CN103530218A - Monitoring triggering method based on behavior detection - Google Patents

Monitoring triggering method based on behavior detection Download PDF

Info

Publication number
CN103530218A
CN103530218A CN201310467999.6A CN201310467999A CN103530218A CN 103530218 A CN103530218 A CN 103530218A CN 201310467999 A CN201310467999 A CN 201310467999A CN 103530218 A CN103530218 A CN 103530218A
Authority
CN
China
Prior art keywords
user
behavior
monitoring
mouse
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201310467999.6A
Other languages
Chinese (zh)
Inventor
韩金倡
杨晓东
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to CN201310467999.6A priority Critical patent/CN103530218A/en
Publication of CN103530218A publication Critical patent/CN103530218A/en
Pending legal-status Critical Current

Links

Images

Landscapes

  • Debugging And Monitoring (AREA)

Abstract

The invention discloses a monitoring triggering method based on behavior detection. According to the method, definition and classification are performed on user behaviors (keyboard operation and mouse operation), detection is performed on the user behaviors, and when a user does not have any behavior, a computer desktop is not recorded; when the user has concrete behaviors, monitored behavior records are compared with a predefined strategy in monitoring setting, the behavior records not needed to be monitored, namely the invalid behaviors are filtered, and finally only the effective operation part of the user is stored to serve as a video record. Through the mode, the possibility that a large quantity of repeated videos are recorded by a monitoring system under the condition that the user does not operate is firstly avoided, then through the careful classification performed on the behaviors, invalid operation content can be accurately filtered, so that all the operation records have high pertinence, and on the basis of saving storage cost, efficiency of backtracking and finding problems for a monitoring controller is improved.

Description

A kind of monitoring triggering method detecting based on behavior
Technical field
The invention belongs to user behavior monitoring technique field, relate to a kind of monitoring triggering method detecting based on behavior.
Background technology
In order to guarantee the safety of enterprises informatization environments, for the monitoring product of computer desktop and server, be more and more developed, the centralized monitoring equipment that the fort machine of take is representative has occupied the market of main flow at present.The main advantage of fort machine is to access by bypass, without whole existing computer environment is transformed, does not affect existing cluster and runs well, and when computer cluster is larger, can significantly save implementation cost.Therefore, many to IT environmental reliability and the higher enterprise of sustainability requirement, can be more prone to such scheme.
But along with the continuous use of fort machine, the memory size of depositing monitor video becomes the bottleneck that supervisory system runs well gradually.Whether this is due to as long as user logins a upper machine, no matter operate, and video record all can continue to carry out.Since growing this, a large amount of useless monitor video records are saved, a large amount of storage spaces have not only been taken, and the later stage of monitor video is reviewed and caused very large trouble, monitoring management personnel often will check that complete video just know the accurate location of the problem operation that causes fault, the place of cannot pinpointing the problems timely and effectively, so that result in greater loss.
The problem very above-mentioned prior art being existed, is necessary to develop research, in fact so that a kind of technical scheme addressing the above problem to be provided.
Summary of the invention
For addressing the above problem, the object of the present invention is to provide a kind of monitoring triggering method detecting based on behavior.
For achieving the above object, technical scheme of the present invention is:
The monitoring triggering method that behavior detects, comprises the steps:
On the computer of needs monitoring, monitor client is set;
Operation starts monitor client, and monitor client carries out user behavior monitoring, user behavior information recording and behavioural information according to predefined user behavior and filters; Wherein, user behavior monitoring refers to when user carries out button and mouse click, obtains original user behavior information, and filters not meeting the behavior of monitoring strategies, finally generates effective user behavior record.
This record uploads on monitoring server by monitor client, and monitoring server receives after the effective user behavior data that monitor client uploads, in the database that can preserve.
Described user behavior definition comprises user key-press and two kinds of behaviors definition of user's mouse click; Wherein, user key-press is divided into edit key and controls button.
Described user behavior information recording refers to the behavioural information of obtaining user by operating system API, the behavior information comprise video information and text description information.
Described user behavior information filtering refers in getting user's behavioural information record, and each field in this record and current predefined monitoring configuration are compared, and retains effective record.
Described text description information comprises operator message and operation descriptor.
Further, described trigger is specifically by mouse and the button of operating system Hook Function supervisory user, specifically in the time of software startup, to operating system, register keyboard Hook Function and Mouse hook function, take keyboard hook function as example, after this function registration success, it is called that the each time button operation of user in this operating system all can trigger this function, obtains the key assignments of button and the key assignments of operating key (comprising Control key, shift key and Alt key) in this function inside.Similarly, after user clicks the mouse, mouse call back function is called, can obtain the position that current mouse is clicked in this function inside.Therefore, by keyboard and Hook Function, can obtain user's operation opportunity.
Compared to prior art, a kind of monitoring triggering method detecting based on behavior of the present invention is by carrying out defining classification (keyboard operation and mouse action) to user behavior, and user behavior is detected, when user does not carry out any behavior, computer desktop is not carried out to record; When user has concrete behavior, the predefine monitoring strategies during the behavior record monitoring and monitoring are arranged contrasts, and it is nullity record that filtration does not need monitoring, finally only preserves effective user's operation part as videograph.First such mode was avoided user without operation in the situation that, supervisory system is recorded out the possibility of a large amount of repetition videos, secondly by the careful classification to behavior, can accurately filter invalid content of operation, make all operation notes all there is very strong specific aim, on the basis of saving carrying cost, improved again the efficiency that monitoring management person recalls and pinpoints the problems.
Accompanying drawing explanation
Fig. 1 is method operating process diagram of the present invention.
Embodiment
In order to make object of the present invention, technical scheme and advantage clearer, below in conjunction with drawings and Examples, the present invention is further elaborated.Should be appreciated that specific embodiment described herein, only in order to explain the present invention, is not intended to limit the present invention.
A kind of monitoring triggering method detecting based on behavior of the present invention, move the client-side program on monitored computer, by user behavior is defined, user behavior detects, user behavior record and user behavior filter, final method of preserving lower effective user behavior.
Described user behavior definition comprises user key-press and two kinds of behaviors definition of user's mouse click.Wherein, user key-press is divided into edit key and controls button by effect, and is divided into normal operations and risky operation button according to monitoring rank.Edit key comprises 26 English alphabet keys, as: delete DELETE, copy CTRL+C, paste CTRL+C, retreat BACKSPACE etc., control button and comprise the function keys such as insertion, capital and small letter, SHIFT, CTRL, WINDOWS.Risky operation comprises deletion, pastes, and other are operating as normal operations.Mouse clicking operation comprises that left button is clicked, left button double-click, right-click, right button is double-clicked and the operation such as mouse rollovers.In the embodiment of the present invention, only left button is clicked with right-click and carried out record.
User behavior monitoring refer to user carry out button and mouse click in trigger to carry out behavior record, and user is not when carrying out predefined operation, do not record to save storage.Particularly, by mouse and the button of operating system Hook Function supervisory user, application program is first to operating system registration keyboard Hook Function and Mouse hook function, when each operating system detects user's button or mouse, can initiatively call corresponding keyboard hook function and Mouse hook function, thus, application program can obtain in real time user's key information and mouse click information.And click by operating system Hook Function supervisory user button and mouse, obtain user's operation opportunity.For key information, record key assignments and the timestamp of button; For mouse click information, record the residing position of mouse, left button or right button, and corresponding timestamp.
User behavior information recording refers to by operating system API, obtains user's behavioural information, and this information comprises video information and text description information.Wherein, obtaining of video information is to realize by screenshot capture, i.e. the sectional drawing to the instant screen of operator, can colour or two kinds of picture formats of gray scale preserve.Text description information comprises operator message and operation descriptor.Wherein, operator message comprises user name, the machine name of using, running time, if the user who comes by Telnet, the machine name and the IP address that need to record source machine.Operation descriptor comprises operated application name, Application Type, and its content can obtain by obtaining title and the title of current application program.Monitoring behavior includes two kinds of behaviors and triggers, and a kind of is user key-press, and a kind of user of being carries out mouse click.If this behavior is user key-press, also need the key value of recording user, as: deletion action; If this behavior is user, carry out mouse click, also need the mouse position of recording user, in video information, add mouse position prompting simultaneously, as: circle prompting.
User behavior information filtering refers in getting user's behavioural information record, and each field in this record and current predefined monitoring configuration are compared.Such as: the operation of certain user under certain application do not monitored, or only monitors the operation after certain the user's login of certain machine.So accurately recording user operation, has avoided invalid operation on follow-up impact of recalling work.
User behavior after filtration is recorded as final effective record, will be saved in file cache so that subsequent treatment.This document is comprised of video binary message, operator message (user name, the machine name of using, running time, if the user who comes by Telnet, the machine name and the IP address that need to record source machine) and operation descriptor.
Fig. 1 is the process flow diagram of the monitoring triggering method based on behavior detection, comprises following steps:
Step 101: definition user behavior.
User behavior is defined as two types of keyboard operation and mouse actions.Wherein, user key-press is divided into again edit key and controls button by effect, and is divided into normal operations and risky operation button according to monitoring rank, edit key comprises 26 English alphabet keys, delete DELETE, copy CTRL+C, paste CTRL+C, retreat BACKSPACE etc., control button and comprise insertion, capital and small letter, SHIFT, CTRL, the function keys such as WINDOWS.Risky operation comprises deletion, pastes, and other are operating as normal operations.Mouse clicking operation is divided into left button to be clicked, and left button is double-clicked, right-click, the operations such as right button double-click and mouse rollovers.
Step 102: define behavior monitoring configuration.
Monitoring setting is set in WEB server background in advance by monitoring management person, and be kept in database, after monitor client starts, initiatively to monitoring server, send request, and by monitoring server, from database, fetch and send back to monitor client, monitor client receives after current strategies, initiatively preserves this locality, forms behavior monitoring configuration file.Which behavior that has defined user in this configuration file is not monitored, has recorded not monitored user name, application, machine name character string.
Step 103: start user behavior monitoring.
In system, register keyboard and mouse response call back function, this function is called when having key-press event and mouse click event to occur.For fear of the long master routine that causes of call back function processing time, block, this step preset an event buffer queue, the duplicate record of avoiding in the short time repeatedly button and mouse click to cause.First, empty this queue, then button and mouse click event are inserted to this buffer queue, and exit at once processing.This buffer queue by system timer asynchronous process regularly.
Step 104: user behavior obtains.
By operating system API, obtain detailed user's behavioural information, this information is divided into again video information and text description information, wherein the i.e. sectional drawing to the instant screen of operator of video information.Text description information has comprised, operator message and operation descriptor.Wherein, operator message comprises user name, the machine name of using, running time; If the user who comes by Telnet, the machine name and the IP address that need to record source machine.Operation descriptor comprises operated application name, Application Type; If this behavior is button, trigger,, in the button call back function described in step 103, record key assignments and the timestamp of button, and the sign that whether has operating key to be pressed, operating key has CTRL, SHIFT etc.; The object of record controls key is to judge whether dangerous operation for follow-up, as SHIFT+DELETE etc.If user is mouse clicking trigger, in the mouse call back function described in step 103, record the residing position of mouse, left button or the sign of right button, and corresponding timestamp add mouse position prompting simultaneously in video information, as circle prompting.
Step 105: user behavior filters.
According to the monitoring configuration of step 102 definition, if this user behavior does not belong to the user scope allowing in monitoring configuration, the user behavior this time getting will not be recorded.
Step 106: by user behavior data buffer memory.
Monitor client, after getting effective user behavior data, will be cached in the storage of local computer.Every user behavior data forms a file record, file is by video binary message, operator message (user name, the machine name of using, running time, if the user who comes by Telnet, need to record machine name and the IP address of source machine), and operation descriptor forms.
The foregoing is only preferred embodiment of the present invention, not in order to limit the present invention, all any modifications of doing within the spirit and principles in the present invention, be equal to and replace and improvement etc., within all should being included in protection scope of the present invention.

Claims (5)

1. the monitoring triggering method detecting based on behavior, is characterized in that, comprises the steps:
On the computer of needs monitoring, monitor client is set;
Operation starts monitor client, and monitor client carries out user behavior monitoring, user behavior information recording and user behavior information filtering according to predefined user behavior; Wherein, user behavior monitoring refers to when user carries out button and mouse click, obtains original user behavior information, and filters not meeting the behavior of monitoring strategies, finally generates effective user behavior record;
Described user behavior definition comprises user key-press and two kinds of behaviors definition of user's mouse click; Wherein, user key-press is divided into edit key and controls button;
Described user behavior information recording refers to the behavioural information of obtaining user by operating system API, the behavior information comprise video information and text description information;
Described user behavior information filtering refers in getting user's behavioural information record, and each field in this record and the predefine strategy of monitoring in arranging are compared, and retains effective record; Described monitoring setting is set in WEB server background in advance, by monitor client, initiatively downloads to this locality;
Described user behavior record uploads on monitoring server by monitor client, and monitoring server receives after the effective user behavior data that monitor client uploads, and can be saved in database.
2. the monitoring triggering method detecting based on behavior as claimed in claim 1, is characterized in that: described text description information comprises operator message and operation descriptor.
3. the monitoring triggering method detecting based on behavior as claimed in claim 2, is characterized in that: described trigger, specifically by mouse and the button of operating system Hook Function supervisory user, obtains user's operation opportunity.
4. the monitoring triggering method detecting based on behavior as described in claim 1 or 2 or 3, it is characterized in that: when the mouse by operating system Hook Function supervisory user and button, application program is first to operating system registration keyboard Hook Function and Mouse hook function, when each operating system detects user's button or mouse, can initiatively call corresponding keyboard hook function and Mouse hook function, thus, application program can obtain in real time user's key information and mouse click information.
5. the monitoring triggering method detecting based on behavior as claimed in claim 4, is characterized in that: monitoring behavior includes user key-press and mouse is clicked two kinds of behaviors triggerings; If working as time behavior is user key-press, the key value of recording user; If working as time behavior is that user carries out mouse click, the mouse position of recording user.
CN201310467999.6A 2013-10-09 2013-10-09 Monitoring triggering method based on behavior detection Pending CN103530218A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201310467999.6A CN103530218A (en) 2013-10-09 2013-10-09 Monitoring triggering method based on behavior detection

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201310467999.6A CN103530218A (en) 2013-10-09 2013-10-09 Monitoring triggering method based on behavior detection

Publications (1)

Publication Number Publication Date
CN103530218A true CN103530218A (en) 2014-01-22

Family

ID=49932249

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201310467999.6A Pending CN103530218A (en) 2013-10-09 2013-10-09 Monitoring triggering method based on behavior detection

Country Status (1)

Country Link
CN (1) CN103530218A (en)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103970533A (en) * 2014-04-14 2014-08-06 深圳市深信服电子科技有限公司 Method and device for recording captured information on screen
CN104410877A (en) * 2014-11-28 2015-03-11 北京国双科技有限公司 Method and device for processing user behavior data of network television
CN105607986A (en) * 2015-01-06 2016-05-25 北京志翔科技股份有限公司 Acquisition method and device of user behavior log data
CN105607985A (en) * 2015-09-29 2016-05-25 中国船舶重工集团公司第七0九研究所 Qt graphical interface software-based operation log recording method and system
CN106598813A (en) * 2016-12-26 2017-04-26 东莞市丰润计算机有限公司 Work-monitoring keyboard-mouse device and method for monitoring computer use process thereof
CN106776225A (en) * 2016-12-26 2017-05-31 东莞市丰润计算机有限公司 One kind is anti-to indulge in key mouse device and its monitoring internet access method
CN106791136A (en) * 2016-12-29 2017-05-31 努比亚技术有限公司 A kind of video record processing method, device and terminal
CN107493299A (en) * 2017-09-20 2017-12-19 杭州安恒信息技术有限公司 A kind of user behavior source tracing method based on three-tier architecture
CN107783878A (en) * 2016-08-27 2018-03-09 北京北信源软件股份有限公司 The method and system of acquisition software usage time information under a kind of Windows
CN108829572A (en) * 2018-05-30 2018-11-16 北京奇虎科技有限公司 The analysis method and device of user's login behavior
CN113377634A (en) * 2021-05-25 2021-09-10 北京猿力教育科技有限公司 Monitoring method for backtracking user operation, user operation backtracking method and device
CN113660292A (en) * 2021-10-19 2021-11-16 北京安华金和科技有限公司 Method and device for acquiring information of calling client main body
CN113810639A (en) * 2021-09-28 2021-12-17 深圳万兴软件有限公司 Method, device and related medium for recording mouse information and re-editing
CN115454784A (en) * 2022-11-09 2022-12-09 成都成电金盘健康数据技术有限公司 User behavior analysis system and method based on keyboard and mouse activity records

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1561037A (en) * 2004-02-23 2005-01-05 南京金鹰国际集团软件系统有限公司 Desk monitoring audit system based on structure
CN1570875A (en) * 2003-07-14 2005-01-26 中兴通讯股份有限公司 Device and method for implementing intelligent agent in monitoring system
CN1929411A (en) * 2006-09-04 2007-03-14 曙光信息产业(北京)有限公司 Intelligent computers group monitoring method
CN101241466A (en) * 2007-02-08 2008-08-13 深圳迈瑞生物医疗电子股份有限公司 Embedded software test method and system
CN102279739A (en) * 2011-06-10 2011-12-14 吴东辉 Recording method and application of screen operation
CN102890641A (en) * 2012-08-30 2013-01-23 北京奇虎科技有限公司 Process behavior control method and device

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1570875A (en) * 2003-07-14 2005-01-26 中兴通讯股份有限公司 Device and method for implementing intelligent agent in monitoring system
CN1561037A (en) * 2004-02-23 2005-01-05 南京金鹰国际集团软件系统有限公司 Desk monitoring audit system based on structure
CN1929411A (en) * 2006-09-04 2007-03-14 曙光信息产业(北京)有限公司 Intelligent computers group monitoring method
CN101241466A (en) * 2007-02-08 2008-08-13 深圳迈瑞生物医疗电子股份有限公司 Embedded software test method and system
CN102279739A (en) * 2011-06-10 2011-12-14 吴东辉 Recording method and application of screen operation
CN102890641A (en) * 2012-08-30 2013-01-23 北京奇虎科技有限公司 Process behavior control method and device

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103970533B (en) * 2014-04-14 2018-01-30 深信服科技股份有限公司 The information recording method and device of screen recording
CN103970533A (en) * 2014-04-14 2014-08-06 深圳市深信服电子科技有限公司 Method and device for recording captured information on screen
CN104410877A (en) * 2014-11-28 2015-03-11 北京国双科技有限公司 Method and device for processing user behavior data of network television
CN105607986A (en) * 2015-01-06 2016-05-25 北京志翔科技股份有限公司 Acquisition method and device of user behavior log data
CN105607985A (en) * 2015-09-29 2016-05-25 中国船舶重工集团公司第七0九研究所 Qt graphical interface software-based operation log recording method and system
CN105607985B (en) * 2015-09-29 2018-02-06 中国船舶重工集团公司第七0九研究所 Operation log recording method and system based on Qt graphic interface softwares
CN107783878A (en) * 2016-08-27 2018-03-09 北京北信源软件股份有限公司 The method and system of acquisition software usage time information under a kind of Windows
CN106598813A (en) * 2016-12-26 2017-04-26 东莞市丰润计算机有限公司 Work-monitoring keyboard-mouse device and method for monitoring computer use process thereof
CN106776225A (en) * 2016-12-26 2017-05-31 东莞市丰润计算机有限公司 One kind is anti-to indulge in key mouse device and its monitoring internet access method
CN106598813B (en) * 2016-12-26 2021-04-16 东莞市丰润计算机有限公司 Work monitoring keyboard and mouse device and method for monitoring computer using process thereof
CN106776225B (en) * 2016-12-26 2021-04-20 东莞市丰润计算机有限公司 Drowning-prevention keyboard and mouse device and internet surfing monitoring method thereof
CN106791136A (en) * 2016-12-29 2017-05-31 努比亚技术有限公司 A kind of video record processing method, device and terminal
CN107493299A (en) * 2017-09-20 2017-12-19 杭州安恒信息技术有限公司 A kind of user behavior source tracing method based on three-tier architecture
CN108829572A (en) * 2018-05-30 2018-11-16 北京奇虎科技有限公司 The analysis method and device of user's login behavior
CN113377634A (en) * 2021-05-25 2021-09-10 北京猿力教育科技有限公司 Monitoring method for backtracking user operation, user operation backtracking method and device
CN113810639A (en) * 2021-09-28 2021-12-17 深圳万兴软件有限公司 Method, device and related medium for recording mouse information and re-editing
CN113810639B (en) * 2021-09-28 2023-09-29 深圳万兴软件有限公司 Method, device and related medium for recording mouse information and re-editing
CN113660292A (en) * 2021-10-19 2021-11-16 北京安华金和科技有限公司 Method and device for acquiring information of calling client main body
CN115454784A (en) * 2022-11-09 2022-12-09 成都成电金盘健康数据技术有限公司 User behavior analysis system and method based on keyboard and mouse activity records

Similar Documents

Publication Publication Date Title
CN103530218A (en) Monitoring triggering method based on behavior detection
US11405301B1 (en) Service analyzer interface with composite machine scores
US10698661B2 (en) Systems and methods for discovering automatable tasks
US11822640B1 (en) User credentials verification for search
US11704177B2 (en) Session triage and remediation systems and methods
US9727625B2 (en) Parallel transaction messages for database replication
US7810156B2 (en) Automated evidence gathering
US9336259B1 (en) Method and apparatus for historical analysis analytics
US10445495B2 (en) Buffer overflow exploit detection
CN105743730B (en) The method and its system of real time monitoring are provided for the web service of mobile terminal
Li et al. FLAP: An end-to-end event log analysis platform for system management
US10992559B2 (en) Diagnostic and recovery signals for disconnected applications in hosted service environment
CN103488793A (en) User behavior monitoring method based on information retrieval
US9009850B2 (en) Database management by analyzing usage of database fields
US10915510B2 (en) Method and apparatus of collecting and reporting database application incompatibilities
CN112799741A (en) Application program differentiation method and device, electronic equipment and storage medium
CN107423090B (en) Flash player abnormal log management method and system
JP2022100232A (en) System and method for over-time cross reference of forensic snap shot for root cause analysis
CN104123217A (en) Capture method and system of execution instruction of service server
US9952773B2 (en) Determining a cause for low disk space with respect to a logical disk
JP2020068019A (en) Information analyzer, method for analyzing information, information analysis system, and program
JP2007200047A (en) Access log-displaying system and method
CN107769970A (en) The processing method and system of configuration information in a kind of distributed system
CN115859278B (en) Method, system, equipment and storage medium for auditing software operation behaviors
CN110856043A (en) Video acquisition method and system based on browser

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C02 Deemed withdrawal of patent application after publication (patent law 2001)
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20140122