Child wear device monitoring data processing method

Abstract

The present application provides a child wearing device monitoring data processing method, relates to the field of information systems, and comprises the following steps: collecting use behavior and group chat interaction data through a child smart watch end and uploading the data to a cloud end after desensitization; after desensitization, the data is processed in parallel through two channels, channel one performs semantic risk analysis based on end-side structured features and voice features and constructs a risk event timeline, and channel two constructs a social topology graph snapshot every week and calculates cross-week topology evolution features to match a risk mode template; the outputs of the two channels are fused through a four-quadrant decision matrix to generate a comprehensive risk rating, and a visual monitoring weekly report is pushed to a guardian together with communication activity, a contact relationship graph and use behavior analysis, while receiving feedback from the guardian to calibrate the topology risk threshold to form a closed loop; and all-link data is set to have different storage life cycles according to types, is physically deleted at the expiration date and records audit logs.

Description

Technical Field

[0001] This invention relates to the field of information systems, specifically to a method for processing monitoring data from children's wearable devices. Background Technology

[0002] With the widespread adoption of children's smartwatches among minors, children are increasingly engaging in online communication through the built-in social applications on these watches. Guardians' concern for their children's online social security has become a pressing need. Simultaneously, relevant laws and regulations impose strict compliance requirements on the processing of minors' personal information. How to achieve effective online social monitoring of children within a compliant framework has become a significant technical challenge in this field. Current technical solutions for children's online social safety mainly include text filtering solutions based on keyword blacklists and chat content review solutions based on centralized cloud storage. Keyword filtering solutions match chat text word by word using a pre-set sensitive word database and trigger alarms. Cloud review solutions upload the original chat logs from the device to the server, perform natural language processing analysis on the server, and then push the detection results to the guardian's terminal. The shortcomings of existing technologies are: keyword matching cannot identify risky content that is concealed by homophones, abbreviations, etc.; uploading and storing the original chat records in their entirety faces pressure to minimize data and comply with privacy protection regulations; only isolated detection of single messages is performed, lacking the ability to analyze the long-term evolution trend of social relationships; and there is a lack of a systematic monitoring mechanism that integrates behavioral data with social data and presents it to guardians in a visual manner on a periodic basis. Summary of the Invention

[0003] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a method for processing monitoring data from children's wearable devices, thereby solving the problem mentioned in the background technology that only detects isolated single messages and lacks the ability to analyze the long-term evolution trend of social relationships.

[0004] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: a method for processing monitoring data of children's wearable devices, comprising: S1, collecting usage behavior data, original group chat content data, and group chat interaction metadata through a child's smartwatch, identifying the target child, and uploading the data to a cloud data processing server; the cloud data processing server performing cloud feature extraction on the original group chat content data, generating terminal-side structured feature data fields and voice feature vector fields, deleting the original group chat content data, and then performing desensitization processing; S2, the desensitized group chat interaction data performs semantic risk analysis along the channel one processing path based on the terminal-side structured feature data field and the voice feature vector field, outputs risk category labels, risk probability values ​​and target child involved markers, constructs a group chat risk event timeline, and pushes alarm messages when alarm conditions are met; S3, the desensitized group chat interaction data is used to construct a snapshot of the group chat social topology graph week by week along the channel two processing path, calculate the topology evolution feature index across statistical periods, match the preset risk pattern template, and output the topology evolution risk score, deviation dimension identifier, confidence label and intermediate calculation index. S4, input the group chat risk event timeline and the topology evolution risk score into the fusion decision step, compare the topology evolution risk score with the preset topology risk threshold, and generate a comprehensive risk rating based on the four-quadrant decision matrix; S5, perform communication activity analysis, contact relationship graph analysis and usage behavior analysis, generate a visual monitoring weekly report by combining the comprehensive risk rating with the communication activity analysis results, contact relationship graph analysis results, usage behavior analysis results and risk event summary results, and push it to the guardian, receive feedback from the guardian to calibrate the preset topological risk threshold to form a feedback closed loop; S6 performs encrypted and time-sensitive storage on all data across the entire chain, manages the storage lifecycle differently according to data type, physically deletes expired data, and records compliance audit logs.

[0005] Preferably, in S1, the statistical period is a natural week, and the time window for topological evolution analysis is four consecutive natural weeks, with a time window length W of 4. Simultaneously, three types of data are silently collected from the child's smartwatch: the first type is usage behavior data, the second type is raw group chat content data, and the third type is group chat interaction metadata. The raw group chat content data includes two fields: raw text data and raw voice data. The raw text data field stores the raw text character sequence of the chat message, and the raw voice data field stores AMR format voice audio data collected by the built-in microphone. Feature extraction of the raw group chat content data is not performed on the smartwatch itself. After being cached in a local SQLite database, it is encrypted and uploaded to the cloud data processing server using HTTPS protocol when the device regains network connectivity. The cloud feature extraction service then performs the feature extraction. After feature extraction is completed in the cloud, the data is immediately physically deleted. The group chat interaction data includes seven fields: sender identifier, receiver identifier, timestamp, group chat identifier, message type, @mention list, and reply reference target message identifier. After the original group chat content data is uploaded to the cloud data processing server, the cloud feature extraction service extracts and generates end-side structured feature data fields and voice feature vector fields, which, together with the above seven group chat interaction metadata fields, form group chat interaction data containing nine fields. This data is then distributed and processed along the channel one processing path and the channel two processing path. The method for determining the target child is as follows: after the child's smartwatch account is pre-bound through the parent's mobile terminal application, it is matched in the group chat member list. The identifier of the successfully matched group member is determined as the target child identifier. The group chat interaction data, after being uniformly anonymized by the cloud data processing server, is distributed to two parallel processing paths: Channel 1 and Channel 2. Channel 1 takes the anonymized terminal-side structured feature data fields and voice feature vector fields as input, performs semantic risk analysis based on structured features using a large language model, and outputs a risk category label, risk probability value, and target child-related marker for each message, constructing a timeline of group chat risk events. When the risk category label is any of the categories of inducing fraud, inciting dangerous behavior, or inducing the disclosure of privacy, and the risk probability value is greater than 0.9, a real-time high-risk alarm is triggered, and an alarm message is immediately pushed to the parent's mobile terminal application. When the risk probability value is greater than 0.7 but not greater than 0.9, and signal B is not empty, a medium-risk immediate alert is triggered, and a collapsed display is pushed to the parent's mobile terminal application. The notification message states that the Channel 2 processing path takes group chat interaction metadata as input, constructs a weekly snapshot sequence of the group chat social topology graph, calculates topology evolution characteristic indicators across W weeks, matches a preset risk pattern template, and outputs a topology evolution risk score and deviation dimension identifier. The outputs of the Channel 1 and Channel 2 processing paths are simultaneously input into the dual-channel fusion decision processing steps, generating a comprehensive risk rating based on a four-quadrant decision matrix. This comprehensive risk rating, along with communication activity analysis results, contact relationship graph analysis results, usage behavior analysis results, and risk event summary results, generates a visualized weekly monitoring report, which is pushed to the guardian every Monday morning via the parent's mobile terminal application. Encrypted and time-sensitive storage is performed on the entire data chain, with differentiated fixed storage lifecycles set according to data types. Expired data is physically deleted by the cloud data processing server, and compliance audit logs are recorded.

[0006] Preferably, the children's smartwatch silently collects usage behavior data, raw group chat content data, and group chat interaction metadata through the built-in WeChat client's message listening interface. The usage behavior data includes three fields: application startup log, screen-on duration, and motion sensor activity record. The application startup log stores the startup timestamp and runtime of each application on the watch. The screen-on duration field stores the cumulative daily screen-on time in seconds. The motion sensor activity record field stores the number of steps detected by the built-in accelerometer and gyroscope, along with the exercise type classification results, including stationary, walking, running, and cycling. There are four categories; the raw content data of group chats includes two fields: raw text data field and raw voice data field. The raw text data field stores the raw text character sequence of the chat message, and the raw voice data field stores the AMR format voice audio data collected by the built-in microphone. The children's smartwatch does not run the on-device analysis model and automatic speech recognition model locally. The raw content data of group chats is not subject to feature extraction on the watch itself; it is directly cached in the local SQLite database and then uploaded to the cloud. The group chat interaction metadata includes sender identifier field, receiver identifier field, timestamp field, group chat identifier field, message type field, @mention list field, and reply reference target message. The message identifier field has 7 fields: Sender Identifier: stores the unique identifier of the message sender in the group chat member list; Receiver Identifier: stores the identifier of the target recipient of the message, and when broadcasting the message within the group, stores the identifiers of all group chat members; Timestamp: stores the Unix timestamp of the message sending time with 1ms precision; Group Chat Identifier: stores the unique identifier of the group chat to which the message belongs; Message Type: uses enumerated integer values ​​to mark the message type, where enumerated value 1 is text message, enumerated value 2 is voice message, enumerated value 3 is image message, and enumerated value 4 is emoticon message; @mention list: extracts the @ syntax markers one by one from the character sequence of the parsed message content. The group member ID mentioned by @ is stored in the current message record as a list data structure, and is set to an empty list when there is no @ syntax marker. The target message identifier field of the reply reference is obtained by reading the unique identifier of the target message being referenced by the reply reference interface of the Wechat client, and is stored in the current message record as a single-value string structure, and is set to an empty string when no reply reference operation is performed. The original group chat content data and group chat interaction metadata, a total of 9 fields, constitute the complete collection record of a single group chat message. After being cached in the local SQLite database on the child smartwatch, it is uploaded to the cloud data processing server in batches via HTTPS protocol when the device resumes network connection.

[0007] Preferably, the cloud data processing server deploys a cloud feature extraction service, which includes a text feature extraction submodule and a speech feature extraction submodule, and the two submodules run in parallel without blocking each other; After receiving the original text data field, the text feature extraction submodule performs the following processing steps: First, it performs Unicode normalization and word segmentation preprocessing on the original text character sequence; Second, it runs a full-precision Transformer architecture feature extraction model to extract a list of sentiment keywords, word frequency statistics vectors, and entity category label sets from the preprocessed text. The feature extraction model uniformly classifies words whose semantics cannot be determined into the category of suspected risk words and writes them into the sentiment keyword list as is, to be retained for secondary judgment by the large language model; Third, it assembles the extraction results into a structured feature data field on the client side and writes it into the metadata record of the message; Fourth, it performs physical deletion on the original text data field, records the deletion timestamp and data identifier, and writes it into the cleanup log; After receiving the raw speech data field, the speech feature extraction submodule performs the following processing steps: First, it runs an end-to-end automatic speech recognition model in the cloud to transcribe AMR format speech audio into a text character sequence; second, it inputs the transcribed text character sequence into the text feature extraction submodule to perform the same feature extraction process as above to generate structured feature data; third, it assembles the extraction results into a speech feature vector field and writes it into the message's metadata record; fourth, it performs physical deletion on the raw speech data field, records the deletion timestamp and data identifier, and writes it into the cleanup log. The cloud-based feature extraction service has a processing latency of no more than 200 milliseconds for a single message. The cloud-based data processing server performs feature extraction and original data deletion message by message to ensure that the original content data does not accumulate in batches in the cloud. During the temporary storage period of the original text data field and the original voice data field after being received by the cloud-based data processing server and before feature extraction is completed, the following security measures are in effect in parallel: First, the original content data is encrypted and stored in an independent temporary storage partition in AES-256-GCM mode, physically isolated from the desensitized structured feature data; Second, access permissions for the temporary storage partition are only granted to the cloud-based feature extraction service process, and other service modules and operation and maintenance accounts have no read permissions; Third, the temporary storage retention period for the original content data is set to no more than 30 minutes from the time of receipt. Data that has not completed feature extraction within the time limit is forcibly physically deleted by a scheduled cleanup task and an exception log is recorded; Fourth, all write, read, and delete operations of the original content data are recorded in a complete audit log, which is encrypted and stored for a retention period of 3 years. Preferably, after receiving group chat interaction data, the cloud data processing server performs unified desensitization in five steps. The first step is device identifier desensitization, which involves performing SHA-256 hash operations on the device identifier IMEI and MAC address in the sender identifier field and appending a 16-bit random value salt. The salt is generated by a true random number generator called by the cloud data processing server and stored in AES-256-GCM mode. The second step is identity information desensitization, which involves replacing the contact name field with an anonymous identifier automatically generated by the cloud data processing server, in the format of "group member_A", "group member_B" incrementing sequentially, and replacing the middle four digits of the phone number field with asterisks. The anonymous identifier retains its correspondence with the original identity through a mapping table that is only accessible to guardians with biometric authentication. The third step is interaction content desensitization, which involves verifying the entity category tag set in the structured feature data field on the client side. If the tag set contains a name... When labeling sensitive entities such as school name and home address, the original labels remain unchanged. When the label set does not contain the above three types of labels but there are high-weight terms of suspected sensitive entities in the word frequency statistics vector, they are supplemented as placeholder labels for the corresponding categories. Vector perturbation processing is performed on the feature components involving voiceprint identity information in the speech feature vector field to remove voiceprint identity features from the feature vector while retaining semantically related feature components. The fourth step is to blur the location information by adding Gaussian random noise with a mean of 0 and a standard deviation of 500m to the latitude and longitude coordinates, so that the coordinate accuracy is reduced to a radius range of 500m. The fifth step is to encrypt and transmit the data. All de-identified data is encrypted and stored in AES-256-GCM mode. Data transmission between the terminal device and the cloud data processing server and the parent mobile terminal application is performed through the TLS1.3 encrypted channel. After de-identification, the data can only be viewed by the authenticated guardian account through the parent mobile terminal application.

[0008] Preferably, in S2, after the cloud data processing server completes the desensitization, it performs three consecutive steps along the channel one processing path on the terminal-side structured feature data field and the speech feature vector field. The first step is structured feature data format verification and normalization. This involves performing Unicode normalization on the sentiment keyword list in the terminal-side structured feature data field to convert traditional Chinese to simplified Chinese, restoring Martian variant characters to standard Chinese characters through a preset character mapping table, performing L2 normalization on the word frequency statistics vector to make the vector magnitude 1, and performing label encoding mapping on the entity category label set to uniformly convert label names to preset category numbers, forming normalized terminal-side structured feature data. The second step... To perform semantic risk analysis based on structured features, a feature context window is formed by combining the normalized end-side structured feature data with the structured feature data of the first 10 messages in the group chat containing the message. If the total number of messages is less than 10, the feature data of all existing messages is used. The entire feature context window is then input into a large language model deployed on the cloud data processing server. A preset risk analysis prompt word template is executed for inference. The prompt word template consists of a role definition section and a task instruction section. The role definition section states, "You are a child social safety analysis expert. Based on the input structured feature data, perform risk analysis and output structured JSON results." The task instruction section includes five field output requirements. The value must be one of nine preset categories: normal, pornography, violence, bullying, fraud inducement, privacy inducement, incitement to dangerous behavior, inappropriate friendships, and negative emotions. The requirement is a floating-point number between 0 and 1 to represent the confidence level for classifying a field as abnormal. The requirement is that floating-point numbers ranging from -1 to +1 represent sentiment tendencies. The requirement is an integer, 0 or 1, indicating whether the target child is involved. The "reason" field requires a text summary of the judgment criteria within 200 characters. The task instruction segment also includes the instruction "For words in the sentiment keyword list that fall into the suspected risk category, first determine whether they are homophones, pinyin abbreviations, or emoji metaphors. If determined to be one of the above hidden expressions, first restore them to standard semantic words and then add them to the sentiment keyword list before performing analysis." The risk probability value is calculated by taking the maximum value of the probability of the 8 categories other than the normal category after the large language model outputs a 9-dimensional softmax probability vector. Sentiment score. The calculation method is to record the number of positive sentiment keywords in the sentiment keyword list as... The number of negative emotion keywords is recorded as ,Right now When the message sender or receiver is the target child, the relevant flag is set to 1; otherwise, it is set to 0. The third step is to construct the timeline of group chat risk events. After sorting all analysis results in ascending order by timestamp, the records with abnormal risk category labels and risk probability values ​​greater than 0.7 are filtered out. The timestamp, risk category label, risk probability value, relevant flag, and group chat identifier are extracted and assembled into risk event nodes. All risk event nodes of the week are sorted by timestamp to form the timeline of group chat risk events as the output of the channel one processing path.

[0009] Preferably, in S3, after the cloud data processing server completes the de-identification, it performs a weekly snapshot construction of the group chat social topology graph along the channel two processing path, using the group chat identifier field, sender identifier field, receiver identifier field, @mention relationship list field, reply referencing target message identifier field, and timestamp field. The construction process consists of two steps. The first step is to determine the node set, which is formed by using the de-identified identifiers of all group members who have sent at least one message in the target group chat during the week as nodes, and includes the target child identifier. As a special marker node, the second step is to construct the directed edge set and assign edge weights, for each pair of unequal ordered nodes in the node set V. and Calculation from point to directed edge weights The calculation formula is: ,in For week t Send and the recipient is Or the total number of messages from all members of the group chat. For week t The @mention relationship list field in the sent message contains The total number of messages, For week t The message sent references the target message identifier field. The total number of messages sent, α (0.5) represents the contribution ratio of basic message interaction, β (0.3) represents the contribution ratio of @mention behavior reflecting targeted attention relationship, and γ (0.2) represents the contribution ratio of reply citation behavior reflecting targeted response relationship, and all three satisfy the following conditions. Normalization constraints, Create from when greater than 0 arrive Directed edges and assigned weights , When the value is 0, no directed edges are created. All directed edges form set E. The node set V and the directed edge set E form a snapshot of the group chat social topology graph in week t. Where W is A weighted matrix is ​​used to construct K snapshots in parallel when the target child participates in K different group chats. (t) to (t) is the single-cycle output of the channel two processing path.

[0010] Preferably, after receiving the continuous W-week topology snapshot sequence G(1) to G(W) along the channel two processing path, the cloud data processing server calculates five topology evolution characteristic indicators for each group chat. The first indicator is the degree centrality time series. The breadth of interaction a target child receives from other members within a group chat topology is measured using the following formula: ,in For the topological snapshot G(t) of week t, the pointers are... The total number of directed edges, i.e., the in-degree value; |V(t)| is the total number of nodes, and the denominator is reduced by 1 to exclude nodes. itself, The values ​​range from 0 to 1, with values ​​closer to 1 indicating more interactions with different members. The second indicator is the eigenvector centrality time series. The formula for measuring whether a target child is interacted with by core members who are at the center of the network is as follows: ,and Where W(t) is the adjacency weight matrix of the topology graph in week t, and x is the largest eigenvalue. The corresponding eigenvector, x( ) is the feature vector Corresponding to the component values, the third indicator, the interaction frequency Gini coefficient time series Gini(t), measures the concentration of interactions among group members, and is calculated using the following formula: Where n is the total number of directed edges in week t, To determine the weight of the i-th edge after sorting all directed edge weights in ascending order, Gini(t) ranges from 0 to 1. A value closer to 1 indicates that the interaction is concentrated among a few member pairs. The fourth metric, ReplyRate(t), measures the proportion of responses from other members after a target child sends a message. The formula is: ,in The total number of messages sent to the target child in week t that were replied to and quoted by other members. The total number of messages sent to the target child in week t is used. The max function takes the larger value than 1 to avoid division by zero errors. The fifth indicator, the InFlow(t) index of newly added contacts, measures the rate at which newly added contacts rise in the intimacy ranking. The intimacy ranking is calculated based on the cumulative edge weights between each contact and the target child within a continuous W-week time window. Generate a ranking list of intimacy levels by sorting in descending order. ,in This represents the ranking of newly added contacts in week t within the week's intimacy ranking. The last ranking in week t-1 is the total number of contacts involved in the ranking. The larger the InFlow(t) value, the higher the intimacy ranking of the new contact in a shorter time. When there are no new contacts in week t, InFlow(t) is set to 0. The five evolutionary feature time series indicators each form a time series vector of length W in a continuous W week, which together constitute the cross-week topological evolution feature output of the channel two processing path.

[0011] Preferably, before performing the calculation of the cross-week topology evolution characteristic index, the cloud data processing server performs an activity assessment on each target group chat along the channel two processing path. The assessment process involves comparing the total number of directed edges in the target group chat's set E(t) in week t with a preset minimum effective edge count threshold. Comparison, The value is 6 directed edges, and the total number of edges is greater than or equal to 6. When determining an active group chat, the topological index observation value is directly used as the output, and the total number of edges is less than [a certain value]. If a group chat is identified as inactive, Bayesian prior correction needs to be performed on all five topological evolution characteristic indicators. The correction process first constructs a prior distribution. Historical observations of the five indicators of historically active group chats confirmed by guardians as "false alarms, not risks" are retrieved from the cloud data processing server database and fitted with normal distribution parameters as the prior distribution, with degree centrality... prior mean Take the mean and prior variance of historical observations Take the variance of historical observations, and the centrality of eigenvectors. The prior parameters for the Gini coefficient, Reply Rate, and InFlow are determined in the same way. When the system is in the cold start phase, i.e., when the cumulative feedback data after deployment is less than 4 weeks, the prior distribution parameters adopt the following default values. The value is 0.40. The value is 0.02. The value is 0.30. The value is 0.015. The value is 0.45. The value is 0.025. The value is 0.35. The value is 0.02. Values ​​1.0, The value is set to 0.5. This default value is based on statistical experience in children's group chat scenarios. After accumulating 4 weeks of feedback data, it automatically switches to normal distribution parameters fitted based on historical observations, and then performs Bayesian posterior estimation. Even when there are a few edges in the low-activity group chat in week t, the observed values ​​of each index are still calculated. Taking degree centrality as an example, the posterior estimation formula is as follows: ,in For degree centrality observations directly calculated based on a small number of edges, The posterior estimate is the variance of the observed values, and the smaller the sample size, the larger the variance. The posterior estimate is more biased towards the prior mean. The remaining four indicators are calculated using the same posterior estimation formula structure. The posterior estimates replace the direct observations as the indicator outputs, and confidence labels are attached. ,in () represents the total number of actual directed edges in the topological graph during week t; This is the preset minimum number of edges threshold; The value ranges from 0 to 1, with values ​​closer to 1 indicating a higher degree of data insufficiency. hour, The closer the value is to 1, the less data is available; when hour, The value is usually 0, indicating sufficient data; in subsequent dual-channel fusion decision processing steps, a decay coefficient of 1- is applied to the topological index with confidence labels. Multiplying by the original topology evolution risk score allows for a reasonable reduction in the contribution of the Channel 2 processing path to the overall risk rating when data is insufficient.

[0012] Preferably, after receiving the five topological evolution feature time series vectors corrected by Bayesian prior along the channel two processing path, the cloud data processing server performs trend fitting and pattern matching on each indicator time series. The first step is to calculate the slope of the linear regression, using the week number t as the independent variable and the time series value y(t) of each indicator as the dependent variable, constructing a least squares linear regression model to calculate the slope coefficient k, as shown in the formula: Where W is the time window length, with a value of 4; y(t) is the index value after Bayesian correction in week t; t is the week number, ranging from 1 to W; a positive k indicates an upward trend in the index time series, and a negative k indicates a downward trend, with a larger |k| indicating a more drastic trend change; eigenvector centrality. The normalization method for (t) is to take the absolute value of all components in the eigenvector x and then perform L1 normalization, so that the sum of the absolute values ​​of all components is 1. After normalization The value range of (t) is 0 to 1. The value range adaptation method of the new contact impact index InFlow(t) is as follows: when the total number of group members |V| in the node set V of the target group chat is less than 10, divide InFlow(t) by 10. (t-1) is normalized to standardize the InFlow(t) value range to 0 to 1. When the total number of group members |V| is greater than or equal to 10, InFlow(t) retains its original calculated value and is not normalized. The second step is to match it with the dynamic time warping (DTW) of the four preset risk pattern templates. The numerical vectors of the four templates are obtained by performing cluster analysis on the time series of topological indicators of four types of risk cases (social isolation, gradual inducement, group exclusion, and exclusive locking) in historical group chats labeled as positive samples, and then taking the indicator value sequence of each cluster center. Template 1 is the social isolation pattern. The template vector is [0.60, 0.45, 0.30, 0.15]; its ReplyRate template vector is [0.50, 0.35, 0.20, 0.10]; its Gini template vector is [0.30, 0.45, 0.60, 0.75]; template 2 is a progressive induction mode, and its InFlow template vector is [0.20, 0.30, 0.40, 0.50]; its The template vector is [0.30, 0.45, 0.60, 0.75], and template 3 represents the herd exclusion pattern. The template vector is [0.55, 0.40, 0.25, 0.10]; its Gini template vector is [0.35, 0.50, 0.65, 0.80]; and the additional condition is that the number of events marked as 1 involving the target child in the group chat risk event timeline output by the channel one processing path is greater than 0, and template 4 is an exclusive locking mode. The template vector is [0.30, 0.50, 0.50, 0.30]; its Gini template vector is [0.30, 0.45, 0.60, 0.75], and the DTW distance formula is... Where P is the time series vector of the indicator to be matched, and Q is the preset risk pattern template vector. Let L be the Euclidean distance function, where L is the total length of the normalized path. A smaller DTW distance indicates a greater similarity to the template. If the DTW distance between any index time series and any template is less than a preset matching threshold, then L is the correct DTW distance. At that time, it was determined that there was a risk of topological evolution. Take the 95th percentile of the DTW distance distribution of each indicator time series in the normal group chat historical data, and finally use the slope coefficient k, DTW distance value and the risk pattern number of the match hit as the output of the channel two processing path.

[0013] Preferably, in S5, after receiving the group chat risk event timeline output from the first processing path and the topology evolution risk score output from the second processing path, the cloud data processing server performs a fusion judgment according to the four-quadrant decision matrix. Signal A is defined as the output from the first processing path, and if it is not empty, it means that there is at least one risk event node in the current week with a risk category label that is not normal and a risk probability value greater than 0.7; if it is empty, it means that there is no such event. Signal B is defined as the topology evolution risk score. Where p is the index of the five topological evolution characteristic indicators, Let k be the linear regression slope coefficient of the p-th index after min-max normalization. The weights are the min-max normalized values ​​of the DTW distance of the optimal matching risk pattern template. The slopes for degree centrality, eigenvector centrality, Gini coefficient, reversion rate, and impact index are assigned a value of 0.25, 0.20, and 0.10 respectively. When assigned a value of 0.15, TopRisk is multiplied by a decay factor of 1 when a confidence level label is attached. (t) is compressed, and the deviation dimension identifier is determined by taking 5 values. The index p corresponding to the maximum value in the product is used as the deviation dimension identifier. TopRisk is greater than the preset topological risk threshold. Signal B is non-empty otherwise empty. The initial value is 0.45. In the four-quadrant decision matrix, if signal A is not empty and signal B is not empty, it is considered high risk, i.e., a double confirmation of content risk and topological anomaly; if signal A is empty and signal B is not empty, it is considered medium risk, i.e., there is topological anomaly but no content risk; if signal A is not empty and signal B is empty, it is considered low risk, i.e., there is scattered content risk but the group structure is stable; if signal A is empty and signal B is empty, it is considered normal. The medium risk determination result triggers an instant weekly alert message, which is pushed to the guardian in a collapsed display form through the parent's mobile terminal application. The alert message includes the deviation dimension identifier and a thumbnail of the topological evolution trend map. The comprehensive risk rating, along with the group chat risk event timeline details and the topological evolution trend map, is transmitted to the guardian's weekly report generation step. This step merges the decision output with the communication activity analysis results, contact relationship graph analysis results, usage behavior analysis results, and risk event summary results. The communication activity analysis results include the weekly chat frequency. Average duration of a single communication and peak periods There are three statistical indicators: The contact relationship graph analysis results include a list of high-frequency contact interactions and intimacy rankings, as well as markers for abnormally added contacts. The usage behavior analysis results include three dimensions: screen-on time trend, application usage distribution changes, and activity level changes. The screen-on time trend is presented as a daily line chart showing the change in screen-on time over the seven days of the week. The application usage distribution changes are presented as a pie chart comparing the percentage of each application's launch time with the average of the previous four weeks. The activity level changes are presented as a bar chart comparing the average daily steps taken in the current week with the average of the previous four weeks. The risk event summary results include risk type, occurrence time, and frequency trends, and real-time high-risk alerts. Alarm records are listed separately under the "Real-time Alarms This Week" category in the risk event summary and are not repeatedly included in the risk frequency trend statistics to avoid the same event being counted repeatedly and causing inflated frequencies. A weekly monitoring report is pushed out every Monday morning via the parent's mobile terminal application in a visual format combining text and images. The parent's mobile terminal application embeds feedback interaction controls on the weekly report page, allowing guardians to mark each risk event as "Confirmed Risk," "False Alarm Not Risk," or "Processed." Feedback data is transmitted back to the cloud data processing server via a TLS 1.3 encrypted channel. Using four consecutive weeks of feedback data as a calibration sample, when the percentage of times a guardian marks a risk as "Confirmed Risk" is less than 40%, [the system will be updated / degraded]. Increase by 0.05 to reduce the sensitivity of the channel 2 processing path; when the proportion is higher than 75%, Decrease by 0.03 to improve sensitivity, after calibration. It takes effect in the next analysis cycle, forming a feedback loop.

[0014] Preferably, the children's smartwatch silently collects usage behavior data while collecting group chat interaction data. This usage behavior data consists of logs and activity records generated during the watch's operation, including three fields: application startup log, screen-on duration, and motion sensor activity record. The application startup log stores the startup timestamps and runtime of each application on the watch. The screen-on duration field stores the cumulative daily screen-on time in seconds. The motion sensor activity record field stores the number of steps and movement type classification results detected by the built-in accelerometer and gyroscope. The purpose of collecting this usage behavior data is to assist in analyzing children's behavioral habits and product usage, not for chat content analysis. The usage behavior data is cached in the children's smartwatch's local SQLite database. After storage, the data is uploaded to the cloud data processing server in batches using the HTTPS protocol when the device regains network connectivity. User behavior data is also anonymized and then encrypted and stored in AES-256-GCM mode. Group chat interaction data and user behavior data from overseas regions are stored on local servers in the corresponding regions rather than being centrally stored in a single data center. The method for determining localized storage is that the cloud data processing server determines the geographical region based on the geographical location information of the child smartwatch's SIM card location code or Wi-Fi access point IP address, and then routes the data to the local storage node in the region to meet the requirements of local personal information protection regulations for data storage location. The data lifecycle management of localized storage follows local regulations and is no less than the differentiated storage lifecycle standard defined in the encryption and storage steps.

[0015] Preferably, the cloud data processing server performs communication activity analysis, contact relationship graph generation, and usage behavior analysis on the target children's group chat interaction data and usage behavior data using a natural week as the statistical period. The communication activity analysis includes three statistical indicators: weekly chat frequency, average duration of a single communication, and peak time period. The calculation formula is: ,in The total number of messages sent by the target child in all group chats during the week, and the number of natural days during the week in which the target child has a message sending record. The minimum value is 1 to avoid division by zero errors; the average duration of a single communication session. The calculation formula is: Where S is the total number of communication sessions with the target child in the current week, and j is the time interval from the timestamp of the first message to the timestamp of the last message in the j-th communication session, in seconds. The communication session segmentation rule is that if the timestamp interval between two adjacent messages in the same group chat exceeds 1800 seconds, they are judged as two different communication sessions. Peak period The method for determining the peak time is to divide the 24 hours of each day into 48 30-minute time slots for statistical analysis. The time slot with the highest number of messages sent by the target child within each time slot of the week is marked as the peak time slot. The contact relationship graph is generated based on the node set V in the weekly topology snapshot G(t), excluding... All other nodes outside Bidirectional cumulative edge weights between A list of contacts with increasing intimacy is generated in descending order. New contacts appearing in the current week and ranking within the top 5 are marked as abnormal new contacts. Behavioral analysis includes three dimensions: screen-on time trend, application usage distribution change, and activity level change. The screen-on time trend is calculated by calculating the average daily screen-on time for the current week and comparing it to the average of the previous four weeks to calculate the rate of change. The application usage distribution change is calculated by calculating the percentage of each application's launch time for the current week and comparing it to the percentage distribution of the previous four weeks to calculate the Jensen-Shannon divergence value. The formula for calculating the Jensen-Shannon divergence value is... ,in Vector of application launch time percentage for the week, This is the arithmetic mean vector of the percentage of launch times for each application over the first four weeks. KL is the Kullback-Leibler divergence and in For the total number of applications, and These are the i-th components of vectors A and B, respectively. The change in activity level is calculated by statistically analyzing the average number of steps in the daily activity record field of the motion sensor during the week and comparing it with the average of the previous four weeks to calculate the rate of change. The results of communication activity analysis, contact relationship graph analysis, and usage behavior analysis, along with the output of the fusion decision processing step, are sent to the monitoring weekly report generation step.

[0016] Preferably, during the message-by-message semantic risk analysis of the channel one processing path, the cloud data processing server performs real-time determination of the risk category label and risk probability value of each message. The determination rule is that when the risk category label is any of the categories of inducing fraud, inciting dangerous behavior, or inducing disclosure of privacy, and the risk probability value is greater than 0.9, a real-time high-risk alarm is triggered. The processing steps for the real-time high-risk alarm are as follows: The first step is instant alarm push. At the same time as triggering the alarm, the cloud data processing server sends a real-time alarm message to the parent's mobile terminal application through the push notification service. The alarm message includes a risk category label, a risk occurrence timestamp, a target child involvement marker, and a de-identified structured feature context summary. The structured feature context summary is generated by extracting the message that triggered the alarm and three messages before and after it. The first step involves concatenating the sentiment keyword list and entity category tag set from the structured feature data of up to seven messages on the client side into a summary string, which does not contain the original plaintext chat. The second step is alarm record archiving, which assembles the timestamp of the real-time alarm event, risk category tag, risk probability value, target child involved marker, and structured feature context summary into a real-time alarm record and writes it to the alarm log database of the cloud data processing server. The real-time alarm record is listed separately as "Real-time Alarms This Week" in the risk event summary of the next natural week's monitoring report and is not repeatedly included in the risk frequency trend statistics to avoid the same event being counted repeatedly in alarm push and weekly report, resulting in an inflated frequency. The real-time alarm mechanism and the periodic monitoring weekly report push run in parallel without affecting each other. The real-time alarm is triggered immediately within the week, while the monitoring weekly report is pushed uniformly every Monday morning.

[0017] Preferably, in S6, the cloud data processing server performs encrypted and time-sensitive storage on the entire data chain, sets differentiated fixed storage lifecycles according to data types, and does not set a regular storage lifecycle for raw content data. This type of data is physically deleted immediately after feature extraction in the cloud. The raw content data includes raw text data fields and raw voice data fields, and is forcibly deleted by a scheduled cleanup task no later than 30 minutes after receipt. After deletion, only the cleanup operation log is retained. The storage lifecycle for location trajectory data is 30 days, and location trajectory data refers to latitude and longitude coordinate data after location information fuzzification. The storage lifecycle for micro-chat interaction data is 60 days. The storage lifecycle for usage behavior data is 90 days. The storage lifecycle for real-time alarm records is 180 days. The storage lifecycle for monitoring weekly reports is 365 days. The starting point of the storage lifecycle is the moment the data is written to the cloud data processing server. The cloud data processing server deploys scheduled cleanup tasks. The execution time is 2:00 AM in the server's time zone. All data records are scanned for write timestamps. Data records exceeding the corresponding storage lifecycle are physically deleted, completely removing them from the storage medium and making them unrecoverable. After the physical deletion is complete, a cleanup operation log is generated, containing the type identifier of the deleted data, data volume statistics, deletion execution time, and operation result. The cleanup operation log is encrypted and stored in AES-256-GCM mode and retained for 3 years to meet compliance audit requirements. Guardians have the authority to actively clean up data through the parent mobile terminal application. Guardians can selectively clean up stored data or perform full data cleanup on the application's data management page according to data type. When a guardian performs an account cancellation operation, the cloud data processing server physically deletes all data records associated with the account within 24 hours of receiving the cancellation request and generates a cancellation cleanup operation log. All cleanup operations are recorded in complete logs for compliance audit purposes.

[0018] (III) Beneficial Effects This invention provides a method for processing monitoring data from wearable devices for children. It has the following beneficial effects: 1. This invention adopts a dual-channel parallel architecture to simultaneously monitor children's group chat safety from two dimensions: message content and group relationship structure, solving the problem of false alarms or missed alarms caused by single-dimensional analysis; the dual-channel output is fused through a four-quadrant decision matrix to cross-validate content risks and topological anomaly signals, improving the reliability of the comprehensive risk rating; a Bayesian prior correction mechanism is introduced for low-activity group chats, using historical prior distribution to perform posterior estimation on small sample observations and attaching confidence labels to avoid risk misjudgment when data is insufficient.

[0019] 2. The children's smartwatch of this invention only collects and encrypts the original content data and interaction metadata. Feature extraction of the original content data is completed in the cloud feature extraction service. After feature extraction is completed, the original text and original voice are immediately physically deleted by the cloud. The retention time of the original content data in the cloud does not exceed the processing time of a single message. By minimizing the existence time of the original data in the cloud, the exposure surface of sensitive data is reduced. The cloud feature extraction model adopts a full-precision architecture, and the feature extraction quality is better than the edge-side quantization model. It can output more refined structured feature data and improve the accuracy of downstream semantic risk analysis. Attached Figure Description

[0020] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein: Figure 1 This is an overall flowchart of the child wearable device monitoring data processing method described in this invention. Detailed Implementation

[0021] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example 1: This invention provides a method for processing monitoring data from children's wearable devices, including: Xiaoming is a ten-year-old primary school student who wears a children's smartwatch on his left wrist. His parents have matched Xiaoming's smartwatch account with members in the class group chat in the parent's mobile terminal application, thereby identifying the target child identifier corresponding to Xiaoming; During a typical school week, the watch continuously operated in the background. Each time the chat client's message listening interface received a group chat message, it automatically generated a complete metadata record. When Xiaoming's classmate sent a text message in the group, "Xiaoming, which community and building do you live in?", the watch's message listening interface stored the original text character sequence of the message in the original text data field. Simultaneously, it wrote the sender identifier, receiver identifier, message timestamp, group chat number, message type, mention relationship, and reply reference relationship into the interaction metadata field. During this time, another classmate sent a voice message, and the AMR format audio captured by the watch's built-in microphone was stored in the original voice data field. All data was cached in a local SQLite database and then uploaded to the cloud data processing server that evening using HTTPS encryption when the watch connected to the home Wi-Fi network. After receiving this batch of data, the cloud data processing server first calls the cloud feature extraction service to process the original content data one by one: For the original text data field of the message "Xiaoming, which community and building do you live in?", the cloud feature extraction model extracts the list of sentiment keywords, word frequency statistics vector, and entity category label set, writes them into the structured feature data field on the client side, and then performs physical deletion on the original text data field; For the original voice data field of voice messages, the cloud automatic speech recognition model first transcribes the AMR audio into a text character sequence, and then the feature extraction model generates structured feature data and writes it into the voice feature vector field, and then performs physical deletion on the original voice data field. Watch usage behavior data is also collected synchronously. The application startup log field records the timestamp and runtime of Xiaoming opening the pedometer and weather applications on the watch that day. The screen on time field records the cumulative number of seconds the screen was on that day. The motion sensor activity record field records the number of steps detected by the accelerometer and gyroscope and the classification results of the movement type. All collected data is cached in the local database and then uploaded to the cloud data processing server in batches when the watch connects to the home wireless network that evening. After receiving this batch of data, the cloud server performs five de-identification steps in sequence. First, it performs a hash operation on the device identifier embedded in the sender identifier field and adds a random value to make the device identifier unable to be reversed to the real device number. Then, it replaces the contact name with an automatically generated anonymous identifier. The mapping relationship can only be viewed by guardians who have been certified by biometrics. Next, it verifies the content of the entity category label set and finds that the entity category label set output by the cloud feature extraction service in the aforementioned student's address inquiry already contains the sensitive entity category label of home address. The server keeps the label unchanged and at the same time performs vector perturbation on the voiceprint identity feature component in the voice feature vector to remove identity information but retain semantic features. Then, it adds random noise to the latitude and longitude coordinates of the location reported by Xiaoming's watch to reduce the accuracy to a radius of 500 meters. All de-identified data is stored in encrypted mode and the data transmission is carried out through an encrypted channel throughout the process. After the data is anonymized, the server distributes the data to two parallel processing paths. The first processing path combines the normalized end-side structured feature data with the feature data of the first ten messages in the group chat into a context window input to the large language model to perform risk analysis and reasoning. The prompt word template requires that suspected hidden expressions be restored to standard semantics before analysis is performed. The output of the large language model shows that the risk category label of the message in which the student asked for the address is induced to disclose privacy, the risk probability value is 0.92, and the target child is marked as 1. Since the risk category is induced to disclose privacy and the probability value exceeds the high-risk alarm threshold, the server immediately triggers a real-time high-risk alarm and sends an alarm message containing the risk category label, the risk occurrence timestamp, and the anonymized structured feature context summary to the application on the parent's mobile phone through the push notification service. At the same time, this record and other general risk events that exceed the content risk judgment threshold but do not reach the alarm level are assembled into risk event nodes and arranged by timestamp to construct a timeline of group chat risk events. The Channel 2 processing path constructs a node set using the de-identified identifiers of all group members who sent messages in the current week as nodes and the identifier of the target child corresponding to Xiaoming as a marker node. When calculating the weight of the directed edge for each pair of nodes, the contributions of basic message interaction, targeted attention, and targeted response are weighted proportionally. If the weight is greater than zero, a directed edge is created. This week, the group chat activity was high and the total number of directed edges exceeded the preset minimum effective edge threshold. The server directly outputs the observation value without performing Bayesian prior correction. Subsequently, the time series values ​​of five topological evolution characteristic indicators were calculated. It was found that a newly transferred student suddenly had intensive interaction with Xiaoming this week, and the value of the new contact impact index was significantly higher. The slope coefficient obtained after the indicator time series was fitted by linear regression showed that the indicator was on a rapid upward trend. The dynamic time warping algorithm calculated the distance between the indicator time series and the four preset risk pattern templates. The matching result did not exceed the preset matching threshold. The topological evolution risk score was obtained after weighted summation. The confidence label was zero, indicating that the data was sufficient and no attenuation was required. After comparing the score with the preset topological risk threshold, it was determined that signal B was empty, that is, it did not exceed the threshold. In the fusion decision-making step, the server inputs the outputs of the two paths into a four-quadrant decision matrix. Channel 1 detects an induced privacy disclosure event, making signal A non-empty; the topology evolution risk score of channel 2 does not exceed the threshold, making signal B empty. The matrix determines the overall risk rating as low risk, meaning there is scattered content risk, but the group structure is stable. Subsequently, the server performs communication activity analysis, calculating Xiaoming's weekly chat frequency, average duration of a single communication, and peak time. It then performs contact relationship graph analysis, generating an intimacy ranking list based on this week's social topology snapshot, and discovers that the intimacy ranking of the newly transferred student has entered the top five, marking them as an abnormally added contact. Finally, it performs usage behavior analysis, calculating the screen-on time change rate, application usage distribution divergence value, and activity level. The judder rate of change, combined with the comprehensive risk rating, the results of the three-way analysis, and the summary results of risk events, generates a visual monitoring weekly report, which is pushed to parents via their mobile terminal application on Monday morning. Real-time high-risk alarms are recorded in a separate category in the risk event summary and are not counted repeatedly in the risk frequency statistics. The weekly report page has embedded feedback controls, allowing parents to mark each risk event as confirmed risk, false alarm, or handled. After viewing the weekly report, parents can mark the event that induces the disclosure of privacy as confirmed risk and another as false alarm. The feedback data is transmitted back to the server through an encrypted channel. The server uses the feedback data from multiple consecutive statistical periods as calibration samples to adjust the preset topological risk threshold. The calibrated threshold takes effect in the next statistical period, forming a feedback loop. Meanwhile, the cloud server performs encrypted and time-sensitive storage on all data. Location trajectory data is retained for 30 days and then physically deleted after expiration; chat interaction data is retained for 60 days; usage behavior data is retained for 90 days; real-time alarm records are retained for 180 days; and monitoring weekly reports are retained for 365 days. Expired data is physically deleted by the server to completely remove the data from the storage medium and make it unrecoverable. After physical deletion, compliance audit logs are generated and stored in encrypted mode.

[0023] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for processing monitoring data from wearable devices for children, characterized in that, include: S1. Collect usage behavior data, original group chat content data, and group chat interaction metadata through the child's smartwatch, identify the target child, and upload them to the cloud data processing server; The cloud data processing server performs cloud feature extraction on the original group chat content data, generates terminal-side structured feature data fields and voice feature vector fields, deletes the original group chat content data, and then performs desensitization processing; S2, the desensitized group chat interaction data performs semantic risk analysis along the channel one processing path based on the terminal-side structured feature data field and the voice feature vector field, outputs risk category labels, risk probability values ​​and target child involved markers, constructs a group chat risk event timeline, and pushes alarm messages when alarm conditions are met; S3, the desensitized group chat interaction data is used to construct a snapshot of the group chat social topology graph week by week along the channel two processing path, calculate the topology evolution feature index across statistical periods, match the preset risk pattern template, and output the topology evolution risk score, deviation dimension identifier, confidence label and intermediate calculation index. S4, input the group chat risk event timeline and the topology evolution risk score into the fusion decision step, compare the topology evolution risk score with the preset topology risk threshold, and generate a comprehensive risk rating based on the four-quadrant decision matrix; S5, perform communication activity analysis, contact relationship graph analysis and usage behavior analysis, generate a visual monitoring weekly report by combining the comprehensive risk rating with the communication activity analysis results, contact relationship graph analysis results, usage behavior analysis results and risk event summary results, and push it to the guardian, receive feedback from the guardian to calibrate the preset topological risk threshold to form a feedback closed loop; S6 performs encrypted and time-sensitive storage on all data across the entire chain, manages the storage lifecycle differently according to data type, physically deletes expired data, and records compliance audit logs.

2. The method for processing monitoring data of children's wearable devices according to claim 1, characterized in that: The data collection process in step S1 includes: S11, the child's smartwatch collects the original content data and group chat interaction metadata of the chat client through the message listening interface of the chat client. The original content data of the chat includes the original text data field and the original voice data field. The terminal-side structured feature data field and the voice feature vector field are extracted and generated from the original content data of the chat by the cloud feature extraction service of the cloud data processing server. The original content data of the chat is physically deleted by the cloud after feature extraction is completed. S12, the child's smartwatch simultaneously collects usage behavior data. The usage behavior data includes the application startup log field, the screen on duration field, and the motion sensor activity record field. S13, the target child identifier is determined by matching the parent's mobile terminal application in the chat member list. The collected data is cached and then uploaded to the cloud data processing server.

3. The method for processing monitoring data of children's wearable devices according to claim 2, characterized in that: In step S1, the desensitization process is performed by the cloud data processing server according to the following steps: S14, perform a hash operation on the device identifier in the sender identifier field and add a random value to complete the device identifier desensitization; S15, replace the contact name with an anonymous identifier and retain the corresponding relationship through a mapping table to complete the identity information desensitization; S16, perform verification on the entity category label set in the end-side structured feature data field output by the cloud feature extraction service and add labels, and perform vector perturbation on the voiceprint identity feature component in the voice feature vector field to remove identity features and retain semantic features to complete the interactive content desensitization; S17, add random noise to the latitude and longitude coordinates to reduce accuracy and complete the location information fuzzification; S18, all desensitized data is stored in encrypted mode, data transmission is performed through an encrypted channel, and the desensitized data can only be viewed by the guardian's account that has been authenticated.

4. The method for processing monitoring data of children's wearable devices according to claim 3, characterized in that: Step S2 includes: S21, performing standardization and normalization on the sentiment keyword list, word frequency statistical vector, and entity category label set in the terminal-side structured feature data field output by the cloud feature extraction service and after desensitization processing; S22, combining the normalized terminal-side structured feature data field with the structured feature data of the group chat's preceding messages to form a feature context window, inputting it into a large language model to perform preset risk analysis prompt word template inference, outputting the risk category label, risk probability value, sentiment score, target child involvement marker, and judgment basis summary for each message. The prompt word template requires that suspected hidden expressions be restored to standard semantics before analysis; S23, assembling the results of filtering risk category labels that are not normal and risk probability values ​​that exceed the content risk judgment threshold into risk event nodes, arranged by timestamps to form the group chat risk event timeline. The alarm condition is that the risk category label is any of the categories of inducing fraud, inciting dangerous behavior, or inducing disclosure of privacy, and the risk probability value exceeds the high-risk alarm threshold.

5. The method for processing monitoring data of children's wearable devices according to claim 4, characterized in that: The process of constructing the group chat social topology snapshot in step S3 includes: S31, using the de-identified identifiers of all group members who sent messages in the group chat during the week as nodes to form a node set, including the target child identifier as a marker node; S32, calculating the weight of the directed edge from the sender to the receiver for each ordered pair of nodes in the node set, and weighting and summing the contributions of basic message interaction, targeted attention relationship, and targeted response relationship according to a preset ratio. When the weight is greater than zero, a directed edge is created. All directed edges constitute an edge set. The node set and the edge set together constitute the group chat social topology snapshot for the week; S33, evaluating the activity of the group chat before calculating the topology evolution characteristic index. When the total number of directed edges reaches the preset minimum effective edge number threshold, the observation value is output. If it does not reach the threshold, Bayesian prior correction is performed. The posterior estimate is calculated using the prior distribution parameters and the observation value to replace the observation value, and the confidence label is attached.

6. The method for processing monitoring data of children's wearable devices according to claim 5, characterized in that: The calculation and matching process of topological evolution characteristic indicators in step S3 includes: S34, calculating the time series of topological evolution characteristic indicators, including the time series of degree centrality, the time series of eigenvector centrality, the time series of interaction frequency concentration, the time series of response rate, and the time series of new contact impact index; S35, performing linear regression trend fitting on each indicator time series to calculate the slope coefficient, and calculating the distance between the indicator time series and the preset risk pattern template through the dynamic time warping algorithm. When the distance is less than the preset matching threshold, it is determined that there is a topological evolution risk. The slope coefficient, the template matching distance, and the matched risk pattern number are used as intermediate calculation indicators.

7. The method for processing monitoring data of a child wearable device according to claim 6, characterized in that: Step S4 includes: S41. Determine signal A based on the timeline of the group chat risk events. Signal A is non-empty when there is at least one risk event node in the timeline; otherwise, it is empty. S42. Calculate the topology evolution risk score based on intermediate calculation indicators. The slope coefficients of each indicator and the optimal template matching distance are normalized and then weighted and summed. When the confidence label is not zero, the score is reduced by its complement value and then compared with the preset topology risk threshold. Signal B is non-empty when it exceeds the threshold; otherwise, it is empty. The deviation dimension identifier is the index number corresponding to the maximum value of the normalized value of the slope coefficient of each indicator and the product of the weights. S43. Determine the comprehensive risk rating based on the four-quadrant decision matrix. Signal A is non-empty and signal B is non-empty, indicating high risk. Signal A is empty and signal B is non-empty, indicating medium risk, and triggering an instant reminder message to be pushed to the guardian for the week. Signal A is non-empty and signal B is empty, indicating low risk. Signal A is empty and signal B is empty, indicating normal.

8. The method for processing monitoring data of a child wearable device according to claim 7, characterized in that: Step S5 includes: S51, performing communication activity analysis, contact relationship graph analysis, and usage behavior analysis on the group chat interaction data and the usage behavior data. The communication activity analysis includes weekly chat frequency, average duration of a single communication, and peak time periods. The contact relationship graph analysis generates an intimacy ranking list based on the group chat social topology snapshot and marks abnormally added contacts. The usage behavior analysis includes screen-on time trends, changes in application usage distribution, and changes in activity levels. The comprehensive risk rating is then combined with the communication activity analysis results, the contact relationship graph analysis results, and the usage behavior data. The analysis results and the summary results of the risk events generate the visualized monitoring weekly report; S52, the visualized monitoring weekly report is pushed through the parent's mobile terminal application, and real-time high-risk alarms are recorded in the summary of risk events, listed in a separate category and not repeatedly included in the risk frequency statistics. The weekly report page embeds a feedback control for the guardian to mark as confirmed risk, false alarm as non-risk, or handled. The feedback data is sent back to the cloud data processing server. The feedback data of multiple consecutive statistical periods are used as calibration samples to increase the sensitivity of the preset topological risk threshold. The calibration value takes effect in the next statistical period to form the feedback closed loop.

Images