Flow collection and behavior intervention integrated device

Abstract

The application relates to the technical field of reinforcement learning, in particular to a flow collection and behavior intervention integrated device, which comprises the following steps: in the application, a graph neural network is used to convert a bottom layer process identifier into a plane node coordinate, a network structure model is constructed by associating the coordinate with a communication frequency, a bottom layer communication optimization incentive feedback channel is reconstructed, the device has the capability of precisely mining a deep topological relationship evaluation of a hidden redundant communication node at a system bottom layer, a long short-term memory network is used to process a matrix numerical element and an action weight parameter point multiplication result, a communication return value is calculated by comparing a truncated threshold to intercept a parameter that does not exceed the parameter, an intervention level is positioned, deep analysis is conducted on internal time sequence dependent features in a multidimensional operation log, a risk of a running environment collapse caused by a strategy iteration amplitude out of range is avoided, a non-core process thread identifier is extracted to overwrite a processor state register into a sleep value, and target focused processes are ensured to exclusively occupy system core computing resources.

Description

Technical Field

[0001] This invention relates to the field of reinforcement learning technology, and in particular to an integrated device for flow acquisition and behavioral intervention. Background Technology

[0002] The reinforcement learning technology framework is based on Markov decision processes, specifically an operational framework for agents to interact with the environment and increase the cumulative reward value to a preset upper limit. The technology constructs a tuple containing elements, specifically including a set of states, a set of actions, state transition probabilities, a reward function, and a discount factor. The computation module uses the Bellman equation to solve the objective value function. The domain includes deep action evaluation network algorithms, flexible actor-critic algorithms, and proximal policy optimization algorithms. The solution abandons the physical signal acquisition method and loads an offline batch processing architecture to perform policy iteration operations on a pre-stored terminal interaction log matrix, which is in line with the basic definition of reinforcement learning that uses intrinsic rewards to drive multi-stage decision optimization.

[0003] The integrated flow acquisition and behavioral intervention device is specifically a combined computational control cluster of a serial discrete state probability inference model and a deep policy gradient network. The purpose of constructing the device is to establish a hidden state mapping channel based on a pre-stored operation log matrix and output an intervention action index to constrain the underlying process of the system. In order to achieve the effect of maintaining the quantitative length of the flow immersion state, the computation module executes quantitative standards, including the pre-indicator of maintaining the target application's foreground active time ratio exceeding a preset active ratio threshold, and the post-indicator of controlling the frequency of non-target process startup to be lower than the preset limit number of times per cycle. When the system evaluation index deviates from the quantitative benchmark, the intervention module is triggered to call the underlying programming interface of the operating system and rewrite the core parameters of the system.

[0004] The existing technical architecture establishes a hidden state mapping channel based on a surface operation log matrix. It directly uses the percentage of active time in the foreground of the target application and the frequency of startup of non-target processes as static absolute judgment quantification benchmarks. It strips away the deep topological inter-process call relationships at the system's underlying level and relies solely on static absolute startup frequency and active time percentages to perform system state judgment. This causes the computing system to lose its ability to identify and evaluate low-frequency, high-system-resource-consuming silent background communication processes. When the system evaluation indicators deviate from the quantification benchmarks, it directly triggers intervention actions that call the system's underlying programming interface to rewrite multiple core configuration parameters. It lacks dynamic verification of the intervention range and safety proportion boundary truncation and restriction mechanisms before the underlying actions are executed, which may lead to bottom-level problems. The unstable operating environment at the layer may even lead to the forced termination of kernel-level system services. When the terminal device is in a high-system-load concurrent operation cycle, a low-level system-level security component update process, although meeting the single-cycle start frequency limit and thus exempt from triggering the interception mechanism, may continuously and forcibly occupy extremely high network download bandwidth and memory page swapping scheduling resources in the background. This can cause delays and stuttering in the data read and write response of the target application in the foreground, thereby disrupting the focused execution environment. If the aforementioned core update process is abruptly cut off according to static fixed evaluation benchmark parameters, it is very easy to induce a communication breakdown and collapse of the underlying core driver components of the operating system, resulting in abnormal crashes and restarts of the physical terminal device, completely destroying the continuity of flow immersion and causing the risk of loss of business operation data. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and propose an integrated device for flow data acquisition and behavioral intervention.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an integrated device for flow acquisition and behavioral intervention.

[0007] System log module: Based on the physical interrupt timestamp and active window handle character, extract the time span and window dwell period, combine the dwell period and span to construct a discrete tensor, merge the current state and historical state tensors, write the integrated tensor to the memory unit, and generate a time-series communication vector; Process topology module: Based on the time-series communication vector, the process identifier is converted into node coordinates through a graph neural network, the coordinates are associated with the communication frequency, the associated values ​​are compared with the baseline and the end level of node traversal is extracted, the depth is read to construct an anomaly penalty term, the penalty term and the reward tensor are merged, and the factor correction matrix is ​​obtained. Strategy optimization module: Based on the factor correction matrix, extract matrix elements and weight parameters, evaluate the probability ratio by the long short-term memory network, compare the ratio value with the truncation threshold, extract the value associated with the benefit parameter, locate the intervention level corresponding to the parameter, convert the level into instruction code, and output the discrete action identifier. Interface mapping module: Based on the factor correction matrix and the action discrete identifier, compare the identifier with the built-in instruction list, extract the interface code associated with the matching instruction, read the communication handle of the matrix abnormal node, combine the handle and the code to construct a pointer, bind the system path and the pointer address, and obtain the kernel blocking stack; Resource rate limiting module: Based on the kernel blocking stack, extract the non-core process thread identifier, overwrite the status register to the sleep value, flip the routing table data discard flag, overwrite the global pop-up switch according to the path, modify the screen brightness attenuation configuration parameters, and generate communication rate limiting parameters.

[0008] As a further aspect of the present invention, the timing communication vector includes a time span, a window dwell period, and an integration tensor; the factor correction matrix includes a node coordinate tensor, an anomaly penalty term, and a communication reward tensor; the action discrete identifier includes a communication intervention level, a device identification instruction code, and a low-level restriction identifier; the kernel blocking stack includes an anomaly code handle, a registry modification path, and a pointer memory start address; and the communication rate limiting parameters include a register sleep value, a data discard control bit, and a screen brightness attenuation percentage.

[0009] As a further aspect of the present invention, the system log module includes: The dwell time extraction submodule: Based on the physical interruption timestamp and the active window handle character, it extracts the difference by subtracting adjacent timestamps, extracts the window dwell time parameter, splices the time difference and dwell parameter, combines multi-dimensional state values ​​to construct a matrix, and generates a communication discrete tensor. State memory submodule: Based on the communication discrete tensor, extract the current state discrete values, merge the historical distribution elements and sum them, assemble the multidimensional discrete tensor into the underlying storage stack, call the hardware addressing channel to write the integration matrix, and generate the time-series communication vector.

[0010] As a further aspect of the present invention, the process topology module includes: Coordinate mapping submodule: Based on the time-series communication vector, a graph neural network is used to convert the underlying process identifier to planar node coordinates, extract the communication call frequency value, bind the planar node coordinates and the call frequency value, assemble the node coordinate tensor and frequency sequence to form a network structure model, and generate the node frequency topology; Hierarchical traversal submodule: Based on the node frequency topology, compare the node association frequency with the distribution baseline parameters, strip off node elements that deviate from the distribution baseline, extract the hierarchical traversal of the stripped nodes to the terminal branches, read the terminal depth parameters to construct an anomaly penalty value sequence, and generate depth penalty parameters; Tensor merging submodule: Based on the depth penalty parameter, it retrieves the underlying communication reward tensor of the operating system, concatenates the abnormal penalty value with the reward tensor elements, superimposes the tensor feature dimension values, merges the multi-dimensional penalty terms with the communication reward tensor elements to construct a matrix, and obtains the factor correction matrix.

[0011] As a further embodiment of the present invention, the graph neural network extracts the underlying process identifier based on the time-series communication vector, calls the graph neural network input layer, maps the underlying process identifier to the initial feature tensor, calls the graph neural network weight parameter matrix, multiplies the initial feature tensor and the weight parameter matrix to output a linear transformation matrix, uses a nonlinear activation function to solve the linear transformation matrix to output the hidden layer feature vector, extracts two floating-point values ​​in the hidden layer feature vector, and merges the two floating-point values ​​to construct the planar node coordinates.

[0012] As a further aspect of the present invention, the strategy optimization module includes: Probability Proportion Submodule: Based on the aforementioned factor correction matrix, the matrix's underlying numerical elements and action weight parameters are multiplied by the current communication probability and historical probability to obtain the proportion value. The proportion value is then merged and assembled using a long short-term memory network to construct a multidimensional numerical distribution sequence and obtain the action probability proportion sequence. The revenue evaluation submodule: Based on the action probability ratio sequence, compare the sequence ratio value with the truncation threshold, extract the parameter that does not exceed the threshold, multiply the extracted parameter with the revenue base value, calculate the communication return value, assemble the return value to construct an evaluation vector, and generate the truncated revenue evaluation vector. Instruction conversion submodule: Based on the truncated benefit evaluation vector, extract the underlying numerical correlation of the vector with the communication intervention level, locate the hardware limitation parameters corresponding to the intervention level, convert the intervention level into device identification instruction code, merge the instruction codes to output the underlying limitation identifier, and generate a discrete action identifier.

[0013] As a further aspect of the present invention, the Long Short-Term Memory (LSTM) network first extracts the proportion values ​​to construct a temporal input tensor, retrieves the network forget gate weight parameters, multiplies the temporal input tensor and forget gate weight parameters to output a retention coefficient, obtains the state vector of the historical memory unit within the network, multiplies the retention coefficient and the historical memory unit state vector to extract decayed memory features, retrieves the network input gate weight parameters, multiplies the temporal input tensor and input gate weight parameters to output candidate update features, superimposes the decayed memory features and candidate update features to obtain the current memory unit state vector, retrieves the network output gate weight parameters, multiplies the current memory unit state vector and output gate weight parameters to generate hidden layer splicing features, and combines the hidden layer splicing features to merge and assemble the proportion values.

[0014] As a further aspect of the present invention, the following steps are taken: extracting the underlying numerical values ​​of the vector associated with the communication intervention level; parsing and truncating the benefit evaluation vector; calculating the continuous floating-point benefit values ​​respectively; retrieving the underlying storage mapping dictionary table; extracting the multi-quantization boundary thresholds for dividing the state space within the table; comparing the continuous floating-point benefit values ​​with the multi-quantization boundary thresholds; determining the absolute value range to which the continuous floating-point benefit values ​​belong; locking the target quantization isolation interval where the continuous floating-point benefit values ​​reside; retrieving the configuration parameter slots attached to the target quantization isolation interval; reading the preset discrete integer state identifiers within the parameter slots; and converting the discrete integer state identifiers to the corresponding communication intervention level.

[0015] As a further aspect of the present invention, the interface mapping module includes: Handle extraction submodule: Based on the factor correction matrix and the action discrete identifier, compare the identifier with the built-in instruction list and extract the instruction-related interface code, read the communication handle of the matrix abnormal node, concatenate the communication handle and the interface code segment, and generate an abnormal code handle; Pointer Binding Submodule: Based on the exception code handle, convert the code into a physical address pointer, read the pop-up control registry modification path, bind the modification path and the pointer memory start address, write the binding address parameter to the underlying control stack, and obtain the kernel blocking stack.

[0016] As a further aspect of the present invention, the resource rate limiting module includes: Thread State Submodule: Based on the kernel blocking stack, extract the non-core process thread identifier, overwrite the processor status register to the sleep value, flip the data packet discard control bit, assemble the register sleep value and discard control bit parameters, and generate the underlying sleep parameters. Pop-up configuration submodule: Based on the underlying sleep parameters, extract the pop-up modification path and overwrite the path-associated pop-up control bit, call the hardware backlight driver and modify the screen brightness attenuation percentage, merge the brightness attenuation parameter and sleep parameter, and generate communication current limiting parameters.

[0017] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by using graph neural networks to convert the underlying process identifiers to planar node coordinates, and associating the coordinates with communication frequency to construct a network structure model, the underlying communication optimization incentive feedback channel is reconstructed, which has the ability to accurately mine the deep topological relationship evaluation of hidden redundant communication nodes at the bottom of the system. In this invention, by using a long short-term memory network to process the dot product results of matrix numerical elements and action weight parameters, comparing the truncation threshold to extract parameters that have not been exceeded, calculating the communication reward value to locate the intervention level, deeply analyzing the inherent temporal dependency characteristics of multidimensional operation logs, and avoiding the risk of the operating environment crashing due to the strategy iteration range exceeding the limit. In this invention, by extracting the thread identifier of a non-core process and overwriting the processor status register to the sleep value, flipping the routing table data discard flag bit, overwriting the global pop-up switch bit according to the path, and modifying the screen brightness attenuation configuration parameters, the target focused process can exclusively occupy the system's core computing resources. Attached Figure Description

[0018] Figure 1 This is a flowchart of the apparatus of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0020] Example 1 Please see Figure 1 The present invention provides a technical solution: an integrated device for flow acquisition and behavioral intervention.

[0021] System log module: Based on the physical interrupt timestamp and active window handle character, extract the time span and window dwell period, combine the dwell period and span to construct a discrete tensor, merge the current state and historical state tensors, write the integrated tensor to the memory unit, and generate a time-series communication vector; Process topology module: Based on time-series communication vectors, process identifiers are converted into node coordinates through graph neural networks, the coordinates are associated with communication frequency, the associated values ​​are compared with the baseline and the end level of node traversal is extracted, the depth is read to construct an anomaly penalty term, the penalty term and the reward tensor are merged, and the factor correction matrix is ​​obtained. Strategy optimization module: Based on the factor correction matrix, extract matrix elements and weight parameters, evaluate the probability ratio by the long short-term memory network, compare the ratio value with the truncation threshold, extract the value associated with the return parameter, locate the intervention level corresponding to the parameter, convert the level into instruction code, and output the discrete action identifier. Interface mapping module: Based on the factor correction matrix and action discrete identifier, compare the identifier with the built-in instruction list, extract the interface code associated with the matching instruction, read the communication handle of the matrix abnormal node, combine the handle and code to construct a pointer, bind the system path and pointer address, and obtain the kernel blocking stack; Resource rate limiting module: Based on the kernel blocking stack, extract the thread identifier of non-core processes, overwrite the status register to the sleep value, flip the routing table data discard flag, overwrite the global pop-up switch bit according to the path, modify the screen brightness attenuation configuration parameters, and generate communication rate limiting parameters.

[0022] The timing communication vector includes the time span, window dwell period, and integration tensor; the factor correction matrix includes the node coordinate tensor, the exception penalty term, and the communication reward tensor; the action discrete identifier includes the communication intervention level, the device identification instruction code, and the underlying restriction identifier; the kernel blocking stack includes the exception code handle, the registry modification path, and the pointer memory start address; and the communication rate limiting parameters include the register sleep value, the data discard control bit, and the screen brightness decay percentage.

[0023] The system log module includes: The resident extraction submodule, based on physical interrupt timestamps and active window handle characters, employs a sliding window batch processing method and a one-hot encoding mapping method to perform subtraction of adjacent timestamps to obtain the difference and feature dimension transformation operations. It also performs time step allocation and setting actions, reading the local configuration file to allocate memory and setting the step size parameter to 256 steps. It extracts adjacent physical interrupt timestamps within the 256-step range, performs floating-point subtraction to obtain the time difference sequence, divides the time difference by an 86400-second baseline value to obtain the proportion parameter, extracts the active window handle character, and calls the one-hot encoding mapping method. The hot coding mapping method constructs a 1024-dimensional character feature dictionary, compares the active window handle character with the fixed position encoding in the character feature dictionary, extracts the matching position index and assigns it the integer 1, extracts the remaining 1023 position indices and assigns them the integer 0, converts the active window handle character into a 1024-dimensional discrete state vector, extracts the window dwell period parameter and concatenates it with the aforementioned proportional parameter, merges the 1024-dimensional discrete state vector with the time dwell feature parameter, and performs a superposition and concatenation operation along the feature dimension at the end of the tensor to form a 1026-dimensional integrated feature matrix, generating a communication discrete tensor; State Memory Submodule: Based on the communication discrete tensor, it employs an exponentially weighted moving average method and a physical memory direct addressing method to extract the current state discrete values ​​and perform historical distribution element merging and summation operations. It also performs historical state decay factor allocation. The system reads the system's global configuration registry key value to set the historical decay factor value to 0.95 and the current update weight value to 0.05. It extracts the current state discrete values ​​from the communication discrete tensor, calls the physical memory direct addressing method to read the starting address of the base address register, adds a 64-megabyte offset, and locks the underlying storage stack. For each memory block, extract the pre-stored historical distribution element tensor, multiply it by the historical decay factor of 0.95 to obtain the decayed historical distribution feature, multiply it by the current state discrete value and the current update weight of 0.05 to obtain the current update feature, perform matrix element-level addition to sum the decayed historical distribution feature and the current update feature, assemble the multidimensional discrete tensor and convert the data type to 64-bit single-precision floating-point format, call the hardware addressing channel to sequentially overwrite the underlying storage stack memory block address area, write the integration matrix to the underlying physical storage medium, and generate the timing communication vector.

[0024] The process topology module includes: The coordinate mapping submodule, based on temporal communication vectors, employs graph neural network and graph convolution feature processing methods to perform the transformation from underlying process identifiers to planar node coordinates. It also initializes the process attribute feature dimensions, reading the local environment variable configuration file to set the initial hidden dimension parameter of nodes to 128 dimensions. The submodule extracts the underlying process identifier and maps it to a 128-dimensional initial feature tensor. It then reads the local environment variable configuration file to set the graph convolution weight parameter matrix to a 128x64 two-dimensional array. Finally, it calls the graph convolution feature processing method to map the 128-dimensional initial feature tensor to the 128x64 two-dimensional array. The matrix dot product operation is performed on the two-dimensional array to output a 64-dimensional linear transformation intermediate matrix. The elements of the linear transformation intermediate matrix are extracted and the less-than-zero elements are cleared and the greater-zero elements are retained and activated. The 64-dimensional hidden layer feature vector is output. The first and last floating-point values ​​of the 64-dimensional hidden layer feature vector are extracted and combined to construct two-dimensional planar node coordinates. The communication call frequency value is extracted and bound to the two-dimensional planar node coordinates and the communication call frequency value. The two-dimensional planar node coordinate tensor and the communication call frequency sequence are assembled. The splicing and combination operation is performed along the feature dimension to form a network structure model and generate a node frequency topology. The hierarchical traversal submodule, based on node frequency topology, employs an isolated forest anomaly detection method and a tree structure hierarchical traversal method to compare node association frequencies with distribution baseline parameters. It performs initial setting of the distribution baseline parameters, queries the underlying hardware historical operating load database to extract the average communication frequency for the previous 30 days, and sets the distribution baseline parameter to 5000 calls per second. It compares the node association frequency with the 5000 calls per second distribution baseline parameter, removing nodes that deviate from the baseline parameter and are associated with nodes exceeding 5000 calls per second. It then calls the isolated forest anomaly detection method to construct an integrated detection structure containing 100 isolated trees, setting individual isolated trees... The number of subsamples is 256. Single-item segmentation floating-point values ​​are randomly selected between the upper limit value and the lower limit value of the feature boundary of the node element. Based on the single-item segmentation floating-point values, the node data space is cyclically cut to construct a multi-level branch decision tree structure. The tree structure level traversal method is called to extract the feature parameters of the stripped node and traverse the level of the end branch inside the multi-level branch decision tree structure. The physical path length of the feature parameters of the stripped node falling into the end leaf node of the multi-level branch decision tree structure is extracted. The physical path length is read as the end depth parameter. The end depth parameter is multiplied by a negative exponential decay ratio coefficient with a base of 2 to construct an abnormal penalty value sequence and generate the depth penalty parameter. The tensor merging submodule, based on the depth penalty parameter, employs a multilayer perceptron feature fusion method and a tensor broadcast alignment method to retrieve the operating system's underlying communication report tensor. It pre-sets the number of hidden layer nodes in the multilayer perceptron by reading the motherboard cache configuration registry key values ​​and setting the number of input layer nodes to 128 and the number of hidden layer nodes to 256. It then retrieves the operating system's underlying communication report tensor and calls the tensor broadcast alignment method to expand the dimensions of the underlying communication report tensor to match the dimension number of the anomaly penalty value sequence. Finally, it concatenates the expanded dimension anomaly penalty value sequence with the underlying tensor. The communication reward tensor elements constitute a 128-dimensional mixed feature array. The multilayer perceptron feature fusion method is called to multiply the 128-dimensional mixed feature array with the 128-row, 256-column weight matrix of the input layer. The values ​​of the 256-dimensional bias array are superimposed to output a 256-dimensional hidden layer transition array. Each element of the 256-dimensional hidden layer transition array is extracted and a non-linear activation mapping operation is performed. The tensor feature dimension values ​​output by the non-linear activation mapping operation are added together. The multi-dimensional penalty term is merged with the underlying communication reward tensor elements to construct a 128-row, 128-column two-dimensional floating-point numerical matrix, and the factor correction matrix is ​​obtained.

[0025] The strategy optimization module includes: The probability ratio submodule, based on the factor correction matrix, employs a policy gradient probability evaluation method and a long short-term memory network method. It performs dot product operations between the matrix's underlying numerical elements and action weight parameters, as well as division operations between the current communication probability and historical probabilities. It initializes the action weight parameters by pre-setting actions, retrieving the local policy control configuration table to set the initialization of action weight parameters to follow a Gaussian distribution with a mean of 0 and a standard deviation of 0.1. It extracts the underlying numerical elements from the factor correction matrix, performs a dot product operation between these elements and the action weight parameters, and outputs the current communication probability parameter by calling an exponential function on the result. It also retrieves historical communication probability parameters from the local cache, divides the current communication probability parameter by the historical probability parameter to obtain the individual ratio value, and uses a long short-term memory network method to extract the ratio. A 128-dimensional temporal input tensor is constructed by taking multiple individual proportional values. The system reads the network weight initialization file and sets the forget gate bias parameter to 1.0. The network forget gate weight matrix is ​​extracted and matrix multiplied with the 128-dimensional temporal input tensor to output the retention coefficients. The state vector of the memory unit of the previous time step is extracted by retrieving the internal hidden layer. The retention coefficients are multiplied with the state vector of the memory unit of the previous time step to extract the decay state features. The network input gate weight matrix is ​​extracted and multiplied with the 128-dimensional temporal input tensor to output the candidate feature vector. The decay state features and the candidate feature vector are added to obtain the current unit state vector. The network output gate weight matrix is ​​multiplied with the current unit state vector to extract the hidden layer feature tensor. Multiple hidden layer feature tensors are merged and assembled to construct a multidimensional numerical distribution sequence to obtain the action probability ratio sequence. The revenue assessment submodule, based on the action probability ratio sequence, employs a proximal strategy optimization pruning method and a dominance assessment basis deduction method. It compares the sequence ratio values ​​with truncation thresholds and multiplies extracted parameters with the revenue basis values. It pre-sets the truncation threshold parameter range, reads the local hyperparameter setting registry to extract configuration key values, and sets the upper limit of the truncation threshold to 1.2 and the lower limit to 0.8. It extracts the sequence ratio values ​​within the action probability ratio sequence, uses the proximal strategy optimization pruning method to call the tensor conditional comparison execution program to compare each sequence ratio value with the upper limit of 1.2 and the lower limit of 0.8, determines the range of each sequence ratio value, and discards values ​​greater than 1.2. For numerical elements in the range less than 0.8, retain and extract parameters that fall within the range of 0.8 to 1.2 and do not exceed the threshold. Perform a pre-extraction of the base value of the revenue. The system calls the advantage assessment cache library to extract the time difference error array and sets it as a 64-dimensional revenue base value tensor. Using the advantage assessment base deduction method, perform scalar multiplication operation on the proposed parameters that do not exceed the threshold and the 64-dimensional revenue base value tensor to calculate the value of a single communication return. For multiple parameters that do not exceed the threshold, perform scalar multiplication operation iteratively to obtain a one-dimensional array containing multiple communication return values. Concatenate the one-dimensional array containing multiple communication return values ​​and the current action value array along the data bus to form a 128-dimensional hybrid assessment tensor and generate a truncated revenue assessment vector. The instruction conversion submodule, based on the truncated benefit evaluation vector, employs a discrete action space mapping method and a machine hexadecimal translation method to extract the correlation between the vector's underlying values ​​and the communication intervention level, locate hardware limitation parameters, and pre-write the communication intervention level boundary configuration. The system reads the underlying hardware mapping configuration file, setting the floating-point value range for Level 1 communication intervention to 0.2 to 0.5 and for Level 2 communication intervention to 0.5 to 0.8. It reads multiple consecutive floating-point underlying values ​​within the truncated benefit evaluation vector, compares these values ​​with the aforementioned preset floating-point value ranges using the discrete action space mapping method, assigns values ​​falling within the 0.2 to 0.5 range as Level 1 intervention discrete variables, and assigns values ​​falling within the range of... The continuous floating-point values ​​in the range of 0.5 to 0.8 are assigned as secondary intervention discrete variables. The hardware peripheral control driver dictionary is retrieved. The primary and secondary intervention discrete variables are used as physical addressing keys to locate the corresponding system bus buffer register hardware limit parameters inside the dictionary. The system string associated with the hardware limit parameters is extracted. The machine hexadecimal translation method is used to call the memory byte parsing execution program to extract the character information exchange standard code values ​​inside the system string. The information exchange standard code values ​​are converted into hexadecimal device identification instruction code variables with symbol prefixes by performing a shift mask operation. Newline separators are inserted between multiple instruction code variables to perform a combination and concatenation operation, and a multi-dimensional underlying limit identifier array is output to generate action discrete identifiers.

[0026] The interface mapping module includes: The handle extraction submodule, based on the factor correction matrix and discrete action identifiers, employs a hash table key-value matching method and a dynamic link library injection reading method to compare the identifier with the built-in instruction list and extract associated interface code. It loads pre-defined actions from the built-in instruction list, reads the system drive's dynamic configuration file to set the built-in instruction list to include 256 underlying network blocking rule code references, calls the hash table key-value matching method to extract the individual device identification instruction code within the discrete action identifier as the query key, and executes a traversal search program within the 256 underlying network blocking rule code references to extract the corresponding Transmission Control Protocol (TCP) blocking interface code segment for successfully matched entries. The extracted factor correction matrix contains abnormal state evaluation dimension values. The dynamic link library injection reading method is called to convert the abnormal state evaluation dimension values ​​into operating system process access permission token parameters. The operating system process access permission token parameters are used to break through the process isolation sandbox to read the local network communication hook log sequence. The unique socket communication handle identifier corresponding to the specific abnormal node is extracted from the local network communication hook log sequence. A continuous 64-byte blank buffer area is allocated in the memory stack space. The unique socket communication handle identifier array and the transmission control protocol blocking interface code segment array are copied and written into the continuous 64-byte blank buffer area in sequence and spliced ​​to generate an abnormal code handle. The pointer binding submodule, based on the exception code handle, employs virtual address translation and low-level register overwriting methods to perform code-to-physical address pointer conversion and path-to-memory starting address binding operations. It also performs pre-writing of registry path configuration settings via pop-up controls, globally intercepts boolean values ​​to activate the path modification by setting a do-not-disturb mode in the system control panel configuration file, and stores the physical track address of a specific registry key. The virtual address translation method extracts a continuous 64-byte buffer area within the exception code handle containing the operating system kernel-level virtual memory allocation base address parameters. It then adds the operating system kernel-level virtual memory allocation base address parameters to the memory page table directory constant offset of 4096 bytes, performing integer addition to calculate and outputting 64 bytes. A 64-bit integer variable is used as the physical address pointer of the starting address of the current process's execution stack segment memory. The aforementioned global interception boolean value of the system drive letter do-not-disturb mode is invoked to activate the modification path configuration file and read the physical track address parameter. The underlying register overwrite method is called to declare a 64-bit structure data type variable. The physical track address parameter is filled into the first configuration field of the structure data type variable, and the physical address pointer of the starting address of the memory is filled into the second configuration field of the structure data type variable. The modification path and the memory start address binding action are completed. The system's underlying privileged instruction set calling function interface program is called to write the 64-bit structure data type variable into the underlying control stack space of the system kernel thread scheduling execution control queue in sequence, and the kernel blocking stack is obtained.

[0027] The resource rate limiting module includes: The thread state submodule, based on the kernel blocking stack, employs system-level memory mapping access and network kernel routing table bit operations to extract non-core process thread identifiers and overwrite processor status registers. It pre-enters the status register's sleep value, reads the motherboard power supply advanced interface configuration table to set the register's sleep value to a specific 8-bit hexadecimal instruction, extracts the 64-bit physical start address parameter from the kernel blocking stack, calls the system-level memory mapping access method to address the operating system kernel memory space based on the 64-bit physical start address parameter, extracts a 32-bit non-core process thread identifier, locates the physical address of the CPU thread execution status register based on the 32-bit non-core process thread identifier, writes a specific 8-bit hexadecimal instruction to replace the original running parameters, calls the network kernel routing table bit operation method to address the underlying network card device control register, extracts the network packet transmit / receive status word, performs a NOT gate logic operation on the 7th bit of the network packet transmit / receive status word, flips the network packet discard control bit to a high level, allocates 64 bytes of buffer space, and performs a bitwise concatenation operation with the specific 8-bit hexadecimal instruction and the high-level network packet discard control bit parameter to generate the underlying sleep parameter. The pop-up configuration submodule, based on underlying sleep parameters, employs system registry handle control and hardware abstraction layer interface communication methods to extract the pop-up modification path and modify the screen brightness attenuation percentage. It performs pre-setting of screen backlight brightness attenuation parameters, queries the local graphics display configuration file to set the target screen brightness attenuation percentage to 30% of the initial brightness value, extracts the underlying sleep parameters and embeds them into the internal registry physical modification path, calls the system registry handle control method to request node read / write management permissions based on the registry physical modification path, locates the 4-byte integer key value storage location of the global pop-up control switch, writes an integer 0 to overwrite the global pop-up switch to disable the operating system interface application notification state, calls the hardware abstraction layer interface communication method to open the motherboard integrated internal communication bus transmission channel, establishes a handshake connection channel with the hardware backlight driver's internal microcontroller, sends a display adjustment command control frame to the hardware backlight driver's internal microcontroller, overwrites the brightness value of the display control register to the aforementioned 30% attenuation parameter, requests a 16-bit long integer variable to store the 30% attenuation parameter and the integer 0 control bit value, and superimposes and merges the 16-bit long integer variable with the underlying sleep parameters to construct a system-level comprehensive hardware constraint vector, generating communication current limiting parameters.

[0028] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An integrated device for flow data acquisition and behavioral intervention, characterized in that, The device includes: System log module: Based on the physical interrupt timestamp and active window handle character, extract the time span and window dwell period, combine the dwell period and span to construct a discrete tensor, merge the current state and historical state tensors, write the integrated tensor to the memory unit, and generate a time-series communication vector; Process topology module: Based on the time-series communication vector, the process identifier is converted into node coordinates through a graph neural network, the coordinates are associated with the communication frequency, the associated values ​​are compared with the baseline and the end level of node traversal is extracted, the depth is read to construct an anomaly penalty term, the penalty term and the reward tensor are merged, and the factor correction matrix is ​​obtained. Strategy optimization module: Based on the factor correction matrix, extract matrix elements and weight parameters, evaluate the probability ratio by the long short-term memory network, compare the ratio value with the truncation threshold, extract the value associated with the benefit parameter, locate the intervention level corresponding to the parameter, convert the level into instruction code, and output the discrete action identifier. Interface mapping module: Based on the factor correction matrix and the action discrete identifier, compare the identifier with the built-in instruction list, extract the interface code associated with the matching instruction, read the communication handle of the matrix abnormal node, combine the handle and the code to construct a pointer, bind the system path and the pointer address, and obtain the kernel blocking stack; Resource rate limiting module: Based on the kernel blocking stack, extract the non-core process thread identifier, overwrite the status register to the sleep value, flip the routing table data discard flag, overwrite the global pop-up switch according to the path, modify the screen brightness attenuation configuration parameters, and generate communication rate limiting parameters.

2. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The time-series communication vector includes time span, window dwell period, and integration tensor; the factor correction matrix includes node coordinate tensor, anomaly penalty term, and communication reward tensor; the action discrete identifier includes communication intervention level, device identification instruction code, and underlying restriction identifier; the kernel blocking stack includes anomaly code handle, registry modification path, and pointer memory start address; and the communication rate limiting parameters include register sleep value, data discard control bit, and screen brightness attenuation percentage.

3. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The system log module includes: The dwell time extraction submodule: Based on the physical interruption timestamp and the active window handle character, it extracts the difference by subtracting adjacent timestamps, extracts the window dwell time parameter, splices the time difference and dwell parameter, combines multi-dimensional state values ​​to construct a matrix, and generates a communication discrete tensor. State memory submodule: Based on the communication discrete tensor, extract the current state discrete values, merge the historical distribution elements and sum them, assemble the multidimensional discrete tensor into the underlying storage stack, call the hardware addressing channel to write the integration matrix, and generate the time-series communication vector.

4. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The process topology module includes: Coordinate mapping submodule: Based on the time-series communication vector, a graph neural network is used to convert the underlying process identifier to planar node coordinates, extract the communication call frequency value, bind the planar node coordinates and the call frequency value, assemble the node coordinate tensor and frequency sequence to form a network structure model, and generate the node frequency topology; Hierarchical traversal submodule: Based on the node frequency topology, compare the node association frequency with the distribution baseline parameters, strip off node elements that deviate from the distribution baseline, extract the hierarchical traversal of the stripped nodes to the terminal branches, read the terminal depth parameters to construct an anomaly penalty value sequence, and generate depth penalty parameters; Tensor merging submodule: Based on the depth penalty parameter, it retrieves the underlying communication reward tensor of the operating system, concatenates the abnormal penalty value with the reward tensor elements, superimposes the tensor feature dimension values, merges the multi-dimensional penalty terms with the communication reward tensor elements to construct a matrix, and obtains the factor correction matrix.

5. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The graph neural network extracts the underlying process identifier based on the time-series communication vector, calls the graph neural network input layer, maps the underlying process identifier to the initial feature tensor, calls the graph neural network weight parameter matrix, multiplies the initial feature tensor and the weight parameter matrix to output the linear transformation matrix, uses a nonlinear activation function to solve the linear transformation matrix to output the hidden layer feature vector, extracts two floating-point values ​​in the hidden layer feature vector, and merges the two floating-point values ​​to construct the planar node coordinates.

6. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The strategy optimization module includes: Probability Proportion Submodule: Based on the aforementioned factor correction matrix, the matrix's underlying numerical elements and action weight parameters are multiplied by the current communication probability and historical probability to obtain the proportion value. The proportion value is then merged and assembled using a long short-term memory network to construct a multidimensional numerical distribution sequence and obtain the action probability proportion sequence. The revenue evaluation submodule: Based on the action probability ratio sequence, compare the sequence ratio value with the truncation threshold, extract the parameter that does not exceed the threshold, multiply the extracted parameter with the revenue base value, calculate the communication return value, assemble the return value to construct an evaluation vector, and generate the truncated revenue evaluation vector. Instruction conversion submodule: Based on the truncated benefit evaluation vector, extract the underlying numerical correlation of the vector with the communication intervention level, locate the hardware limitation parameters corresponding to the intervention level, convert the intervention level into device identification instruction code, merge the instruction codes to output the underlying limitation identifier, and generate a discrete action identifier.

7. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The Long Short-Term Memory (LSTM) network first extracts the proportional values ​​to construct a temporal input tensor. Then, it retrieves the network forget gate weight parameters, multiplies the temporal input tensor by the forget gate weight parameters to output a retention coefficient, obtains the state vector of the historical memory units within the network, multiplies the retention coefficient by the historical memory unit state vector to extract decayed memory features, retrieves the network input gate weight parameters, multiplies the temporal input tensor by the input gate weight parameters to output candidate update features, superimposes the decayed memory features and candidate update features to obtain the current memory unit state vector, retrieves the network output gate weight parameters, multiplies the current memory unit state vector by the output gate weight parameters to generate hidden layer splicing features, and combines the hidden layer splicing features to assemble the proportional values.

8. The integrated device for flow acquisition and behavioral intervention according to claim 6, characterized in that, The process involves extracting the underlying numerical values ​​of the vector associated with the communication intervention level, parsing and truncating the benefit evaluation vector, calculating continuous floating-point benefit values, retrieving the underlying storage mapping dictionary table, extracting the multi-quantization boundary thresholds for dividing the state space within the table, comparing the continuous floating-point benefit values ​​with the multi-quantization boundary thresholds, determining the absolute value range to which the continuous floating-point benefit values ​​belong, locking the target quantization isolation interval where the continuous floating-point benefit values ​​reside, retrieving the configuration parameter slots attached to the target quantization isolation interval, reading the preset discrete integer state identifiers within the parameter slots, and converting the discrete integer state identifiers into the corresponding communication intervention level.

9. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The interface mapping module includes: Handle extraction submodule: Based on the factor correction matrix and the action discrete identifier, compare the identifier with the built-in instruction list and extract the instruction-related interface code, read the communication handle of the matrix abnormal node, concatenate the communication handle and the interface code segment, and generate an abnormal code handle; Pointer Binding Submodule: Based on the exception code handle, convert the code into a physical address pointer, read the pop-up control registry modification path, bind the modification path and the pointer memory start address, write the binding address parameter to the underlying control stack, and obtain the kernel blocking stack.

10. The integrated device for flow acquisition and behavioral intervention according to claim 1, characterized in that, The resource rate limiting module includes: Thread State Submodule: Based on the kernel blocking stack, extract the non-core process thread identifier, overwrite the processor status register to the sleep value, flip the data packet discard control bit, assemble the register sleep value and discard control bit parameters, and generate the underlying sleep parameters. Pop-up configuration submodule: Based on the underlying sleep parameters, extract the pop-up modification path and overwrite the path-associated pop-up control bit, call the hardware backlight driver and modify the screen brightness attenuation percentage, merge the brightness attenuation parameter and sleep parameter, and generate communication current limiting parameters.

Images