CN105025170A - Detection and alarm method of mobile phone in non-normal use - Google Patents
Detection and alarm method of mobile phone in non-normal use Download PDFInfo
- Publication number
- CN105025170A CN105025170A CN201510472659.1A CN201510472659A CN105025170A CN 105025170 A CN105025170 A CN 105025170A CN 201510472659 A CN201510472659 A CN 201510472659A CN 105025170 A CN105025170 A CN 105025170A
- Authority
- CN
- China
- Prior art keywords
- mobile phone
- application
- owner
- detection
- specific
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 86
- 238000000034 method Methods 0.000 title claims abstract description 36
- 230000006399 behavior Effects 0.000 claims abstract description 58
- 230000035945 sensitivity Effects 0.000 claims description 31
- 238000012887 quadratic function Methods 0.000 claims description 18
- 238000005070 sampling Methods 0.000 claims description 16
- 238000004364 calculation method Methods 0.000 claims description 13
- 230000002452 interceptive effect Effects 0.000 claims description 13
- 230000002159 abnormal effect Effects 0.000 claims description 11
- 230000008569 process Effects 0.000 claims description 7
- 230000004224 protection Effects 0.000 claims description 7
- 230000007423 decrease Effects 0.000 claims description 6
- 238000011017 operating method Methods 0.000 claims description 5
- 230000003542 behavioural effect Effects 0.000 claims description 3
- 230000002123 temporal effect Effects 0.000 claims description 3
- 238000000605 extraction Methods 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 abstract description 2
- 238000011835 investigation Methods 0.000 abstract 1
- 230000006870 function Effects 0.000 description 5
- 230000007704 transition Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 238000007619 statistical method Methods 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000012098 association analyses Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000013011 mating Effects 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Landscapes
- Mobile Radio Communication Systems (AREA)
- Telephone Function (AREA)
Abstract
A detection and alarm method of mobile phone in non-normal use provided by the present invention comprises the following steps: selecting and setting four sensitive operation behaviors through which important and sensitive data is liable to be leaked according to investigation and survey of specific people attention to important data, wherein the four sensitive operation behaviors consist of message browse, picture browse, note browse and video play which are special application operations; detecting, respectively, the four special application operations, the detection comprising statistics detection aim at each independent operation behavior and correlation detection aim at a plurality of continuous operation behaviors, and detecting and determining, through combination of the two detection means, whether the mobile phone is in a non-normal use mode, namely is not used by the owner of the mobile phone; and emitting alarm information immediately in case of determination of the mobile phone in the non-normal use mode. The method provided by the invention is characterized in that: complex operation of inputting passwords in the mobile phone caused by the hard encryption technology is avoided, even though the mobile phone is used by the owner, and the risk of private data leakage is effectively reduced when the owner of the mobile phone is not paying attention, thereby having a good future.
Description
Technical field
The present invention relates to a kind of detection alarm method of mobile phone non-normal use, exactly, relate to a kind of mobile phone by detection alarm method when non-owner's use, i.e. non-normal use, belong to the technical field of smart mobile phone private data guard.
Background technology
Now, mobile phone because of its can carry with and easy to use, flexibly and the various features that is gradually improved of function, become an indispensable part in people's life.Especially the universal use of smart mobile phone, people are made usually the sensitive information of some high values to be stored in mobile phone, make mobile phone progressively be evolved into process and store the multimedia platform of personal information, the information wherein stored comprises: address list, private photos, important note, entry password of even some application etc.These data are extremely important for each owner.And the storage of these private datas is all also exist using mobile phone as medium, simultaneously information dropout also can be caused and by the hidden danger peeped.Under some public arena (as in work unit, school, family, dining room or film and drama place etc.), these sensitive informations can be worked together, classmate, friend, the head of a family and even stranger etc. browse carelessly or deliberately, and these behaviors all can cause the individual privacy of owner and reveal or infringement.
At present, all pay much attention to the secret protection of data in mobile phone both at home and abroad, develop multiple typical apply in this respect, such as: this base mobile phone safe software of 360 mobile phone bodyguards, safe house keeper and kappa etc.These fail-safe software majorities existing are the secret protections adopting the method be encrypted the private data file on mobile phone to realize data in mobile phone.During the password that user only has input correct, just can browse and use the file in encryption folder or data.Although this mode is simple and reliable, the drawback existed is: even if when owner uses sensitive document, equally also first must input password, feel very inconvenient at every turn, and easily makes other people notice mobile phone exists sensitive information.In addition, cipher mode is usually only effective to stranger, personnel familiar with owner (such as work together, good friend and relatives etc.) are often also known to the password of mobile phone, the mode of this encrypt file, whether have people under owner unwitting situation, attempt the privacy information browsed in mobile phone if owner just can not be allowed to understand.
Therefore; how to design a kind of when mobile phone is not in owner's visual line of sight; can automatically detect the file preserving sensitive information; and judge whether viewed and initiatively to owner's alarm and log, guard method for the mobile phone private data of tracing to the source afterwards; being a new problem very with actual application value, is also the focus that numerous mobile phone owner pays special attention to.
Summary of the invention
In view of this; the object of this invention is to provide detection alarm method time a kind of mobile phone non-normal use (namely non-owner uses); the present invention is the mobile phone guard method of a kind of " flexibility "; can operation behavior on active monitoring mobile phone; and whether be in non-normal use state according to this mobile phone of operation behavior feature detection, namely whether someone attempts the sensitive information browsing mobile phone EMS memory storage.Once detect that mobile phone is in non-normal use state, the number just initiatively preset to owner or mailbox send a warning message, and in the daily record of mobile phone local recordings.The present invention can effectively be reduced in owner careless time, the private data in mobile phone, by the risk revealed, has good application prospect.
In order to achieve the above object, the invention provides a kind of mobile phone non-normal use, namely detection alarm method when non-owner uses, it is characterized in that: according to the finding of specific crowd for significant data attention rate, choose and to arrange in cellphone subscriber's operation behavior easily reveal important sensitive data browse note, browse photo, the four kinds of sensitive operation behaviors browsing notepad and displaying video are application-specific operation, and detect for the behavior of this four kinds of application-specific operation: the statistic mixed-state carried out for each independently operation behavior of mobile phone respectively and the interactive calculation carried out for multiple continuous print operation behavior, again these two kinds of detection meanss detected be combineding with each other and judge whether this mobile phone is in non-normal use, the i.e. state of non-Mobile phone instigator, once judge that mobile phone is in non-owner and uses, just send warning information immediately, the operation behavior of described mobile phone is the operation behavior that the current user of mobile phone is using mobile phone, the method comprises following two operating procedures:
Step 1, preliminary treatment and optimum configurations: based on the study to owner's mobile phone operation behavioural characteristic, sample and preliminary treatment to the time data of application-specific operation, then arrange detected parameters: detection sensitivity and alarm address;
Step 2, the operation behavior that detection and indentification user is current, once detect and judging that mobile phone is in non-normal use, sends warning information immediately.
Mobile phone non-normal use of the present invention detects alarm method and solves the defect that prior art exists preferably: whether owner can not understand in its unwitting situation, and someone attempts the privacy information browsed or browsed in mobile phone.In addition, the inventive method also has following innovative characteristics:
(1) even if the inventive method not only avoid owner user's use that hardware encryption causes, the troublesome operation inputting password is needed too; Meanwhile, the alarm under non-normal use state, can under the ignorant state of owner real-time reminding owner: there is risk of leakage in the sensitive data in mobile phone.And the operation behavior daily record that mobile phone stores also allows owner understand for which sensitive data, when be never actually viewed by others, for the foundation of tracing to the source afterwards.
(2) the present invention adopts the detection method of statistical analysis to detect for single sensitive operation behavior, and the time statistical characteristics of each independent sensitive operation can be adjusted accordingly according to the habit statistical characteristic of the different operating time of each owner.
(3) the inventive method supports personalized alarm: first, each user can both select different detection sensitivity, namely different user can be arranged corresponding detection sensitivity for self mobile phone by the attention degree of non-normal use according to oneself, make both to be unlikely to produce too much uncorrelated wrong report, also do not omit the alarm event oneself be concerned about.Secondly, user can also arrange different alarm modes according to the actual conditions of oneself: the alarm mode that both can adopt SMS, also can adopt the alarm mode of Email.
In a word, the inventive method operating procedure is simple, convenient, reliable, practical, is expected to obtain and applies.
Accompanying drawing explanation
Fig. 1 is the detection alarm method operating procedure flow chart of mobile phone non-normal use of the present invention.
Fig. 2 is the mobile phone owner single operation time standard difference distribution schematic diagram in the embodiment of the present invention.
Fig. 3 is the multirow in the embodiment of the present invention is interactive calculation state transitions schematic diagram (detection sensitivity is " sensitivity ").
Fig. 4 is the multirow in the embodiment of the present invention is interactive calculation state transitions schematic diagram (detection sensitivity is " generally ").
Embodiment
For making the object, technical solutions and advantages of the present invention clearly, below in conjunction with drawings and Examples, the present invention is described in further detail.
The present invention is a kind of mobile phone non-normal use, namely detection alarm method when non-owner uses, the method is according to the finding of specific crowd for significant data attention rate, choose and arrange the current user of mobile phone to use in the operation behavior of mobile phone easily reveal important sensitive data browse note, browse photo, the four kinds of sensitive operation behaviors browsing notepad and displaying video are application-specific operation, and detect for the behavior of this four kinds of application-specific operation: the statistic mixed-state carried out for each independent operation behavior of mobile phone respectively and the interactive calculation carried out for multiple continuous print operation behavior, again these two kinds of detection meanss detected be combineding with each other and judge whether this mobile phone is in non-Mobile phone and instigates and use, the i.e. state of non-normal use, once judge that mobile phone is in non-owner and uses, just send warning information immediately.
See Fig. 1, introduce following two operating procedures of the inventive method:
Step 1, preliminary treatment and optimum configurations: based on the study to owner's mobile phone operation behavioural characteristic, sample and preliminary treatment to the time data of application-specific operation, then arrange detected parameters: detection sensitivity and alarm address.This step 1 comprises following content of operation:
(11) extractor instigator uses the statistical nature of application-specific operating time, carry out preliminary treatment: the statistical law of application-specific operating time during extraction owner use mobile phone, again based on this statistics, obtain mobile phone owner to the operating time t of each application-specific and the relational expression of probability P and distribution curve thereof, thus the different application-specific operations controls of each mobile phone owner are not corresponded to a quadratic function matched curve, and the statistical nature using this matched curve as the application-specific operating time of each mobile phone owner.
Embodiments of the invention are operating as example with note, and concrete statistical method is described below: the time span value gathering owner's 100 note application operatings, with 3 seconds for interval computing time, concrete data are as shown in table 1 below.
Table 1: the statistical form of 100 note operating times of certain mobile phone owner
In this table 1, t is the operating time, and F is operation frequency (namely in 100 operations, the operating time is the number of operations of t).Based on above-mentioned statistics, obtain the note operating time t of mobile phone owner and the relation of probability P.
(12) from the maximum the data distribution curve of each application-specific operating time, progressively successively decrease respectively, and decline rate progressively accelerates toward its both sides, the regularity of distribution and the quadratic function curve of this application-specific operating time obtained are similar; This makes it possible to carry out matching with quadratic function to the temporal regularity that owner operates the operation of each application-specific, the time t that each application-specific of each owner is operated and the model of fit of frequency of operation F thereof are set to quadratic function matched curve: F=at
2+ bt+ct; In formula, frequency of operation F be in 100 mobile phone operations the operating time be the number of operations of t, t is the operating time, a, b, c are respectively the different fitting coefficients of each application-specific, and a and the b numerical value of different owner to the quadratic function corresponding to the operating time statistical property of each application-specific is different, concrete numerical value depends on the sample space of collection; In addition, based on actual physics implication, the operating time is the generation frequency of the setting operation of 0 is also 0, therefore c=0; So just obtain the distribution characteristics matched curve of each owner to the single behavior operating time of each application-specific, its formula is: F=at
2+ bt.
There is a maximum in the data distribution curve of embodiment, progressively successively decreases and decline rate also progressively accelerates from maximum toward both sides.The regularity of distribution of this curve and the regularity of distribution of quadratic function similar, therefore owner can be operated the rule quadratic function of note time and carry out matching, can obtain the time (t) of owner's operating handset note is quadratic function matched curve, that is: F=at with the model of fit of probability (p1)
2+ bt+ct.Three fitting coefficients a, b, c are wherein corresponding from the different operating of each user, i.e. corresponding different quadratic function matched curve respectively.This matched curve is exactly the statistical nature of the operating time of user.
(13) because of everyone operating habit different (speed of such as typewriting), therefore a of the quadratic function corresponding to operating time statistical property of different people, the value of b also can corresponding difference, and the numerical value of fitting coefficient is relevant with the sample space collected.Therefore, for the statistical nature fitting function of each single application-specific operation behavior of owner respectively according to its standard deviation of formulae discovery:
Standard deviation is that in much scopes of being distributed in around mean value of most of value set of this parameter, its computing formula is: standard deviation
in formula, natural number i is the sampling number sequence number of certain application-specific operating time, and its maximum, i.e. sampling total degree are n, t
ii-th operating time sampled value, T
0it is the arithmetic mean of all operations time sampling value.This step (13) comprises following content of operation:
(13A) the arithmetic mean T of each independent sensitive operation behavior of owner (browse note, browse photo, browse notepad or displaying video) time is calculated
0.
Time because of certain application operating in user's calling mobile phone is random, this T
0be the arithmetic mean of the operating time of calling certain setting application under mobile phone normal operating state, its computing formula is:
in formula, natural number i is the sampling number sequence number of certain application operating time, and its maximum, i.e. sampling total degree are n, t
ithe time sampling value that owner calls this setting application operating for i-th time, T
0it is the arithmetic mean of all operations time sampling value; t
nnumerical values recited depend on and the statistics feature (the statistics feature in namely presetting in above-mentioned table 1) in the stage of pre-seting and specify that the sampling number n of this statistics should be not less than 100.
(13B) the respective standard deviation of each single sensitive operation time of owner is calculated: according to standard deviation
the standard deviation of formula calculator main operation time.In addition, consider actual physics implication, the operating time is the frequency of the operation generation of 0 also should be 0, therefore c=0.Namely to be the distribution characteristics matched curve of operating time be owner's single file: P=at
2+ bt.
By standard deviation, obtain the standard deviation distribution of each independent sensitive operation behavior (browse note, browse photo, browse notepad or displaying video) of owner as shown in Figure 2.
(13C) the standard difference Butut (as shown in Figure 2) of each single sensitive operation time of owner is obtained according to standard deviation:
From the abscissa T corresponding to the peak the data distribution curve of each application-specific operating time
0it is the arithmetic mean of operating time, the region arranged between two lines near these peak both sides is the responsive surveyed area of event occurrence rate in 94% scope, then the region arranged outside this peak between two lines is the common surveyed area of event occurrence rate in 70% scope or conventional sense region.
See Fig. 2, abscissa T in figure is the arithmetic mean of certain sensitive operation time, article two, the region between " common " vertical line is the region of event occurrence rate in 94% scope, and the region between two " sensitivity " vertical lines is the region of event occurrence rate in 70% scope.
(14) detected parameters is set: whether be non-normal use to realize detection of handset, two class detected parameters are set: detection sensitivity and alarm address.Wherein, detection sensitivity is divided into again two kinds: the responsive susceptibility of detection and the susceptibility of common detection; Alarm address comprises phone number and email address, for when mobile phone non-normal use being detected, warning information is sent to this alarm address.
Step 2, the operation behavior that detection and indentification user is current, once detect and judging that mobile phone is in non-normal use, sends warning information immediately.This step 2 comprises following content of operation:
(21) operation behavior that detection and indentification user is current: when cellphone subscriber starts certain application operating, catch this application operating, and judge whether this application operating belongs to the browsing note, browse photo of setting, to browse in four class application-specific operations of notepad and displaying video a certain; If so, then start timer, start to carry out timing to the time of this application operating, and perform subsequent step (22); If not, then ignore this operation, terminate whole flow process;
(22) whether the mobile phone detected now belongs to non-normal use:
Because the cellphone subscriber of non-owner is when browsing cellphone information, also corresponding subsequent operation to be performed; Therefore for following two kinds of different situations, perform the content of operation of corresponding two kinds of detection methods respectively:
(A) with clearly defined objective, when directly browsing the single application-specific operation of the note in mobile phone, picture, video/or notepad sensitive information, adopt statistical detection method.
Now, the statistical detection method of the single application-specific operation performed, its basic ideas are: owner uses the operating time of this application (as note operation, picture browsing etc.) to meet the distribution of quadratic function statistical nature, if the operating time of active user does not meet the operating time statistical nature of owner, just think that this user is not owner, and then judge that mobile phone is in non-normal use state at present.Concrete detection method comprises following operative step:
(22A) first catch current phone user perform single application-specific operation behavior after, add up the time of implementation t that this user operates this application-specific.
(22B) use the time of this application-specific operation to meet the regularity of distribution of quadratic function statistical nature according to owner, judge whether the time of implementation t of current user operation meets the time statistical nature that owner performs the operation of this application-specific; If meet, then terminate this flow process; If do not meet, then think that this active user is not owner, and then perform subsequent step (22C).
(22C) judge that mobile phone is current and whether be in non-normal use state: according to the individual demand of owner and the different attention rates others being used to oneself mobile phone thereof, two kinds of detection sensitivity of " the responsive detection " or " common detection " selected respectively and arrange, judge whether this operating time t is positioned at selected detection sensitivity scope; If t is not positioned at " responsive detection " or the corresponding detection range of " common detection ", then judges that now mobile phone is just in non-normal use state, perform subsequent step (22D); If t is positioned at " responsive detection " or the corresponding detection range of " common detection ", then thinks that mobile phone is in normal operating condition, terminate this flow process.
In step (22C),
When confidential interval is 94% being the detection sensitivity of " responsive detect ", though owner operate also have an appointment 5 ~ 10% probability be judged as abnormal operation;
When confidential interval be 70% is the detection sensitivity of " common detection ", even if the probability that owner's operation also exists 30% is judged as abnormal operation.
When selecting " responsive detection ", if the sensitive range that t does not fall in fig. 2 interior (namely in 70% scope) is just judged as that mobile phone is in non-normal use state; When selecting " common detection ", if t does not fall, ordinary range in fig. 2 interior (in 94% scope), is just judged as that mobile phone is in non-normal use state.
(22D) mobile phone records this application-specific operation behavior in daily record, and the mobile phone pre-set to owner or mailbox send a warning message, " your mobile phone is used by other people, please notes protection privacy information! ", notify that owner has people attempting to browse the privacy information in owner's mobile phone, start automatic screen locking function locking display screen simultaneously, avoid continuing to reveal privacy information.
(B) target is indefinite, browses the Miscellaneous Documents that may comprise oneself information of interest successively respectively, when comprising multiple application-specific operation of note, picture, video and/or notepad, adopts interactive calculation method.
In step (22), the thinking of interactive calculation method of the multiple application-specific operation behaviors performed is: be in the operation behavior of the cellphone subscriber under non-normal use state based on majority target is indefinite often and browse the related operation such as note, photo continuously, such as: viewer is absorbed in browse owner's short message content, browse note and find that nothing is interested, with regard to then browsing photo, video or notepad etc., these likely store the file of sensitive information.The temporal characteristics function that such use operates separately judges just inaccurate.Extreme case is now: the document time that viewer browses certain particular type is not long, but he performs one time this several operation that may comprise owner's private data whole.Therefore the present invention adopts measuring ability sensitive operation behavior being carried out to association analysis, continuous print operation behavior can be carried out associating and mating, and then improves the accuracy of alarm.
Consider by others' mobile phone see search privacy information time, viewer can obtain oneself interested content with the shortest time usually as far as possible, and therefore the note oneself paid close attention to, photo, video and these files that may comprise sensitive information of notepad can all be browsed to look into and read through by most cases successively; And these operations are generally continuous print, can not finish watching note, upper meeting youngster net (or connecing a phone), then see photo; This does not meet the psychology of peeper.But owner then generally can not these actions of continued operation.Therefore, as long as these sensitive action recur, just think non-normal use state, just can report to the police.
Therefore, in view of above-mentioned analysis, this interactive calculation method comprises following operative step:
(22a) when mobile phone is in normal condition, if when producing application-specific operation behavior, this mobile phone just transfers to abnormal operation state by normal condition;
If (22b) under abnormal operation state, judge whether mobile phone still continues to produce new application-specific operation behavior, and according to the different detection sensitivity that owner is arranged, make corresponding judgement:
When the detection sensitivity of owner is set to " responsive detection ", as long as produce two or more application-specific operation behavior continuously, mobile phone just transfers to alarm status by abnormal operation state, performs subsequent step (22c).Interactive calculation state transitions relation when be detection sensitivity shown in Fig. 3 being " sensitivity "
When the detection sensitivity of owner is set to " common detection ", only have the application-specific operation behavior producing more than three or three continuously, mobile phone just transfers to alarm status by abnormal operation state, performs subsequent step (22c).Interactive calculation state transitions relation when be detection sensitivity shown in Fig. 4 being " sensitivity ".
(22c) be in the handset starting protecting sensitive data function of alarm status: automatically lock display screen, avoid continuing to reveal privacy information; Send a warning message to the mobile phone arranged and mailbox " your mobile phone is used by other people, please notes protection privacy information simultaneously! "; In daily record, also record above-mentioned various operation behavior, inquire about for owner afterwards and call to account.
Inventions have been and repeatedly implement test, test section result is successful, achieves goal of the invention.
The foregoing is only preferred embodiment of the present invention, not in order to limit the present invention, within the spirit and principles in the present invention all, any amendment made, equivalent replacement, improvement etc., all should be included within the scope of protection of the invention.
Claims (7)
1. the detection alarm method of a mobile phone non-normal use, it is characterized in that: according to the finding of specific crowd for significant data attention rate, choose and to arrange in cellphone subscriber's operation behavior easily reveal important sensitive data browse note, browse photo, the four kinds of sensitive operation behaviors browsing notepad and displaying video are application-specific operation, and detect for the behavior of this four kinds of application-specific operation: the statistic mixed-state carried out for each independently operation behavior of mobile phone respectively and the interactive calculation carried out for multiple continuous print operation behavior, again these two kinds of detection meanss detected be combineding with each other and judge whether this mobile phone is in non-normal use, the i.e. state of non-Mobile phone instigator, once judge that mobile phone is in non-owner and uses, just send warning information immediately, the operation behavior of described mobile phone is the operation behavior that the current user of mobile phone is using mobile phone, the method comprises following two operating procedures:
Step 1, preliminary treatment and optimum configurations: based on the study to owner's mobile phone operation behavioural characteristic, sample and preliminary treatment to the time data of application-specific operation, then arrange detected parameters: detection sensitivity and alarm address;
Step 2, the operation behavior that detection and indentification user is current, once detect and judging that mobile phone is in non-normal use, sends warning information immediately.
2. method according to claim 1, is characterized in that: described step 1 comprises following content of operation:
(11) extractor instigator uses the statistical nature of application-specific operating time, carry out preliminary treatment: the statistical law of application-specific operating time during extraction owner use mobile phone, again based on this statistics, obtain mobile phone owner to the operating time t of each application-specific and the relational expression of probability P and distribution curve thereof, thus the different application-specific operations controls of each mobile phone owner are not corresponded to a quadratic function matched curve, and the statistical nature using this matched curve as the application-specific operating time of each mobile phone owner;
(12) from the maximum the data distribution curve of each application-specific operating time, progressively successively decrease respectively, and decline rate progressively accelerates toward its both sides, the regularity of distribution and the quadratic function curve of this application-specific operating time obtained are similar; This makes it possible to carry out matching with quadratic function to the temporal regularity that owner operates the operation of each application-specific, the time t that each application-specific of each owner is operated and the model of fit of frequency of operation F thereof are set to quadratic function matched curve: F=at
2+ bt+ct; In formula, frequency of operation F be in 100 mobile phone operations the operating time be the number of operations of t, t is the operating time, a, b, c are respectively the different fitting coefficients of each application-specific, and a and the b numerical value of different owner to the quadratic function corresponding to the operating time statistical property of each application-specific is different, concrete numerical value depends on the sample space of collection; In addition, based on actual physics implication, the operating time is the generation frequency of the setting operation of 0 is also 0, therefore c=0; So just obtain the distribution characteristics matched curve of each owner to the single behavior operating time of each application-specific, its formula is: F=at
2+ bt;
(13) operating habit because of everyone is different, therefore for the statistical nature fitting function of each single application-specific operation behavior of owner respectively according to its standard deviation of formulae discovery:
in formula, natural number i is the sampling number sequence number of certain application-specific operating time, and its maximum, i.e. sampling total degree are n, t
ii-th operating time sampled value, T
0it is the arithmetic mean of all operations time sampling value; Described standard deviation is in much scopes of being distributed in around mean value of most of value set of this parameter;
(14) arrange detected parameters: whether be non-normal use to realize detection of handset, arrange two class detected parameters: detection sensitivity and alarm address, wherein, detection sensitivity is divided into again two kinds: the susceptibility of the responsive susceptibility that detects and common detection; Alarm address comprises phone number and email address, for when mobile phone non-normal use being detected, warning information is sent to this alarm address.
3. method according to claim 2, is characterized in that: described step (13) comprises following content of operation:
(13A) the arithmetic mean T of computer main operation time
0: the time because of certain application operating in user's calling mobile phone is random, this T
0be the arithmetic mean of the operating time of calling setting application under mobile phone normal operating state, its computing formula is:
in formula, natural number i is the sampling number sequence number of certain application operating time, and its maximum, i.e. sampling total degree are n, t
ithe time sampling value that owner calls this setting application operating for i-th time, T
0it is the arithmetic mean of all operations time sampling value; t
nnumerical values recited depend on the statistics feature in the stage of pre-seting, and specify that the sampling number n of this statistics should be not less than 100;
(13B) standard deviation of computer main operation time: according to
the standard deviation of formula calculator main operation time;
(13C) the standard difference Butut of each single sensitive operation time of owner is obtained according to standard deviation: from the abscissa T corresponding to the peak the data distribution curve of each application-specific operating time
0it is the arithmetic mean of operating time, the region arranged between two lines near these peak both sides is the responsive surveyed area of event occurrence rate in 94% scope, then the region arranged outside this peak between two lines is the common surveyed area of event occurrence rate in 70% scope or conventional sense region.
4. method according to claim 1, is characterized in that: described step 2 comprises following content of operation:
(21) user operation behavior is identified: when cellphone subscriber starts certain application operating, catch this application operating, and judge whether this application operating belongs to the browsing note, browse photo of setting, to browse in four class application-specific operations of notepad and displaying video a certain; If so, then start timer, start to carry out timing to the time of this application operating, and perform subsequent step (22); If not, then ignore this operation, terminate whole flow process;
(22) whether the mobile phone detected now belongs to non-normal use: because the cellphone subscriber of non-owner is when browsing cellphone information, also will perform corresponding subsequent operation; Therefore for following two kinds of different situations, perform the content of operation of corresponding two kinds of detection methods respectively:
(A) with clearly defined objective, when directly browsing the single application-specific operation of the note in mobile phone, picture, video/or notepad sensitive information, adopt statistical detection method;
(B) target is indefinite, browses the Miscellaneous Documents that may comprise oneself information of interest successively respectively, when comprising multiple application-specific operation of note, picture, video and/or notepad, adopts interactive calculation method.
5. method according to claim 4, is characterized in that: in described step (22), and the statistical detection method of the single application-specific operation of execution comprises following operative step:
(22A) first catch current phone user perform single application-specific operation behavior after, add up the time of implementation t that this user operates this application-specific;
(22B) use the time of this application-specific operation to meet the regularity of distribution of quadratic function statistical nature according to owner, judge whether the time of implementation t of current user operation meets the time statistical nature that owner performs the operation of this application-specific; If meet, then terminate this flow process; If do not meet, then think that this active user is not owner, and then perform subsequent step (22C);
(22C) judge that mobile phone is current and whether be in non-normal use state: according to the individual demand of owner and the different attention rates others being used to oneself mobile phone thereof, two kinds of detection sensitivity of " the responsive detection " or " common detection " selected respectively and arrange, judge whether this operating time t is positioned at selected detection sensitivity scope; If t is not positioned at " responsive detection " or the corresponding detection range of " common detection ", then judges that now mobile phone is just in non-normal use state, perform subsequent step (22D); If t is positioned at " responsive detection " or the corresponding detection range of " common detection ", then thinks that mobile phone is in normal operating condition, terminate this flow process;
(22D) mobile phone records this application-specific operation behavior in daily record, and the mobile phone pre-set to owner or mailbox send a warning message, " your mobile phone is used by other people, please notes protection privacy information! ", notify that owner has people attempting to browse the privacy information in owner's mobile phone, start automatic screen locking function locking display screen simultaneously, avoid continuing to reveal privacy information.
6. method according to claim 4, is characterized in that: in described step (22C),
When confidential interval is 94% being the detection sensitivity of " responsive detect ", though owner operate also have an appointment 5 ~ 10% probability be judged as abnormal operation;
When confidential interval be 70% is the detection sensitivity of " common detection ", even if the probability that owner's operation also exists 30% is judged as abnormal operation.
7. method according to claim 4, it is characterized in that: in described step (22), the thinking of the interactive calculation method of the multiple application-specific operation behaviors performed is: during because checking its privacy information with others' mobile phone, oneself interested content can be obtained with the shortest time as much as possible, therefore the sensitive information in note, photo, video and/or the notepad oneself paid close attention to can be browsed successively, continuously; As long as therefore these application-specific of execution operate continuously, just think non-normal use state; This interactive calculation method comprises following operative step:
(22a) when mobile phone is in normal condition, if when producing application-specific operation behavior, this mobile phone just transfers to abnormal operation state by normal condition;
(22b) mobile phone judges whether to continue to produce new application-specific operation behavior, and according to the different detection sensitivity that owner is arranged, makes corresponding judgement:
When the detection sensitivity of owner is set to " responsive detection ", as long as produce two or more application-specific operation behavior continuously, mobile phone just transfers to alarm status by abnormal operation state, performs subsequent step (22c);
When the detection sensitivity of owner is set to " common detection ", only have the application-specific operation behavior producing more than three or three continuously, mobile phone just transfers to alarm status by abnormal operation state, performs subsequent step (22c);
(22c) be in the handset starting protecting sensitive data function of alarm status: automatically lock display screen, avoid continuing to reveal privacy information; Send a warning message to the mobile phone arranged and mailbox " your mobile phone is used by other people, please notes protection privacy information simultaneously! "; In daily record, also record above-mentioned various operation behavior, inquire about for owner afterwards and call to account.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510472659.1A CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510472659.1A CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105025170A true CN105025170A (en) | 2015-11-04 |
| CN105025170B CN105025170B (en) | 2017-10-10 |
Family
ID=54414858
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510472659.1A Expired - Fee Related CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105025170B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105791570A (en) * | 2016-02-29 | 2016-07-20 | 宇龙计算机通信科技(深圳)有限公司 | Early-warning method and early-warning system of mobile terminal |
| CN106709365A (en) * | 2016-11-30 | 2017-05-24 | 广东欧珀移动通信有限公司 | Privacy protection method and device and mobile terminal |
| CN106919579A (en) * | 2015-12-24 | 2017-07-04 | 腾讯科技（深圳）有限公司 | A kind of information processing method and device, equipment |
| CN109587345A (en) * | 2018-12-28 | 2019-04-05 | 努比亚技术有限公司 | Abnormal Application Hints method, mobile terminal and computer readable storage medium |
| CN109756620A (en) * | 2018-12-15 | 2019-05-14 | 深圳壹账通智能科技有限公司 | Softcam recognition methods and relevant device based on mobile phone |
| CN110609500A (en) * | 2019-09-23 | 2019-12-24 | 四川长虹电器股份有限公司 | Displacement sensor alarm state control system and method based on cloud |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100299757A1 (en) * | 2009-05-21 | 2010-11-25 | Ho Sub Lee | Mobile terminal for information security and information security method of mobile terminal |
| WO2012075765A1 (en) * | 2010-12-09 | 2012-06-14 | 中兴通讯股份有限公司 | Method and device for preventing mobile terminal from illegal users |
| CN103906045A (en) * | 2013-12-25 | 2014-07-02 | 武汉安天信息技术有限责任公司 | Method and system for monitoring mobile terminal privacy stealing behaviors |
| CN104268481A (en) * | 2014-10-10 | 2015-01-07 | 中国联合网络通信集团有限公司 | Method and device for realizing early warning of smart phone |
-
2015
- 2015-08-05 CN CN201510472659.1A patent/CN105025170B/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100299757A1 (en) * | 2009-05-21 | 2010-11-25 | Ho Sub Lee | Mobile terminal for information security and information security method of mobile terminal |
| WO2012075765A1 (en) * | 2010-12-09 | 2012-06-14 | 中兴通讯股份有限公司 | Method and device for preventing mobile terminal from illegal users |
| CN103906045A (en) * | 2013-12-25 | 2014-07-02 | 武汉安天信息技术有限责任公司 | Method and system for monitoring mobile terminal privacy stealing behaviors |
| CN104268481A (en) * | 2014-10-10 | 2015-01-07 | 中国联合网络通信集团有限公司 | Method and device for realizing early warning of smart phone |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106919579A (en) * | 2015-12-24 | 2017-07-04 | 腾讯科技（深圳）有限公司 | A kind of information processing method and device, equipment |
| CN105791570A (en) * | 2016-02-29 | 2016-07-20 | 宇龙计算机通信科技(深圳)有限公司 | Early-warning method and early-warning system of mobile terminal |
| CN105791570B (en) * | 2016-02-29 | 2020-02-21 | 宇龙计算机通信科技(深圳)有限公司 | Early warning method and system for mobile terminal |
| CN106709365A (en) * | 2016-11-30 | 2017-05-24 | 广东欧珀移动通信有限公司 | Privacy protection method and device and mobile terminal |
| CN106709365B (en) * | 2016-11-30 | 2019-09-13 | Oppo广东移动通信有限公司 | A kind of method for secret protection and device, mobile terminal |
| CN109756620A (en) * | 2018-12-15 | 2019-05-14 | 深圳壹账通智能科技有限公司 | Softcam recognition methods and relevant device based on mobile phone |
| CN109756620B (en) * | 2018-12-15 | 2021-07-23 | 深圳壹账通智能科技有限公司 | Virtual camera identification method based on mobile phone and related equipment |
| CN109587345A (en) * | 2018-12-28 | 2019-04-05 | 努比亚技术有限公司 | Abnormal Application Hints method, mobile terminal and computer readable storage medium |
| CN109587345B (en) * | 2018-12-28 | 2021-09-07 | 努比亚技术有限公司 | Abnormal application prompting method, mobile terminal and computer readable storage medium |
| CN110609500A (en) * | 2019-09-23 | 2019-12-24 | 四川长虹电器股份有限公司 | Displacement sensor alarm state control system and method based on cloud |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105025170B (en) | 2017-10-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105025170A (en) | Detection and alarm method of mobile phone in non-normal use | |
| US20210318793A1 (en) | Method and Apparatus for Managing Notification Bar Message | |
| EP2945091B1 (en) | Assessment type-variable enterprise security impact analysis | |
| US8826452B1 (en) | Protecting computers against data loss involving screen captures | |
| US20050210056A1 (en) | Workstation information-flow capture and characterization for auditing and data mining | |
| CN105787324A (en) | Computer information security system | |
| KR101522311B1 (en) | A carrying-out system for images of the closed-circuit television with preview function | |
| TW200945181A (en) | Method for prompting outstanding event in screen lock state, electronic device thereof, and recording medium thereof | |
| EP2993607B1 (en) | Privacy compliant event analysis | |
| US20140245452A1 (en) | Responding to a possible privacy leak | |
| US20220215093A1 (en) | Event Monitoring | |
| CN117240614B (en) | Network information safety monitoring and early warning system based on Internet | |
| US20230306131A1 (en) | Systems and methods for tracking propagation of sensitive data | |
| AU2016262874A1 (en) | Systems, methods, and devices for information sharing and matching | |
| Smith et al. | User authentication in smartphones for telehealth | |
| AlAbdulkarim et al. | Impact of privacy concerns on consumers' acceptance of smart metering in the Netherlands | |
| Agrafiotis et al. | A tripwire grammar for insider threat detection | |
| US20230259251A1 (en) | Systems and methods for managing security events using a graphical user interface | |
| CN106529338A (en) | Safe processing method and equipment of data file | |
| Horsman | Reviewing the devices of those subject to Sexual Harm Prevention Orders (SHPOs): iOS opportunities, limitations and strategies | |
| CN103207968A (en) | Recording method for operating process and management method and system for information safety | |
| Park et al. | A study on development of internal information leak symptom detection model by using internal information leak scenario & data analytics | |
| Horsman | Can signs of digital coercive control be evidenced in mobile operating system settings?-A guide for first responders | |
| US20220156309A1 (en) | Multimedia management system (mms) | |
| TW201329769A (en) | Method and system for managing information security |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20171010 |