Mobile terminal local security protection method and device based on multi-dimensional behavior recognition

Abstract

The present application relates to the technical field of data security protection, in particular to a mobile terminal local security protection method and device based on multi-dimensional behavior recognition, first, through preset time length learning period, four kinds of multi-dimensional behavior data of host touch, input, posture and interaction are collected, time domain, frequency domain and sequence mode features are extracted, and a single-class classifier is used to train a host exclusive behavior boundary model locally on the terminal; in the running stage, overlapping sliding windows are used to continuously collect real-time behavior data, a feature vector input model is constructed to obtain a matching degree score, and an adaptive threshold is combined to determine behavior abnormalities; according to the matching degree, a graded security policy is executed. The present application adopts non-perception continuous identity verification, multi-dimensional behavior joint identification, local modeling to protect privacy, and graded response to reduce false negative loss, solves the defects of traditional biological recognition passive verification, easy to be forged and easy to be avoided by attackers, and improves the sensitive data protection capability in the scenario of mobile phone loss.

Description

Technical Field

[0001] This invention relates to the field of data security protection technology, specifically to a local security protection method and device for mobile terminals based on multi-dimensional behavior recognition. Background Technology

[0002] Currently, smartphones commonly use authentication methods such as passwords, patterns, fingerprints, and facial recognition to control device access. Existing solutions have significant shortcomings:

[0003] Biometric authentication is a passive verification mechanism; verification only occurs when the user actively triggers the unlock screen. When a phone is stolen, criminals will not actively trigger unlock verification while browsing and operating the device normally, making it impossible for the system to continuously identify whether the current user is the owner. Attackers can simply cancel the verification pop-up and continue to illegally operate the terminal.

[0004] Fingerprints and facial recognition are susceptible to forgery, while 3D-printed fingerprints, high-definition photos, and videos can bypass some verification systems.

[0005] Traditional behavior recognition solutions mostly rely on cloud-based modeling, which requires continuous uploading of user operation data and poses a risk of privacy leaks; some behavior recognition methods only use a single touch feature, resulting in insufficient recognition accuracy and a high false alarm rate.

[0006] Existing security strategies mostly involve "locking the device immediately once an anomaly is detected." If a misjudgment occurs, the owner will be unable to use the phone normally, resulting in a poor user experience and a lack of a tiered and progressive handling mechanism.

[0007] Therefore, there is an urgent need for a mobile terminal security protection solution that can continuously identify users without their awareness in the background, jointly identify multi-dimensional features, protect privacy through local model deployment, and support hierarchical response. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a local security protection method and device for mobile terminals based on multi-dimensional behavior recognition, so as to overcome the problems existing in the current technology, such as passive triggering of mobile terminal identity verification, easy forgery of biometric features, privacy risks of cloud behavior recognition, and simple and crude abnormal handling methods that are prone to misjudgment and affect normal use.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: On the one hand, this application provides a local security protection method for mobile terminals based on multi-dimensional behavior recognition, including: Step S1: Continuously collect multi-dimensional behavioral data of mobile terminal users; Step S2: Extract the feature vector of the multi-dimensional behavioral data; Step S3: Input the feature vector into the pre-trained behavior boundary model to obtain the matching score corresponding to the feature vector; Step S4: Classify the matching score into abnormal levels and execute the corresponding protection strategy.

[0010] Furthermore, the method described above, prior to step S1, further includes: A behavior learning period of preset duration is initiated, and multi-dimensional behavior data of the user during daily use is silently collected in the background; wherein, the multi-dimensional behavior data includes touch behavior data, input behavior data, posture behavior data and interaction behavior data; The collected multi-dimensional behavioral data is subjected to feature engineering processing to extract time-domain statistical features, frequency-domain features, and sequence pattern features, and a training feature vector is constructed. A single-class classifier is trained using the training feature vectors to obtain a behavior boundary model specific to the device owner, and the behavior boundary model is then fully deployed locally on the mobile terminal.

[0011] Furthermore, in the method described above, step S1 includes: By setting a sliding time window with a fixed duration and a 50% overlap between adjacent windows, the system continuously collects the current user's touch behavior data, input behavior data, posture behavior data, and interaction behavior data.

[0012] Furthermore, in the method described above, step S2 includes: The touch behavior data, input behavior data, posture behavior data and interaction behavior data collected in each of the sliding time windows are subjected to feature engineering processing, and feature vectors that are completely aligned with the dimensions and types of the training feature vectors are constructed.

[0013] Furthermore, in the method described above, step S4 includes: The anomaly detection threshold T and the number of consecutive anomalies M are adaptively determined based on the degree of fluctuation in the host's own behavior during the learning period. The matching score of the feature vectors output by multiple consecutive sliding time windows is smoothed and denoised using the exponentially weighted moving average method. When the matching score after smoothing is lower than the threshold T for M consecutive sliding time windows, the current user's behavior is determined to be in an abnormal state. The lowest matching score is determined from the matching scores corresponding to the outputs of the M consecutive sliding time windows; The lowest matching score is classified as an anomaly level, and the corresponding protection strategy is implemented.

[0014] Furthermore, the method described above, wherein classifying the lowest matching score into anomaly levels and implementing corresponding protection strategies, includes: When the lowest matching score is in the first preset range, it is judged as a slight behavioral deviation. The mobile terminal silently starts the front camera to capture the current user's image and encrypts and stores it locally. It also collects and records the geographical location information at the same time. The front end does not output any prompt information to the user. When the lowest matching score is in the second preset range, it is determined to be a moderate behavioral deviation, and the mobile terminal silently invokes biometric verification in the form of a transparent overlay or a disguised page; wherein, the biometric verification includes at least one of fingerprint recognition, facial recognition and iris recognition; If the biometric verification is successful, the deviation behavior will be included as normal behavior sample data of the owner in the iterative update database, and the behavior boundary model will be iteratively updated when the sample data in the iterative update database reaches a preset number. If biometric verification fails or the user fails to complete the verification within a preset time, the judgment will be upgraded to a high level of behavioral deviation. When the lowest matching score is below the threshold N, it is determined to be a high behavioral deviation. The mobile terminal screen is locked and the owner's preset contact information is displayed. Sensitive data, including albums, contacts, chat logs and documents, are locally encrypted. The captured image, geographical location and abnormal trigger time are pushed to the owner's preset trusted contact. After determining that the behavior is highly deviant, the usage status of the mobile terminal is continuously monitored. If the owner's identity is not verified after the maximum tolerance time preset by the owner, the specified sensitive data is automatically destroyed.

[0015] Furthermore, the methods described above also include: Real-time monitoring of network hardware anomalies such as SIM card removal, prolonged lack of cellular network signal, and forced activation of airplane mode, recording the time of the anomaly and the corresponding geographical location; The network anomaly events are integrated with the behavior recognition and judgment results for comprehensive analysis; If the behavior recognition determines that the current user is the account holder, then network anomalies will not trigger security alarms.

[0016] Furthermore, in the above-described method, the touch behavior data includes: the contact area of ​​the finger touching the screen, the contact shape, the screen pressing pressure, the single click coordinate deviation distribution, and the continuous sliding operation trajectory coordinate sequence; The input behavior data includes: the duration of virtual keyboard keys from pressing to releasing, the distribution of time intervals between adjacent keys, the rhythm of inputting common words, the frequency of use of the backspace key and the space key, and input method switching habits; The posture behavior data is collected by accelerometers and gyroscopes, including: terminal three-dimensional spatial tilt angle, grip posture, sensor timing data of the entire process from taking out the terminal to unlocking the screen, and terminal shaking acceleration waveform in walking state; The interactive behavior data includes: application opening order and launch interval, distribution of dwell time on each application page, pattern of screen on / off time, and differences in usage behavior under charging and non-charging scenarios.

[0017] Furthermore, in the methods described above, the time-domain statistical features include: mean, variance, kurtosis, and skewness; The frequency domain features are extracted by performing Fourier transform on the sensor's multi-dimensional temporal behavior data to extract the main frequency component; The sequence pattern features include an application behavior transition probability matrix.

[0018] On the other hand, this application provides a local security protection device for mobile terminals based on multi-dimensional behavior recognition, including a processor and a memory, wherein the processor is connected to the memory: The processor is used to call and execute the program stored in the memory; The memory is used to store the program, which is at least used to execute the mobile terminal local security protection method based on multi-dimensional behavior recognition as described above.

[0019] The beneficial effects of this invention are as follows: Unobtrusive, proactive, and continuous identity authentication: No user needs to actively trigger verification; the background continuously analyzes user behavior, making it impossible for attackers to evade identity monitoring. It is suitable for continuous risk control after a mobile phone is lost. Multi-dimensional behavior joint recognition makes it extremely difficult to forge: It integrates four dimensions of temporal features, namely touch, keyboard input, sensor posture, and application usage habits, making it difficult for humans to completely imitate. Purely local modeling with strong privacy protection: It adopts a single-class classifier and trains the model using only the owner's own data. There is no need to collect samples from other users. All data and models are stored locally on the terminal and do not need to be uploaded to the cloud. Adaptive judgment parameters + temporal smoothing noise reduction: The threshold is automatically adjusted according to the stability of the host behavior, and EWMA is used to eliminate instantaneous anomalies caused by a single accidental operation, reducing the probability of misjudgment; Tiered and progressive security response: From silent evidence collection and secondary verification to locking encryption and data destruction, the system is upgraded step by step to avoid locking the device directly due to a single misjudgment, which would affect normal use; Network anomaly fusion-assisted judgment: By combining comprehensive analysis of hardware status such as SIM card and airplane mode, it distinguishes between scenarios where the user voluntarily enters a no-signal environment and scenarios where the device has been stolen, further suppressing false alarms. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart provided by an embodiment of the local security protection method for mobile terminals based on multi-dimensional behavior recognition according to the present invention; Figure 2 This is a schematic diagram of the structure of a local security protection device for a mobile terminal based on multi-dimensional behavior recognition, according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart illustrating an embodiment of a local security protection method for mobile terminals based on multi-dimensional behavior recognition according to the present invention. Please refer to... Figure 1 This embodiment may include the following steps: Step S1: Continuously collect multi-dimensional behavioral data of mobile terminal users; Step S2: Extract feature vectors from multi-dimensional behavioral data; Step S3: Input the feature vector into the pre-trained behavior boundary model to obtain the matching score corresponding to the feature vector; Step S4: Classify the matching score into abnormal levels and execute the corresponding protection strategy.

[0024] Preferably, before step S1, the method further includes: A behavior learning period of preset duration is initiated, silently collecting multi-dimensional behavior data from the user's daily usage in the background; this multi-dimensional behavior data includes touch behavior data, input behavior data, posture behavior data, and interaction behavior data. Feature engineering is performed on the collected multi-dimensional behavioral data to extract time-domain statistical features, frequency-domain features, and sequence pattern features, and to construct training feature vectors. A single-class classifier is trained using training feature vectors to obtain a behavior boundary model specific to the device owner, and the behavior boundary model is then fully deployed locally on the mobile terminal.

[0025] Preferably, the touch behavior data includes: the contact area of ​​the finger touching the screen, the contact shape, the screen pressing pressure, the single click coordinate deviation distribution, and the continuous swipe operation trajectory coordinate sequence; Input behavior data includes: the duration of virtual keyboard key presses and releases, the distribution of time intervals between adjacent keys, the input rhythm of frequently used words, the frequency of use of the backspace and space keys, and input method switching habits; The posture and behavior data are collected by accelerometers and gyroscopes, including: the terminal's three-dimensional spatial tilt angle, grip posture, sensor timing data of the entire process from taking the terminal out to unlocking the screen, and the terminal's shaking acceleration waveform in the walking state; Interaction behavior data includes: application opening order and launch interval, distribution of dwell time on each application page, patterns of screen on / off time, and differences in usage behavior in charging and non-charging scenarios.

[0026] Preferably, the time-domain statistical features include: mean, variance, kurtosis, and skewness; Frequency domain features are extracted by performing Fourier transform on multi-dimensional temporal behavioral data of the sensor to extract the main frequency component; Sequence pattern features include an application behavior transition probability matrix.

[0027] Understandably, after a user activates this feature for the first time, the system will enter a behavior learning period. This phase typically lasts 7 to 14 days, and its purpose is to collect multi-dimensional behavioral data generated by the user during normal phone use to establish a behavior boundary model specific to the user.

[0028] During the learning period, the system silently collects data in the background from the following dimensions: Touch behavior data includes: the size and shape of the contact area when a finger touches the screen, the pressure applied (for devices with pressure-sensitive screens), the screen coordinate deviation distribution of a single click, and the trajectory coordinate sequence formed by continuous swipe operations. Everyone's finger size, pressing habits, and the smoothness and curvature of their swipe trajectory are different. For example, some people swipe in a very straight, even trajectory, while others unconsciously draw a slight arc; some people always tap icons slightly off-center to the upper right, while others tap precisely. These subtle differences collectively constitute a person's unique touch behavior characteristics.

[0029] Input behavior data includes: the time interval between pressing and releasing each key on the virtual keyboard, the time distribution between two consecutive keys, the input rhythm pattern of frequently used words, the frequency of use of the backspace and space keys, and input method switching habits. Individual differences in keyboard input behavior are very significant—each person has a unique pattern in their typing rhythm, keystroke speed for frequently used words, and error correction habits.

[0030] Postural behavior data. Collected via the phone's built-in accelerometer and gyroscope. This includes: the phone's tilt angle in three-dimensional space (reflecting the grip posture), the acceleration waveform of the phone's movement with the body while walking, and the sensor data sequence from taking the phone out of the pocket to unlocking the screen. Different people exhibit significant differences in their phone grip posture and gait acceleration patterns. Gait recognition has been extensively supported by academic research; the gait characteristics of the same person at different times show a high degree of consistency, while the gait characteristics of different people show clear differentiation.

[0031] Interactive behavior data includes: the order and time intervals in which applications are opened, the distribution of time spent in each application, the pattern of screen on / off times, and differences in usage behavior when charging versus not charging. Each person's application usage habits are highly personalized. For example, one person might habitually check WeChat before browsing Weibo, spending an average of 3 minutes in WeChat and 8 minutes on Weibo; another person might open email before calendar, spending no more than 2 minutes on each application. These interaction patterns constitute the macro-level characteristics of user behavior.

[0032] The data collected during the learning period undergoes feature engineering—including time-domain statistical features (mean, variance, kurtosis, skewness), frequency-domain features (using Fourier transform to extract the dominant frequency component from sensor time-series data), and sequence pattern features (such as the transition probability matrix used by the application)—to form feature vectors. These feature vectors are then input into a single-class classifier (e.g., a one-class support vector machine, One-ClassSVM) for training. The key feature of a single-class classifier is that it is trained using only the user's own data, learning "where the boundaries of the user's behavioral feature space lie," without needing to collect data from others. This protects privacy (no need to upload or store others' behavioral data) and allows the model to be deployed and run locally on the phone.

[0033] The model obtained after training is the behavioral boundary model of the host.

[0034] It should be noted that, for the input feature vector X, the behavioral boundary model calculates its signed distance d(X) relative to the decision boundary in the high-dimensional feature space through the decision function: d(X) = X·w - ρ Where w is the weight vector learned by the behavior boundary model, and ρ is the bias term. When d(X)>0, it means that the feature vector is located inside the decision boundary (belonging to the normal region). The larger the value, the closer it is to the center region of the feature space, and the better it matches the host's behavior. When d(X)<0, it means that the feature vector is located outside the decision boundary (belonging to the abnormal region). The larger the absolute value, the more serious the deviation from the host's behavior pattern.

[0035] The symbolic distance is mapped to a matching score of 0-100. Since the parameters of the behavioral boundary model differ among different owners, the units of the symbolic distance are not uniform, requiring calibration mapping. After the learning period, the system inputs the feature vectors of all behavioral data from the learning period into the trained behavioral boundary model, recording the symbolic distance value di for each sample, thus obtaining the distance distribution D_owner corresponding to the owner's normal behavior. The mean μ_d and standard deviation σ_d of this distribution are calculated. For any newly input feature vector X, the symbolic distance is mapped to a matching score S(X) of 0-100 using the following formula: S(X) = 100 × Φ((d(X) - μ_d) / σ_d) Where Φ(·) is the cumulative distribution function of the standard normal distribution. The physical meaning of this score is: the probability of matching the current behavior with the typical behavior pattern of the host. The closer the score is to 100, the higher the matching degree; the lower the score, the greater the deviation.

[0036] Preferably, step S1 includes: By setting a sliding time window with a fixed duration and a 50% overlap between adjacent windows, the system continuously collects the current user's touch behavior data, input behavior data, posture behavior data, and interaction behavior data.

[0037] Preferably, step S2 includes: Feature engineering is performed on the touch behavior data, input behavior data, posture behavior data, and interaction behavior data collected in each sliding time window, and feature vectors that are fully aligned with the dimensions and types of the training feature vectors are constructed.

[0038] Preferably, step S4 includes: The anomaly detection threshold T and the number of consecutive anomalies M are adaptively determined based on the degree of fluctuation in the host's own behavior during the learning period. An exponentially weighted moving average method is used to smooth and denoise the matching score of the feature vectors output by multiple consecutive sliding time windows. When the matching score after smoothing is lower than the threshold T for M consecutive sliding time windows, the current user's behavior is determined to be in an abnormal state. The lowest matching score is determined from the matching scores output in M ​​consecutive sliding time windows; The lowest matching score is classified as an anomaly level, and the corresponding protection strategy is implemented.

[0039] Preferably, the lowest matching score is classified into an anomaly level, and the corresponding protection strategy is implemented, including: When the lowest matching score is in the first preset range, it is judged as a slight behavioral deviation. The mobile terminal silently starts the front camera in the background to capture the current user's image and encrypts and stores it locally. It also collects and records the geographical location information at the same time. The front end does not output any prompt information to the user. When the lowest matching score is in the second preset range, it is judged as a moderate behavioral deviation, and the mobile terminal silently invokes biometric verification in the form of a transparent overlay or a disguised page; wherein, biometric verification includes at least one of fingerprint recognition, facial recognition and iris recognition; If the biometric verification is successful, the deviation behavior will be included as normal behavior sample data of the owner in the iterative update database, and the behavior boundary model will be iteratively updated when the sample data in the iterative update database reaches a preset number. If biometric verification fails or the user fails to complete the verification within a preset time, the judgment will be upgraded to a high level of behavioral deviation. When the lowest matching score is below the threshold N, it is judged as a high behavioral deviation, the mobile terminal screen is locked and the owner's preset contact information is displayed, sensitive data including album, address book, chat history and documents are locally encrypted, and the captured image, geographical location and abnormal trigger time are pushed to the owner's preset trusted contact. After determining that the behavior is highly deviant, the mobile terminal usage status is continuously monitored. If the owner's identity is still not verified after the owner's preset maximum tolerance time, the specified sensitive data will be automatically destroyed.

[0040] Understandably, the system will automatically enter continuous monitoring mode after the learning period ends.

[0041] Step 1: Sliding Window Data Acquisition. The system continuously collects user touch, input, gesture, and interaction data in a fixed-duration sliding window (e.g., every 30 seconds, with 50% overlap between adjacent windows). The windowed design ensures timely judgment—it doesn't require waiting a long time for user interaction to make a decision.

[0042] Step 2: Feature Extraction. Behavioral features are extracted from the multi-dimensional behavioral data within each sliding time window, forming feature vectors aligned with the host model's feature space. The feature extraction method is completely consistent with the learning phase, ensuring comparability.

[0043] Step 3: Matching Score. The feature vector of the current sliding time window is input into the user behavior boundary model. The model outputs not a simple "yes or no," but a behavior matching score (a continuous value between 0 and 100). The higher the score, the more similar the current user's behavior is to the user's; the lower the score, the greater the deviation. This continuous scoring mechanism is more flexible than the binary "yes / no" judgment, reflecting the "degree" of deviation rather than just "presence or absence."

[0044] Step 4: Smoothing and Cumulative Judgment. Rating fluctuations in a single window may be affected by occasional factors (such as a user briefly holding the phone with their other hand). To filter out these transient noises, the system uses an Exponentially Weighted Moving Average (EWMA) method to smooth the rating sequence. EWMA assigns higher weights to recent data and lower weights to older data, reflecting the current state without being affected by single-point anomalies. If the smoothed matching score is below a preset threshold T for M consecutive time windows (e.g., a score consistently below 40 for 6 consecutive windows, or 3 minutes), it is determined to trigger an abnormal behavior state.

[0045] It should be noted that the threshold T and the number of continuous windows M are not fixed values. During the behavior learning phase, the system automatically determines appropriate parameters based on the stability of the user's behavior. After the learning period, the feature vectors of all behavioral data from the learning period are input into the behavior boundary model one by one to obtain the matching score Si (i=1,2,…,N) for each sample, thus obtaining the baseline distribution S_owner corresponding to the user's normal behavior. This distribution reflects the typical range and fluctuation of the matching score of the user under normal usage conditions.

[0046] The determination of T takes into account both the average level and the degree of fluctuation in the owner's behavior. For owners with more stable behavior patterns, the threshold can be set more strictly (i.e., with higher sensitivity); for owners with more fluctuating behavior patterns, the threshold will be appropriately relaxed to reduce false alarms. The calculation formula is: T = max(Q_α, μ_S - k·σ_S) Where μ_S is the mean of the benchmark distribution, σ_S is the standard deviation (reflecting the stability of the user's daily behavior patterns), Q_α is the α-th percentile of the benchmark distribution (α is 5 in this embodiment), and k is an adjustable coefficient (k is 2~3 in this embodiment). The physical meaning of this formula is: the threshold is taken as the larger of the "lower quantile of normal behavior" and "the mean deviating downwards by several times the standard deviation," ensuring that the threshold reflects the true lower limit of the user's behavior without being excessively suppressed by a few extreme normal samples. For users with more stable behavior patterns (smaller σ_S), the threshold is closer to Q_α (i.e., higher sensitivity); for users with more volatile behavior patterns (larger σ_S), the threshold will be appropriately relaxed to reduce false alarms.

[0047] Determine the number of consecutive anomalies, M. The system presets an anomaly confirmation duration D (D is 90 seconds in this embodiment), indicating how long behavioral anomalies need to be observed before triggering a safety response. The formula for calculating M is: M = [ D / (L × (1 - overlap)) ] Where L is the fixed duration of a single sliding time window (L=30 seconds in this embodiment), and overlap is the overlap rate of adjacent windows (overlap=50% in this embodiment). Therefore, the starting time interval between adjacent windows is L×(1-overlap)=15 seconds. Substituting into the calculation, we get M=90 / 15=6, which means that the score of 6 consecutive windows (lasting 90 seconds) must be continuously lower than the threshold to trigger an abnormal state.

[0048] Upon triggering an abnormal behavior state, the system will not immediately lock the phone or destroy data—that might result in the owner being unable to use the phone due to misjudgment. This application adopts a tiered, progressive response, taking different levels of measures based on different matching scores: Slight deviation (match score between 30-40): Silent evidence collection. The system silently activates the front-facing camera in the background to take a photo of the current user and saves it to local encrypted storage. It also records the current geographical location information. No notification is given to the user at this time.

[0049] Moderate deviation (match score between 20-30): Two-factor authentication. The system automatically initiates biometric verification—fingerprint, facial recognition, or iris recognition. To avoid detection by attackers, the verification interface can use a transparent overlay or dynamic disguise (e.g., disguised as an application loading screen), silently collecting fingerprint or facial data in the background. If the biometric verification passes, it indicates that the current user is indeed the owner, and the system records this deviation as a normal extension of the owner's behavior, taking it into consideration in subsequent model updates. If the biometric verification fails or the user does not complete the verification within a preset time (e.g., 30 seconds), it is escalated to a high deviation.

[0050] High deviation (match score below 20 and biometric verification failed): Confirmed not to be the device owner. The system determines that the current user is not the device owner and implements protection measures according to the user's preset strategy.

[0051] After confirming that the current user is not the owner of the device, the system will perform one or more of the following preset protection measures: (1) Lock the phone screen and display the owner's preset contact information (such as a backup phone number or email address) to facilitate the finder to contact and return the phone.

[0052] (2) Locally encrypt sensitive data of specified types (such as photo albums, address books, chat logs, documents, etc.), with the encryption key derived from the security key preset by the owner. The encrypted data can only be recovered by the owner.

[0053] (3) Send the current user's captured photos, geographical location, and abnormal behavior trigger time to the owner's preset trusted contact via SMS, email or instant messaging.

[0054] If the device is not restored to the owner's use after the maximum tolerance time preset by the owner (e.g., 24 hours), the specified data will be automatically destroyed.

[0055] Preferred options also include: Real-time monitoring of network hardware anomalies such as SIM card removal, prolonged lack of cellular network signal, and forced activation of airplane mode, recording the time of the anomaly and the corresponding geographical location; Integrate and comprehensively analyze the results of network anomaly events and behavior identification; If the behavior recognition determines that the current user is the account holder, then network anomalies will not trigger security alarms.

[0056] Understandably, based on the aforementioned behavior recognition, this application also includes a network anomaly detection module as an auxiliary means. When the mobile phone detects situations such as a SIM card being removed, prolonged lack of signal, or forced activation of airplane mode, it will record the time and geographical location of the anomaly, and make a comprehensive judgment based on the analysis results of the behavior recognition module. If the behavior recognition has determined that the current user is the owner of the phone (for example, the owner has traveled to an area with no signal), then no false alarm will be triggered.

[0057] The present invention also provides a local security protection device for mobile terminals based on multi-dimensional behavior recognition, for implementing the above-described method embodiments. Figure 2 This is a schematic diagram of the structure of an embodiment of a local security protection device for a mobile terminal based on multi-dimensional behavior recognition according to the present invention. Figure 2 As shown, the mobile terminal local security protection device based on multi-dimensional behavior recognition in this embodiment includes a processor 21 and a memory 22, with the processor 21 connected to the memory 22. The processor 21 is used to call and execute a program stored in the memory 22; the memory 22 is used to store the program, which is at least used to execute the mobile terminal local security protection method based on multi-dimensional behavior recognition in the above embodiments.

[0058] The specific implementation scheme of the local security protection device for mobile terminals based on multi-dimensional behavior recognition provided in this application embodiment can refer to the implementation scheme of the local security protection method for mobile terminals based on multi-dimensional behavior recognition in any of the above embodiments, and will not be repeated here.

[0059] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0060] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0061] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0062] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0063] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0064] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0065] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0066] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0067] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A local security protection method for mobile terminals based on multi-dimensional behavior recognition, characterized in that, include: Step S1: Continuously collect multi-dimensional behavioral data of mobile terminal users; Step S2: Extract the feature vector of the multi-dimensional behavioral data; Step S3: Input the feature vector into the pre-trained behavior boundary model to obtain the matching score corresponding to the feature vector; Step S4: Classify the matching score into abnormal levels and execute the corresponding protection strategy.

2. The method according to claim 1, characterized in that, Before step S1, the following is also included: A behavior learning period of preset duration is initiated, and multi-dimensional behavior data of the user during daily use is silently collected in the background; wherein, the multi-dimensional behavior data includes touch behavior data, input behavior data, posture behavior data and interaction behavior data; The collected multi-dimensional behavioral data is subjected to feature engineering processing to extract time-domain statistical features, frequency-domain features, and sequence pattern features, and a training feature vector is constructed. A single-class classifier is trained using the training feature vectors to obtain a behavior boundary model specific to the device owner, and the behavior boundary model is then fully deployed locally on the mobile terminal.

3. The method according to claim 2, characterized in that, Step S1 includes: By setting a sliding time window with a fixed duration and a 50% overlap between adjacent windows, the system continuously collects the current user's touch behavior data, input behavior data, posture behavior data, and interaction behavior data.

4. The method according to claim 3, characterized in that, Step S2 includes: The touch behavior data, input behavior data, posture behavior data and interaction behavior data collected in each of the sliding time windows are subjected to feature engineering processing, and feature vectors that are completely aligned with the dimensions and types of the training feature vectors are constructed.

5. The method according to claim 4, characterized in that, Step S4 includes: The anomaly detection threshold T and the number of consecutive anomalies M are adaptively determined based on the degree of fluctuation in the host's own behavior during the learning period. The matching score of the feature vectors output by multiple consecutive sliding time windows is smoothed and denoised using the exponentially weighted moving average method. When the matching score after smoothing is lower than the threshold T for M consecutive sliding time windows, the current user's behavior is determined to be in an abnormal state. The lowest matching score is determined from the matching scores corresponding to the outputs of the M consecutive sliding time windows; The lowest matching score is classified as an anomaly level, and the corresponding protection strategy is implemented.

6. The method according to claim 5, characterized in that, The process of classifying the lowest matching score into anomaly levels and implementing corresponding protection strategies includes: When the lowest matching score is in the first preset range, it is judged as a slight behavioral deviation. The mobile terminal silently starts the front camera to capture the current user's image and encrypts and stores it locally. It also collects and records the geographical location information at the same time. The front end does not output any prompt information to the user. When the lowest matching score is in the second preset range, it is determined to be a moderate behavioral deviation, and the mobile terminal silently invokes biometric verification in the form of a transparent overlay or a disguised page; wherein, the biometric verification includes at least one of fingerprint recognition, facial recognition and iris recognition; If the biometric verification is successful, the deviation behavior will be included as normal behavior sample data of the owner in the iterative update database, and the behavior boundary model will be iteratively updated when the sample data in the iterative update database reaches a preset number. If biometric verification fails or the user fails to complete the verification within a preset time, the judgment will be upgraded to a high level of behavioral deviation. When the lowest matching score is below the threshold N, it is determined to be a high behavioral deviation. The mobile terminal screen is locked and the owner's preset contact information is displayed. Sensitive data, including albums, contacts, chat logs and documents, are locally encrypted. The captured image, geographical location and abnormal trigger time are pushed to the owner's preset trusted contact. After determining that the behavior is highly deviant, the usage status of the mobile terminal is continuously monitored. If the owner's identity is not verified after the maximum tolerance time preset by the owner, the specified sensitive data is automatically destroyed.

7. The method according to claim 6, characterized in that, Also includes: Real-time monitoring of network hardware anomalies such as SIM card removal, prolonged lack of cellular network signal, and forced activation of airplane mode, recording the time of the anomaly and the corresponding geographical location; The network anomaly events are integrated with the behavior recognition and judgment results for comprehensive analysis; If the behavior recognition determines that the current user is the account holder, then network anomalies will not trigger security alarms.

8. The method according to claim 7, characterized in that, The touch behavior data includes: the contact area of ​​the finger touching the screen, the contact shape, the screen pressing pressure, the coordinate deviation distribution of a single click, and the coordinate sequence of continuous sliding operation trajectory; The input behavior data includes: the duration of virtual keyboard keys from pressing to releasing, the distribution of time intervals between adjacent keys, the rhythm of inputting common words, the frequency of use of the backspace key and the space key, and input method switching habits; The posture behavior data is collected by accelerometers and gyroscopes, including: terminal three-dimensional spatial tilt angle, grip posture, sensor timing data of the entire process from taking out the terminal to unlocking the screen, and terminal shaking acceleration waveform in walking state; The interactive behavior data includes: application opening order and launch interval, distribution of dwell time on each application page, pattern of screen on / off time, and differences in usage behavior under charging and non-charging scenarios.

9. The method according to claim 8, characterized in that, The time-domain statistical features include: mean, variance, kurtosis, and skewness; The frequency domain features are extracted by performing Fourier transform on the sensor's multi-dimensional temporal behavior data to extract the main frequency component; The sequence pattern features include an application behavior transition probability matrix.

10. A local security protection device for mobile terminals based on multi-dimensional behavior recognition, characterized in that, It includes a processor and a memory, wherein the processor is connected to the memory: The processor is used to call and execute the program stored in the memory; The memory is used to store the program, which is at least used to execute the local security protection method for mobile terminals based on multi-dimensional behavior recognition as described in any one of claims 1-9.

Images