through a multi-head self-attention mechanism.

[0007] As a further improvement to this technical solution, in step S3, an anomaly score is generated based on a high-order feature representation using an autoregressive time-series prediction model to quantify the degree to which the current behavior deviates from the normal pattern, including the following steps: S3.1 Collect confirmed normal user click samples from historical data, extract the corresponding high-order feature representation sequences, construct a normal behavior feature set, and train an autoregressive time series prediction model based on the Transformer encoder based on the normal behavior feature set. S3.2 Input the high-order feature representation sequence of the current user into the trained autoregressive time series prediction model to predict the behavior at the next time step and obtain the predicted feature representation; S3.3. Based on step S2, obtain the high-order feature representation of the actual observation at the next time step, and calculate the deviation between it and the predicted feature representation. and the deviation Standardize; S3.4. Construct a difference sequence based on the click event time interval sequence, generate a discrete rhythm state sequence based on the difference sequence, and use sliding window embedding to extract time pattern subsequences and construct a pattern probability distribution. Generate a click rhythm stability index based on the pattern probability distribution. ; S3.5 Calculate displacement features based on click coordinates and determine repeated click states. Combine directional discretization to construct a state sequence and its transition probability matrix. Generate a spatial repetition rate index based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. And the spatial repetition rate index Perform normalization; S3.6, Based on standardized deviation and rhythm stability index Based on the normalized spatial repetition rate index, a comprehensive anomaly scoring function is constructed to generate anomaly scores.

[0008] As a further improvement to this technical solution, in step S3.4, a difference sequence is constructed based on the click event time interval sequence, a discrete rhythm state sequence is generated based on the difference sequence, and a sliding window embedding is used to extract the time pattern subsequence and construct the pattern probability distribution. A click rhythm stability index is then generated based on the pattern probability distribution. This includes the following steps: S3.41. Construct a time interval sequence based on the timestamps of click events, and then construct a difference sequence based on the time interval sequence. ; S3.42, Based on difference sequences Encode into symbol sequences using discrete symbol mapping functions ; S3.43. Set the sliding window length for the symbol sequence. Perform sliding window embedding to construct a set of time pattern subsequences. ; S3.44, Set of Subsequences of Time Pattern Perform statistical counting to construct the pattern probability distribution. ; S3.45, Based on pattern probability distribution By introducing distributed weighting, an enhanced complexity index is generated. And the enhanced complexity index Normalization is performed to generate a click rhythm stability index.

[0009] As a further improvement to this technical solution, in step S3.5, a spatial repetition rate index is generated based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. This includes the following steps: S3.51 Constructing a displacement vector sequence based on click coordinates for adjacent click events And based on the displacement vector sequence Calculate displacement modulus ; S3.52, Based on displacement modulus The system determines whether a click is a non-repeating click based on a preset spatial threshold, and calculates the displacement direction angle based on the determination result. And use the discrete mapping function to determine the displacement direction angle Mapping to discrete labels generates a unified state sequence; S3.53. Based on the unified state sequence, count the state transition frequency and construct a transition probability matrix based on the state transition frequency; S3.54. Construct a spatial generation complexity function based on the transition probability matrix and calculate the trajectory generation entropy. ; S3.55, Generate entropy for the trajectory Normalization is performed, and a spatial repetition rate index is generated. ; S3.56, Set a fixed-length window Sliding step size For each window, steps S3.53 to S3.55 are executed independently to obtain the local spatial repetition rate of that window and generate a local repetition rate time series. S3.57 Calculate the coefficient of variation of repetition rate based on the time series of local repetition rates Mean of the absolute value of the first difference of the repetition rate ; S3.58, Based on the coefficient of variation of repetition rate Mean of the absolute value of the first difference of the repetition rate Spatial repetition rate index Make corrections to generate the final corrected spatial repetition rate index. .

[0010] As a further improvement to this technical solution, in step S4, the set of boundary adsorption points is used as the starting anchor point of the sliding window. Statistical analysis of the anomaly scores is performed within the sliding window to generate stable anomaly indicators, including the following steps: S4.1 Organize the anomaly scores into an anomaly score sequence according to time order. Based on the abnormal scoring sequence, the characteristics of local abnormal density changes are calculated to identify the set of boundary adsorption points of abnormal behavior segments; S4.2 Construct a fixed-length sliding window using the boundary adsorption point as the starting anchor point of the sliding window; S4.3 For each sliding window, extract the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion; S4.4. Based on the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion, a window-level stable anomaly index is generated by introducing a boundary integrity coefficient. S4.5 Construct a window anomaly sequence based on window-level stable anomaly indicators, and construct a continuous anomaly window count; S4.6 Classify click behavior based on window-level stable anomaly indicators and consecutive abnormal window counts.

[0011] As a further improvement to this technical solution, in step S4.1, calculating the local abnormal density change characteristics based on the abnormal scoring sequence and identifying the set of boundary adsorption points of abnormal behavior segments includes the following steps: S4.11, Based on anomaly scoring sequences In the time scale window Built-in sliding statistical neighborhood For sliding statistical neighborhood The internal anomaly score is binarized and mapped, and the local anomaly density is calculated. ; S4.12, Based on local anomaly density A time-continuous difference constraint relationship is constructed, a density transition detection mechanism is introduced, the density state at adjacent time points is compared and analyzed, and a boundary adsorption judgment function is constructed. S4.13. Based on the boundary adsorption decision function, the discrete trigger points in the entire time series are extracted in a structured manner and represented in a set to form a boundary adsorption point set. .

[0012] As a further improvement to this technical solution, step S5, which triggers a corresponding control strategy based on the click behavior classification result, includes the following steps: Based on the click behavior classification results, risk levels are mapped to the behavior states corresponding to each sliding window to construct a discrete risk state set. An anomaly intensity modulation factor is constructed based on window-level stable anomaly index and continuous anomaly window count. The corresponding control strategy is generated based on the discrete risk state set and the anomaly intensity modulation factor.

[0013] On the other hand, the present invention provides an AI-based cloud phone abnormal behavior detection system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the above-mentioned AI-based cloud phone abnormal behavior detection method.

[0014] Compared with existing technologies, the above-mentioned technical solution of the present invention has the following beneficial technical effects: By introducing machine learning technology, especially by using the Transformer encoder to extract high-order features from click event sequences, and combining it with an autoregressive time series prediction model to dynamically model normal behavior patterns, the system can automatically learn and distinguish the essential differences between normal human operations and automated scripts in terms of spatiotemporal distribution, rhythm changes, and transition patterns, without relying on manually preset fixed rules or thresholds; this machine learning-driven detection mechanism has strong generalization ability and adaptability, and can effectively cope with different cloud phone instances, different user habits, and constantly evolving abnormal attack methods, significantly improving the accuracy and robustness of abnormal behavior identification, while reducing the false alarm rate, providing an intelligent and high-precision real-time security protection solution for the cloud phone environment. Attached Figure Description

[0015] Figure 1 This is a flowchart of the overall method of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: Please refer to Figure 1 As shown, this embodiment provides an AI-based method for detecting abnormal behavior in cloud phones, including the following steps: S1. Collect raw user click data on the cloud phone instance side, and organize the raw user click data in a structured manner according to the time sequence to construct a click event sequence; In this embodiment, raw user click data is collected on the cloud phone instance side, and the raw user click data is structured and organized in chronological order to construct a click event sequence, including the following steps: S1.1 In the cloud phone instance (virtual Android environment), a click listening interface is registered through the system input subsystem or accessibility service to capture user touch operations in real time. When a touch press or release event is detected, the acquisition mechanism is triggered to obtain the raw touch event data stream. Touch events with click semantics are then filtered from the raw touch event data stream as the user's original click data (specifically, in the cloud phone instance, the continuous touch event stream is parsed event by event. First, the input stream is initially filtered based on the event type field, retaining only key events with click semantics such as touch press (ACTION_DOWN) and touch release (ACTION_UP), and removing continuous movement events (ACTION_MOVE) generated during swiping). Subsequently, based on... Candidate events are paired and aggregated based on temporal neighborhood constraints. Press and release events occurring in pairs within a preset time threshold range (used to constrain the time interval between touch press and release events, with values ​​ranging from [50ms, 400ms], used to filter touch operations that conform to instantaneous click semantics) are combined into a complete click operation. At the same time, non-instantaneous click behaviors such as long press and drag are filtered out (such as events whose duration exceeds threshold a or whose trajectory displacement exceeds spatial threshold b). Further, the corresponding click coordinates, timestamps, and interface context information are extracted from the filtered click events, and outlier removal and debouncing processing are performed (such as merging pseudo-clicks that are repeatedly triggered in a short period of time). Finally, a user click raw data sequence containing only discrete click semantics is formed for subsequent behavior modeling and anomaly detection. S1.2 Extract key raw fields based on user click raw data, including at least click coordinates. timestamp Click interval and interface context information The process involves generating initial click events, preprocessing these events, and then performing time standardization on the preprocessed events. The time-standardized click events are then sorted by timestamp to generate a continuous click event sequence. Specifically, the process involves parsing each filtered piece of raw user click data to extract the click coordinates of touch press and release events. System timestamp Click interval calculated from the time difference between adjacent clicks ( (for index variables), and interface context information obtained through window handles or accessibility nodes. (Including the current application identifier, page hierarchy path, and control type or ID), and encapsulate the above fields into a structured initial click event; then perform preprocessing on the initial click event, including outlier removal (such as coordinate out-of-bounds errors, timestamp rollback), duplicate click merging (aggregating jitter events within a preset time threshold into a single click), missing field completion (using forward padding or default value strategies), and data format standardization; on this basis, perform time standardization processing, converting the original timestamps into a unified time base (such as millisecond-level Unix time or relative time axis), and normalizing or scaling the click intervals to eliminate device and sampling differences; finally, perform stable sorting of all click events according to the standardized timestamps to generate a strictly monotonically increasing continuous click event sequence. , This represents the total length of the click event sequence, used for subsequent timing modeling and anomaly detection.

[0018] S2. Based on the click event sequence, perform spatial normalization encoding, time interval embedding, and contextual semantic representation on each click event to generate a click behavior sequence. And the click behavior sequence The high-order feature representation of the click behavior is extracted from the input Transformer encoder. In this embodiment, a click behavior sequence is generated and input into the Transformer encoder to extract high-order feature representations of the click behavior, including the following steps: S2.1 Based on the click event sequence, each event is decomposed into fields, and spatial features are extracted separately. Time characteristics and contextual semantic features This forms a multimodal input subspace. Specifically, this refers to click event sequences that have been sorted by time. For each moment of the event To perform field-level parsing and standardization, the original click coordinates are first read from the event. And in combination with the device screen resolution ( Indicates the width of the screen. The spatial features are obtained by normalizing and mapping the height of the screen. It can also optionally perform boundary clipping and scale alignment to eliminate differences between different devices; secondly, it calculates the time interval between adjacent events based on the timestamp sequence. Furthermore, time characteristics are formed by scaling through logarithmic compression or piecewise linear functions. This enhances the ability to represent changes at different time scales; then, discrete semantic fields such as the current application identifier, page structure path, and control attributes are extracted from the interface context information, and generated into contextual semantic features through index encoding or lightweight semantic mapping functions. Finally, the aforementioned spatial, temporal, and semantic features are organized in a unified manner to construct a multimodal input subspace representation. This provides structured input for subsequent embedding encoding and temporal modeling; S2.2, Based on spatial features A two-dimensional spatial discrete partitioning function is constructed to map continuous coordinates to a discrete grid, and a learnable embedding matrix is ​​used. Perform a lookup table mapping to obtain the spatial embedding vector. Specifically, based on the normalized spatial characteristics... ( (This represents the standardized position of the click event in the screen coordinate system. The screen space is a two-dimensional continuous coordinate plane, and it is divided into horizontal and vertical directions according to a preset granularity.) and A two-dimensional spatial discrete grid system is constructed by performing equidistant discrete partitioning. Within this grid system, a spatial discrete partitioning function is used (the input variable is the normalized spatial characteristics, and the output variable is the discrete grid index). The continuous coordinates are quantized and mapped using a one-dimensional mapping identifier (or its one-dimensional mapping identifier), mapping each click position to a unique grid cell. This is achieved by determining the grid interval based on the normalized ratio of the horizontal and vertical coordinates in their respective directions, thus obtaining the corresponding two-dimensional grid index. Subsequently, for unified representation, the two-dimensional grid index is further mapped to a one-dimensional discrete identifier, giving each spatial grid a unique number, thus forming a discrete spatial index space. After discretization, a learnable spatial embedding matrix is ​​constructed. This matrix uses all grid indices as row indices and the embedding dimension as column structure, with each grid index corresponding to a trainable vector representation in the matrix. Finally, by performing a lookup operation on the discrete spatial index, the corresponding row vector is directly extracted from the embedding matrix as the spatial embedding representation of the click position, thereby realizing the complete transformation process from continuous spatial coordinates to discrete grid mapping, and then to vectorized semantic representation. S2.3, Targeting Time Characteristics Encoding is performed using a nonlinear mapping function (such as MLP) to generate a temporal embedding vector. Specifically, regarding time characteristics First, the original time interval is calculated based on the timestamps of adjacent click events. The system then undergoes numerical stability processing, including truncating outliers and scaling (e.g., min-max) to eliminate the influence of long-tailed distributions. Subsequently, the processed scalar time interval is used as input features to construct a multilayer perceptron (MLP) nonlinear mapping function. The mapping function consists of an input layer, several hidden layers, and a nonlinear activation function (such as ReLU or GELU). It projects the low-dimensional scalar of the time interval into a high-dimensional space through layer-by-layer linear and nonlinear transformations (first transforming the time interval scalar...). The input vector is obtained by performing logarithmic transformation or normalization. ( (For the real number field), used as the network input layer; subsequently, a system is constructed from... A multi-layer nonlinear mapping structure consisting of layers, wherein the first layer... A layer is defined as a composite function of a linear transformation and a nonlinear activation, i.e. ,in , For the first Layer weight matrix, For bias terms, The activation function is a non-linear function (such as ReLU); by stacking layers, the time interval is gradually mapped from a one-dimensional scalar space to a high-dimensional latent space representation; in the output of the last layer, a linear projection matrix is ​​used. Map hidden representations to a preset embedding dimension (After passing through) Hidden representations are obtained after layer nonlinear mapping. ,in, For the hidden layer dimension, a linear projection matrix is ​​defined. ), to obtain the final temporal embedding vector Specifically, the temporal features are first mapped to a high-dimensional latent space through a linear transformation, then enhanced with nonlinear activation, and optionally layer normalization is introduced to stabilize the distribution, ultimately outputting a fixed-dimensional temporal embedding vector. This enables a nonlinear semantic representation of the click time interval from a scalar to a vector space. S2.4, Contextual semantic features Input a semantic encoding function (such as a lightweight encoding network) to generate semantic embedding vectors. Specifically, the semantic encoding function is a lightweight context encoding network, whose overall structure consists of an input layer, an embedding layer, a feature fusion layer, and an output layer. First, the input layer receives the interface context information. This information consists of a set of structured fields, including discretized application identifiers, page hierarchy paths, and control types or IDs. In the embedding layer, learnable embedding tables are built for each discrete semantic field, mapping each type of contextual attribute to a corresponding low-dimensional vector representation, such as application ID embedding, page path embedding, and control semantic embedding. An initial semantic vector set is formed by concatenation or weighted summation. In the feature fusion layer, the concatenated semantic vectors are input into a lightweight neural network for nonlinear modeling. This network consists of 1-2 fully connected layers or lightweight Transformer encoding blocks, and is stabilized using the ReLU function and optional LayerNorm to model interactions and contextual associations between different semantic dimensions. Finally, in the output layer, the fused high-dimensional semantic representation is projected onto a preset dimension through linear mapping. Generate the final context semantic embedding vector It is used to achieve a unified and integrated representation with spatial and temporal features; S2.5 Embedding the space into a vector Temporal embedding vector Semantic embedding vectors The data is then stitched together to generate a unified click behavior vector. ( For bias terms, It is a learnable weight matrix (fusion matrix) used to linearly map the concatenated vector to a preset embedding dimension, and is used to represent the multimodal integrated information of a single click; S2.6, Based on a unified click behavior vector Introducing positional encoding to generate enhanced behavior vectors Specifically: index the time steps. Mapping to position encoding function (Input is the time step index) The output is the feature dimension. The aligned position vectors are constructed using sine and cosine functions, which are derived from the sine and cosine functions in even and odd dimensions, respectively. and The location encoding, constructed using sine and cosine function embedding, is used to characterize the temporal dependencies of the click sequence. The sine and cosine forms can be represented as combinations of periodic functions of different frequencies to enhance the model's ability to express long- and short-term dependencies. Subsequently, based on a unified click behavior vector... Dimensions Generate a position information vector of the same dimension. This ensures the additivity of the two in the feature space; based on this, the position encoding vector and the unified behavior vector are fused element-wise, i.e., the following steps are performed. This allows absolute position information to be injected into the original multimodal behavior representation; S2.7, Based on Enhanced Behavior Vectors Form an enhanced click behavior sequence Click behavior sequence The input is a Transformer encoder, which generates a high-order representation sequence through a multi-head self-attention mechanism. The Transformer encoder consists of an input layer, a stacked encoder layer, and an output layer. The input layer first receives the serialized click behavior vector and then overlays positional encoding before entering the encoder structure to inject sequence positional information, thus forming an initial representation with temporal semantics. The intermediate encoder layer consists of several stacked encoder layers with the same structure. Each layer mainly contains a multi-head self-attention sub-layer and a feedforward neural network sub-layer. The multi-head self-attention mechanism achieves global dependency modeling by weighting the correlation between time steps in the input sequence, while the feedforward neural network performs nonlinear transformations on the representation at each position to enhance expressive power. Residual connections and layer normalization are introduced between sub-layers to stabilize training and accelerate convergence. After multi-layer encoding, a high-order contextual feature representation sequence is obtained. Finally, the output layer performs sequence-level aggregation processing on the encoding result, such as CLS token extraction, average pooling, or attention pooling, to compress the entire sequence into a global behavior representation vector for subsequent anomaly scoring or classification tasks, thereby achieving global modeling and contextual semantic fusion of the click behavior sequence.

[0019] S3. Based on high-order feature representation, an autoregressive time series prediction model is used to generate anomaly scores to quantify the degree to which the current behavior deviates from the normal pattern. In this embodiment, anomaly scores are generated using an autoregressive time-series prediction model based on higher-order feature representation, including the following steps: S3.1. Collect confirmed normal user click samples from historical data (continuously record user click behavior log data on the cloud phone or mobile terminal side, including original interaction information such as click coordinates, timestamps, click intervals, and interface context, and store all historical click sessions in time series format; then, based on the normal user behavior data sources marked on the business side (such as manually reviewed records, whitelisted user behavior, historical sessions without abnormal alarms, or low-risk scoring samples), perform preliminary screening on historical click sessions, and remove samples marked as abnormal, suspected automated scripts, or with risk control alarms, i.e., confirmed normal user click samples), extract the corresponding high-order feature representation sequence according to the same process as steps S1 and S2 (standardize the high-order feature representation sequence (such as Z-score)), and construct a normal behavior feature set. Train an autoregressive time series prediction model based on the Transformer encoder based on the normal behavior feature set. The autoregressive temporal prediction model based on the Transformer encoder consists of an input layer, a temporal modeling layer, and an output prediction layer. The input layer receives a sequence of historical high-order feature representations. The model employs a sequence representation sequence by overlaying positional encodings at each time step to preserve sequence order information. The intermediate temporal modeling layer consists of multiple stacked Transformer encoder units, each including a multi-head self-attention sublayer and a feedforward neural network sublayer. Through self-attention, it globally models the dependencies between historical time steps and combines residual connections and layer normalization to improve training stability and expressive power, enabling the current time-instance representation to incorporate information from the entire historical context. Under autoregressive constraints, the model only uses information from the current and previous time steps for representation updates, avoiding future information leakage. Finally, the output layer encodes the current time-instance hidden state. Input a prediction head (such as a linear mapping layer or a multilayer perceptron), perform feature regression to obtain the predicted representation for the next time step. This enables autoregressive prediction of future behavioral characteristics based on historical sequences; S3.2 Input the high-order feature representation sequence of the current user into the trained autoregressive time series prediction model to predict the behavior at the next time step, and obtain the predicted feature representation. ; S3.3. Obtain the higher-order feature representation of the next time step based on the actual observations from step S2. (After obtaining the actual click event at the next moment, the corresponding high-order feature representation is generated through the same feature extraction process as in step S2, which is used as the actual observed feature and compared with the predicted feature), and the deviation between the actual observed feature representation and the predicted feature representation is calculated. This error reflects the degree of abnormality in the temporal evolution of the current click behavior. The larger the error, the more the behavior deviates from the normal user pattern, and the greater the deviation. Standardize the process (using the Z-score standardization method). S3.4. Construct a difference sequence based on the click event time interval sequence to characterize the rhythm change trend. Generate a discrete rhythm state sequence based on the difference sequence, and use sliding window embedding to extract time pattern subsequences and construct a pattern probability distribution. Generate a click rhythm stability index based on the pattern probability distribution. ; In this embodiment, step S3.4 primarily addresses the highly regular and mechanical nature of abnormal behaviors such as automated scripts and robot clicks in the cloud phone environment, particularly in terms of temporal rhythm. Specifically, human users' click intervals exhibit natural fluctuations and uncertainties (such as thinking time and reaction delays), while automated scripts often display precise, periodic rhythmic patterns. This invention extracts "rhythm acceleration" features by constructing a differential sequence of time intervals, discretizing it into three states: accelerated, stable, and decelerated. Then, it utilizes sliding window embedding to extract local pattern subsequences and constructs a probability distribution. Finally, it generates a rhythm stability index based on pattern complexity and information entropy. This index effectively captures the structured evolutionary characteristics of rhythm changes, exhibits high sensitivity to periodically repetitive and strictly uniform script rhythms, and tolerates natural fluctuations in human operation, thereby significantly improving the accuracy and robustness of anomaly detection. Specifically, a difference sequence is constructed based on the click event time interval sequence, a discrete rhythm state sequence is generated based on the difference sequence, and a sliding window embedding is used to extract time pattern subsequences and construct a pattern probability distribution. A click rhythm stability index is generated based on the pattern probability distribution. This includes the following steps: S3.41 Constructing a time interval sequence based on the timestamp of the click event And construct a difference sequence based on the time interval sequence. ( (For time series indexing), used to characterize the acceleration features of click rhythm (i.e., the trend of rhythm change); S3.42, Based on difference sequences Encode into symbol sequences using discrete symbol mapping functions +1: Faster pace, 0: Stable pace, -1: Slower pace; Step S3.42 sets three types of judgment thresholds based on the numerical distribution characteristics of the difference values, including the positive threshold. (Adaptive or preset based on data distribution. For example, take...) (0.5 times the standard deviation of the sequence) and the negative threshold (for (0.3 to 0.5 times) are used to distinguish between significant acceleration and deceleration states, and the stability threshold range is determined by... definition( To accommodate minute fluctuations and measurement noise, a discrete symbol mapping function is constructed to perform interval determination for each difference value: when Time mapping is This indicates a significantly faster click pace; when Time mapping is This indicates that the rhythm is stable; when Time mapping is This indicates a significant slowdown in pace; for those in the transitional zone (such as...) or For samples, neighborhood smoothing or nearest-neighbor classification strategies are used for supplementary judgment to avoid frequent state jitter. (For difference samples in the transition interval, a local time neighborhood of a certain length is first selected with the current time point as the center, and the symbol states that have been preliminarily determined at several times before and after this point are obtained as reference context; then, the state distribution in this neighborhood is statistically analyzed to determine which state dominates in the local window. If the occurrence ratio of a certain state is significantly higher than that of other states, the current transition sample is directly classified into the dominant state, thereby achieving smooth correction using local consistency; if the distribution of each state in the neighborhood is relatively balanced and there is no obvious dominant trend, it is further classified into the closest state category based on the distance relationship between the current difference value and the threshold interval corresponding to each state, achieving classification based on the principle of minimum distance; through the above correction method based on the combination of local statistical consistency and distance constraints, the original discrete symbols are smoothed, thereby suppressing the phenomenon of frequent state switching caused by local fluctuations or noise); finally, a symbol sequence is obtained. This sequence depicts the dynamic trend of click rhythm in a discrete manner, providing a basis for subsequent pattern statistics and complexity calculation; S3.43, Set the length of the sliding window For symbol sequences Perform sliding window embedding to construct a set of time pattern subsequences. ( (length of the symbol sequence), used to characterize the local dynamic pattern structure of the click rhythm; specifically: setting the length of the sliding window. Then, first in the symbol sequence The slide continues with a step size of 1, and starting from the first position, it successively intercepts segments of length . The local subsequence, i.e., at each time index Extracting from the current symbol and its subsequent symbols A sequence segment consisting of consecutive symbols This truncation process is repeated continuously as the window slides backward until the end of the sequence can no longer form a complete length. This process continues until the first subsequence is found. Based on this, all satisfying local subsequences are organized into a set according to their starting time position, forming a time pattern subsequence set. Each element in this set corresponds to the dynamic change pattern of the original click rhythm symbol sequence within a local time range, which is used to characterize the structured evolution characteristics of click behavior on a short time scale. S3.44, Set of Subsequences of Time Pattern Perform statistical counting to construct the pattern probability distribution. , Specifically, this refers to the set of time pattern subsequences. When performing statistical counting, first count all items in the set with length of... Subsequences are treated as observable temporal pattern samples and subjected to deduplication and pattern encoding, that is, subsequences with the same structure are grouped into the same pattern category. This forms a pattern set. ; and then for each unique pattern The frequency of occurrence is obtained by counting the number of times it appears in all sliding windows. and the total number of all subsequences After normalization, the probability distribution of this time pattern is obtained. ; S3.45, Based on pattern probability distribution By introducing distributed weighting, an enhanced complexity index is generated. ( These are weighting coefficients used to balance the contributions of the pattern diversity term and the information entropy term to the overall complexity; the distribution weighting is mainly reflected in the entropy term. probability weights in The nonlinear modulation effect on the complexity contribution means that the influence of each time pattern is not equally weighted, but rather determined by its probability of occurrence within the sliding window. The adaptive mechanism determines the magnitude of the contribution: the impact of high-frequency patterns on overall complexity is amplified, while the impact of low-frequency patterns is suppressed, thus forming a weighted mechanism based on probability distribution; simultaneously, this weighted distribution is combined with the structural diversity term. Through weighting coefficients Outer layer fusion is performed to achieve dual modeling of uniform weighting at the structural level and probability weighting at the distribution level. This allows the complexity index to not only reflect the number of pattern types but also characterize the unevenness of pattern occurrence probabilities and information uncertainty. The enhanced complexity index is then further refined. Normalization was performed (obtained through Min-Max normalization). Generate click rhythm stability index ; S3.5 Calculate displacement features based on click coordinates and determine repeated click states. Combine directional discretization to construct a state sequence and its transition probability matrix. Generate a spatial repetition rate index based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. And the spatial repetition rate index Perform normalization (using the Min-Max normalization method); In this embodiment, step S3.5 mainly addresses the problem of high repetition and low randomness in the spatial trajectory of abnormal behaviors such as automated scripts and robot clicks in the cloud phone environment. Specifically, the click positions of human users are naturally dispersed, and the movement directions are random and varied, resulting in high uncertainty in the displacement trajectory. Automated scripts, on the other hand, often exhibit repeated clicks on the same or a limited number of positions, fixed movement direction patterns, and simple state transition rules. This invention determines the repeated click state by displacement modulus, discretizes and integrates repeated behaviors and directions into a unified state sequence, and constructs a transition probability matrix to calculate the trajectory generation entropy, thereby quantifying the uncertainty and predictability of the spatial pattern. Furthermore, it extracts the local repetition rate dynamic time series through a sliding window and introduces the repetition rate variation coefficient (characterizing long-term stability) and the mean absolute value of the first-order difference (characterizing the change amplitude) to adaptively correct the global spatial repetition rate index. This allows the corrected index to effectively suppress occasional jitter interference while amplifying continuous and highly consistent mechanical behavior signals, significantly improving the recognition accuracy and robustness of automated click behavior. Furthermore, a spatial repetition rate index is generated based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. This includes the following steps: S3.51, Based on click coordinates Construct a sequence of displacement vectors for adjacent click events ( (total length of the click event sequence), and based on the displacement vector sequence Calculate displacement modulus ; S3.52, Based on displacement modulus By a preset space threshold Determine if it is a non-repeated click (if) (Click repeatedly) ,like (Non-repeated clicks) , To represent based on displacement modulus and spatial threshold The resulting binary duplicate click determination variable is used to characterize whether the current click involves spatial repetition. Based on the determination result (for non-repetitive clicks...),... )) Calculate the displacement direction angle And use the discrete mapping function to determine the displacement direction angle Mapping to discrete labels Meanwhile, for repeated clicks ( Define your own status label Generate a unified state sequence Specifically: First, under the condition of non-repeated clicks ( ), calculate the direction angle based on the adjacent click displacement vectors The continuous angular space is divided into [various types] according to a preset angular division rule. For each discrete interval (e.g., divided by equal angles or sectors), a discrete mapping function is constructed. The architecture of this discrete mapping function is a deterministic mapping rule from a continuous angular space to a finite set of discrete tags. Its independent variable is the displacement direction angle between two adjacent clicks. The dependent variable is a discretized directional category label. The function first divides the entire circumference according to a preset granularity (such as equal angular intervals). (or unequal-spaced sector division) divided into There are three non-overlapping angle intervals, each interval corresponding to a unique integer label; then, based on the input angle... The interval to which it belongs, search by interval (e.g., to determine) (The function outputs the corresponding label value based on which sector boundary the click falls within). Essentially, this is a piecewise constant function that quantizes continuous angles into discrete symbols, thus transforming the click motion direction pattern into a statistically significant state sequence, making each angle interval correspond to a unique direction category number; subsequently... Input the discrete mapping function to perform interval determination and obtain the corresponding directional discrete labels. This is used to characterize the motion direction category for non-repeated clicks; for repeated clicks ( Since its displacement magnitude is within the threshold and its directional information does not have stable geometric meaning, it is directly defined as a dedicated state label. Finally, the repeated click states and directional discrete labels are uniformly encoded to form a unified state sequence. This enables a joint discretization representation of "spatial repetitive behavior" and "directional motion behavior"; S3.53, Based on a unified state sequence Statistical state transition frequency ( , (as a state index), and based on the frequency of state transitions. Construct the transition probability matrix Based on state transition frequency Construct the transition probability matrix The core function is to transform discrete state transition counts into standardized probabilistic expressions, thereby eliminating the scale effect caused by differences in sequence length or number of clicks, making the behavioral patterns of different users or different time windows comparable; at the same time, the probability matrix can fully characterize the transition rules and dependency structure between states, upgrading the original "count statistics" to "transition distribution modeling", thus more accurately reflecting the dynamic evolution characteristics of click behavior in spatial state sequences, and providing a probabilistically meaningful basic input for subsequent trajectory entropy calculation, complexity assessment and anomaly detection; S3.54, Based on the transition probability matrix Construct a space generation complexity function and calculate the trajectory generation entropy. Based on the transition probability matrix Construct a space generation complexity function and calculate the trajectory generation entropy. The purpose of this method is to elevate the state transition structure of click behavior from a "local frequency relationship" to a "global uncertainty measure." By modeling the information entropy of all state transition probability distributions, it quantifies the randomness and predictability of user click trajectories in the spatial state space. The higher the entropy value, the more uniform the state transition, the more unpredictable the trajectory path, and the higher the behavioral complexity. Conversely, a lower entropy value indicates that the click path exhibits strong regularity or repetition. This can be used to characterize the essential differences between normal human operations and automated script behaviors in spatial dynamic evolution, providing a global structural basis for subsequent anomaly detection and repetitive behavior identification. S3.55, Generate entropy for the trajectory Normalization is performed, and a spatial repetition rate index is generated. ( To generate entropy for the normalized trajectory, ) represents the maximum entropy value; S3.56, Set a fixed-length window (For example (Number of clicks), slide step size For each window ( ), independently execute steps S3.53 to S3.55 to obtain the local spatial repetition rate of the window. And generate local repetition rate time series. Specifically: Set a fixed-length window. and sliding step size Then, first in the unified state sequence The slide segmentation is performed in chronological order, moving backward each time from the starting position. Each time step, the truncation length is... A continuous subsequence as a local window ,in, For the first The starting index of a fixed-length window; then for each window... Independently execute state transition statistics (S3.53) to construct a local transition probability matrix, and calculate the trajectory generation entropy based on this matrix (S3.54–S3.55), thereby obtaining the space complexity or repetition rate index corresponding to this window. Finally, all windows are arranged in chronological order to form a time series sequence of local spatial repetition rates. ( (Number of windows), used to depict the dynamic change trend of spatial repetitive behavior in the time dimension; S3.57 Calculate the coefficient of variation of repetition rate based on the time series of local repetition rates (in, for The mean, for (Standard deviation) and mean of the absolute values ​​of the first differences of the repetition rate ; S3.58, Based on the coefficient of variation of repetition rate Mean of the absolute value of the first difference of the repetition rate Spatial repetition rate index Make corrections to generate the final corrected spatial repetition rate index. ( This is an adjustment coefficient used to adjust the contribution ratio of global statistical features and local dynamic correction features to the final spatial repetition rate. (To adjust the weight of the contribution of the MD term); in the original spatial repetition index Building upon this foundation, a joint characterization of temporal stability and dynamic fluctuation is introduced to improve the accuracy and robustness of identifying repeated click behavior: whereby the coefficient of variation of the repetition rate... Used to measure the dispersion of repetition rate within each time window, reflecting the consistency of repetitive behavior across different time segments; mean of the absolute value of the first difference of repetition rate. Used to characterize the magnitude of change in repetition rate over time, reflecting the dynamic fluctuation characteristics of repetitive behavior; by combining the two for analysis... The correction effectively suppresses misjudgments caused by occasional repetitions or localized jitter, while enhancing the responsiveness to continuous, highly consistent automated click behavior, resulting in a better spatial repetition rate metric. It has stronger stability and discriminative power in distinguishing between real user actions and script behavior; S3.6, Based on standardized deviation Rhythm stability index Based on the normalized spatial repetition rate index, a comprehensive anomaly scoring function is constructed to generate anomaly scores. ( This is the normalized spatial repetition rate index. The weights of the deviation terms control the contribution of prediction deviation to abnormal scores. The weighting of the rhythm stability index controls the impact of click rhythm stability on abnormal scores. The weight of the spatial repetition rate indicator controls the contribution of spatial repetition behavior to the anomaly score.

[0020] S4. Based on the abnormal score, extract the local abnormal density change features, identify the boundary adsorption point set of abnormal behavior segments, use the boundary adsorption point set as the starting anchor point of the sliding window, perform statistical analysis on the abnormal score within the sliding window, and generate stable abnormal indicators for classifying click behavior. In this embodiment, the set of boundary adsorption points is used as the starting anchor point of the sliding window. Statistical analysis of anomaly scores is performed within the sliding window to generate stable anomaly indicators, including the following steps: S4.1 Organize the anomaly scores into an anomaly score sequence according to time order. ( (Number of abnormal scores), calculate the local abnormal density change characteristics based on the abnormal score sequence, and identify the turning points from low to high abnormal density as the set of boundary adsorption points of abnormal behavior segments; In this embodiment, step S4.1 primarily addresses the issue that abnormal behaviors (such as automated scripts and robot operations) in cloud phone environments typically manifest as continuous, fragmented bursts rather than isolated points, but existing methods struggle to accurately pinpoint the start and end boundaries of these abnormal behavior fragments. Specifically, abnormal scoring sequences often exhibit noise fluctuations, with individual high scores caused by random errors, while genuine abnormal behaviors result in a cumulative increase in local density. This invention calculates local abnormal density using sliding statistical neighborhoods, effectively suppressing interference from isolated noise points on boundary determination; and introduces a density transition detection mechanism to identify unidirectional inflection points where local abnormal density transitions from a low-density background state to a high-density cluster state, thereby accurately locating the initial boundary adsorption point of the abnormal behavior fragment. This method not only adaptively fits the true boundary of the abnormal fragment, avoiding truncation bias caused by fixed-length windows, but also provides a highly reliable starting position for subsequent sliding window statistics based on boundary anchor points, significantly improving the boundary accuracy and noise resistance of abnormal fragment detection. The process of calculating local anomaly density change characteristics based on anomaly scoring sequences and identifying transition points from low to high anomaly density as the set of boundary adsorption points for anomalous behavior segments includes the following steps: S4.11, Based on anomaly scoring sequences In the time scale window Built-in sliding statistical neighborhood ( (representing the time index in the abnormal scoring sequence), for the sliding statistical neighborhood. Binarization mapping of internal anomaly scores: To characterize the spatial clustering of local anomalous activation states and calculate local anomalous density. ( The activation threshold for anomaly scoring is used to characterize the time frame, and the proportion of anomaly activations within the sliding statistical neighborhood reflects the time frame. (Local anomalous aggregation intensity); S4.12, Based on local anomaly density A temporally continuous difference constraint relationship is constructed, and a density transition detection mechanism is introduced (the density transition detection mechanism refers to a method that, based on the temporal continuity characteristics of local abnormal density sequences, performs differential or comparative analysis on the density states at adjacent time points to identify the process of abnormal density abruptly changing from a low-level state to a high-level state or crossing a threshold. Its core lies in characterizing the "state switching behavior" of the density curve, that is, not only focusing on whether the density value at a certain time exceeds the threshold, but also emphasizing the upward trend and transition starting point of density in the time dimension. By constraining the condition of "not reaching the threshold at the previous time point, exceeding the threshold at the current time point," the key turning point of the transformation of the abnormality from a dispersed background state to an aggregated activated state is detected, which is used to locate the boundary position of the abnormal behavior segment). The density states at adjacent time points are compared and analyzed to characterize the transition process of the abnormality from a low-density background state to a high-density aggregated state, and a boundary adsorption judgment function is constructed. when and hour, ,otherwise, ; This is the abnormal density trigger threshold, used to constrain the transition judgment condition when abnormal density enters the continuously active region from the inactive region; where, This indicates that the current time has entered a high-density anomalous state, meaning that the anomalous activation threshold has been exceeded. This indicates that the previous time step was still in a low-density background state; the density transition detection mechanism constrains the state relationship of local anomalous densities in adjacent time steps, i.e. and This enables the detection of unidirectional transition events from low-density to high-density regions in terms of abnormal density. S4.13. Based on the boundary adsorption decision function, the discrete trigger points in the entire time series are extracted in a structured manner and represented in a set to form a boundary adsorption point set. Specifically: based on the boundary adsorption determination function Discrete-time indexes over the full time series To perform point-by-point scanning and state determination, the local anomaly density sequence is first input sequentially in chronological order. and its adjacent forward states And based on the judgment conditions and Binarize and label each time step to obtain the corresponding trigger indication sequence. ; then for all satisfied The time points are indexed and extracted while maintaining their original time order. Deduplication and continuity constraint processing are performed (only the starting point of a single transition is retained). Finally, the set of all discrete time points that satisfy the transition conditions is represented as a set of boundary adsorption points. It is used to characterize the structural boundary position during the transition of anomalous density from low to high; S4.2 Construct a fixed-length sliding window using the boundary adsorption point as the starting anchor point of the sliding window. ; If the tail of the window is still in an abnormally dense area, ,otherwise, ; Specifically, this refers to the set of boundary adsorption points. The time points in the data are sorted chronologically and then renumbered to represent an ordered sequence of boundary points. ,in, Indicates the first A boundary adsorption point, This represents the total number of boundary points; this ordered sequence of boundary points serves as the time anchor input for subsequent sliding window construction, realizing the transformation from "event set representation" to "time series structure representation"; using the boundary snapping points as the starting anchor points for window construction, each boundary snapping point is first selected sequentially according to time order. As the starting point of the window, and with a fixed length Extracting the abnormal scoring sequence from the beginning to form a basic window. Subsequently, an adaptive tail expansion mechanism was introduced to extend the window tail. Subsequent local anomaly density detection is performed; if the anomaly density in the terminal neighborhood still exceeds the threshold, then... If the abnormal behavior is within a dense and persistent interval, it is determined that the current abnormal behavior has not completely ended, and the extension length flag is set to... And extend the window backward by one or more time steps to obtain an enhanced window. Conversely, if the abnormal density in the terminal neighborhood has fallen back to the threshold... The following is assumed The window maintains a fixed length; at the same time, a state indicator variable for the window's tail is defined. When the end of the window is still in an abnormally dense area, take Otherwise take It is used to characterize whether abnormal segments are completely covered, thereby ensuring that the sliding window can adaptively fit the real boundary structure of abnormal behavior and avoid the loss of abnormal information caused by fixed-length truncation. S4.3, For each sliding window Extract the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion; specifically: extract the anomaly score sequence within the window. As input, statistical analysis is performed to extract three types of features: the mean anomaly intensity is obtained by taking the arithmetic mean of all anomaly scores within the window, and is used to characterize the overall anomaly level of that time segment; the anomaly fluctuation intensity is obtained by calculating the variance or standard deviation of the anomaly scores within the window, and is used to characterize the dispersion and fluctuation amplitude of the anomaly degree within a local time range; the high anomaly proportion is determined by setting an anomaly intensity threshold. Within the statistics window, the following conditions are met. The sample size is calculated and normalized by the ratio to the window length, which is used to measure the concentration of high-intensity anomalous behavior within the window. Finally, the above three types of statistics together constitute the window-level anomalous feature vector, providing the basic input for subsequent calculation of stable anomaly indicators. S4.4. Based on the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion, a boundary integrity coefficient is introduced. Generate window-level stable anomaly indicators (In the formula, For the first The mean anomaly intensity within each window is used to characterize the overall anomaly level of the window. For the first The high anomaly percentage index within a window is used to characterize the concentration of high-intensity anomalies within that window. For the first The intensity of abnormal fluctuations (such as standard deviation or variance) within a window is used to reflect the dispersion and instability of abnormal scores. The weight of the mean anomaly intensity, The weight of indicators with a high proportion of anomalies, The weighting of the intensity of abnormal fluctuations. Weights for boundary integrity Indicates if time Local anomaly density exceeds threshold If the value is positive, it is recorded as 1 (indicating that the region is in a high-density anomaly zone at that moment); otherwise, it is recorded as 0. A boundary integrity coefficient is introduced. The purpose is to further characterize the "completeness of coverage" and "continuity of clustering" of abnormal behavior within the time window. Specifically, by statistically analyzing the proportion of time points exceeding the abnormal density threshold within the window, it measures whether the current sliding window completely covers a continuous abnormal segment. A higher value indicates that the window is in a high-density anomaly state most of the time, and the window boundary is highly aligned with the actual anomaly boundary, thus improving the reliability of window-level anomaly detection; conversely, a lower value indicates that the window only captures the edge or transition area of ​​the anomaly, thus reducing the credibility of the anomaly score for that window. Therefore, Introduction In addition to statistical intensity (mean, fluctuation, high proportion), the constraints on the integrity of the abnormal structure can be further enhanced, so that the window-level stable anomaly index not only reflects the "abnormal intensity" but also reflects "whether the abnormal segment is complete and formed", thereby improving the stability and robustness of subsequent classification and judgment. S4.5, Based on window-level stable anomaly indicators Constructing window exception sequences And construct a continuous anomaly window count. Specifically, based on window-level stable anomaly indicators. First, all sliding windows are sorted in chronological order, and then the abnormal indicator values ​​corresponding to each window are extracted in turn to construct a window anomaly sequence. ,in, This represents the total number of sliding windows; subsequently, an anomaly detection threshold is introduced. For each window Make judgments one by one, when At this point, the window is considered to be in an abnormally active state. Under the constraint of time continuity, the current window count is updated to the previous window count plus one. Used to accumulate the length of consecutive exception windows; when If an abnormal state is considered interrupted, the continuous count is reset to 0. This results in a continuously changing sequence of abnormal window counts over time. It is used to characterize the persistence and continuous aggregation intensity of abnormal behavior, providing a basis for temporal consistency in subsequent behavior classification; S4.6, Based on window-level stable anomaly indicators Click behavior is categorized (for denoising and stabilizing click behavior over time, thereby transforming transient abnormal fluctuations into persistent and structured abnormal patterns, enabling reliable differentiation between normal and automated abnormal behavior): If and This is considered a normal click. and Then it is an automated script click behavior, if ( and )or( and If the condition is ), then it is considered a suspicious risk status; specifically: based on window-level stable anomaly indicators. and consecutive abnormal window count First, the click behavior corresponding to each sliding window is judged one by one, and the stable abnormal indicators of the current window are determined. Compared with the preset abnormal threshold Comparison, combined with consecutive abnormal window counts With persistence threshold Perform joint constraint judgment; when the conditions are met... and If the current window's abnormal strength or abnormal persistence is insufficient, it is judged as normal click behavior; if both conditions are met... and If the window not only exhibits significant abnormal intensity but also has a continuous cumulative characteristic, it is determined to be an automated script click behavior; if ( and )or( and If the value is 0, it is considered a suspicious risk status.

[0021] S5. Trigger corresponding control strategies based on the click behavior classification results; In this embodiment, triggering the corresponding control strategy based on the click behavior classification result includes the following steps: Based on the click behavior classification results, risk levels are mapped to the behavior states corresponding to each sliding window, thus constructing a discrete risk state set. , This indicates a normal click behavior. Indicates a suspicious risk status. This indicates the click behavior of an automated script; Based on window-level stable anomaly indicators and consecutive abnormal window count Constructing anomaly intensity modulation factor (In the formula, To address window-level stable anomaly indicators Normalized anomaly intensity This is the maximum continuous window length (used for normalization). To control the weight of the contribution of the normalized window-level stability anomaly index to the modulation factor, (To control the weight of the normalized value of the consecutive abnormal window count on the contribution of the modulation factor). Based on discrete risk state set and anomaly intensity modulation factor Generate the corresponding control strategy; specifically: first, predefine a set of control strategies. ,in, This indicates a no-intervention strategy, used to directly allow normal behavior to proceed; This indicates a light control strategy, used to perform low-impact interventions such as click limiting or behavior logging; This indicates a moderate control strategy, used to trigger interactive verification mechanisms such as slider verification and human-machine verification. This indicates a strong control policy, used to implement high-intensity restrictive measures such as forced blocking, session freezing, or account banning; based on this, targeting the... Each sliding window is based on its corresponding discrete risk state. and abnormal intensity modulation factor Achieving joint decision-making: when At that time, the no-intervention strategy was directly implemented. ;when At that time, based on the abnormal intensity modulation factor The range of values ​​is segmented and mapped, when... Implement a mild control strategy ,when Implement moderate control strategies ;when At that time, reinforcement mapping is performed based on the anomaly intensity. Implement moderate control strategies ,when Execute strong control strategy ;in, This serves as the dividing line between mild and moderate risk. This serves as the dividing threshold between moderate and high risk, and satisfies... This is used to implement tiered adjustment of the enforcement intensity of control strategies, thereby ensuring a normal user experience while progressively enhancing intervention in abnormal behaviors to achieve refined risk control. Based on the final set of control strategies, corresponding control actions are executed on the cloud phone instance or server, including at least adjusting the input response rate (frequency limiting); injecting verification mechanisms (CAPTCHA or two-factor authentication); blocking click event transmission; and marking session risks and reporting them to the risk control system.

[0022] Example 2: This example provides an AI-based cloud phone abnormal behavior detection system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the AI-based cloud phone abnormal behavior detection method described in Example 1 above.

[0023] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. An AI-based method for detecting abnormal behavior in cloud mobile phones, characterized in that, include: S1. Collect raw user click data on the cloud phone instance side, and organize the raw user click data in a structured manner according to the time sequence to construct a click event sequence; S2. Based on the click event sequence, each click event is spatially normalized, embedded with time intervals, and semantically represented in context to generate a click behavior sequence. The click behavior sequence is then input into the Transformer encoder to extract high-order feature representations of the click behavior. S3. Based on high-order feature representation, an autoregressive time series prediction model is used to generate anomaly scores to quantify the degree to which the current behavior deviates from the normal pattern. S4. Based on the abnormal score, extract the local abnormal density change features, identify the boundary adsorption point set of abnormal behavior segments, use the boundary adsorption point set as the starting anchor point of the sliding window, perform statistical analysis on the abnormal score within the sliding window, and generate stable abnormal indicators for classifying click behavior. S5. Trigger corresponding control strategies based on the click behavior classification results.

2. The AI-based cloud phone abnormal behavior detection method according to claim 1, characterized in that, In step S1, raw user click data is collected on the cloud phone instance side, and the raw user click data is structured and organized in chronological order to construct a click event sequence, including the following steps: S1.1 In the cloud phone instance, a click listening interface is registered through the system input subsystem to capture user touch operations in real time; when a touch press event is detected, the acquisition mechanism is triggered to obtain the raw touch event data stream, and touch events with click semantics are filtered from the raw touch event data stream as the user click raw data; S1.2 Extract key raw fields based on user click raw data, including at least click coordinates, timestamp, click interval and interface context information, to generate initial click events; preprocess the initial click events, and perform time standardization on the preprocessed initial click events; sort the time-standardized click events according to the timestamp to generate a continuous click event sequence.

3. The AI-based cloud phone abnormal behavior detection method according to claim 1, characterized in that, In step S2, a click behavior sequence is generated and input into the Transformer encoder to extract high-order feature representations of the click behavior, including the following steps: S2.1 Based on the click event sequence, each event is decomposed into fields, and spatial features are extracted separately. Time characteristics and contextual semantic features This forms a multimodal input subspace; S2.2, Based on spatial features A two-dimensional spatial discrete partitioning function is constructed to map continuous coordinates to a discrete grid, and a lookup table mapping is performed using a learnable embedding matrix to obtain the spatial embedding vector. ; S2.3, Targeting Time Characteristics Encoding is performed using a nonlinear mapping function to generate a time embedding vector. ; S2.4, Contextual semantic features Input semantic encoding function to generate semantic embedding vector ; S2.5 Embedding the space into a vector Temporal embedding vector Semantic embedding vectors The data is then stitched together to generate a unified click behavior vector. It is used to characterize the multimodal integrated information of a single click; S2.6, Based on a unified click behavior vector Introducing positional encoding to generate enhanced behavior vectors ; S2.7, Based on Enhanced Behavior Vectors Form an enhanced click behavior sequence Click behavior sequence The input is a Transformer encoder, which generates a high-order representation sequence through a multi-head self-attention mechanism.

4. The AI-based cloud phone abnormal behavior detection method according to claim 1, characterized in that, In step S3, an anomaly score is generated using an autoregressive time-series prediction model based on higher-order feature representation to quantify the degree to which the current behavior deviates from the normal pattern. This includes the following steps: S3.1 Collect confirmed normal user click samples from historical data, extract the corresponding high-order feature representation sequences, construct a normal behavior feature set, and train an autoregressive time series prediction model based on the Transformer encoder based on the normal behavior feature set. S3.2 Input the high-order feature representation sequence of the current user into the trained autoregressive time series prediction model to predict the behavior at the next time step and obtain the predicted feature representation; S3.

3. Based on step S2, obtain the high-order feature representation of the actual observation at the next time step, and calculate the deviation between it and the predicted feature representation. and the deviation Standardize; S3.

4. Construct a difference sequence based on the click event time interval sequence, generate a discrete rhythm state sequence based on the difference sequence, and use sliding window embedding to extract time pattern subsequences and construct a pattern probability distribution. Generate a click rhythm stability index based on the pattern probability distribution. ; S3.5 Calculate displacement features based on click coordinates and determine repeated click states. Combine directional discretization to construct a state sequence and its transition probability matrix. Generate a spatial repetition rate index based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. And the spatial repetition rate index Perform normalization; S3.6, Based on standardized deviation and rhythm stability index Based on the normalized spatial repetition rate index, a comprehensive anomaly scoring function is constructed to generate anomaly scores.

5. The AI-based cloud phone abnormal behavior detection method according to claim 4, characterized in that, In step S3.4, a difference sequence is constructed based on the click event time interval sequence, a discrete rhythm state sequence is generated based on the difference sequence, and a sliding window embedding is used to extract time pattern subsequences and construct a pattern probability distribution. A click rhythm stability index is generated based on the pattern probability distribution. This includes the following steps: S3.

41. Construct a time interval sequence based on the timestamps of click events, and then construct a difference sequence based on the time interval sequence. ; S3.42, Based on difference sequences Encode into symbol sequences using discrete symbol mapping functions ; S3.

43. Set the sliding window length for the symbol sequence. Perform sliding window embedding to construct a set of time pattern subsequences. ; S3.44, Set of Subsequences of Time Pattern Perform statistical counting to construct the pattern probability distribution. ; S3.45, Based on pattern probability distribution By introducing distributed weighting, an enhanced complexity index is generated. And the enhanced complexity index Normalization is performed to generate a click rhythm stability index.

6. The AI-based cloud phone abnormal behavior detection method according to claim 4, characterized in that, In step S3.5, a spatial repetition rate index is generated based on the transition probability matrix. The spatial repetition rate index was analyzed by comparing the coefficient of variation of the repetition rate with the mean absolute value of the first difference of the repetition rate. Dynamically adjust and generate the corrected spatial repetition rate index. This includes the following steps: S3.51 Constructing a displacement vector sequence based on click coordinates for adjacent click events And based on the displacement vector sequence Calculate displacement modulus ; S3.52, Based on displacement modulus The system determines whether a click is a non-repeating click based on a preset spatial threshold, and calculates the displacement direction angle based on the determination result. And use the discrete mapping function to determine the displacement direction angle Mapping to discrete labels generates a unified state sequence; S3.

53. Based on the unified state sequence, count the state transition frequency and construct a transition probability matrix based on the state transition frequency; S3.

54. Construct a spatial generation complexity function based on the transition probability matrix and calculate the trajectory generation entropy. ; S3.55, Generate entropy for the trajectory Normalization is performed, and a spatial repetition rate index is generated. ; S3.56, Set a fixed-length window Sliding step size For each window, steps S3.53 to S3.55 are executed independently to obtain the local spatial repetition rate of that window and generate a local repetition rate time series. S3.57 Calculate the coefficient of variation of repetition rate based on the time series of local repetition rates Mean of the absolute value of the first difference of the repetition rate ; S3.58, Based on the coefficient of variation of repetition rate Mean of the absolute value of the first difference of the repetition rate Spatial repetition rate index Make corrections to generate the final corrected spatial repetition rate index. .

7. The AI-based cloud phone abnormal behavior detection method according to claim 1, characterized in that, In step S4, the set of boundary adsorption points is used as the starting anchor point of the sliding window. Statistical analysis of the anomaly scores is performed within the sliding window to generate stable anomaly indicators, including the following steps: S4.1 Organize the anomaly scores into an anomaly score sequence according to time order. Based on the abnormal scoring sequence, the characteristics of local abnormal density changes are calculated to identify the set of boundary adsorption points of abnormal behavior segments; S4.2 Construct a fixed-length sliding window using the boundary adsorption point as the starting anchor point of the sliding window; S4.3 For each sliding window, extract the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion; S4.

4. Based on the mean anomaly intensity, anomaly fluctuation intensity, and high anomaly proportion, a window-level stable anomaly index is generated by introducing a boundary integrity coefficient. S4.5 Construct a window anomaly sequence based on window-level stable anomaly indicators, and construct a continuous anomaly window count; S4.6 Classify click behavior based on window-level stable anomaly indicators and consecutive abnormal window counts.

8. The AI-based cloud phone abnormal behavior detection method according to claim 7, characterized in that, In step S4.1, the calculation of local abnormal density change characteristics based on the abnormal scoring sequence and the identification of the boundary adsorption point set of abnormal behavior segments include the following steps: S4.11, Based on anomaly scoring sequences In the time scale window Built-in sliding statistical neighborhood For sliding statistical neighborhood The internal anomaly score is binarized and mapped, and the local anomaly density is calculated. ; S4.12, Based on local anomaly density A time-continuous difference constraint relationship is constructed, a density transition detection mechanism is introduced, the density state at adjacent time points is compared and analyzed, and a boundary adsorption judgment function is constructed. S4.

13. Based on the boundary adsorption decision function, the discrete trigger points in the entire time series are extracted in a structured manner and represented in a set to form a boundary adsorption point set. .

9. The AI-based cloud phone abnormal behavior detection method according to claim 1, characterized in that, In step S5, the corresponding control strategy is triggered based on the click behavior classification result, including the following steps: Based on the click behavior classification results, risk levels are mapped to the behavior states corresponding to each sliding window to construct a discrete risk state set. An anomaly intensity modulation factor is constructed based on window-level stable anomaly index and continuous anomaly window count. The corresponding control strategy is generated based on the discrete risk state set and the anomaly intensity modulation factor.

10. An AI-based cloud phone abnormal behavior detection system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes a computer program to implement the AI-based cloud phone abnormal behavior detection method as described in any one of claims 1-9.

Images