CN101930520A - Notebook computer antitheft method and system - Google Patents
Notebook computer antitheft method and system Download PDFInfo
- Publication number
- CN101930520A CN101930520A CN2010102869386A CN201010286938A CN101930520A CN 101930520 A CN101930520 A CN 101930520A CN 2010102869386 A CN2010102869386 A CN 2010102869386A CN 201010286938 A CN201010286938 A CN 201010286938A CN 101930520 A CN101930520 A CN 101930520A
- Authority
- CN
- China
- Prior art keywords
- notebook computer
- module
- antitheft
- abnormal
- abnormal behaviour
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Alarm Systems (AREA)
Abstract
The invention discloses a notebook computer antitheft method and a notebook computer antitheft system. The notebook computer antitheft method mainly comprises the following steps of: defining abnormal operations of the notebook computer, and identifying system messages which correspond to the abnormal operations in a Windows message mechanism; and monitoring the system messages in a Windows message queue, and alarming when finding the system message which corresponds to the abnormal operation. An operating system event triggered by a theft action is captured by detecting the abnormal operations of the notebook computer, intelligent alarming is realized, and the whole system is realized in a software mode without addition or installation of extra hardware, so that the notebook computer antitheft method and the notebook computer antitheft system are easy to realize and popularize.
Description
Technical field
The present invention relates to notebook-computer system, specifically be meant notebook computer antitheft method and system.
Background technology
Along with improving constantly and extensive popularizing of notebook computer performance, customer volume and user's usage frequency are increasing.Yet, also in rising trend at the larceny case incidence of notebook computer.Specialize in the company of notebook computer antitheft business according to the U.S. one family---the investigation of MyLaptopGps shows that in 2004, the whole world estimated at stolen above 1,500,000 notebook computers.Now, the stolen quantity of annual notebook computer surpasses 2,600,000, this means average per 12 seconds, just has a notebook computer stolen in the world.As office tools, the data of storing on the notebook computer often relates to individual's privacy and secret of the trade.In case stolen, just mean that these are in not the information of guard mode and may lose at any time, directly cause various economic losses.
The portability of notebook computer has determined its use often not have fixed-site, thereby traditional notebook computer antitheft mode is difficult to play a role usually.For example, in public places such as library, coffee shops, traditional safety lock often is difficult to set up use; And the use of physics alarm is loaded down with trivial details, and needs the cost extra cost to purchase; Simultaneously, means such as MAC Address of Network Card tracking can only be used for the remedial efforts after computer is had things stolen, and can not effectively prevent larceny.
For example, Chinese patent application discloses " a kind of anti-theft laptop " for No. 200910101663.1, comprise fuselage, power supply, fingerprint identification module, motion sensor, warning circuit, loudspeaker are set on the described fuselage, described motion sensor links to each other with warning circuit, and warning circuit links to each other with loudspeaker, and fingerprint identification module links to each other with warning circuit, fingerprint identification module links to each other with the CPU of notebook computer again, and power supply is CPU, motion sensor power supply.This antitheft mode can't be applied to existing notebook computer, has increased production cost, is difficult to apply; And judge by motion sensor that notebook is whether stolen and have a bigger limitation.Similarly the antitheft mode of notebook also has a lot, has above-mentioned shortcoming mostly.
Summary of the invention
The invention provides a kind of notebook computer antitheft method and system, its fundamental purpose is to overcome existing notebook computer antitheft method and is difficult to be applied to existing notebook computer, cost height, difficultly promotes, judges shortcomings such as whether stolen notebook accuracy rate low.
The present invention adopts following technical scheme:
Notebook computer antitheft method comprises the steps: 1) definition is to the abnormal operation of notebook computer, in the identification windows messaging mechanism with the corresponding system message of these abnormal operations; 2) system message in the windows messaging formation is monitored, above-mentioned during when finding to have with the corresponding system message of abnormal operation, give the alarm.
Aforementioned notebook computer antitheft method, to the abnormal operation of notebook computer comprise the notebook lid that closes, extract external power supply, extract USB device, a kind of or any combination more than two kinds in the shutdown, cancellation.
Aforementioned notebook computer antitheft method, when finding to have with the corresponding system message of abnormal operation, the hard closing program of shielding notebook computer operating system, forced shutdown operation.
The notebook computer antitheft system comprises: the information processing centre module, set up the abnormal behaviour model bank, and catch the system message in the windows messaging formation, this system message and abnormal behaviour model bank are mated, generate the abnormal behaviour report; Alarm modules is play the alarm audio frequency or is called hummer according to the instruction of information processing centre module and sounds the alarm.
Aforementioned notebook computer antitheft system, also comprise a combined strategy module, permission is carried out combination selection and self-defined antitheft strategy to the abnormal behaviour in the abnormal behaviour model bank, and with the report of the abnormal behaviour of information processing centre module and this antitheft tactful combination, draw the alarm decision-making, issue the information processing centre module.
Aforementioned abnormal behaviour comprises the notebook lid of closing, extracts external power supply, extracts USB device, shutdown, cancellation.
Aforementioned notebook computer antitheft system also comprises a security mask module, according to hard closing program, the forced shutdown operation of the instruction shielding notebook computer operating system of information processing centre module.
Described security mask module comprises the keyboard hook module and forces shroud module.
By the above-mentioned description of this invention as can be known, compare with prior art, the present invention has following advantage: the present invention detects the OS Events that larceny is caused by notebook abnormal behaviour and catches, and realize intelligent alarm, total system realizes in the mode of software, need not to add and extra hardware is installed, realize easily and promote; The present invention carries out test run on test type (Dell 1520, Windows 7 operating systems), notebook computer antitheft software systems CPU usage is less than 1%, and memory consumption is 5144k, has realized the purpose of the system that is stationed well; The present invention is used in the notebook computer antitheft of public arenas such as coffee shop, library.
Description of drawings
Fig. 1 is a system architecture synoptic diagram of the present invention;
Fig. 2 is a workflow diagram of the present invention.
Embodiment
The specific embodiment of the present invention is described with reference to the accompanying drawings.
With reference to Fig. 1, the notebook computer antitheft system is installed on the notebook computer with form of software, and this system comprises information processing centre module 1, alarm modules 3, combined strategy module 4 and security mask module 5.Information processing centre module 1 is set up abnormal behaviour model bank 2, catches the system message in the windows messaging formation 10, and this system message and abnormal behaviour model bank 2 are mated, and generates the abnormal behaviour report; Alarm modules 3 is play the alarm audio frequency or is called hummer according to the instruction of information processing centre module 1 and sounds the alarm; Combined strategy module 4 allows the user that the abnormal behaviour in the abnormal behaviour model bank 2 is carried out combination selection and self-defined antitheft strategy, and with the report of the abnormal behaviour of information processing centre module 1 and this antitheft tactful combination, draw the alarm decision-making, issue information processing centre module 1; Security mask module 5 is according to hard closing program, the forced shutdown operation of the instruction shielding notebook computer operating system of information processing centre module 1, and this security mask module 5 comprises the keyboard hook module and forces shroud module.
Generally include with the relevant abnormal behaviour of theft that the notebook that closes covers, extracts external power supply, extracts USB device, shutdown/cancellation etc.
With reference to Fig. 2, the groundwork flow process of above-mentioned notebook computer antitheft system is as follows: after the system start-up, real-time listening windows messaging formation (step S1), mate (step S2) with abnormal behaviour model bank 2, pick out the message relevant with abnormal behaviour, generate abnormal behaviour report (step S3), in addition, (step S6) selected and makes up in input according to extraneous user to the abnormal behaviour in the abnormal behaviour model bank 2, form personalized combined strategy, combined strategy that this is personalized and abnormal behaviour report combination, form alarm decision-making (step S4), give the alarm shielding hard closing program according to the alarm decision-making, operations such as forced shutdown (step S5).
The appearance of above-mentioned abnormal behaviour will trigger corresponding system message incident.Message mechanism is the core of window application.All that take place in Windows can represent that message is used to tell what has taken place operating system with message.The user will trigger an incident to each operating operation of operating system, and for example, the user supresses keyboard, just produce a key-press event.By the incident of message mechanism, convert the form of message to then, leave in the message queue of memory field, be distributed to the object of accepting message triggering.
The abnormal behaviour model bank 2 that information processing centre module 1 is set up at the notebook lid that closes, extract external power supply, extract USB device, shutdown/four kinds of behaviors such as cancellation set up behavior model respectively.The abnormal behaviour model structure is expressed as:＜behavior ID, behavior description, registration function, message id, message parameter, action weight 〉.Wherein registration function is that software is to obtain the operating system registration function that the corresponding message incident is used; Message id and message parameter are after abnormal behaviour takes place, message and parameter thereof that operating system is sent to antitheft software; The action weight is represented the hazard level of this abnormal behaviour.When system moves, monitor and detect by acquisition mode separately.
By calling the RegisterPowerSettingNotification registration function, can carry out perception to power events.Power events comprises the state that power supply is relevant or the change of setting.When system moves, the message that information processing centre module 1 real-time listening is handled and transmitted from windows messaging mechanism.After notebook lid is closed, laptop is pulled out, operating system will be sent the WM_POWERBROADCAST window message, and 1 pair of power events of announcement information processing enter module responds.Information processing centre module 1 is in the MessageProc function, the WM_POWERBROADCAST window message of receiving is carried out the parameter analysis, mate with abnormal behaviour model bank 2, which kind of larceny has been taken place with judgement, generate packaged abnormal behaviour report simultaneously, be distributed to combined strategy module 4 and make a strategic decision, and command other modules according to the result of decision.
For the behavior of extracting USB device, by calling the window message that the RegisterDeviceNotification function obtains the USB device plug; Wait the behavior of suspension system current sessions for shutdown/cancellation, obtain visit the system event notice by the SystemEvents class.
Alarm has dual mode: a kind of is the alarm audio frequency of playing appointment, and another kind is by the Beep function, sends not same tone and calls hummer and simulate alarm song.When alarm modules 3 is received the instruction of information processing centre module 1, give the alarm by predetermined way.For obtaining better alarm effect, before giving the alarm, the notebook volume is transferred to maximum decibel by the SendMessage function.In addition, because the common external quiet key of notebook, quiet in order to prevent that locking system suffers when giving the alarm, system monitors and shields quiet operation in real time.
For avoiding the interference of other operations to system, the user can be provided with password when open system, allow notebook computer enter protected mode.In protected mode, can not carry out any operation to notebook, thereby effectively shield operations such as hard closing program, forced shutdown.The user can cancel protected mode by inputing correct password.The main body of security mask module 3 is by keyboard hook program and force mask program to constitute.Keyboard hot key message is caught by module before arriving shutdown programm, therefore can make a response before system closing, shields this imperative operation.
The notebook computer antitheft system is based upon under the normal operation of operating system.The robber may cut off the electricity supply by extracting extreme means such as battery before stealing notebook, caused operating system to stop operation because of outage.At the behavior, after the formal commercialization of software, expansion module can be set, a part of alarm mechanism is moved to high in the clouds.When burglary-resisting system brought into operation, Cloud Server was communicated by letter with its maintenance.Network interrupts or the notebook outage in case detect, and the high in the clouds service routine can be notified the user by modes such as automatic transmission notes.
Above-mentioned only is the specific embodiment of the present invention, but design concept of the present invention is not limited thereto, and allly utilizes this design that the present invention is carried out the change of unsubstantiality, all should belong to the behavior of invading protection domain of the present invention.
Claims (8)
1. notebook computer antitheft method is characterized in that comprising the steps:
1) definition is to the abnormal operation of notebook computer, in the identification windows messaging mechanism with the corresponding system message of these abnormal operations;
2) system message in the windows messaging formation is monitored, above-mentioned during when finding to have with the corresponding system message of abnormal operation, give the alarm.
2. notebook computer antitheft method as claimed in claim 1 is characterized in that: described abnormal operation to notebook computer comprises the notebook lid of closing, extracts external power supply, extracts USB device, a kind of or any combination more than two kinds in the shutdown, cancellation.
3. notebook computer antitheft method as claimed in claim 1 is characterized in that: when finding to have with the corresponding system message of abnormal operation, and the hard closing program of shielding notebook computer operating system, forced shutdown operation.
4. notebook computer antitheft system is characterized in that comprising:
The information processing centre module is set up the abnormal behaviour model bank, catches the system message in the windows messaging formation, and this system message and abnormal behaviour model bank are mated, and generates the abnormal behaviour report;
Alarm modules is play the alarm audio frequency or is called hummer according to the instruction of information processing centre module and sounds the alarm.
5. notebook computer antitheft as claimed in claim 4 system, it is characterized in that: also comprise a combined strategy module, permission is carried out combination selection and self-defined antitheft strategy to the abnormal behaviour in the abnormal behaviour model bank, and with the report of the abnormal behaviour of information processing centre module and this antitheft tactful combination, draw the alarm decision-making, issue the information processing centre module.
6. as claim 4 or 5 described notebook computer antitheft systems, it is characterized in that: described abnormal behaviour comprises the notebook lid that closes, extracts external power supply, extracts USB device, shutdown, cancellation.
7. notebook computer antitheft as claimed in claim 4 system is characterized in that: also comprise a security mask module, according to hard closing program, the forced shutdown operation of the instruction shielding notebook computer operating system of information processing centre module.
8. notebook computer antitheft as claimed in claim 7 system is characterized in that: described security mask module comprises the keyboard hook module and forces shroud module.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2010102869386A CN101930520A (en) | 2010-09-20 | 2010-09-20 | Notebook computer antitheft method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2010102869386A CN101930520A (en) | 2010-09-20 | 2010-09-20 | Notebook computer antitheft method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101930520A true CN101930520A (en) | 2010-12-29 |
Family
ID=43369691
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2010102869386A Pending CN101930520A (en) | 2010-09-20 | 2010-09-20 | Notebook computer antitheft method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101930520A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103996258A (en) * | 2014-04-17 | 2014-08-20 | 广东工业大学 | Intelligent notebook antitheft device |
| CN104134051A (en) * | 2014-07-16 | 2014-11-05 | 清华大学 | Notebook computer antitheft system and notebook computer antitheft method |
| CN104750628A (en) * | 2013-12-30 | 2015-07-01 | 上海格尔软件股份有限公司 | Method for triggering SSL logout by utilizing USB notification |
| CN108399700A (en) * | 2018-01-31 | 2018-08-14 | 上海乐愚智能科技有限公司 | Theft preventing method and smart machine |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2000075756A1 (en) * | 1999-06-02 | 2000-12-14 | Gretech Co., Ltd. | Antitheft apparatus and method for portable electronic device |
| CN101763146A (en) * | 2008-12-24 | 2010-06-30 | 深圳易拓科技有限公司 | Notebook PC with anti-theft and alarm device |
-
2010
- 2010-09-20 CN CN2010102869386A patent/CN101930520A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2000075756A1 (en) * | 1999-06-02 | 2000-12-14 | Gretech Co., Ltd. | Antitheft apparatus and method for portable electronic device |
| CN101763146A (en) * | 2008-12-24 | 2010-06-30 | 深圳易拓科技有限公司 | Notebook PC with anti-theft and alarm device |
Non-Patent Citations (1)
| Title |
|---|
| 《家用电脑》电子版,> 20100713 Lonewolf等 美女防盗卫士 助你看管笔记本 第50版 1-4 , 第26期 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104750628A (en) * | 2013-12-30 | 2015-07-01 | 上海格尔软件股份有限公司 | Method for triggering SSL logout by utilizing USB notification |
| CN103996258A (en) * | 2014-04-17 | 2014-08-20 | 广东工业大学 | Intelligent notebook antitheft device |
| CN104134051A (en) * | 2014-07-16 | 2014-11-05 | 清华大学 | Notebook computer antitheft system and notebook computer antitheft method |
| CN108399700A (en) * | 2018-01-31 | 2018-08-14 | 上海乐愚智能科技有限公司 | Theft preventing method and smart machine |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101406350A (en) | Fingerprint file cabinet system and control method thereof | |
| CN103957316A (en) | Smart phone anti-theft protective method | |
| CN206210020U (en) | A kind of thief-proof electricity meter box | |
| CN102622818A (en) | All-directional intelligent monitoring method for bank ATMs | |
| CN201641038U (en) | Face recognition electronic bag storage cabinet | |
| CN104900228A (en) | Suspicious door opening sound identification apparatus and identification method | |
| CN106251531A (en) | A kind of thief-proof electricity meter box | |
| CN101930520A (en) | Notebook computer antitheft method and system | |
| CN101599958A (en) | Correlation engine system and data processing method thereof based on scene | |
| CN1963717A (en) | System and method for preventing theft of portable computer | |
| KR20090038189A (en) | Apparatus and method for managing terminal users | |
| CN107067640A (en) | A kind of intellectual communityintellectualized village's safety protecting method and system | |
| CN110276195A (en) | A kind of smart machine intrusion detection method, equipment and storage medium | |
| CN107918336A (en) | Anti-theft electricity meter box and ammeter box monitoring system | |
| CN103036998A (en) | Intrusion detection system based on immune principle in cloud computing | |
| CA2752279C (en) | Protection device, corresponding method and computer software product | |
| CN108399710A (en) | A kind of fingerprint recognition alarm method, system and terminal device | |
| CN101848117A (en) | Illegal external connection monitoring method and system thereof | |
| CN105608380A (en) | Virtual machine lifecycle-based cloud computation security assessing method | |
| CN206619143U (en) | A kind of computer network security shielding system | |
| CN106291016A (en) | A kind of intelligent electric meter preventing power stealing | |
| CN102982267A (en) | Safety protection method and system and terminal | |
| Naiping et al. | A study on intrusion detection based on data mining | |
| CN211979798U (en) | Information operation and maintenance personnel behavior compliance linkage early warning system | |
| CN104318187B (en) | The guard method of intelligent terminal interactive information based on capacitance detecting and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20101229 |