A user safety state evaluation method and system based on a digital activity index

Abstract

This invention discloses a user security status assessment method and system based on a digital activity index. The method involves a processor passively acquiring non-content-related metadata event streams generated during user device operation by listening to event broadcasts or state change callbacks generated by the operating system. A digital activity index is calculated based on event frequency, event interval, recent event time, and / or event type distribution. The current digital activity index is compared with an activity baseline model to detect continuous decay. When the digital activity index remains below a dynamic threshold for a preset duration, it is determined to be a state of digital activity exhaustion, generating a security warning response. Therefore, user security status assessment can be achieved with low power consumption and low privacy collection range without actively activating sensors to collect raw data or parsing content data.

Description

Technical Field

[0001] This invention relates to the fields of user security monitoring, terminal data processing, abnormal status identification, intelligent care, low-power event processing and risk warning, and in particular to a method and system for calculating a digital activity index based on non-content metadata event streams generated by the operating system, firmware or equivalent event management program on the user equipment side, and assessing the user security status based on the continuous decay of the digital activity index.

[0002] More specifically, the present invention relates to a technical solution that quantifies the level of user-device interaction activity through existing operational events of user equipment without parsing communication content, text content, image content, audio content, or application service content, and generates a machine-readable security warning response when the digital activity index is continuously lower than a dynamic threshold. Background Technology

[0003] In scenarios such as care for people living alone, safety monitoring of the elderly, confirmation of the status of family members, industrial duty, vehicle safety, monitoring of care recipients, and security of remote work, the system usually needs to determine whether the target user is out of contact, disabled, unresponsive, has not operated for an abnormally long period of time, or has other risk statuses that require external confirmation.

[0004] In the prior art, common solutions include monitoring solutions based on dedicated physical sensors, monitoring solutions based on active data collection from mobile terminals, anomaly identification solutions based on mobile phone behavior analysis, and digital health solutions based on usage time statistics.

[0005] Solutions based on dedicated physical sensors typically rely on devices such as door magnets, smart locks, infrared sensors, millimeter-wave radar, mattress sensors, cameras, wearable heart rate sensors, and fall detection sensors. While these solutions can acquire information about the physical activity of a target user, they usually require additional hardware deployment and present issues such as installation costs, maintenance costs, power supply, network connectivity, false alarms, and the expansion of privacy collection scope.

[0006] Solutions based on mobile terminal-based active data collection typically determine user status by actively reading location data, actively accessing accelerometers, actively collecting motion data, periodically uploading user status updates, or actively accessing other hardware sensors. Such solutions may introduce additional power consumption, permission dependencies, user perception issues, background operation limitations, and privacy compliance pressures.

[0007] Mobile behavior analytics solutions typically analyze behavioral patterns such as calls, text messages, app usage, social interactions, response speed, usage preferences, and operation sequences. These solutions focus on what users are doing and how they interact, potentially involving communication content, text content, image content, audio content, application business content, or behavioral semantic analysis. However, they are unsuitable for security monitoring scenarios that only require determining whether a user still possesses normal interactive capabilities and have high privacy collection requirements.

[0008] Schemes based on usage time statistics can collect data such as screen usage time, application usage time, and number of unlocks, but they are usually used for digital health, screen time management, or display of usage habits. They lack a closed-loop processing mechanism to convert non-content-related system events into user security status assessment results.

[0009] Therefore, how to quantify the level of user-device interaction activity with low power consumption and low privacy by utilizing event broadcasts, state change callbacks, system records, or state snapshots generated by the user device's operating system, firmware, or equivalent event management program, without adding dedicated hardware, actively activating sensors to collect raw data, or parsing user content data, and to identify the continuous decay of this level of interaction activity, has become an urgent technical problem to be solved.

[0010] Furthermore, related technical issues include: how to convert discrete system-level event types and event timestamps into a digital activity index that can be calculated by the processor; how to identify the continuous decay of the digital activity index based on an activity baseline model, rather than simply using a fixed threshold; how to adjust the credibility of the event stream when there are abnormal device event reporting, unavailable permissions, low-power system states, or network anomalies; how to distinguish between normal sleep, normal long-term inactivity, abnormal device states, and real security risks; and how to reduce the impact of pseudo-activity caused by automated scripts, smart agents, background tasks, or push wake-ups on security status assessment. Summary of the Invention

[0011] First, the technical problems to be solved The technical problem to be solved by the present invention is: in a user equipment or related computing device environment, how to calculate a digital activity index to quantify the level of user interaction activity based on the non-content metadata event stream generated by the operating system, firmware or equivalent event management program, and generate user security status assessment results and security warning responses according to the continuous decay state of the digital activity index relative to the activity baseline model.

[0012] Second, technical solutions To address the aforementioned technical problems, this invention provides a method for assessing user security status based on a digital activity index. For example... Figure 2 As shown, the method is applied to a user device containing a processor and includes the following steps.

[0013] Step S1: The processor passively acquires the non-content metadata event stream generated by the user equipment during operation by listening to the event broadcast or state change callback generated by the operating system. The non-content metadata event stream includes event type and event timestamp, but does not contain communication content, text content, image content, audio content or application service content.

[0014] Step S2: The processor calculates a digital activity index by multi-dimensional weighted fusion based on the event frequency, event interval, recent event time and / or event type distribution in the non-content metadata event stream; the digital activity index is used to quantify the level of user interaction activity with the user device within a preset time window.

[0015] Step S3: The processor compares the current digital activity index with a pre-built activity baseline model to detect the continuous decay of the digital activity index.

[0016] Step S4: When the digital activity index remains below the dynamic threshold for a preset duration, the processor determines that the digital activity is in a state of exhaustion and generates a safety warning response.

[0017] In some embodiments, step S2 further includes: evaluating the credibility of the non-content metadata event stream based on the event reporting continuity of the user equipment, the system low power consumption state, the permission availability state and / or the network connection state, and determining the credibility coefficient; and using the credibility coefficient as a weighting factor for calculating the digital activity index.

[0018] In some embodiments, the user equipment is a mobile terminal; the non-content metadata events include at least two of the following: screen state change events, device motion state change events recorded by the operating system, charging state change events, and network connection state change events.

[0019] In some embodiments, the activity baseline model is a personalized baseline model constructed based on the target user's historical digital activity index data, constructed by time period partitioning to distinguish between weekdays and non-weekdays, and continuously optimized using an incremental update method; the method also includes sleep period identification, detecting characteristic patterns of the user entering a sleep state, and reducing the dynamic threshold and / or extending the preset duration during sleep periods.

[0020] In some embodiments, in step S1, the passive acquisition does not include actively activating the camera, microphone, positioning module, or motion sensor to collect raw data; the event broadcast or state change callback is a record generated by the operating system based on the existing operating state of the user device.

[0021] In some embodiments, all calculations in steps S1 to S4 are performed locally on the user equipment, without transmitting the original event data to the outside, and only the digital activity index or security status determination result is output.

[0022] In some embodiments, step S3 further includes: detecting whether the user equipment has not entered the system low power mode within a preset time period; when the digital activity index is continuously lower than the dynamic threshold and the user equipment has not entered the system low power mode within the corresponding time period, increasing the confidence level of the determination of the digital activity decay state.

[0023] In some embodiments, step S2 further includes: performing a consistency check on the active events in the non-content metadata event stream; when the active event is not accompanied by corresponding changes in the corresponding time window of the touch input event, device motion state change event, charging state change event, or screen wake-up source event recorded by the operating system, the contribution weight of the active event to the digital activity index is reduced.

[0024] In some embodiments, step S3 further includes: detecting the decay mode of the digital activity index; when the decay mode is a cliff-like decay, shortening the preset duration and / or increasing the risk level of the digital activity depletion state; when the decay mode is a gradual decay, maintaining or extending the preset duration.

[0025] This invention also provides a user security status assessment system based on a digital activity index. For example... Figure 1 As shown, the system includes an event acquisition module, an activity calculation module, a baseline comparison module, and a security response module.

[0026] The event acquisition module is configured to passively acquire non-content metadata event streams generated by the user device by listening to event broadcasts or state change callbacks generated by the operating system; the non-content metadata event stream includes event type and event timestamp, and does not contain communication content, text content, image content, audio content or application business content.

[0027] The activity calculation module is configured to calculate a digital activity index based on the event frequency, event interval, recent event time and / or event type distribution in the non-content metadata event stream through multi-dimensional weighted fusion; the digital activity index is used to quantify the level of interaction activity between the user and the user device.

[0028] The baseline comparison module is configured to compare the current digital activity index with a pre-built activity baseline model to detect the continuous decay of the digital activity index.

[0029] The safety response module is configured to determine the state of digital activity depletion and generate a safety warning response when the digital activity index remains below the dynamic threshold for a preset duration.

[0030] Third, beneficial effects Compared with the prior art, the present invention has at least the following beneficial effects.

[0031] 1. This invention utilizes event broadcasts or state change callbacks already generated by the operating system for passive acquisition, eliminating the need to actively activate cameras, microphones, positioning modules, or motion sensors to collect raw data in order to generate a digital activity index, thereby reducing power consumption and permission dependencies.

[0032] 2. This invention only processes non-content metadata such as event type and event timestamp, and does not parse communication content, text content, image content, audio content or application business content, which can reduce the scope of privacy collection and computational burden caused by content parsing, content storage and content transmission.

[0033] 3. This invention converts discrete system events into digital activity indices, enabling the processor to continuously quantify and compare the level of user and device interaction activity, rather than simply relying on screen time statistics or single event counts.

[0034] 4. This invention uses an active baseline model and dynamic threshold to detect the continuous decay state, which can adapt to different users, different time periods, weekdays and non-weekdays, sleep and non-sleep scenarios, and reduce false alarms caused by fixed thresholds.

[0035] 5. This invention improves the reliability of digital activity depletion state determination by using event stream credibility assessment, low power consumption state judgment, consistency verification, and decay mode classification to technically process event missing, device inactivity, pseudo-activity, and decay mode.

[0036] 6. The present invention can complete the calculation locally on the user equipment and only output the digital activity index, security status judgment result or machine-readable security warning response, which is convenient for independent use or as input to other security monitoring systems. Attached Figure Description

[0037] Figure 1 This is an overall architecture diagram of the user security status assessment system based on digital activity index according to an embodiment of the present invention; Figure 2 This is a flowchart of the user security status assessment method based on digital activity index according to an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the acquisition and filtering of non-content metadata event streams in an embodiment of the present invention; Figure 4 This is a flowchart illustrating the calculation of the digital activity index in an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating the construction and updating of the active baseline model and dynamic threshold in an embodiment of the present invention; Figure 6 This is a flowchart of the event stream credibility assessment and weighting process in an embodiment of the present invention; Figure 7 This is a flowchart of low-power state anomaly detection and consistency verification in an embodiment of the present invention; Figure 8 This is a flowchart illustrating the classification and processing of cliff-like attenuation and gradual attenuation in an embodiment of the present invention. Figure 9 This is a schematic diagram of the collaborative query of the user equipment digital activity index as a cross-domain silent association second observation channel in an embodiment of the present invention. Detailed Implementation

[0038] The present invention will be further described below with reference to embodiments. It should be understood that the following embodiments are used to explain the technical solutions of the present invention, and not to limit the scope of protection of the present invention. Where there is no conflict, the technical features in the following embodiments can be combined with each other.

[0039] I. Definition of Terms A user is a natural person who has an interactive, portable, usage, binding, or service relationship with a user's device. A user can be a device holder, account user, family member, person living alone, elderly person, security guard, driver, patient, person receiving care, office worker, operator, or other target object whose security status needs to be assessed based on their device interaction status.

[0040] User equipment refers to an electronic device capable of running an operating system, firmware, or equivalent event management program, and generating user interaction-related events or device state change events. User equipment can be smartphones, smartwatches, smart glasses, augmented reality / virtual reality headsets, smart rings, smart fabrics, implantable medical devices, brain-computer interface devices, tablets, laptops, desktop computers, smart TVs, in-vehicle terminals, smart speakers, central control panels, or other terminal devices, wearable devices, or personal devices with a processor and operating system, firmware, or equivalent event management program.

[0041] In some implementations, user devices are not limited to smartphones. Smartwatches, smart glasses, augmented reality / virtual reality headsets, smart rings, smart fabrics, implantable medical devices, brain-computer interface devices, or other wearable or personal devices, during operation, can generate non-content-based metadata event streams such as device state change events, user interaction events, communication link state change events, physiological state tag change events, or device wearing status change events. By listening to, reading, or receiving these event streams and executing steps S1 to S4 of this invention, the processor can achieve user security status assessment based on a digital activity index.

[0042] When the user device is an implantable medical device, a brain-computer interface device, or other device capable of generating physiologically relevant status tags, the data used in this invention can be non-content-based status tags, event types, and event timestamps already generated by the device's operating system, firmware, or equivalent event management program, without requiring the acquisition of raw physiological signals, parsing medical images, waveforms, diagnostic content, or treatment parameters, and without requiring disease diagnosis or treatment decisions.

[0043] Non-content metadata event streams refer to a set of event data generated by user devices during operation and recorded by the operating system, firmware, or equivalent event management program in the form of event broadcasts, state change callbacks, system logs, state snapshots, usage statistics, system records, or equivalent methods. It includes at least the event type and event timestamp, and may further include event source category, system service category, application category, input method category, status label, event duration, event count, window identifier, wake-up source, or equivalent summary field.

[0044] Non-content metadata event streams do not include communication content, text content, image content, audio content, or application business content. "Does not include" means that the processor does not parse, extract, save, or upload the aforementioned content itself in the method of this invention. For notification events, application foreground / background state changes, voice wake-up events, or input events, the processor may record the event occurrence identifier, event type, source category, and timestamp, but does not record the notification text, voice content, image content, page content, or user input text.

[0045] Passive acquisition refers to the processor reading the existing running state of the operating system, obtaining the system's recorded usage statistics, or obtaining periodic state snapshots by listening to the event broadcasts or state change callbacks generated by the operating system, rather than actively activating cameras, microphones, positioning modules, or motion sensors to collect raw data in order to generate a digital activity index.

[0046] Passive acquisition can include event-driven and periodic state snapshot methods. Event-driven methods are suitable for operating system environments that can provide real-time broadcasts or callbacks; periodic state snapshot methods are suitable for operating system environments with limited background permissions or where the system does not support continuous callbacks. Event sequences, count sequences, timestamp sequences, or window features obtained from system usage statistics, screen usage statistics, notification statistics, input statistics, status statistics, or platform interface conversions can also be used as non-content metadata event streams or their equivalent expressions.

[0047] The Digital Activity Index is a numerical value, level, tag, probability, confidence level, status code, or equivalent expression calculated based on non-content metadata event streams. It is used to quantify the level of user interaction activity with user devices within a preset time window. The name of the Digital Activity Index is not limited and can be referred to as activity score, device interaction activity, digital interaction activity, interaction activity index, activity index, security activity score, risk tag, or other machine-readable expression in practice.

[0048] An activity baseline model is used to characterize the normal digital activity level of a target user or target group under different time conditions. An activity baseline model can be a personalized baseline model, a group baseline model, a device type baseline model, a scenario baseline model, a time period baseline model, a default initial baseline model, a rolling statistical model, or a combination thereof.

[0049] Dynamic thresholds refer to thresholds determined based on active baseline models, historical statistics, time periods, scenarios, event stream credibility, sleep states, or other state conditions. Dynamic thresholds can be determined by the mean, quantiles, standard deviation, confidence intervals, outlier scores, model classification boundaries, risk boundaries, or rule conditions.

[0050] Digital activity exhaustion refers to a state where the digital activity index remains below a dynamic threshold for a preset duration. This state indicates that a user may be in a risky situation where they are unable to interact normally with their device, have been inactive for an unusually long period, are unreachable, disabled, unresponsive, or require external confirmation.

[0051] A security alert response refers to a response generated by a processor based on the digital activity decay state, which can be executed, recorded, transmitted, or further processed by a device, platform, or program. Security alert responses can be notifications, work orders, API calls, status updates, confirmation requests, device linkage, alert escalation, risk levels, status codes, message queue events, database records, query responses, or other machine-readable results.

[0052] Activity events refer to non-content events that may increase the digital activity index, such as changes in screen status, touch input, keyboard input, remote control input, changes in device motion status, changes in network connection status, changes in charging status, changes in screen wake-up source, or changes in device wearing status.

[0053] Pseudo-activity refers to a combination of events that are not generated by actual user interaction but may cause the user's device to show signs of activity, such as background autoplay, auto refresh, auto reply, script operation, smart agent auto operation, push notification wake-up, or screen state changes caused by system auto tasks.

[0054] II. System Overall Architecture like Figure 1 As shown, the user security status assessment system based on the digital activity index includes an event acquisition module, an activity calculation module, a baseline comparison module, and a security response module. In some embodiments, the system may further include a credibility assessment unit, a non-content filtering unit, a low-power status detection unit, a consistency verification unit, a decay mode classification unit, and an external interface unit. These units can be implemented as independent modules or integrated into the event acquisition module, activity calculation module, baseline comparison module, or security response module.

[0055] The event acquisition module passively acquires non-content-related metadata event streams generated by the user device by listening to event broadcasts or state change callbacks generated by the operating system. In operating system environments with restricted background permissions, the event acquisition module can acquire non-content-related metadata event streams through periodic state snapshots, system usage statistics interfaces, system log summaries, firmware status records, or platform interfaces.

[0056] The activity calculation module is used to calculate the digital activity index based on the event frequency, event interval, recent event time, and / or event type distribution in the non-content metadata event stream through multi-dimensional weighted fusion. The activity calculation module can also adjust the contribution of different events to the digital activity index based on the credibility coefficient, consistency verification results, or event type weight.

[0057] The baseline comparison module compares the current digital activity index with a pre-built activity baseline model to detect the continuous decline of the digital activity index. The baseline comparison module can output the digital activity decline status based on dynamic thresholds, historical curves, duration of low values, amplitude of low values, or decline patterns.

[0058] The security response module is used to determine a digital activity depletion state and generate a security warning response when the digital activity index remains below the dynamic threshold for a preset duration. The security response module can generate notifications, confirmation requests, risk levels, API call parameters, work orders, status codes, message events, database status updates, or external query responses.

[0059] In some embodiments, event acquisition, activity calculation, baseline comparison, and security response can all be performed by the user equipment's local processor. In other embodiments, the user equipment can perform non-content filtering and feature summary generation locally, sending the content-free event statistical summary, digital activity index, or intermediate features to a gateway, server, or monitoring platform for baseline comparison or security response. Distributed implementations do not alter the technical concept of this invention: calculating the digital activity index based on non-content metadata event streams and detecting continuous decay.

[0060] III. Overall Method Flow like Figure 2 As shown, the processor executes a user security status assessment method based on a digital activity index.

[0061] First, the processor establishes event listening, callback subscription, log reading, and statistical reading or state snapshot tasks. It obtains event types and event timestamps through the event acquisition module to form a non-content metadata event stream.

[0062] Then, the processor statistically analyzes the event frequency, event interval, recent event time, event type distribution, and other features according to a preset time window, and performs normalization, weighted fusion, and credibility correction on the features to generate a digital activity index.

[0063] The processor then compares the current digital activity index with the activity baseline model to obtain the degree of deviation, persistently low value, or persistently decaying state.

[0064] When the digital activity index is below the dynamic threshold for multiple consecutive time windows and the duration reaches the preset duration, the processor determines that the digital activity is in a state of exhaustion and generates a security warning response.

[0065] The method does not require all event types to be available simultaneously. When a certain type of event is unavailable due to permissions, device capabilities, operating system limitations, or network conditions, the processor can calculate a digital activity index based on the remaining available event types and adjust the reliability of the result using a confidence coefficient.

[0066] IV. Acquisition and Filtering of Non-Content Metadata Event Streams like Figure 3 As shown, the processor can obtain non-content metadata event streams in at least one of the following ways.

[0067] In one embodiment, the processor listens for screen-on, screen-off, unlock, lock, foreground / background switching, or screen-wake-up events generated by the operating system.

[0068] In one embodiment, the processor listens for device motion state change events recorded by the operating system, such as stationary, walking, carrying, placing, lifting, or other motion state tags output by the system state service. This method reads state tags already recorded or generated by the operating system and does not require actively activating motion sensors to collect raw data in order to generate a digital activity index.

[0069] In one embodiment, the processor listens for charging state change events, such as power connection, power disconnection, charging state change, power range change, or power management state change.

[0070] In one embodiment, the processor listens for network connectivity status change events, such as wireless network connection, cellular network connection, Bluetooth connection, offline status, network switching, or communication link status change.

[0071] In one embodiment, the processor listens for touch input events, keyboard input events, mouse input events, remote control input events, key events, voice wake-up events, headphone connection status changes, near-field communication interaction events, application foreground / background status changes, notification event events, system unlock status changes, alarm clock status changes, shortcut trigger events, smart home control events, or other non-content events that can reflect the level of user interaction with the device.

[0072] For operating systems with restricted background permissions, the processor can read the system's recorded state change summaries, usage statistics, screen status, network status, power status, device connection status, or other system status snapshots at preset intervals, and convert the differences between adjacent snapshots into non-content metadata events.

[0073] When acquiring events, the processor performs non-content filtering, retaining only the event type, event timestamp, event source category, event duration, event count, window identifier, or status label, without reading or saving communication content, text content, image content, audio content, or application business content.

[0074] For example, when a user device generates a message notification event, the processor can record the time, source category, or count of the notification event, but not the notification body, sender identity, image, voice, link, or specific business content. When a user device experiences a foreground / background state change, the processor can record that a foreground / background switch event has occurred and a timestamp, but does not parse the application page content, user input, or in-application business objects.

[0075] V. Calculation of the Digital Activity Index like Figure 4 As shown, within each preset time window, the processor can calculate one or more of the following features.

[0076] Event frequency is a feature used to represent the number of valid activity events that occur within a window. A higher event frequency generally indicates a higher level of user interaction with the device.

[0077] Event interval is a feature used to represent the time interval between adjacent valid activity events. A longer event interval generally indicates a lower level of user interaction activity.

[0078] The recent event time feature is used to represent the length of time since the most recent valid active event. The further back in time the most recent valid active event is from the current time, the lower the digital activity generally is.

[0079] Event type distribution characteristics are used to represent the distribution of different types of events within a window. For example, simple background network changes and events such as touch input, screen wake-up, and charging status changes have different weights in reflecting real user interactions.

[0080] The valid event ratio characteristic represents the proportion of events that pass consistency or reliability checks. A lower valid event ratio indicates a greater impact from spurious or low-reliability events in the event stream.

[0081] In one embodiment, the digital activity index A(t) can be calculated using the following formula: A(t) = Q(t) * [w1*F_count(t) + w2*F_interval(t) + w3*F_recent(t) +w4*F_type(t) + w5*F_valid(t)] Where A(t) represents the numerical activity index of time window t; Q(t) represents the event stream credibility coefficient; F_count(t) represents the event frequency feature; F_interval(t) represents the event interval feature; F_recent(t) represents the recent event time feature; F_type(t) represents the event type distribution feature; F_valid(t) represents the valid event ratio feature; and w1 to w5 represent the corresponding weights.

[0082] In one embodiment, F_count(t) can be normalized based on the ratio of the current number of window events to the historical number of normal window events; F_interval(t) can be converted based on the ratio of the current event interval to the historical baseline event interval; F_recent(t) can be converted based on the duration of the most recent valid active event using a time decay function; F_type(t) can be calculated based on the preset weights or historical contribution weights of different event types; and F_valid(t) can be calculated based on the proportion of events that pass consistency verification, credibility verification, or operator consistency verification to the total number of events within the window.

[0083] In another embodiment, the digital activity index can be calculated using a rule-based model, a statistical model, a quantile model, an exponentially weighted moving average model, a machine learning model, or a combination thereof. The digital activity index can be an explicit intermediate variable or an implicitly generated composite score, rating, status code, risk label, or confidence level by the processor in a rule-based, statistical, or machine learning model. As long as the processor comprehensively characterizes the level of user and device interaction activity based on multiple dimensions in a non-content-based metadata event stream and compares this to a baseline or threshold, it can be considered as calculating the digital activity index.

[0084] The preset time window can be a fixed time window, a sliding time window, a scrolling time window, an event count window, a session window, a day segmented window, or an adaptive window.

[0085] VI. Event Stream Credibility Assessment like Figure 6 As shown, the processor can assess the credibility of non-content metadata event streams and determine the credibility coefficient based on the continuity of event reporting by user equipment, system low power status, permission availability status, and / or network connectivity status.

[0086] In one embodiment, the processor detects the continuity of event reporting. If there are abnormal interruptions, timestamp gaps, significantly abnormal reporting intervals, or discontinuous event sequences in event reporting, the reliability coefficient is reduced.

[0087] In one embodiment, the processor detects a low-power state of the system. If the user device enters a low-power mode, hibernation mode, power-saving mode, background restricted state, deep idle state after the screen is off, or an equivalent state, the processor adjusts the interpretation of missing events based on the system state. If the device enters a deep idle state, the low event frequency may be closer to normal inactivity; if the device does not enter a low-power mode but continues to lack user interaction events, this state may correspond to a higher risk.

[0088] In one embodiment, the processor detects the permission availability status. If the permissions required for some events are disabled, revoked, or restricted by the system, the weight of the corresponding event type or the event stream reliability coefficient is reduced.

[0089] In one embodiment, the processor detects network connectivity status. If the user device is offline, experiencing network switching, weak network conditions, synchronization failure, or platform data latency, the weight of events relying on network status reporting is reduced.

[0090] The confidence coefficient can be used as a weighting factor in the calculation of the digital activity index, or as a confidence correction factor in the determination of digital activity depletion.

[0091] VII. Active Baseline Model and Dynamic Threshold like Figure 5 As shown, the activity baseline model can be built based on the target user's historical digital activity index data. The personalized baseline model can be built by time period partitioning, distinguishing between weekdays and non-weekdays, daytime and nighttime, working hours and rest hours, and resident scenarios and outing scenarios.

[0092] The active baseline model can be updated using one or more of the following methods: exponentially weighted moving average, sliding window statistics, median model, quantile model, rule model, or machine learning model.

[0093] In one embodiment, the active baseline model is incrementally updated using an exponentially weighted moving average method: B(t) = alpha*A(t) + (1-alpha)*B(t-1) Where B(t) represents the current updated baseline value; A(t) represents the digital activity index of the current time window; B(t-1) represents the baseline value of the corresponding period in the previous time window or period; and alpha represents the update coefficient.

[0094] Dynamic thresholds can be determined based on an activity baseline model. For example, the historical digital activity index mean, quantiles, standard deviation, minimum normal level, or model output for the corresponding time period can be used as a reference and adjusted according to user age, device type, event credibility, sleep status, or scene tags.

[0095] When personal historical data of target users is lacking, an initial dynamic threshold can be set using a group activity baseline model, device type baseline model, scenario baseline model, or default initial baseline model, and then gradually switched to a personalized baseline model as personal data accumulates. This cold start process is an optional implementation and does not change the core process of this invention, which uses a digital activity index to detect continuous decay.

[0096] 8. Sleep Period Identification In one embodiment, the processor identifies characteristic patterns of a user entering a sleep state based on low-frequency patterns of event streams during nighttime hours, prolonged screen off time, stable charging status, stable network status, stable device motion status, or historical sleep patterns.

[0097] During sleep periods, the processor can lower the dynamic threshold and / or extend the preset duration to reduce false alarms caused by normal sleep. Sleep period recognition does not require access to sleep content, health data, or raw physiological data; where available, it can also receive sleep state tags already generated by the operating system, firmware, or health platform as auxiliary input.

[0098] IX. Determination of Digital Activity Exhaustion The processor compares the current digital activity index with a dynamic threshold. When the digital activity index is below the dynamic threshold for multiple consecutive preset time windows, and the duration reaches a preset duration, it is determined to be a state of digital activity depletion.

[0099] The continuous decline of the digital activity index is not limited to the gradual decrease of the index value, but also includes the digital activity index being below the dynamic threshold, close to zero, remaining at a low level, having no effective activity events, having an event interval exceeding the threshold, having the most recent event time exceeding the threshold, having accumulated a preset number of low-activity windows, or having the risk level continuously at a high level, etc.

[0100] The following factors can be considered simultaneously when determining digital activity decay: the duration of digital activity index below the dynamic threshold, the magnitude of the decline below the dynamic threshold, the event stream reliability coefficient, whether it is in a sleep period, whether the user device has entered the system's low power mode, whether there is a consistency check anomaly, and whether the decay mode is a cliff-like decay or a gradual decay.

[0101] 10. Anomaly detection when a device remains idle for an extended period but fails to enter low-power mode. like Figure 7 As shown, in one embodiment, the processor detects whether the user equipment has not entered the system low-power mode within a preset time period. When the digital activity index remains below a dynamic threshold and the user equipment has not entered the system low-power mode within the corresponding time period, the processor increases the confidence level of the determination of the digital activity decay state.

[0102] This embodiment is used to distinguish between normal prolonged inactivity and abnormal inoperability. During normal prolonged inactivity, the device may enter a low-power mode over time, resulting in reduced background wake-ups and decreased digital activity, which can be explained by normal inactivity. In cases of abnormal inoperability, the device may not have entered a low-power mode and may still exhibit background wake-ups, push notifications, network activity, or power consumption, but the lack of user interaction events and decreased digital activity are more likely to indicate that the user cannot operate the device.

[0103] System low-power modes can include operating system-provided sleep mode, power-saving mode, background restriction mode, deep idle mode after screen is off, or equivalent modes. System low-power modes can also be determined by background wake-up frequency, power consumption rate, CPU wake-up count, network wake-up count, push wake-up count, or equivalent device operating status.

[0104] XI. Activity Event Consistency Verification like Figure 7 As shown, the processor can perform consistency checks on active events in the non-content-based metadata event stream. When an active event is not accompanied by corresponding changes in the corresponding time window of touch input events, device motion state change events, charging state change events, or screen wake-up source events recorded by the operating system, the contribution weight of the active event to the digital activity index is reduced.

[0105] For example, if a user device experiences screen wake-up, application switching, or playback status change, but there is no touch input, device motion status change, charging status change, or user-triggered screen wake-up source within the corresponding time window, the processor can mark the event as a low-confidence activity event and reduce its weight in the digital activity index.

[0106] This consistency check can be used to mitigate the impact of pseudo-activity caused by automated scripts, intelligent agent automatic operations, background playback, push notifications, or system automatic tasks. The consistency check described in this invention is still based on non-content-related events or state changes already recorded by the operating system, and does not require parsing user communication content, text content, image content, audio content, or application business content.

[0107] In some embodiments, consistency checks can generate a valid event ratio characteristic. The lower the valid event ratio, the more likely the processor is to reduce the digital activity index or the contribution weight of the corresponding active event.

[0108] In some embodiments, the processor may also perform operator consistency verification to reduce the impact of multiple users sharing a user device on the digital activity index. The operator consistency verification may construct a baseline model of the target user's interactive behavior based on touch dynamics statistics, device holding posture statistics, operation rhythm statistics, associated personal device state characteristics, and / or system authentication event characteristics in a non-content metadata event stream.

[0109] When the deviation of the current interactive behavior characteristics from the baseline model of the interactive behavior meets the preset conditions, the processor can reduce the contribution weight of the corresponding activity event to the digital activity index, or reduce the confidence level of the security status determination result.

[0110] The touch dynamics statistical features may include one or more of the following: touch duration, swipe speed, click interval distribution, and swipe to click ratio; the device holding posture statistical features may include device posture change tags, motion state change tags, or holding stability statistics recorded by the operating system; the associated device status features may include associated device connection status, signal strength range, distance status, wearing status changes, or motion state changes; the system authentication event features may include authentication event occurrence identifier, authentication type, and authentication timestamp.

[0111] The above operator consistency verification is based solely on statistical comparison of non-content-related behavioral or state characteristics. It does not collect, save, or compare biometric templates of natural persons, nor does it parse communication content, text content, image content, audio content, or application business content, nor is it intended to identify the identity of a specific natural person.

[0112] XII. Classification of Attenuation Modes like Figure 8 As shown, the processor can detect the decay pattern of the digital activity index.

[0113] Cliff-like decay refers to a state where the digital activity index rapidly declines from a normal level to near zero or below the dynamic threshold within a short period of time. For cliff-like decay, the processor can shorten the preset duration and / or increase the risk level of the digital activity decay state.

[0114] Gradual decay refers to a state where the digital activity index gradually declines over a relatively long period and remains below the normal level corresponding to the activity baseline model. For gradual decay, the processor can maintain or extend the preset duration and generate alerts for monitoring, review, or low-level warnings.

[0115] The terms "cliff-like decay" and "gradual decay" are not restrictive. The processor can classify the decay patterns of the digital activity index based on the descent slope, inter-window difference, number of consecutive low values, duration of low values, curve shape, trend model output, or similarity to historical curves, and adjust the preset duration, risk level, or warning response intensity according to the classification results.

[0116] XIII. Local Computing, Privacy Protection, and Distributed Processing In one embodiment, all calculations in steps S1 to S4 are performed locally on the user equipment. The user equipment does not transmit raw event data to the outside, but only outputs the digital activity index, security status judgment result, risk level, time window, credibility coefficient, or warning response status.

[0117] Local computation can include event filtering, feature statistics, digital activity index calculation, baseline comparison, credibility assessment, consistency verification, and digital activity depletion determination.

[0118] In another embodiment, the user equipment can perform non-content filtering and feature summary generation locally, and send the event statistics summary, digital activity index or intermediate features that do not contain content to the home gateway, server, care platform, device management platform or other external system, which will then perform baseline comparison or security response.

[0119] With user authorization, user devices can upload anonymized model parameters, statistical summaries, or security status results to external systems, but not the original event stream or content data.

[0120] The technical effects of the non-content processing described in this invention include reducing data field parsing and storage, reducing terminal computing load and storage overhead, reducing dependence on application business interfaces, content parsing interfaces and sensitive permissions, improving portability across applications, systems and devices, reducing the impact of content format changes, application version changes and business page changes on recognition results, and reducing the amount of original data transmission.

[0121] XIV. Safety Early Warning Response Security alert responses may include one or more of the following: popping up a security confirmation request on the user's device, sending a notification to emergency contacts, sending security status judgment results to care platforms, community platforms, property management platforms, medical care platforms, home gateways, smart home platforms, account centers, device management platforms, enterprise security systems, or vehicle platforms, generating work orders, updating database status, calling external interfaces, generating message queue events, triggering device linkage, or executing alert upgrades.

[0122] Security alert responses can be determined based on the duration of the digital activity index being below the dynamic threshold, the magnitude of the low value, the credibility of the event stream, the low power consumption state, the consistency verification results, and the decay mode.

[0123] Security alert responses are not limited to alarms targeting the elderly, people living alone, or care services. They can also be expressed as risk levels, status labels, confirmation requests, interface callbacks, work orders, tasks, messages, status updates, or other machine-readable responses used to reduce abnormal user disconnection, incapacity, inability to interact, or uncertainty of status.

[0124] XV. Collaborative Implementation Examples for Responding to External Queries like Figure 9 As shown, in one collaborative embodiment, the user equipment can respond to a status query request from an external system and return the current digital activity index, digital activity depletion determination result, risk level, credibility coefficient, last update time, active / inactive tag, or other machine-readable status results.

[0125] The external system can be a door magnetic monitoring system, a smart door lock system, a cross-domain silent association system, a care platform, a home gateway, a smart home central control system, an account system, a device management platform, or other security monitoring systems.

[0126] exist Figure 9 In the illustrated embodiment, when the external system detects a lack of activity or an abnormal status in the first observation channel, it sends a status query request to the user equipment. The user equipment generates a machine-readable status result based on its locally calculated digital activity index, digital activity depletion determination result, reliability coefficient, and most recent update time, and returns the machine-readable status result to the external system. The external system determines whether the digital interaction channel is synchronously silent based on the returned result, and performs cross-channel security assessment or early warning response accordingly.

[0127] For example, when the door magnetic monitoring system detects that the target user has not opened or closed the door within the first time window, the system can initiate a status query to the user equipment. The user equipment returns the current digital activity index or the digital activity depletion judgment result. Based on this, the external system determines whether the physical channel silence and the digital interaction channel silence are synchronized, thereby realizing cross-channel security status assessment.

[0128] The collaborative query interface can be implemented using a local area network interface, cloud interface, message queue, Bluetooth interface, system sharing interface, home gateway interface, broadcast interface, subscription callback interface, or other data interface. Responding to external queries can itself constitute one form of security alert response output.

[0129] XVI. Typical Implementation Examples Example 1: Independent security monitoring at the user equipment end The user device is a smartphone. The processor monitors changes in screen status, touch input, charging status, network connection status, and device motion status recorded by the operating system, forming a non-content-based metadata event stream. The processor calculates event frequency, event interval, recent event time, and event type distribution according to a preset time window, and calculates a digital activity index based on this.

[0130] The processor constructs a personalized activity baseline model based on the user's historical digital activity index data. If the digital activity index remains below the dynamic threshold for a preset duration during a certain daytime period, and the user's device has not entered the system's low-power mode, the processor increases the confidence level of the digital activity decay status and generates a security confirmation request or notification.

[0131] Example 2: Collaboration with door magnets or cross-domain silent association systems The user equipment (UAE) acts as a secondary observation channel, providing the external system with a digital activity index or a digital activity depletion assessment result. When a door magnet or other physical observation channel shows a lack of activity, the external system queries the UAE's current digital activity status to determine if there is multi-channel synchronous silence. In this embodiment, the UAE may not actively trigger an alarm, but instead simply return the digital activity index, risk level, or depletion assessment result via an interface.

[0132] Example 3: Wearable or personal devices User devices can be smartwatches, smart glasses, augmented reality / virtual reality headsets, smart rings, smart fabrics, implantable medical devices, brain-computer interface devices, or other wearable or portable devices. The processor monitors wrist-raising events, changes in wearing status, eye-tracking interaction events, gesture input events, button input events, touch input events, changes in charging status, changes in communication link status, changes in system-recorded motion status, changes in physiological status tags, or changes in device connection status. It calculates a digital activity index and generates a safety warning response when the digital activity index continuously decays.

[0133] For physiological state label change events, the processor can use only the occurrence identifier of the label change, the event type, and the event timestamp, without parsing the original physiological signals or medical diagnostic content.

[0134] Example 4: Computer or office terminal The user device is a computer or office terminal. The processor monitors keyboard input, mouse input, screen lock, network connection, charging, or power status changes, and calculates a digital activity index for security status assessment of on-duty personnel, remote workers, or personnel in high-risk positions. Security alert responses can be status codes, work orders, confirmation requests, or task escalations within the enterprise security system.

[0135] Example 5: Smart TV, smart speaker, or home control system The user device is a smart TV, smart speaker, or home control center. The processor listens for non-content events such as remote control input, voice wake-up event markers, volume adjustments, scene switching, network connection status changes, and device connection status changes, calculates the digital activity index, and generates a security status judgment result when the activity continues to decay.

[0136] Example 6: Multi-user scenario In homes, institutional care settings, corporate on-call services, driver queues, hospital wards, dormitories, or offices, this invention can construct digital activity indices and activity baseline models for multiple users. Each user can correspond to one or more user devices, and the system outputs the digital activity index, safety status assessment results, and early warning responses for each user. User grouping, home, institutional, corporate, fleet, or ward settings are merely management organization methods and do not change the technical essence of detecting activity decay based on user device event streams for a single target user.

[0137] Example 7: Monitoring Response Capacity After Rehabilitation or Nursing Care In rehabilitation care, home care, or post-discharge follow-up scenarios, user devices can be smartphones, smartwatches, smart rings, home control systems, or other personal devices. The processor calculates a digital activity index based on non-content-based metadata event streams and outputs a judgment result on the user's responsiveness status, digital activity decay status, or safety status based on the change of the digital activity index relative to the activity baseline model.

[0138] This embodiment is used to assist in determining whether the level of user-device interaction activity has recovered to a preset level or whether it has continued to decline. It does not require the acquisition of original physiological signals, nor does it analyze medical records, diagnostic content, images, waveforms, or treatment parameters, nor is it intended for disease diagnosis or treatment decision-making.

[0139] Example 8: Industrial Monitoring and High-Risk Operation Scenarios In industrial, mining, high-altitude operations, hazardous chemical operations, energy facilities, data centers, or other high-risk work scenarios, user equipment can be smart helmets, workstation terminals, handheld terminals, vehicle terminals, smartwatches, smart glasses, or other wearable devices. The processor calculates the digital activity index of the worker based on the non-content-related metadata event stream generated during the operation of the user equipment.

[0140] When the digital activity index remains below the dynamic threshold for a preset duration during the on-duty or work period, the system can generate a safety status assessment result, a job confirmation request, a work order, an interface call, or other machine-readable safety warning response. In this embodiment, the digital activity index is used to reduce the uncertainty of the status caused by prolonged periods of inactivity among workers, without requiring the collection of images, audio, or communication content from workers.

[0141] Example 9: Scenario for Assisting in Judging Vehicle Driving or Takeover Capability In scenarios involving vehicle driving, assisted driving, autonomous driving with safety personnel on duty, or remote driving, user devices can be in-vehicle terminals, driver's mobile phones, smartwatches, smart glasses, vehicle central control units, or other interactive terminals. The processor can monitor non-content-related metadata event streams such as central control touch screen interactions, steering wheel button presses, voice wake-up indicators, navigation interactions, changes in vehicle screen status, changes in communication link status, or interactions with personal devices.

[0142] The processor calculates a digital activity index based on the aforementioned event stream and outputs the driver's or safety officer's responsiveness status, confirmation request, or risk level when the digital activity index continuously decays. In this embodiment, the digital activity index can serve as an auxiliary safety signal for takeover capability or on-duty status, and does not replace the vehicle control system, driver monitoring system, or existing safety control strategies.

[0143] Example 10: User activity verification scenario using AI agents or external automated systems In scenarios where AI agents, automated assistants, automated scripts, financial services, account security, or other external automated systems perform high-risk operations, the external system can query the user's device for the current digital activity index, digital activity depletion judgment result, risk level, credibility coefficient, or most recent update time before performing the operation.

[0144] If the digital activity index of a user device remains below the dynamic threshold within the corresponding time window, or if an activity event fails the consistency check, the external system can use this result as an auxiliary verification signal to generate a secondary confirmation request, delay execution, increase the verification level, or reject automated operations.

[0145] This embodiment does not require parsing the business content of automated operations, nor does it require determining the authenticity of specific transactions, messages, or schedule content. In this embodiment, the invention provides user activity status results obtained from non-content-based metadata event streams of user devices, which serve as one of the inputs for security verification by external systems.

[0146] Example 11: Real-side user activity verification scenario in augmented reality, virtual reality, or virtual space In augmented reality, virtual reality, mixed reality, virtual space, or remote collaboration scenarios, user equipment can be augmented reality / virtual reality headsets, smart glasses, controllers, motion controllers, smart rings, smartwatches, or other wearable interactive devices. The processor can calculate a digital activity index based on gaze interaction events, gesture input events, controller input events, changes in wearing status events, changes in screen status events, changes in communication link status events, or changes in device connection status events.

[0147] When an identity, session, or operation in the virtual space needs to confirm whether the user on the real side is still in a normal interactive state, the system can call the digital activity index or the digital activity depletion judgment result as an auxiliary security signal. This embodiment does not require the identification of specific content, images, voice, or business semantics in the virtual space, nor does it require the digital activity index to be the sole basis for identity authentication.

[0148] XVII. Equivalent Implementation Method This invention does not limit the user equipment type, operating system type, firmware type, event source type, event window length, weight calculation method, baseline model form, deployment method, or early warning response form.

[0149] Non-content-related metadata event streams can be obtained through real-time monitoring, batch reading, periodic status snapshots, system usage statistics, system log summaries, callback interfaces, platform interfaces, or terminal status summaries synchronized from the cloud. As long as the data source is an event, status, or summary that has already been generated or recorded during the operation of the user device, and the processor has not actively initiated the sensor to collect raw data in order to generate a digital activity index, it falls under the passive acquisition implementation method described in this invention.

[0150] The digital activity index can be expressed as continuous numerical values, discrete levels, risk labels, probabilities, confidence levels, status codes, model outputs, or other machine-readable representations. Multidimensional feature vectors, weighted sums, normalized scores, model output probabilities, discrete levels, and risk labels are all convertible to each other, and their technical essence of quantifying user interaction activity remains unchanged despite different forms of representation.

[0151] The active baseline model can be a personalized baseline model, a group baseline model, a device type baseline model, a scenario baseline model, a time period baseline model, a default initial baseline model, a rolling statistical model, or a combination thereof. Pre-built active baseline models are not required to be fixed before the user's device leaves the factory; they can also be built from local historical data, group statistical data, cloud-based anonymized model parameters, or initial rules after user authorization, and are incrementally updated during operation.

[0152] Security alert responses can take the form of proactive alarms, passive queries, status synchronization, subscription callbacks, notifications, work orders, API calls, status updates, confirmation requests, device linkage, database recording, or alert escalation. Essentially, a security alert response is a response result generated by the processor based on the digital activity decay state, which can be executed, recorded, transmitted, or further processed by the system.

[0153] This invention is not limited to deployment as a standalone application. Event acquisition, activity calculation, baseline comparison, and security response can be implemented by applications, system services, background services, software development kits, operating system components, device management components, health service components, home service components, cloud service components, or combinations thereof.

[0154] The method steps of this invention can be executed by a processor of the same user device, or they can be executed collaboratively by one or more processors in the user device, gateway, server, monitoring platform, or external system. When the overall system completes the acquisition of non-content metadata event streams, calculation of digital activity index, baseline comparison, continuous decay detection, and generation of security warning responses, this overall system can constitute an embodiment of this invention.

[0155] Without departing from the technical concept of this invention, the event types, confidence assessment, baseline update, sleep recognition, low power anomaly detection, consistency verification and decay mode classification in different embodiments can be used in combination.

Claims

1. A user security status assessment method based on a digital activity index, applied to user equipment containing a processor, characterized in that, Includes the following steps: Step S1: The processor passively acquires the non-content metadata event stream generated by the user equipment during operation by listening to the event broadcast or state change callback generated by the operating system. The non-content metadata event stream includes event type and event timestamp, but does not contain communication content, text content, image content, audio content or application business content; Step S2: The processor calculates a digital activity index based on the event frequency, event interval, recent event time and / or event type distribution in the non-content metadata event stream through multi-dimensional weighted fusion; the digital activity index is used to quantify the level of user interaction activity with the user device within a preset time window; Step S3: The processor compares the current digital activity index with the pre-built activity baseline model to detect the continuous decay state of the digital activity index. Step S4: When the digital activity index remains below the dynamic threshold for a preset duration, the processor determines that the digital activity is in a state of exhaustion and generates a safety warning response.

2. The method according to claim 1, characterized in that, Step S2 further includes: evaluating the credibility of the non-content metadata event stream based on the event reporting continuity of the user equipment, the system low power consumption state, the permission availability state and / or the network connection state, and determining the credibility coefficient; and using the credibility coefficient as a weighting factor for calculating the digital activity index.

3. The method according to claim 1, characterized in that, The user equipment is a mobile terminal; the non-content metadata events include at least two of the following: screen state change events, device motion state change events recorded by the operating system, charging state change events, and network connection state change events.

4. The method according to claim 1, characterized in that, The active baseline model is a personalized baseline model built based on the target user's historical digital activity index data. It is constructed by time period partitioning, distinguishing between weekdays and non-weekdays, and continuously optimized using an incremental update method. It also includes sleep period identification, detecting the characteristic patterns of users entering a sleep state, and reducing the dynamic threshold and / or extending the preset duration during sleep periods.

5. The method according to claim 1, characterized in that, In step S1, the passive acquisition does not include actively activating the camera, microphone, positioning module, or motion sensor to collect raw data; the event broadcast or state change callback is a record generated by the operating system based on the existing operating state of the user device.

6. The method according to claim 1, characterized in that, All calculations in steps S1 to S4 are completed locally on the user equipment. No raw event data is transmitted to the outside. Only the digital activity index or security status judgment result is output.

7. The method according to claim 1, characterized in that, Step S3 further includes: detecting whether the user equipment has not entered the system low power mode within a preset time period; when the digital activity index is continuously lower than the dynamic threshold and the user equipment has not entered the system low power mode within the corresponding time period, increasing the confidence level of the determination of the digital activity decay state.

8. The method according to claim 1, characterized in that, Step S2 further includes: performing consistency verification on the active events in the non-content metadata event stream; when the active event is not accompanied by corresponding changes in the corresponding time window of the touch input event, device motion state change event, charging state change event or screen wake-up source event recorded by the operating system, the contribution weight of the active event to the digital activity index is reduced.

9. The method according to claim 1, characterized in that, Step S3 further includes: detecting the decay mode of the digital activity index; when the decay mode is a cliff-like decay, shortening the preset duration and / or increasing the risk level of the digital activity depletion state; when the decay mode is a gradual decay, maintaining or extending the preset duration.

10. A user security status assessment system based on a digital activity index, characterized in that, include: The event acquisition module is configured to passively acquire non-content metadata event streams generated by the user device by listening to event broadcasts or state change callbacks generated by the operating system. The non-content metadata event stream includes event type and event timestamp, but does not contain communication content, text content, image content, audio content or application business content; The activity calculation module is configured to calculate a digital activity index based on the event frequency, event interval, recent event time and / or event type distribution in the non-content metadata event stream through multi-dimensional weighted fusion; the digital activity index is used to quantify the level of interaction activity between the user and the user device. The baseline comparison module is configured to compare the current digital activity index with a pre-built activity baseline model to detect the continuous decay of the digital activity index. The safety response module is configured to determine the state of digital activity depletion and generate a safety warning response when the digital activity index remains below the dynamic threshold for a preset duration.

Images