CN105025170B - A kind of detection alarm method of mobile phone non-normal use - Google Patents
A kind of detection alarm method of mobile phone non-normal use Download PDFInfo
- Publication number
- CN105025170B CN105025170B CN201510472659.1A CN201510472659A CN105025170B CN 105025170 B CN105025170 B CN 105025170B CN 201510472659 A CN201510472659 A CN 201510472659A CN 105025170 B CN105025170 B CN 105025170B
- Authority
- CN
- China
- Prior art keywords
- mobile phone
- application
- owner
- detection
- specific
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 106
- 238000000034 method Methods 0.000 title claims abstract description 30
- 230000006399 behavior Effects 0.000 claims abstract description 66
- 230000035945 sensitivity Effects 0.000 claims description 41
- 238000012887 quadratic function Methods 0.000 claims description 23
- 238000005070 sampling Methods 0.000 claims description 19
- 230000002159 abnormal effect Effects 0.000 claims description 11
- 230000007423 decrease Effects 0.000 claims description 6
- 238000011017 operating method Methods 0.000 claims description 5
- 230000002123 temporal effect Effects 0.000 claims description 4
- 230000003542 behavioural effect Effects 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims description 3
- 238000005315 distribution function Methods 0.000 claims description 3
- 238000011896 sensitive detection Methods 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 abstract description 3
- 230000001010 compromised effect Effects 0.000 abstract description 2
- 238000011835 investigation Methods 0.000 abstract 1
- 230000006870 function Effects 0.000 description 7
- 238000007689 inspection Methods 0.000 description 5
- 238000012546 transfer Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 238000007619 statistical method Methods 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 230000033228 biological regulation Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 239000000686 essence Substances 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000011895 specific detection Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Landscapes
- Mobile Radio Communication Systems (AREA)
- Telephone Function (AREA)
Abstract
Four kinds of sensitive operation behaviors that important sensitive data is easily revealed in cellphone subscriber's operation behavior are chosen and set in a kind of detection alarm method of mobile phone non-normal use, the investigation according to specific crowd to significant data attention rate：It is application-specific operation to browse short message, browse photo, browse notepad and play video, and is detected for four kinds of application-specific operation behaviors：The association for being directed to each independent operation behavior statistic mixed-state carried out of mobile phone respectively and being carried out for multiple continuous operation behaviors is detected, then both detection means are detected with judging whether the mobile phone is in non-normal use, the state that i.e. non-mobile phone owner uses in conjunction with each other；Once judge mobile phone be in non-owner in use, once send warning information immediately.Even if causing owner user to use inventive process avoids existing hardware encryption technology, the troublesome operation of password is also inputted, is also effectively reduced when owner is careless, the compromised risk of the private data in mobile phone, application prospect is had an optimistic view of.
Description
Technical field
The present invention relates to a kind of detection alarm method of mobile phone non-normal use, exactly, it is related to a kind of mobile phone in quilt
Non- owner uses, i.e. non-normal use when detection alarm method, the technology for belonging to smart mobile phone private data guard leads
Domain.
Background technology
Now, mobile phone can be carried with and easy to use, flexibly and the various features that are gradually improved of function because of it,
An indispensable part in through being lived as people.The popularization of especially smart mobile phone is used so that people are usually some
The sensitive information of high value is stored in mobile phone so that mobile phone has progressively been evolved into the multimedia of processing and storage personal information
Platform, wherein the information stored includes：Address list, private photos, important short message, or even some entry passwords applied etc..
These data are extremely important for each owner.Moreover, the storage of these private datas is deposited using mobile phone as medium
, while will also result in the hidden danger that information is lost and peeped.(such as work unit, school, family under some public arenas
In, dining room or film and drama place etc.), these sensitive informations can be worked together, classmate, friend, parent or even stranger etc. are careless
Or purposely browse, these behaviors all can be caused to reveal or damaged to the individual privacy of owner.
At present, the secret protection of data in mobile phone is all paid much attention to both at home and abroad, and a variety of typical cases have been developed in this respect should
With for example：This base mobile phone safe software of 360 mobile guards, safe house keeper and kappa etc..These existing fail-safe softwares are most
It is using the secret protection that data in mobile phone is realized to the method that the private data file on mobile phone is encrypted.User only has input
During correct password, just it may browse through and using the file or data in encryption folder.This mode is although simple and reliable,
But be the drawbacks of exist：Even if owner uses sensitive document every time, password equally must be also inputted first, felt very not
It is convenient, and easily cause other people to notice there is sensitive information on mobile phone.In addition, cipher mode generally only has to stranger
Effect, for the personnel (such as colleague, good friend and relatives) familiar with owner often it is also known that the password of mobile phone, this to add
The mode of ciphertext part, it is then not possible to allow owner to see whether someone in the case of owner is unwitting, it is intended to browse in mobile phone
Privacy information.
Therefore, one kind how is designed when mobile phone is not in owner's visual line of sight, can be automatically to preserving sensitive letter
The file of breath is detected, and is judged whether to be browsed and actively alerted and log, the hand for tracing to the source afterwards to owner
The guard method of machine private data, be one very have actual application value new problem, be also numerous mobile phone owners very
One focus of concern.
The content of the invention
In view of this, it is an object of the invention to provide inspection when a kind of mobile phone non-normal use (i.e. non-owner uses)
Alarm method is surveyed, the present invention is a kind of mobile phone guard method of " flexibility ", operation behavior that can be on actively monitoring mobile phone, and root
Whether according to operation behavior feature detection, whether the mobile phone is in non-normal use state, i.e., attempt to browse mobile phone EMS memory storage
Sensitive information.When mobile phone is detected in non-normal use state, just actively sent to the default number of owner or mailbox
Warning information, and in mobile phone local recordings daily record.The present invention can be reduced effectively when owner is careless, hidden in mobile phone
The compromised risk of private data, with good application prospect.
When in order to achieve the above object, being used the invention provides a kind of mobile phone non-normal use, i.e. non-owner
Detect alarm method, it is characterised in that：According to finding of the specific crowd for significant data attention rate, choose and hand is set
Browsing short message, browsing photo, browse notepad and play video for important sensitive data is easily revealed in machine user's operation behavior
Four kinds of sensitive operation behaviors be application-specific operation, and detected for the behavior of four kinds of application-specifics operation：Respectively
Statistic mixed-state and the association for multiple continuous operation behaviors progress that each independent operation behavior for mobile phone is carried out
Detection, then both detection means are detected and judge whether the mobile phone is in non-normal use, i.e. non-mobile phone in conjunction with each other
The state that owner uses；Once judge mobile phone be in non-owner in use, once send warning information immediately；The operation of the mobile phone
Behavior is the operation behavior that the currently used person of mobile phone is using mobile phone；This method includes following two operating procedure：
Step 1, pretreatment and parameter setting：Based on the study to owner's mobile phone operation behavioural characteristic, answer specific
Sampled and pre-processed with the time data of operation, then detection parameter is set：Detection sensitivity and alarm address；The step
1 includes following operation content：
(11) extractor instigator is pre-processed with the statistical nature of application-specific operating time：Extracting owner makes
With the statistical law of application-specific operating time during mobile phone, then based on the statistics, mobile phone owner is obtained to each specific
The operating time t of application and the relational expression and its distribution curve of probability P, so that the different application-specifics of each mobile phone owner be grasped
Work all corresponds to a quadratic function matched curve respectively, and specific using the matched curve as each mobile phone owner should
With the statistical nature of operating time；
(12) from the maximum in the data distribution curve of each application-specific operating time, progressively passed toward its both sides respectively
Subtract, and decline rate progressively accelerates, the regularity of distribution and quadratic function curve of the obtained application-specific operating time is similar；
It is fitted this makes it possible to the temporal regularity for operating each application-specific to operate owner with quadratic function so that each owner
The operation of each application-specific time t and its operating frequency F model of fit be set to quadratic function matched curve：F=at2
+bt+ct；In formula, operating frequency F is the number of operations that the operating time is t in 100 mobile phone operations, and t is operating time, a, b, c
The different fitting coefficients of respectively each application-specific, and different owners are to the operating time statistical property institute of each application-specific
A the and b numerical value of corresponding quadratic function is different, and concrete numerical value depends on the sample space of collection；In addition, based on actual thing
Implication is managed, the operating time is also 0 for the generation frequency of 0 setting operation, therefore c=0；Each owner is thus obtained to each spy
Surely the distribution characteristics matched curve for the single behavior operating time applied, its formula is：F=at2+bt；
(13) because everyone operating habit is different, therefore the system of each single application-specific operation behavior for owner
Meter feature fitting function calculates its standard deviation according to formula respectively：In formula, natural number i is
The sampling number sequence number of some application-specific operating time, its maximum, i.e. sampling total degree are n, tiIt is the ith operating time
Sampled value, T0It is the arithmetic mean of instantaneous value of all operationss time sampling value；The standard deviation is most of value sets of the parameter
It is distributed in much scopes around average value；
(14) detection parameter is set：In order to realize whether detection mobile phone is non-normal use, sets two classes to detect parameter：Inspection
Susceptibility and alarm address are surveyed, wherein, detection sensitivity is divided into two kinds again：The susceptibility of sensitivity detection and the sensitivity commonly detected
Degree；Alerting address includes phone number and email address, for when detecting mobile phone non-normal use, warning information to be sent
To the alarm address；
Step 2, the detection operation behavior current with identification user, once detect and judge that mobile phone is in non-normal use
When, warning information is sent immediately.
Mobile phone non-normal use detection alarm method of the present invention preferably solves the defect of prior art presence：Owner is not
It can see whether in the case of its is unwitting, attempt to browse or browsed the privacy information in mobile phone.In addition,
The inventive method also has following innovative characteristicses：
(1) even if the inventive method not only avoid the owner user that hardware encryption causes and use, similarly need defeated
Enter the troublesome operation of password；Meanwhile, the alarm under non-normal use state, can under the ignorant state of owner real-time reminding
Owner：There is risk of leakage in the sensitive data in mobile phone.Have moreover, the operation behavior daily record stored on mobile phone also allows owner to understand
Which sensitive data, it had been never actually viewed by others at what time, for the foundation traced to the source afterwards.
(2) present invention is detected using the detection method of statistical analysis for single sensitive operation behavior, moreover, each
The time statistical characteristics of independent sensitive operation can be made according to the habit statistical characteristic of the different operating time of each owner
Corresponding adjustment.
(3) the inventive method supports personalized alarm：First, each user can select different detection sensitivities,
Namely different user can be set corresponding detection by the attention degree of non-normal use according to oneself for itself mobile phone
Susceptibility so that be both unlikely to produce excessive uncorrelated wrong report, the alarm event of oneself care is not omitted yet.Secondly, user
Different alarm modes can also be set according to the actual conditions of oneself：Both the alarm mode of SMS can be used, can also
Using the alarm mode of Email.
In a word, the inventive method operating procedure is simple, convenient, reliable, practical, is expected to obtain popularization and application.
Brief description of the drawings
Fig. 1 is the detection alarm method operating procedure flow chart of mobile phone non-normal use of the present invention.
Fig. 2 is the poor distribution schematic diagram of mobile phone owner's single operation time standard in the embodiment of the present invention.
Fig. 3 is that (detection sensitivity is " quick for many behaviors association detection state transfer schematic diagram in the embodiment of the present invention
Sense ").
Fig. 4 is that (detection sensitivity is " one for many behaviors association detection state transfer schematic diagram in the embodiment of the present invention
As ").
Embodiment
To make the object, technical solutions and advantages of the present invention clearer, with reference to the accompanying drawings and examples to the present invention
It is described in further detail.
A kind of detection alarm method when the present invention is mobile phone non-normal use, i.e. non-owner uses, this method is
According to finding of the specific crowd for significant data attention rate, choose and set the currently used person of mobile phone to use mobile phone
Operation behavior in easily reveal important sensitive data browse short message, browse photo, browse notepad and play video four
It is that application-specific is operated to plant sensitive operation behavior, and is detected for the behavior of four kinds of application-specifics operations：It is directed to respectively
Statistic mixed-state and detected for the association of multiple continuous operation behaviors progress that each single operation behavior of mobile phone is carried out,
Again by both detection means detect in conjunction with each other with judge the mobile phone whether in non-mobile phone owner using, i.e. improper make
State；Once judge mobile phone be in non-owner in use, once send warning information immediately.
Referring to Fig. 1, the following two operating procedure of the inventive method is introduced：
Step 1, pretreatment and parameter setting：Based on the study to owner's mobile phone operation behavioural characteristic, answer specific
Sampled and pre-processed with the time data of operation, then detection parameter is set：Detection sensitivity and alarm address.The step 1
Including following operation content：
(11) extractor instigator is pre-processed with the statistical nature of application-specific operating time：Extracting owner makes
With the statistical law of application-specific operating time during mobile phone, then based on the statistics, mobile phone owner is obtained to each specific
The operating time t of application and the relational expression and its distribution curve of probability P, so that the different application-specifics of each mobile phone owner be grasped
Work all corresponds to a quadratic function matched curve respectively, and specific using the matched curve as each mobile phone owner should
With the statistical nature of operating time.
Embodiments of the invention are that so that short message is operated as an example, specific statistical method is described as follows：Gather 100 short messages of owner
The time span value of application operating, with 3 seconds to calculate time interval, specific data are as shown in table 1 below.
Table 1：The statistical form of 100 short message operating times of certain mobile phone owner
In the table 1, t is the operating time, and F is to operate frequency (number of operations that the operating time is t in i.e. 100 times operations).
Based on above-mentioned statistics, the short message operating time t of mobile phone owner and the relation of probability P are obtained.
(12) from the maximum in the data distribution curve of each application-specific operating time, progressively passed toward its both sides respectively
Subtract, and decline rate progressively accelerates, the regularity of distribution and quadratic function curve of the obtained application-specific operating time is similar；
It is fitted this makes it possible to the temporal regularity for operating each application-specific to operate owner with quadratic function so that each owner
The operation of each application-specific time t and its operating frequency F model of fit be set to quadratic function matched curve：F=at2
+bt+ct；In formula, operating frequency F is the number of operations that the operating time is t in 100 mobile phone operations, and t is operating time, a, b, c
The different fitting coefficients of respectively each application-specific, and different owners are to the operating time statistical property institute of each application-specific
A the and b numerical value of corresponding quadratic function is different, and concrete numerical value depends on the sample space of collection；In addition, based on actual thing
Implication is managed, the operating time is also 0 for the generation frequency of 0 setting operation, therefore c=0；Each owner is thus obtained to each spy
Surely the distribution characteristics matched curve for the single behavior operating time applied, its formula is：F=at2+bt。
Be present a maximum in the data distribution curve of embodiment, progressively successively decrease and decline rate from maximum toward both sides
Also progressively accelerate.The regularity of distribution of the curve and the regularity of distribution of quadratic function are similar, therefore owner can be operated into short message
The rule of time is fitted with quadratic function, can obtain the time (t) of owner's operating handset short message and the plan of probability (p1)
Matched moulds type is quadratic function matched curve, i.e.,：F=at2+bt+ct.Three fitting coefficients a, b, c therein are with each user's
Different operating is corresponding, correspond to different quadratic function matched curves respectively.The matched curve is exactly the operating time of user
Statistical nature.
(13) because everyone operating habit is different (speed such as typewrited), therefore the operating time statistics of different people
The a of quadratic function corresponding to characteristic, b value also can be accordingly different, and the numerical value of fitting coefficient has with the sample space collected
Close.Therefore, calculated respectively according to formula for the statistical nature fitting function of each single application-specific operation behavior of owner
Its standard deviation：
Standard deviation is that most of value sets of the parameter are distributed in much scopes around average value, its calculation formula
It is：In formula, natural number i is the sampling number sequence number of some application-specific operating time, its
Maximum, i.e. sampling total degree are n, tiIt is ith operating time sampled value, T0Be all operationss time sampling value arithmetic put down
Average.The step (13) includes following operation content：
(13A) calculates each individually sensitive operation behavior of owner and (browses short message, browse photo, browse notepad or broadcast
Put video) the arithmetic mean of instantaneous value T of time0。
Because the time of some application operating in user's calling mobile phone is random, the T0Under being mobile phone normal operating state
The arithmetic mean of instantaneous value of the operating time of some setting application is called, its calculation formula is：Formula
In, natural number i is the sampling number sequence number of some application operating time, and its maximum, i.e. sampling total degree are n, tiIt is owner
Ith calls the time sampling value of the setting application operating, T0It is the arithmetic mean of instantaneous value of all operationss time sampling value；tnNumber
Value size depends on pre-seting the statistics feature (the statistics feature in being preset in i.e. above-mentioned table 1) in stage, and regulation
The sampling number n of the statistics should be not less than 100.
(13B) calculates the respective standard deviation of each single sensitive operation time of owner：According to
The formula calculator main operation time standard deviation.Additionally, it is contemplated that actual physics implication, the operating time is 0 operation generation
The frequency should also be 0, therefore c=0.That is the distribution characteristics matched curve of owner's single act operating time is：P=at2+bt。
By standard deviation, each independent sensitive operation behavior for obtaining owner (browses short message, browses photo, browses account
This plays video) standard deviation distribution it is as shown in Figure 2.
(13C) obtains the standard difference Butut of each single sensitive operation time of owner according to standard deviation (such as Fig. 2 institutes
Show)：
From the abscissa T corresponding to the peak in the data distribution curve of each application-specific operating time0It is operation
The arithmetic mean of instantaneous value of time, the region being arranged close between the two lines of the peak both sides is event occurrence rate in 94% model
Enclose interior sensitive detection zone, then it is event occurrence rate 70% to set the region between two lines on the outside of the peak
In the range of common detection zone or conventional detection region.
Referring to Fig. 2, the abscissa T in figure is the arithmetic mean of instantaneous value of some sensitive operation time, two " sensitivity " vertical lines it
Between region be region of the event occurrence rate in the range of 94%, the region between two " common " vertical lines occurs generally for event
Region of the rate in the range of 70%.
(14) detection parameter is set：In order to realize whether detection mobile phone is non-normal use, sets two classes to detect parameter：Inspection
Survey susceptibility and alarm address.Wherein, detection sensitivity is divided into two kinds again：The susceptibility of sensitivity detection and the sensitivity commonly detected
Degree；Alerting address includes phone number and email address, for when detecting mobile phone non-normal use, warning information to be sent
To the alarm address.
Step 2, the detection operation behavior current with identification user, once detect and judge that mobile phone is in non-normal use
When, warning information is sent immediately.The step 2 includes following operation content：
(21) the detection operation behavior current with identification user：When cellphone subscriber starts some application operating, capture should
Application operating, and judge whether the application operating belongs to browsing short message, browsing photo, browse notepad and broadcasting is regarded for setting
A certain kind in the four class application-specifics operation of frequency；If it is, starting timer, starting to carry out the time of the application operating
Timing, and perform subsequent step (22)；If it is not, then ignoring the operation, terminate whole flows；
(22) whether the mobile phone of detection now belongs to non-normal use：
Because the cellphone subscriber of non-owner is when browsing cellphone information, corresponding subsequent operation is also performed；Therefore for following
Two kinds of different situations, perform the operation content of corresponding two kinds of detection methods respectively：
(A) it is with clearly defined objective, directly browse the single specific of short message in mobile phone, picture, video/or notepad sensitive information
During application operating, using statistical detection method.
Now, the statistical detection method of the single application-specific operation of execution, its basic ideas is：Owner uses should
Operating time using (such as short message operation, picture browsing) meets the distribution of quadratic function statistical nature, if active user
Operating time does not meet the operating time statistical nature of owner, and it is not owner to be considered as the user, and then judges hand
Machine is currently in non-normal use state.Specific detection method includes following operative step：
(22A) is captured after the behavior that current phone user performs single application-specific operation first, counts the user to this
The execution time t of application-specific operation.
The time that (22B) is operated according to owner using the application-specific meets the distribution rule of quadratic function statistical nature
Rule, judges whether execution time t of current user operation meets the time statistics spy that owner performs application-specific operation
Levy；If meeting, terminate the flow；If not meeting, then it is assumed that the active user is not owner, and then perform subsequent step
(22C)。
(22C) judges whether mobile phone is currently in non-normal use state：According to the individual demand of owner and its to other
People uses the different attention rates of oneself mobile phone, and two kinds of detections of " the sensitivity detection " or " common detection " that selects and set respectively are quick
Sensitivity, judges whether operating time t is located in the range of selected detection sensitivity；If t is not located at " sensitivity detection " or " general
In the corresponding detection range of logical detection ", then judge that now mobile phone is at non-normal use state, performs subsequent step (22D)；
If t is located in the corresponding detection range of " sensitivity detection " or " common detection ", then it is assumed that mobile phone is in normal operating condition, terminates
The flow.
In step (22C),
When it 94% is the detection sensitivity of " sensitivity detection " that confidential interval, which is, operated even if owner also have about 5~
10% probability is judged as abnormal operation；
When it is the detection sensitivity of " common detection " that confidential interval, which is 70%, even if there is also 30% for owner's operation
Probability be judged as abnormal operation.
When selection " sensitivity detection ", it is judged as if t is not fallen within the sensitive range in Fig. 2 (in the range of i.e. 70%)
Mobile phone is in non-normal use state；When selection " common detection ", if t does not fall within Fig. 2 (94% scope in ordinary range
It is interior), just it is judged as that mobile phone is in non-normal use state.
(22D) mobile phone records the application-specific operation behavior, and the mobile phone or mailbox pre-set to owner in daily record
Sending a warning message, " your mobile phone is used by others, it is noted that protection privacy information！", notify owner someone to be attempt to
The privacy information in owner's mobile phone is browsed, function locking display screen is locked screen automatically while starting, it is to avoid continues to reveal privacy information.
(B) target is indefinite, and the Miscellaneous Documents of oneself information of interest may be included successively by browsing respectively, including short message,
During multiple application-specifics operation of picture, video and/or notepad, using association detection method.
In step (22), the thinking of the association detection method of multiple application-specific operation behaviors of execution is：Based on many
The operation behavior for the cellphone subscriber that number is under non-normal use state, which is often that target is indefinite, continuously browses short message, photo
Etc. related operation, such as：Viewer is not to be absorbed in browse owner's short message content, browses short message and finds do not have sense emerging
Interest, just then browse photo, video or notepad etc. these be possible to store sensitive information file.So with individually operated
Temporal characteristics function judge just it is inaccurate.Extreme case now is：When viewer browses the file of some particular type
Between it is not long, but he all this several may be carried out one time comprising operations of owner's private data.Therefore it is of the invention
Using the detection function that analysis is associated to sensitive operation behavior, continuous operation behavior can be associated and be matched,
And then improve the degree of accuracy of alarm.
During in view of seeing lookup privacy information by others' mobile phone, viewer would generally obtain oneself with the shortest time as far as possible
Content interested, therefore most cases can by short message, photo, video and the notepad oneself paid close attention to, these may be wrapped successively
File containing sensitive information is all browsed to look into and read through；Moreover, these operations are usually continuous, short message, upper meeting will not be finished watching
Youngster's net (or connecing a phone), then see photo；This does not meet the psychology of peeper.However, owner then typically will not continuously grasp
Make these actions.Therefore, as long as these sensitive actions are recurred, it is taken as non-normal use state, it is possible to
Alarm.
Therefore, in view of above-mentioned analysis, the association detection method includes following operative step：
When (22a) mobile phone is in normal condition, if produce application-specific operation behavior, the mobile phone is just by normal condition
It is transferred to abnormal operation state；
(22b) if under abnormal operation state, judging whether mobile phone continues to produce new application-specific operation behavior,
And the different detection sensitivities set according to owner, make corresponding judgement：
When the detection sensitivity of owner is set to " sensitivity detection ", as long as continuously generating two or more specific
Application operating behavior, mobile phone is just transferred to alarm status by abnormal operation state, performs subsequent step (22c).It is inspection shown in Fig. 3
Survey association detection state transfer relationship when susceptibility is " sensitivity "
When " common detection " is set to when the detection sensitivity of owner, three or more than three specific is only continuously generated
Application operating behavior, mobile phone is just transferred to alarm status by abnormal operation state, performs subsequent step (22c).It is inspection shown in Fig. 4
Survey association detection state transfer relationship when susceptibility is " sensitivity ".
(22c) is in the handset starting protecting sensitive data function of alarm status：Automatic locking display screen, it is to avoid continue to let out
Reveal privacy information；Being sent a warning message simultaneously to the mobile phone and mailbox of setting, " your mobile phone is being used by others, it is noted that protected
Protect privacy information！”；Above-mentioned various operation behaviors are also recorded in daily record, inquiring about and call to account afterwards for owner uses.
Implement experiment inventions have been multiple, test section result is successful, realizes goal of the invention.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the invention, all essences in the present invention
God is with principle, and any modification, equivalent substitution and improvements done etc. should be included within the scope of protection of the invention.
Claims (6)
1. a kind of detection alarm method of mobile phone non-normal use, it is characterised in that：Closed according to specific crowd for significant data
The finding of note degree, choose and set easily revealed in cellphone subscriber's operation behavior important sensitive data browse short message, it is clear
Look at photo, browse notepad and play video four kinds of sensitive operation behaviors for application-specific operate, and be directed to this four kinds it is specific
The behavior of application operating is detected：The statistic mixed-state of each independent operation behavior progress of mobile phone is directed to respectively and for many
The association detection that individual continuous operation behavior is carried out, then both detection means are detected with judging the mobile phone be in conjunction with each other
The no non-normal use state used in non-mobile phone owner；Once judge mobile phone be in non-mobile phone owner in use, once immediately
Send warning information；The operation behavior of the mobile phone is the operation behavior that the currently used person of mobile phone is using mobile phone；This method
Including following two operating procedure：
Step 1, pretreatment and parameter setting：Based on the study to owner's mobile phone operation behavioural characteristic, application-specific is grasped
The time data of work is sampled and pre-processed, then sets detection parameter：Detection sensitivity and alarm address；The step 1 is wrapped
Include following operation content：
(11) extractor instigator is pre-processed with the statistical nature of application-specific operating time：Extract owner and use hand
The statistical law of application-specific operating time during machine, then based on the statistics, mobile phone owner is obtained to each application-specific
Operating time t and probability P relational expression and its distribution curve, so that the different application-specifics of each mobile phone owner be operated
A quadratic function matched curve is corresponded to respectively, and is grasped using the matched curve as the application-specific of each mobile phone owner
Make the statistical nature of time；
(12) from the maximum in the data distribution curve of each application-specific operating time, progressively successively decrease toward its both sides respectively,
And decline rate progressively accelerates, the regularity of distribution and quadratic function curve of the obtained application-specific operating time is similar；This
The temporal regularity that sample just can operate each application-specific to operate owner with quadratic function is fitted so that each owner's
The time t and its operating frequency F of the operation of each application-specific model of fit are set to quadratic function matched curve：F=at2+
bt+ct；In formula, operating frequency F is the number of operations that the operating time is t in 100 mobile phone operations, and t is operating time, a, b, c
The different fitting coefficients of respectively each application-specific, and different owners are to the operating time statistical property institute of each application-specific
A the and b numerical value of corresponding quadratic function is different, and concrete numerical value depends on the sample space of collection；In addition, based on actual thing
Implication is managed, the operating time is also 0 for the generation frequency of 0 setting operation, therefore c=0；Each owner is thus obtained to each spy
Surely the distribution characteristics matched curve for the single behavior operating time applied, its formula is：F=at2+bt；
(13) because everyone operating habit is different, therefore the statistics for each single application-specific operation behavior of owner is special
Levy fitting function and calculate its standard deviation according to formula respectively：In formula, natural number i is some
The sampling number sequence number of application-specific operating time, its maximum, i.e. sampling total degree are n, tiIt is the sampling of ith operating time
Value, T0It is the arithmetic mean of instantaneous value of all operationss time sampling value；The standard deviation is most of value sets distribution of the parameter
In much scopes around average value；
(14) detection parameter is set：In order to realize whether detection mobile phone is non-normal use, sets two classes to detect parameter：Detection is quick
Sensitivity and alarm address, wherein, detection sensitivity is divided into two kinds again：The susceptibility of sensitivity detection and the susceptibility commonly detected；
Alerting address includes phone number and email address, for when detecting mobile phone non-normal use, warning information to be sent to
The alarm address；
Step 2, the detection operation behavior current with identification user, when detecting and judging that mobile phone is in non-normal use, stands
Send warning information.
2. according to the method described in claim 1, it is characterised in that：The step (13) includes following operation content：
The arithmetic mean of instantaneous value T of (13A) computer main operation time0：Because the time of some application operating in user's calling mobile phone is
Random, the T0It is the arithmetic mean of instantaneous value for the operating time for calling under mobile phone normal operating state setting to apply, its calculation formula
For：In formula, natural number i is the sampling number sequence number of some application operating time, and it is maximum
Value, i.e. sampling total degree are n, tiIt is the time sampling value that owner's ith calls the setting application operating, T0When being all operationss
Between sampled value arithmetic mean of instantaneous value；tnNumerical values recited depend on pre-seting the statistics feature in stage, and provide the statistics
The sampling number n of data should be not less than 100；
The standard deviation of (13B) computer main operation time：According toFormula calculator main operation
The standard deviation of time；
(13C) obtains the standard difference Butut of each single sensitive operation time of owner according to standard deviation：From it is each it is specific should
With the abscissa T corresponding to the peak in the data distribution curve of operating time0It is the arithmetic mean of instantaneous value of operating time, sets
Region between the two lines of the peak both sides is sensitive detection zone of the event occurrence rate in the range of 94%, then
It is common detection zone of the event occurrence rate in the range of 70% to set the region being located on the outside of the peak between two lines
Or conventional detection region.
3. according to the method described in claim 1, it is characterised in that：The step 2 includes following operation content：
(21) user's operation behavior is recognized：When cellphone subscriber starts some application operating, the application operating is captured, and judges to be somebody's turn to do
Whether application operating belongs to browsing short message, browsing photo, browse notepad and four class application-specifics of broadcasting video for setting
A certain kind in operation；If it is, starting timer, starting to carry out the time of the application operating timing, and perform follow-up
Step (22)；If it is not, then ignoring the operation, terminate whole flows；
(22) whether the mobile phone of detection now belongs to non-normal use：Because the cellphone subscriber of non-owner is when browsing cellphone information,
Also to perform corresponding subsequent operation；Therefore for following two kinds of different situations, the behaviour of corresponding two kinds of detection methods is performed respectively
Make content：
(A) it is with clearly defined objective, directly browse the single application-specific of short message in mobile phone, picture, video/or notepad sensitive information
During operation, using statistical detection method；
(B) target is indefinite, and the Miscellaneous Documents of oneself information of interest may be included successively by browsing respectively, including short message, picture,
During multiple application-specifics operation of video and/or notepad, using association detection method.
4. method according to claim 3, it is characterised in that：In the step (22), the single application-specific behaviour of execution
The statistical detection method of work includes following operative step：
(22A) is captured after the behavior that current phone user performs single application-specific operation first, counts the user specific to this
The execution time t of application operating；
The time that (22B) is operated according to owner using the application-specific meets the regularity of distribution of quadratic function statistical nature,
Judge whether execution time t of current user operation meets the time statistical nature that owner performs application-specific operation；
If meeting, terminate the flow；If not meeting, then it is assumed that the active user is not owner, and then perform subsequent step
(22C)；
(22C) judges whether mobile phone is currently in non-normal use state：Make according to the individual demand of owner and its to others
With the different attention rates of oneself mobile phone, two kinds of detections of " the sensitivity detection " or " common detection " that selects and set respectively are sensitive
Degree, judges whether operating time t is located in the range of selected detection sensitivity；If t is not located at " sensitivity detection " or " common
In the corresponding detection range of detection ", then judge that now mobile phone is at non-normal use state, performs subsequent step (22D)；If
T is located in the corresponding detection range of " sensitivity detection " or " common detection ", then it is assumed that mobile phone is in normal operating condition, terminates this
Flow；
(22D) mobile phone records the application-specific operation behavior in daily record, and the mobile phone or mailbox pre-set to owner is sent
" your mobile phone is used by others warning information, it is noted that protection privacy information！", notify owner someone to be attempt to browse
Privacy information in owner's mobile phone, function locking display screen is locked screen automatically while starting, it is to avoid continue to reveal privacy information.
5. method according to claim 4, it is characterised in that：In the step (22C),
When it is the detection sensitivity of " sensitivity detection " that confidential interval, which is 94%, also have 5~10% even if owner's operation
Probability is judged as abnormal operation；
When it 70% is the detection sensitivity of " common detection " that confidential interval, which is, though owner operate there is also 30% it is general
Rate is judged as abnormal operation.
6. method according to claim 3, it is characterised in that：In the step (22), multiple application-specifics behaviour of execution
Making the thinking of the association detection method of behavior is：, can be as much as possible with most in short-term during because checking its privacy information with others' mobile phone
Between obtain oneself content interested, therefore can successively, continuously browse short message, photo, video and/or the notepad of oneself concern
In sensitive information；As long as therefore continuously perform these application-specifics operation, be taken as non-normal use state；The association is detected
Method includes following operative step：
When (22a) mobile phone is in normal condition, if produce application-specific operation behavior, the mobile phone is just shifted by normal condition
To abnormal operation state；
(22b) mobile phone judges whether to continue to produce new application-specific operation behavior, and the different detections set according to owner
Susceptibility, makes corresponding judgement：
When the detection sensitivity of owner is set to " sensitivity detection ", as long as continuously generating two or more application-specifics
Operation behavior, mobile phone is just transferred to alarm status by abnormal operation state, performs subsequent step (22c)；
When the detection sensitivity of owner is set to " common detection ", the application-specific of three or more than three are only continuously generated
Operation behavior, mobile phone is just transferred to alarm status by abnormal operation state, performs subsequent step (22c)；
(22c) is in the handset starting protecting sensitive data function of alarm status：Automatic locking display screen, it is to avoid continue to reveal hidden
Personal letter ceases；Being sent a warning message simultaneously to the mobile phone and mailbox of setting, " your mobile phone is being used by others, it is noted that protection is hidden
Personal letter ceases！”；Above-mentioned various operation behaviors are also recorded in daily record, inquiring about and call to account afterwards for owner uses.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510472659.1A CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510472659.1A CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105025170A CN105025170A (en) | 2015-11-04 |
| CN105025170B true CN105025170B (en) | 2017-10-10 |
Family
ID=54414858
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510472659.1A Expired - Fee Related CN105025170B (en) | 2015-08-05 | 2015-08-05 | A kind of detection alarm method of mobile phone non-normal use |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105025170B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106919579B (en) * | 2015-12-24 | 2020-11-06 | 腾讯科技（深圳）有限公司 | Information processing method, device and equipment |
| CN105791570B (en) * | 2016-02-29 | 2020-02-21 | 宇龙计算机通信科技(深圳)有限公司 | Early warning method and system for mobile terminal |
| CN106709365B (en) * | 2016-11-30 | 2019-09-13 | Oppo广东移动通信有限公司 | A kind of method for secret protection and device, mobile terminal |
| CN109756620B (en) * | 2018-12-15 | 2021-07-23 | 深圳壹账通智能科技有限公司 | Virtual camera identification method based on mobile phone and related equipment |
| CN109587345B (en) * | 2018-12-28 | 2021-09-07 | 努比亚技术有限公司 | Abnormal application prompting method, mobile terminal and computer readable storage medium |
| CN110609500B (en) * | 2019-09-23 | 2022-02-22 | 四川长虹电器股份有限公司 | Displacement sensor alarm state control system and method based on cloud |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2012075765A1 (en) * | 2010-12-09 | 2012-06-14 | 中兴通讯股份有限公司 | Method and device for preventing mobile terminal from illegal users |
| CN103906045A (en) * | 2013-12-25 | 2014-07-02 | 武汉安天信息技术有限责任公司 | Method and system for monitoring mobile terminal privacy stealing behaviors |
| CN104268481A (en) * | 2014-10-10 | 2015-01-07 | 中国联合网络通信集团有限公司 | Method and device for realizing early warning of smart phone |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101541305B1 (en) * | 2009-05-21 | 2015-08-03 | 삼성전자주식회사 | Mobile terminal for protecting information and information protecting method performed by the mobile terminal |
-
2015
- 2015-08-05 CN CN201510472659.1A patent/CN105025170B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2012075765A1 (en) * | 2010-12-09 | 2012-06-14 | 中兴通讯股份有限公司 | Method and device for preventing mobile terminal from illegal users |
| CN103906045A (en) * | 2013-12-25 | 2014-07-02 | 武汉安天信息技术有限责任公司 | Method and system for monitoring mobile terminal privacy stealing behaviors |
| CN104268481A (en) * | 2014-10-10 | 2015-01-07 | 中国联合网络通信集团有限公司 | Method and device for realizing early warning of smart phone |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105025170A (en) | 2015-11-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105025170B (en) | A kind of detection alarm method of mobile phone non-normal use | |
| Servida et al. | IoT forensic challenges and opportunities for digital traces | |
| Greenwald | NSA collecting phone records of millions of Verizon customers daily | |
| CN104967875B (en) | The method and apparatus that control monitor video checks permission | |
| CN103077339B (en) | Data protection method and device | |
| CN103413088B (en) | A kind of computer document operation safety auditing system | |
| KR101522311B1 (en) | A carrying-out system for images of the closed-circuit television with preview function | |
| EP2993607B1 (en) | Privacy compliant event analysis | |
| TW200945181A (en) | Method for prompting outstanding event in screen lock state, electronic device thereof, and recording medium thereof | |
| CN117240614B (en) | Network information safety monitoring and early warning system based on Internet | |
| CN102891749A (en) | Method and communication terminal for data encryption | |
| CN104949280B (en) | Air conditioner, control method and device thereof and air conditioning system | |
| AU2015101772A4 (en) | Reducing inadvertent data loss in email | |
| Glisson et al. | Investigating information security risks of mobile device use within organizations | |
| US20150033366A1 (en) | Methods and apparatus for displaying simulated digital content | |
| Shidek et al. | WhatsApp Chat Visualizer: A Visualization of WhatsApp Messenger’ s Artifact Using the Timeline Method | |
| Kaushik et al. | Smart home IoT forensics: current status, challenges, and future directions | |
| GB2512140A (en) | Messaging system and method | |
| Valecha et al. | An exploration of public reaction to the OPM data breach notifications | |
| CN112035865A (en) | Safety supervision system for preventing network data from being leaked | |
| CN112911142B (en) | Image processing method, image processing apparatus, non-volatile storage medium, and processor | |
| CN111177770A (en) | Protection method of sensitive information, mobile equipment and storage device | |
| US20220350928A1 (en) | Information processing system, information processing method, program, and user interface | |
| Lee | Smart Home Data Privacy and an Evolving Fourth Amendment | |
| Horsman | Reviewing the devices of those subject to Sexual Harm Prevention Orders (SHPOs): iOS opportunities, limitations and strategies |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20171010 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |