CN111352814A - Operation abnormal behavior recognition method and device, storage medium and electronic equipment - Google Patents
Operation abnormal behavior recognition method and device, storage medium and electronic equipment Download PDFInfo
- Publication number
- CN111352814A CN111352814A CN202010112441.6A CN202010112441A CN111352814A CN 111352814 A CN111352814 A CN 111352814A CN 202010112441 A CN202010112441 A CN 202010112441A CN 111352814 A CN111352814 A CN 111352814A
- Authority
- CN
- China
- Prior art keywords
- picture
- feature
- abnormal
- query
- library
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 65
- 206010000117 Abnormal behaviour Diseases 0.000 title claims abstract description 23
- 230000002159 abnormal effect Effects 0.000 claims abstract description 105
- 238000000605 extraction Methods 0.000 claims description 46
- 238000012549 training Methods 0.000 claims description 11
- 238000013507 mapping Methods 0.000 claims description 9
- 238000004590 computer program Methods 0.000 claims description 6
- 230000006399 behavior Effects 0.000 abstract description 26
- 238000012550 audit Methods 0.000 abstract description 9
- 238000012423 maintenance Methods 0.000 description 21
- 238000012872 hydroxylapatite chromatography Methods 0.000 description 19
- 238000013527 convolutional neural network Methods 0.000 description 14
- 239000013598 vector Substances 0.000 description 14
- 230000006870 function Effects 0.000 description 12
- 238000010586 diagram Methods 0.000 description 10
- 230000008569 process Effects 0.000 description 9
- 238000012545 processing Methods 0.000 description 8
- 238000004422 calculation algorithm Methods 0.000 description 5
- 238000001514 detection method Methods 0.000 description 5
- 238000002372 labelling Methods 0.000 description 5
- 238000012544 monitoring process Methods 0.000 description 5
- 238000012163 sequencing technique Methods 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 4
- 238000013135 deep learning Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 238000010801 machine learning Methods 0.000 description 4
- 230000000007 visual effect Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 238000013528 artificial neural network Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000003066 decision tree Methods 0.000 description 2
- 239000000284 extract Substances 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 210000002569 neuron Anatomy 0.000 description 2
- 238000012552 review Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 238000012706 support-vector machine Methods 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 210000004027 cell Anatomy 0.000 description 1
- 238000013145 classification model Methods 0.000 description 1
- 239000003086 colorant Substances 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000007667 floating Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000011900 installation process Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 239000011159 matrix material Substances 0.000 description 1
- 238000011176 pooling Methods 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000010897 surface acoustic wave method Methods 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3476—Data logging
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/24323—Tree-organised classifiers
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computational Linguistics (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Image Analysis (AREA)
Abstract
The application provides an operation abnormal behavior identification method, an operation abnormal behavior identification device, a storage medium and electronic equipment, wherein the method comprises the following steps: receiving a query picture containing abnormal information input in a query system, and acquiring a first picture characteristic corresponding to the query picture; acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to an interface operation video screenshot; based on the first picture feature and the second picture feature, an abnormal picture set is identified in the picture library. And comparing the first picture characteristic with the second picture characteristic to obtain the similarity between the query picture and each picture in the picture library. And because the query picture contains abnormal information, the system automatically identifies abnormal operation behaviors. Therefore, compared with a mode of manually finding abnormal operation behaviors from a large number of videos or images, the audit efficiency can be effectively improved.
Description
Technical Field
The application relates to the field of safe operation and maintenance, in particular to an operation abnormal behavior identification method and device, a storage medium and electronic equipment.
Background
The operation and maintenance safety audit system (HAC) is directed to solving the key IT infrastructure operation and maintenance safety problem. The method can perform safe and effective operation audit on data access of Unix and Windows hosts, servers, networks and safety equipment, and support real-time monitoring and afterwards playback. The HAC makes up the defects of the traditional auditing system, upgrades the operation and maintenance auditing from event auditing to content auditing, integrates identity authentication, authorization and auditing into a whole, and effectively realizes the precaution, the central control and the after audit.
In general, the HAC usually includes a large number of videos or graphs of system operation and maintenance operations, and there may be some graphs of abnormal operations, in order to identify these graphs of abnormal operations, an auditor has to manually find abnormal operation behaviors from the videos or graphs frame by frame, and the auditing efficiency is low.
Disclosure of Invention
In order to solve the above problem, embodiments of the present application provide an operation abnormal behavior identification method and apparatus, and an electronic device, which can solve the problem of low auditing efficiency in an HAC.
In a first aspect, an embodiment of the present application provides an operation abnormal behavior identification method, including the following steps:
receiving a query picture containing abnormal information input in a query system, and acquiring a first picture characteristic corresponding to the query picture;
acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to an interface operation video screenshot;
based on the first picture feature and the second picture feature, an abnormal picture set is identified in the picture library.
Optionally, the method further comprises:
acquiring an interface operation picture sample, and marking an abnormal operation type corresponding to the interface operation picture sample;
and training a feature extraction model by adopting the interface operation picture sample and the abnormal operation type.
Optionally, the obtaining of the first picture feature corresponding to the query picture includes:
when the query picture is marked, inputting the query picture into the feature extraction model to obtain an output mark of the feature extraction model;
acquiring first picture features output by a full connection layer of the feature extraction model;
when the query picture is not marked, extracting pixel features of the query picture, mapping the pixel features to a feature space, and generating first picture features corresponding to the query picture.
Optionally, the method further comprises:
when a target picture in the picture library is marked, inputting the marked picture into the feature extraction model, and generating a second picture feature corresponding to the target picture output by a full connection layer of the feature extraction model;
when the target picture in the picture library is not marked, extracting the pixel characteristics of the target picture, mapping the pixel characteristics into a characteristic space, and generating second picture characteristics corresponding to the target picture.
Optionally, the identifying, in the picture library, an abnormal picture set based on the first picture feature and the second picture feature includes:
calculating the similarity between the first picture characteristic and each second picture characteristic;
and acquiring a second picture feature set with the similarity larger than a similarity threshold, and identifying an abnormal picture set indicated by the second picture feature set in the picture library.
Optionally, the method further comprises:
sequentially displaying the abnormal picture sets according to the sequence of the similarity;
and when the abnormal picture with the highest similarity in the abnormal picture set is not the specified picture, adjusting the feature extraction model.
Optionally, the method further comprises:
recording an interface operation video;
and adding the key frame in the interface operation video into the picture library.
In a second aspect, an embodiment of the present application provides an operation abnormal behavior identification apparatus, including:
the query system comprises a first feature acquisition unit, a second feature acquisition unit and a query unit, wherein the first feature acquisition unit is used for receiving a query picture which is input in the query system and contains abnormal information and acquiring a first picture feature corresponding to the query picture;
the second characteristic acquisition unit is used for acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to the interface operation video screenshot;
and the abnormal picture identification unit is used for identifying an abnormal picture set in the picture library based on the first picture characteristic and the second picture characteristic.
In a third aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, which when executed by a processor implements the steps of any one of the above methods.
In a fourth aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the steps of any one of the above methods when executing the program.
In the embodiment of the application, a query picture containing abnormal information input in a query system is received, and a first picture characteristic corresponding to the query picture is obtained; acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to an interface operation video screenshot; based on the first picture feature and the second picture feature, an abnormal picture set is identified in the picture library. And comparing the first picture characteristic with the second picture characteristic to obtain the similarity between the query picture and each picture in the picture library. Because the query picture contains abnormal information, the picture possibly containing the abnormal information can be identified from the picture library according to the similarity degree with the query picture. Therefore, compared with a mode of manually finding videos or pictures possibly containing abnormal information from a large number of videos or pictures, the auditing efficiency can be effectively improved.
Drawings
Fig. 1 is a schematic diagram of a system architecture of an HAC to which an embodiment of the present application may be applied;
fig. 2 is a schematic flowchart of an abnormal operation behavior identification method according to an embodiment of the present application;
fig. 3 is a schematic view of a video screenshot of an interface operation provided in an embodiment of the present application;
fig. 4 is a schematic flowchart of another method for identifying abnormal operation behavior according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a picture annotation provided in an embodiment of the present application;
FIG. 6 is a schematic diagram of a convolutional neural network provided by an embodiment of the present application;
fig. 7 is a schematic flowchart of a further method for identifying abnormal operation according to an embodiment of the present application;
fig. 8 is a schematic flowchart of another method for identifying abnormal operation behavior according to an embodiment of the present application;
fig. 9 is a schematic structural diagram of an abnormal operation behavior recognition apparatus according to an embodiment of the present application;
fig. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The present application is further described with reference to the following figures and examples.
In the following description, the terms "first" and "second" are used for descriptive purposes only and are not intended to indicate or imply relative importance. The following description provides embodiments of the present application, where different embodiments may be substituted or combined, and thus the present application is intended to include all possible combinations of the same and/or different embodiments described. Thus, if one embodiment includes feature A, B, C and another embodiment includes feature B, D, then this application should also be considered to include an embodiment that includes one or more of all other possible combinations of A, B, C, D, even though this embodiment may not be explicitly recited in text below.
The following description provides examples, and does not limit the scope, applicability, or examples set forth in the claims. Changes may be made in the function and arrangement of elements described without departing from the scope of the disclosure. Various examples may omit, substitute, or add various procedures or components as appropriate. For example, the described methods may be performed in an order different than the order described, and various steps may be added, omitted, or combined. Furthermore, features described with respect to some examples may be combined into other examples.
Fig. 1 is a schematic diagram of a system architecture of an HAC to which an embodiment of the present application may be applied. AS shown in fig. 1, the HAC provides a complete session record of network sessions such AS operation and maintenance protocols Telnet, FTP, SSH, SFTP, RDP (Windows Terminal), Xwindows, VNC, AS400, and records all operations of the user for later tracing. Aiming at the potential operation risk possibly existing in the operation and maintenance process, the HAC carries out illegal operation detection in the operation and maintenance process according to a security policy configured by a user, and provides real-time warning and blocking for illegal operation, so that the operation risk is reduced, and the safety management and control capability is improved.
For real-time alarming and post-event tracing of illegal operation, the HAC provides pictures or videos for auditors to review. For example, the real-time monitoring function of the operation of online operation and maintenance, aiming at the command interaction protocol, various operations in operation and maintenance can be monitored in real time in an image mode, and the information of the operations is completely consistent with that seen by the operation and maintenance client. For example, in the follow-up process, the HAC provides an audit interface for video playback, and the operation process is reproduced in a real, intuitive and visual mode.
CBIR (Content-based image retrieval of Content) technology is a technology of retrieving the most similar images according to the Content of the images, wherein the image Content includes low-level visual features of color, texture, layout, and the like of the images. The CBIR integrates technologies such as information retrieval, computer vision and the like, and in recent years, with the rise of machine learning, particularly deep learning, the accuracy of CBIR retrieval is greatly improved by high-level features learned from low-level visual features by depending on a machine learning method.
The HAC synchronizes and stores graphical interface operation records in the server operation and maintenance session, and auditors locate violation behaviors, and the current main means is to browse video frames. If abnormal behaviors in a large number of pictures are filtered through auditors, the efficiency is low, and the recall rate is low. The embodiment of the application aims to provide an image retrieval engine for auditors, and the image retrieval engine is assisted to retrieve operation images containing illegal operations from large-scale videos stored by HACs. In the scene, an auditor inputs a picture, returns a plurality of most similar pictures, and sorts the pictures from high to low according to the similarity degree.
The method is based on the server operation and maintenance session data acquired by the HAC, and the CBIR-based audit staff is used for assisting in retrieving the violation behaviors of graphical interface operation in the operation and maintenance session, so that the audit staff is assisted in finding out the violation behaviors, the HAC is supported to block in real time and trace back the violation behaviors afterwards, manual review of the audit staff is avoided, audit efficiency is improved, and the recall rate and the accuracy rate of abnormal detection are improved.
Referring to fig. 2, fig. 2 is a schematic flowchart of an operation abnormal behavior identification method provided in an embodiment of the present application, where the method includes:
s201, receiving a query picture containing abnormal information input in a query system, and acquiring a first picture characteristic corresponding to the query picture.
The abnormal information is abnormal behavior information which may appear in the system operation process of the user, and comprises user unauthorized operation behavior information, user overtime operation behavior information, user specific information deletion behavior information and the like. The query picture containing the abnormal information can represent that the corresponding user possibly has abnormal behaviors in the system operation process. The query picture containing the abnormal information can be obtained in various ways, for example, the query picture can be obtained by performing screenshot and related processing on a user interface operation video with abnormal behaviors, or can be obtained by simulating abnormal system operation behaviors by an auditor and performing screenshot and related processing.
A picture feature is a global feature. A picture feature is used to describe an image property of a scene to which an image or image region corresponds. Picture features may be represented by one or more sets of feature vectors. The picture features may include: color histograms, histogram of oriented gradients, edge features, linear features, center features, diagonal features, and the like. The first picture feature may be represented by one or more sets of feature vectors.
S202, obtaining second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to the interface operation video screenshot.
The user interface operation video can be recorded, and the video screenshot in the video can be intercepted, so that the picture library can be generated. Fig. 3 is a schematic view of a video screenshot of an interface operation provided in an embodiment of the present application. Fig. 3 is a screenshot of the operations of the windows server2012 graphical interface collected by the HAC. The picture library can be generated by adopting a mode of regularly intercepting the video and also adopting a mode of extracting key frames.
A method of generating a picture library is presented, comprising: recording an interface operation video; and adding the key frame in the interface operation video into the picture library.
And storing the graphical interface operation video of the user session, extracting key frames in the video and storing the key frames as a sequence picture set. The key frame is a frame with obvious dynamic change of a video picture, and is extracted to be used as a key picture for subsequent machine learning training and picture feature extraction. In general, a large number of frames of a video of a conversation are static, that is, an interface does not change for a certain time, because a picture is relatively static when an operation and maintenance person performs a certain operation. If a certain software is installed, the progress bar is changed in the installation process, but most of the whole picture is still, and the whole picture can be judged to be a non-key frame. The key frame is identified and extracted to form a sequence picture set, which is the key for judging whether the illegal operation exists in one session.
Similar to the description of the first picture feature above, the second picture feature is a picture feature used to characterize a picture in a picture library. The second picture feature may be represented by one or more sets of feature vectors.
S203, identifying an abnormal picture set in the picture library based on the first picture characteristic and the second picture characteristic.
The similarity between the first picture feature and the second picture feature may be determined by calculating a distance between the first picture feature and the second picture feature. The distance between the first picture feature and the second picture feature may be a euclidean distance or a cosine distance, etc. Generally, the closer the distance between the first picture feature and the second picture feature, the higher the similarity between the first picture feature and the second picture feature, and the more similar the first picture and the second picture.
If the first picture characteristic and the second picture characteristic are closer to each other, it is indicated that the second picture is more likely to contain abnormal information. The second picture may be displayed to an auditor for troubleshooting and locating abnormal operating behavior.
It should be noted that the feature dimensions of the first picture feature and each second picture feature in the system should be the same and can be matched, so that the similarity between the query picture and each picture in the picture library can be calculated based on the first picture feature and each second picture feature in the system.
Alternatively, step S203 may include:
calculating the similarity between the first picture characteristic and each second picture characteristic;
and acquiring a second picture feature set with the similarity larger than a similarity threshold, and identifying an abnormal picture set indicated by the second picture feature set in the picture library.
The distance between the first picture feature and the second picture feature and the corresponding relation of the similarity between the first picture feature and the second picture feature can be prestored in the system, so that the acquaintance degree between the first picture feature and the second picture feature is determined according to the distance between the first picture feature and the second picture feature.
The similarity threshold can be set according to actual requirements. If the similarity between the first picture characteristic and the second picture characteristic is greater than the similarity threshold, it indicates that the second picture has a greater possibility of also containing abnormal information, and an abnormal picture set composed of the second pictures should be displayed.
Optionally, after step S203, the method further includes:
and sequentially displaying the abnormal picture sets according to the sequence of the similarity.
The higher the similarity between the first picture feature and the second picture feature is, the higher the possibility that the picture corresponding to the second picture feature contains abnormal behavior information is. And displaying the abnormal picture sets in sequence according to the sequence of the similarity, so that auditors can conveniently inquire and position pictures containing abnormal behavior information.
Based on feature extraction, storing a feature vector with fixed length and capable of calculating distance in a database in an off-line manner, wherein the feature vector corresponds to each picture in a picture library, calculating the similarity between the two pictures, and sorting the results according to the similarity. For high-speed search, the feature vectors are indexed, and the distance between two pictures is calculated. When an auditor searches images, a query picture is uploaded, the CBIR system extracts the characteristics of the picture on line and calculates the characteristic similarity of the picture and each picture stored in the database off line. The feature vectors of the inquired picture set are stored off line, so that the features of the inquired picture are mainly extracted on line, and the feature distance between the inquired picture and the inquired picture set is calculated.
The performance of search ordering needs to take into account speed aspects such as memory consumption and time consumption. The speed is mainly the calculation of the distance between the query picture and a huge query picture set, and mainly depends on an index algorithm, such as hash index and inverted index.
According to the method for identifying the operation abnormal behavior, the similarity between the query picture and each picture in the picture library can be obtained through comparison of the first picture characteristic and the second picture characteristic. Because the query picture contains abnormal information, the picture possibly containing the abnormal information can be obtained from the picture library according to the similarity with the query picture, so that the system can automatically identify abnormal operation behaviors. Therefore, the technical scheme of the embodiment of the application solves the problem of low auditing efficiency in the prior art.
Referring to fig. 4, fig. 4 is a schematic flowchart of an operation abnormal behavior identification method provided in an embodiment of the present application, where the method includes:
s401, receiving a query picture containing abnormal information input in a query system, wherein the query picture is a marked picture.
The marked picture is a picture marked with an area which may contain abnormal information. Training at the pixel level for a picture proves to be less than that for a local area, because the entire picture contains too much information and is far less straightforward than the features of a region of interest. Therefore, segmentation and labeling can be performed on the image, the area with the illegal action is labeled, and a plurality of abnormal areas can be labeled on one image. The abnormal area can be marked by lines with different colors, different thicknesses and different shapes.
Fig. 5 is a schematic diagram of a picture annotation provided in an embodiment of the present application. As shown in fig. 5, the positions enclosed by the rectangular frames in the figure are regions that may contain abnormal information. The machine learning method will learn features from the abnormal region for matching of two pictures.
S402, inputting the query picture into the feature extraction model, and obtaining an output mark of the feature extraction model.
The following provides a method for training a feature extraction model, comprising: acquiring an interface operation picture sample, and marking an abnormal operation type corresponding to the interface operation picture sample; and training a feature extraction model by adopting the interface operation picture sample and the abnormal operation type.
And marking an abnormal type for the sample picture, wherein the abnormal type can be an integer. If the normal is 0, the exception is marked from 1 to n according to the type, and n exception types are provided. From this perspective, feature learning of pictures is a multi-classification task. The feature extraction model can be various classification models, such as decision trees (DecisionTrees) and Support Vector Machines (SVMs).
For example, CNN (convolutional neural network) may be used as the feature extraction model. Fig. 6 is a schematic diagram of a convolutional neural network provided in an embodiment of the present application. CNN is a feedforward neural network whose artificial neurons can respond to a part of the coverage of surrounding cells, and performs well for large-scale image processing. The convolutional neural network consists of one or more convolutional layers and a top fully-connected layer, and also includes associated weights and pooling layers. Convolutional neural networks can give better results in terms of image and speech recognition than other deep learning structures. This model can also be trained using a back propagation algorithm. Compared with other deep and feedforward neural networks, the convolutional neural network needs fewer considered parameters, so that the convolutional neural network becomes an attractive deep learning structure.
Based on this, the embodiment of the present application selects CNN to train a labeled picture set, and selects the output of the last full-link layer from the pre-trained CNN model as the feature of the input picture. As shown in fig. 6, a picture is input and output as an abnormal type or area. And using the sample picture, and using the pre-trained CNN model to extract the advanced features of the picture. Wherein, a full connection (FullConnection) layer (position marked by a matrix) is selected as a feature vector of an input picture for calculating similarity by subsequent feature matching. Assuming a fully connected layer with 1000 neurons, i.e. 1000 dimensions, each picture will be uniformly characterized by a vector of these 1000 dimensions, with the values of each dimension being floating point numbers.
It should be noted that the labeled picture can be selected as the sample picture. The method for labeling pictures can be referred to the above description of step S401. Because the marked pictures contain richer region operation information, the marked pictures are selected as sample pictures, and compared with the pictures without marks as the sample pictures, the feature extraction model obtained by training is more accurate.
And S403, acquiring the first picture feature output by the full connection layer of the feature extraction model.
And inputting the first picture as an input parameter into the feature extraction model to obtain the first picture feature. And if the feature extraction model is CNN, the full connection layer of the feature extraction model is the first picture feature corresponding to the first picture.
S404, second picture characteristics corresponding to pictures in the picture library are obtained, and the second picture characteristics are generated based on a feature extraction model.
The second picture feature is generated based on the feature extraction model, and the second picture feature can be a picture feature of a marked picture in the picture library. And inputting the second picture as an input parameter into the feature extraction model to obtain the features of the second picture. And if the feature extraction model is CNN, the full connection layer of the feature extraction model is the second picture feature of the second picture.
It should be noted that, because the first picture feature and the second picture feature are both generated based on the same feature extraction model. Therefore, the feature dimensions of the first picture feature and each second picture feature in the system are the same and can be matched, and in step S405 described below, the similarity between the query picture and each picture in the picture library can be calculated based on the first picture feature and each second picture feature in the system.
S405, identifying an abnormal picture set in the picture library based on the first picture characteristic and the second picture characteristic.
Optionally, after step S405, the method further includes:
sequentially displaying the abnormal picture sets according to the sequence of the similarity;
and when the abnormal picture with the highest similarity in the abnormal picture set is not the specified picture, adjusting the feature extraction model.
There are two considerations to the performance of search ranking, one is speed, such as memory consumption and time consumption. One is accuracy considerations such as hit rate, quality of ordering, etc. The speed is mainly the calculation of the distance between the query picture and a huge query picture set, and mainly depends on an index algorithm, such as hash index and inverted index. There are two levels of accuracy, the first is no hits, and abnormal operations like querying pictures are not retrieved. The second is the ranking quality, such as the ranking position of the retrieved pictures, i.e. the relevance level.
In order to improve the sequencing quality, for the HAC operation and maintenance monitoring scene, the scheme further utilizes RF (Relevance feedback) to further collect data and optimize the model. Due to the limitation of abnormal operation of the HAC operation and maintenance monitoring scene, feedback behaviors of auditors on the retrieval result can be collected continuously, and the behavior data are added into the model to further optimize feature extraction. If the auditor selects the 10 records returning the query result, selects the most similar picture, and if the picture is not ranked first, the background data set can be updated, the feedback is noted, and the feedback information can be utilized during model learning.
According to the method for identifying the operation abnormal behavior, under the condition that the query picture is marked, the picture features are generated based on the feature extraction model, so that the picture features can well represent the characteristics of the picture, the accuracy of the similarity value between the first picture and the second picture obtained by utilizing the first picture features and the second picture features is higher, and the picture possibly containing abnormal information returned by the auditing system is more accurate and comprehensive.
Referring to fig. 7, fig. 7 is a schematic flowchart of another method for identifying an abnormal operation behavior according to an embodiment of the present application, where the method includes:
s701, receiving a query picture containing abnormal information input in a query system, wherein the query picture is a non-labeled picture.
The marked picture is a picture marked with an area which may contain abnormal information. It should be noted that the unmarked picture is not a picture without processing the original query picture, but is a picture without a marked area with possible abnormal information in the picture.
S702, extracting pixel characteristics of the query picture, mapping the pixel characteristics to a characteristic space, and generating first picture characteristics corresponding to the query picture.
The pixel features may be color features, texture features, layout features, and the like. The first picture features extracted based on the pixel features are low-level picture features. The extraction of the first picture feature mainly comprises two steps:
1) and extracting characteristics such as color, texture, layout and the like from the query picture. The key point features extracted from the query picture can be obtained by using an algorithm such as sift (scaleinvarietfeaturetransform) or surf (speeduprobustfeatures).
2) And mapping the picture features to a common feature space, wherein the feature dimensions of the first picture features and the second picture features are the same and can be matched to obtain the feature vector with the fixed length of the query picture. The local image description may be compressed into a fixed-length vector using the vlad (vectorlocallyaggegeteddescriptors) algorithm.
S703, second picture characteristics corresponding to each picture in the picture library are obtained, and each second picture characteristic is generated based on the pixel characteristics.
The second picture feature is generated based on the pixel feature, and the second picture feature can be a picture feature of an unmarked picture in the picture library. The generation method of the second picture feature can be referred to the description in step S702.
It should be noted that the feature dimensions of the first picture feature and each second picture feature in the system are the same and can be matched, so that in the following step S704, the similarity between the query picture and each picture in the picture library can be calculated based on the first picture feature and each second picture feature in the system.
S704, identifying an abnormal picture set in the picture library based on the first picture characteristic and the second picture characteristic.
According to the method for identifying the operation abnormal behavior, under the condition that the query picture is not marked, the picture feature, namely the low-level picture feature, is generated based on the pixel feature of the query picture. And calculating the similarity between the query picture and each picture in the picture library based on the first picture characteristic and each second picture characteristic in the system, and identifying an abnormal picture set from the picture library by using the recognition degree between the pictures so as to facilitate the auditors to carry out abnormal operation investigation from the abnormal picture set without investigating the whole picture library, thereby reducing the workload of the auditors and improving the time spent on auditing work.
In the method for identifying an operation abnormal behavior provided by the embodiment of the application, second picture characteristics corresponding to each picture in a picture library need to be prestored in a system. Fig. 8 is a schematic flowchart of another method for identifying an abnormal operation behavior according to an embodiment of the present application. As shown in fig. 8, the system session stores a graphical interface operation video during user operation, extracts key frames in the video, and stores the key frames as a sequence picture set. The method can be used for labeling the pictures in the picture set to generate labeled pictures. Or not labeling the pictures in the picture set, wherein the pictures are non-labeled pictures. For a non-labeled picture, low-level features of the picture can be extracted. For tagged pictures, the high-level features of the pictures can be extracted. The picture characteristics of the pictures in the picture library are saved in the system, and the picture characteristics can be low-level characteristics or high-level characteristics. And calculating the similarity between the query picture and the pictures in the picture library based on the picture characteristics of the pictures in the picture library, sequencing based on the similarity, returning the query result to an auditor, and positioning possible illegal behaviors by the auditor based on the query result.
When a target picture in the picture library is marked, inputting the marked picture into the feature extraction model, and generating a second picture feature corresponding to the target picture output by a full connection layer of the feature extraction model; when the target picture in the picture library is not marked, extracting the pixel characteristics of the target picture, mapping the pixel characteristics into a characteristic space, and generating second picture characteristics corresponding to the target picture.
When the target picture in the picture library is labeled, please refer to the descriptions in steps S401-S404 for the generation process of the second picture feature. When the target picture in the picture library is not labeled, please refer to the descriptions in steps S701 to S703 for the generation process of the second picture feature.
It should be noted that the system may store multiple high-level features of multiple pictures in the picture library at the same time, or store multiple low-level features of multiple pictures in the picture library, and a picture in the picture library may have corresponding high-level features and low-level features in the system at the same time. The low-level features of the query picture can be directly obtained, or the query picture can be labeled firstly, and then the high-level features of the query picture can be obtained based on the labeled query picture. When the query is performed based on the query picture, the query can be performed based on the low-level characteristics of the query picture, and the query can also be performed based on the high-level characteristics of the query picture.
The scheme of the embodiment of the application provides a CBIR-based HAC operation and maintenance violation operation retrieval method, which can assist an auditor in retrieving abnormal operation in a graphical operation interface in operation and maintenance service, improve auditing efficiency and recall rate and accuracy rate of abnormal detection, and is mainly characterized in that:
1) collecting key frames of an operation video of the HAC operation and maintenance session to form a picture set, and labeling the abnormal types and local areas of the pictures;
2) pre-training the model based on the picture set and the marked information, extracting the feature vectors with fixed length off line, and storing the feature vectors into a database;
3) extracting the characteristics of the query picture on line based on a pre-training model, carrying out similarity calculation with the characteristics in the database, and feeding back a sequencing result based on the similarity;
4) for the sequencing result, the scheme further provides for applying a Relevance Feedback (RF) technology to collect the behavior of the auditor on the sequencing result for further optimizing the model.
The scheme of the embodiment of the application supports that one image is input, a plurality of most similar images containing abnormal operation are fed back from the system, and also supports that a plurality of most similar images are fed back by inputting keyword query, namely, image retrieval based on text. However, this solution requires some text description of the operation and maintenance image, such as a label, a title, or a content description.
The scheme of the embodiment of the application is that the features are extracted and then vector calculation is carried out for retrieval, and with the progress of deep learning, an end-to-end mode can be developed in the future, namely the input query image directly outputs the most similar image. However, this solution requires that the similarity between images be labeled in advance, which is very labor intensive.
Referring to fig. 9, fig. 9 is a schematic structural diagram of an abnormal operation behavior recognition apparatus according to an embodiment of the present application, and as shown in fig. 9, the abnormal operation behavior recognition apparatus includes:
a first feature obtaining unit 901, configured to receive a query picture containing abnormal information input in a query system, and obtain a first picture feature corresponding to the query picture;
a second feature obtaining unit 902, configured to obtain a second picture feature corresponding to each picture in a picture library, where the picture library is a picture set corresponding to an interface operation video screenshot;
an abnormal picture identification unit 903, configured to identify an abnormal picture set in the picture library based on the first picture feature and the second picture feature.
Optionally, the apparatus further comprises:
the model training module 904 is used for acquiring an interface operation picture sample and marking an abnormal operation type corresponding to the interface operation picture sample;
and training a feature extraction model by adopting the interface operation picture sample and the abnormal operation type.
Optionally, the first feature obtaining unit 901 is specifically configured to:
when the query picture is marked, inputting the query picture into the feature extraction model to obtain an output mark of the feature extraction model;
acquiring first picture features output by a full connection layer of the feature extraction model;
when the query picture is not marked, extracting pixel features of the query picture, mapping the pixel features to a feature space, and generating first picture features corresponding to the query picture.
Optionally, the second feature obtaining unit 902 is specifically configured to:
when a target picture in the picture library is marked, inputting the marked picture into the feature extraction model, and generating a second picture feature corresponding to the target picture output by a full connection layer of the feature extraction model;
when the target picture in the picture library is not marked, extracting the pixel characteristics of the target picture, mapping the pixel characteristics into a characteristic space, and generating second picture characteristics corresponding to the target picture.
Optionally, the abnormal picture identifying unit 903 is specifically configured to:
calculating the similarity between the first picture characteristic and each second picture characteristic;
and acquiring a second picture feature set with the similarity larger than a similarity threshold, and identifying an abnormal picture set indicated by the second picture feature set in the picture library.
Optionally, the apparatus further comprises:
a picture display unit 905, configured to sequentially display the abnormal picture sets according to the high-low order of the similarity;
and when the abnormal picture with the highest similarity in the abnormal picture set is not the specified picture, adjusting the feature extraction model.
Optionally, the apparatus further comprises:
the picture adding unit 906 is used for recording interface operation videos;
and adding the key frame in the interface operation video into the picture library.
It is clear to a person skilled in the art that the solution according to the embodiments of the present application can be implemented by means of software and/or hardware. The "unit" and "module" in this specification refer to software and/or hardware that can perform a specific function independently or in cooperation with other components, where the hardware may be, for example, an FPGA (Field programmable gate array), an IC (Integrated Circuit), or the like.
Each processing unit and/or module in the embodiments of the present application may be implemented by an analog circuit that implements the functions described in the embodiments of the present application, or may be implemented by software that executes the functions described in the embodiments of the present application.
The embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the above-mentioned operation abnormal behavior identification method. The computer-readable storage medium may include, but is not limited to, any type of disk including floppy disks, optical disks, DVD, CD-ROMs, microdrive, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data.
Referring to fig. 10, a schematic structural diagram of an electronic device according to an embodiment of the present application is shown, where the electronic device may be used to implement the method for identifying abnormal operation behavior in the foregoing embodiment. Specifically, the method comprises the following steps:
the memory 720 may be used to store software programs and modules, and the processor 790 executes various functional applications and data processing by operating the software programs and modules stored in the memory 720. The memory 720 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the terminal device, and the like. Further, the memory 720 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, the memory 720 may also include a memory controller to provide the processor 790 and the input unit 730 access to the memory 720.
The input unit 730 may be used to receive input numeric or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control. In particular, input unit 730 may include a touch-sensitive surface 731 (e.g., a touch screen, a touchpad, or a touch frame). Touch-sensitive surface 731, also referred to as a touch display screen or touch pad, can collect touch operations by a user on or near touch-sensitive surface 731 (e.g., operations by a user on or near touch-sensitive surface 731 using a finger, stylus, or any other suitable object or attachment) and drive the corresponding connection device according to a predetermined program. Alternatively, the touch sensitive surface 731 may comprise two parts, a touch detection means and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, and sends the touch point coordinates to the processor 790, and can receive and execute commands sent from the processor 790. In addition, the touch-sensitive surface 731 can be implemented in a variety of types, including resistive, capacitive, infrared, and surface acoustic wave.
The display unit 740 may be used to display information input by a user or information provided to a user and various graphic user interfaces of the terminal device, which may be configured by graphics, text, icons, video, and any combination thereof. The display unit 740 may include a display panel 741, and optionally, the display panel 741 may be configured in the form of an LCD (liquid crystal display), an OLED (organic light-emitting diode), or the like. Further, touch-sensitive surface 731 can overlie display panel 741 such that when touch operations are detected at or near touch-sensitive surface 731, they are passed to processor 790 for determining the type of touch event, and processor 790 then provides a corresponding visual output on display panel 741 in accordance with the type of touch event. Although in FIG. 7 the touch-sensitive surface 731 and the display panel 741 are implemented as two separate components to implement input and output functions, in some embodiments the touch-sensitive surface 731 and the display panel 741 may be integrated to implement input and output functions.
The processor 790 is a control center of the terminal device, connects various parts of the entire terminal device using various interfaces and lines, and performs various functions of the terminal device and processes data by operating or executing software programs and/or modules stored in the memory 720 and calling data stored in the memory 720, thereby integrally monitoring the terminal device. Optionally, the processor 790 may include one or more processing cores; the processor 790 may integrate an application processor, which primarily handles operating systems, user interfaces, applications, etc., and a modem processor, which primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 790.
Specifically, in this embodiment, the display unit of the terminal device is a touch screen display, the terminal device further includes a memory and one or more programs, where the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include steps for implementing the above-mentioned method for identifying abnormal operation.
In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.
All functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (10)
1. An operation abnormal behavior recognition method, characterized in that the method comprises:
receiving a query picture containing abnormal information input in a query system, and acquiring a first picture characteristic corresponding to the query picture;
acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to an interface operation video screenshot;
based on the first picture feature and the second picture feature, an abnormal picture set is identified in the picture library.
2. The method of claim 1, further comprising:
acquiring an interface operation picture sample, and marking an abnormal operation type corresponding to the interface operation picture sample;
and training a feature extraction model by adopting the interface operation picture sample and the abnormal operation type.
3. The method according to claim 2, wherein the obtaining of the first picture feature corresponding to the query picture comprises:
when the query picture is marked, inputting the query picture into the feature extraction model to obtain an output mark of the feature extraction model;
acquiring first picture features output by a full connection layer of the feature extraction model;
when the query picture is not marked, extracting pixel features of the query picture, mapping the pixel features to a feature space, and generating first picture features corresponding to the query picture.
4. The method of claim 2, further comprising:
when a target picture in the picture library is marked, inputting the marked picture into the feature extraction model, and generating a second picture feature corresponding to the target picture output by a full connection layer of the feature extraction model;
when the target picture in the picture library is not marked, extracting the pixel characteristics of the target picture, mapping the pixel characteristics into a characteristic space, and generating second picture characteristics corresponding to the target picture.
5. The method of claim 2, wherein identifying an abnormal picture set in the picture library based on the first picture feature and the second picture feature comprises:
calculating the similarity between the first picture characteristic and each second picture characteristic;
and acquiring a second picture feature set with the similarity larger than a similarity threshold, and identifying an abnormal picture set indicated by the second picture feature set in the picture library.
6. The method of claim 5, wherein after identifying an abnormal picture set in the picture library, the method further comprises:
sequentially displaying the abnormal picture sets according to the sequence of the similarity;
and when the abnormal picture with the highest similarity in the abnormal picture set is not the specified picture, adjusting the feature extraction model.
7. The method of claim 1, further comprising:
recording an interface operation video;
and adding the key frame in the interface operation video into the picture library.
8. An operation abnormal behavior recognition apparatus, characterized in that the apparatus comprises:
the query system comprises a first feature acquisition unit, a second feature acquisition unit and a query unit, wherein the first feature acquisition unit is used for receiving a query picture which is input in the query system and contains abnormal information and acquiring a first picture feature corresponding to the query picture;
the second characteristic acquisition unit is used for acquiring second picture characteristics corresponding to each picture in a picture library, wherein the picture library is a picture set corresponding to the interface operation video screenshot;
and the abnormal picture identification unit is used for identifying an abnormal picture set in the picture library based on the first picture characteristic and the second picture characteristic.
9. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.
10. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1-7 are implemented when the program is executed by the processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010112441.6A CN111352814A (en) | 2020-02-24 | 2020-02-24 | Operation abnormal behavior recognition method and device, storage medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010112441.6A CN111352814A (en) | 2020-02-24 | 2020-02-24 | Operation abnormal behavior recognition method and device, storage medium and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111352814A true CN111352814A (en) | 2020-06-30 |
Family
ID=71197146
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010112441.6A Pending CN111352814A (en) | 2020-02-24 | 2020-02-24 | Operation abnormal behavior recognition method and device, storage medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111352814A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113762115A (en) * | 2021-08-27 | 2021-12-07 | 国网浙江省电力有限公司 | Distribution network operator behavior detection method based on key point detection |
| CN114758284A (en) * | 2022-04-28 | 2022-07-15 | 重庆长安汽车股份有限公司 | Graphic session auditing method of operation and maintenance auditing system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105468781A (en) * | 2015-12-21 | 2016-04-06 | 小米科技有限责任公司 | Video query method and device |
| CN109241946A (en) * | 2018-10-11 | 2019-01-18 | 平安科技（深圳）有限公司 | Abnormal behaviour monitoring method, device, computer equipment and storage medium |
| CN109960742A (en) * | 2019-02-18 | 2019-07-02 | 苏州科达科技股份有限公司 | The searching method and device of local message |
| WO2019219083A1 (en) * | 2018-05-18 | 2019-11-21 | 北京中科寒武纪科技有限公司 | Video retrieval method, and method and apparatus for generating video retrieval mapping relationship |
| CN110532866A (en) * | 2019-07-22 | 2019-12-03 | 平安科技（深圳）有限公司 | Video data detection method, device, computer equipment and storage medium |
-
2020
- 2020-02-24 CN CN202010112441.6A patent/CN111352814A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105468781A (en) * | 2015-12-21 | 2016-04-06 | 小米科技有限责任公司 | Video query method and device |
| WO2019219083A1 (en) * | 2018-05-18 | 2019-11-21 | 北京中科寒武纪科技有限公司 | Video retrieval method, and method and apparatus for generating video retrieval mapping relationship |
| CN109241946A (en) * | 2018-10-11 | 2019-01-18 | 平安科技（深圳）有限公司 | Abnormal behaviour monitoring method, device, computer equipment and storage medium |
| CN109960742A (en) * | 2019-02-18 | 2019-07-02 | 苏州科达科技股份有限公司 | The searching method and device of local message |
| CN110532866A (en) * | 2019-07-22 | 2019-12-03 | 平安科技（深圳）有限公司 | Video data detection method, device, computer equipment and storage medium |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113762115A (en) * | 2021-08-27 | 2021-12-07 | 国网浙江省电力有限公司 | Distribution network operator behavior detection method based on key point detection |
| CN113762115B (en) * | 2021-08-27 | 2024-03-15 | 国网浙江省电力有限公司 | Distribution network operator behavior detection method based on key point detection |
| CN114758284A (en) * | 2022-04-28 | 2022-07-15 | 重庆长安汽车股份有限公司 | Graphic session auditing method of operation and maintenance auditing system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112738126B (en) | Attack tracing method based on threat intelligence and ATT & CK | |
| CN101989327B (en) | Image analyzing apparatus and image analyzing method | |
| CN112926654B (en) | Pre-labeling model training and certificate pre-labeling method, device, equipment and medium | |
| CN106028134A (en) | Detect sports video highlights for mobile computing devices | |
| Yong et al. | Wildlife video key-frame extraction based on novelty detection in semantic context | |
| CN115828112B (en) | Fault event response method and device, electronic equipment and storage medium | |
| CN111953697A (en) | APT attack identification and defense method | |
| CN111352814A (en) | Operation abnormal behavior recognition method and device, storage medium and electronic equipment | |
| CN112231038B (en) | Work order information display method, device, computer equipment and storage medium | |
| CN104508683A (en) | Handwriting input support apparatus and method | |
| CN112911204A (en) | Monitoring method, monitoring device, storage medium and electronic equipment | |
| CN110737714A (en) | Computer vision-based electronic competition data visualization system and method | |
| EP3037985A1 (en) | Search method and system, search engine and client | |
| CN112995757A (en) | Video clipping method and device | |
| CN114419631A (en) | Network management virtual system based on RPA | |
| CN111784360B (en) | Anti-fraud prediction method and system based on network link backtracking | |
| CN111783786B (en) | Picture identification method, system, electronic device and storage medium | |
| CN111199172A (en) | Terminal screen recording-based processing method and device and storage medium | |
| CN110909380B (en) | Abnormal file access behavior monitoring method and device | |
| CN110708341B (en) | User behavior detection method and system based on remote desktop encryption network traffic mode difference | |
| CN111127057B (en) | Multi-dimensional user portrait recovery method | |
| CN111597423A (en) | Performance evaluation method and device of interpretable method of text classification model | |
| Guo et al. | Saliency detection on sampled images for tag ranking | |
| CN116091982A (en) | Image detection method, device, electronic equipment and computer readable storage medium | |
| KR102342495B1 (en) | Method and Apparatus for Creating Labeling Model with Data Programming |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200630 |