CN112131076A - Method, equipment and system for acquiring mouse operation event information - Google Patents
Method, equipment and system for acquiring mouse operation event information Download PDFInfo
- Publication number
- CN112131076A CN112131076A CN202010983683.2A CN202010983683A CN112131076A CN 112131076 A CN112131076 A CN 112131076A CN 202010983683 A CN202010983683 A CN 202010983683A CN 112131076 A CN112131076 A CN 112131076A
- Authority
- CN
- China
- Prior art keywords
- mouse
- operation event
- mouse operation
- information
- request information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 35
- 230000004044 response Effects 0.000 claims abstract description 130
- 238000012423 maintenance Methods 0.000 claims abstract description 18
- 238000012550 audit Methods 0.000 abstract description 10
- 238000010586 diagram Methods 0.000 description 8
- 238000004891 communication Methods 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000003825 pressing Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3041—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is an input/output interface
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3089—Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents
Abstract
Compared with the prior art, according to the method, the device and the system for acquiring the mouse operation event information, firstly, a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period are acquired, then, mouse coordinate information corresponding to each request information is determined based on the plurality of mouse operation event request information, then, mouse coordinate information and operation content corresponding to each response information are determined based on the plurality of mouse operation event response information, and finally, mouse coordinate information and operation content corresponding to each mouse operation event are determined based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information. By the method, the operation position information of each mouse operation event in a certain time period can be acquired, the specific mouse operation content corresponding to the mouse operation event can be acquired, and the remote operation and maintenance audit accuracy of the mouse operation event is realized.
Description
Technical Field
The application relates to the technical field of computers, in particular to a technology for acquiring information of mouse operation events.
Background
With the continuous improvement of the network and informatization level, the daily operation of enterprises is performed to a great extent through the enterprise network, the requirement on information security is higher and higher, and the operation, maintenance and audit operation of the enterprise intranet becomes an indispensable part. Generally, a user uses a computer, almost all operations are completed through a mouse and a keyboard, and therefore operation and maintenance audit comprises a large amount of mouse operation event audit. On the basis of security, proxy equipment is usually arranged in the network to isolate the server equipment from the client equipment, protect the server equipment from various illegal accesses or attacks, and ensure the security of the server equipment. An operation and maintenance person usually logs in various server-side devices in a network remotely through a proxy-side device on the basis of a remote communication protocol at a client-side device to perform operation and maintenance audit on the server-side devices, and an operation flow of a remote mouse based on the remote communication protocol is shown in fig. 1.
RDP (Remote Desktop Protocol) is a standard Protocol applied to microsoft Remote Desktop, and allows a user to remotely connect to a computer providing microsoft terminal services.
At present, each operation and maintenance auditing product in the market almost supports the operation and maintenance auditing operation based on the RDP protocol. For a remote mouse operation event, only the coordinate position of the mouse operation event can be directly obtained, but specific contents of the mouse operation, such as what file is opened, what content is copied, what file is deleted, and the like, cannot be directly obtained.
Disclosure of Invention
The application aims to provide a method and equipment for acquiring mouse operation event information, which are used for solving the technical problem that specific contents of a mouse operation event cannot be directly acquired in the existing remote operation and maintenance audit.
According to one aspect of the application, a method for acquiring mouse operation event information is provided, wherein the method comprises the following steps:
acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information;
determining mouse coordinate information and operation content corresponding to each response message based on the plurality of mouse operation event response messages;
and determining mouse coordinate information and operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
Optionally, the obtaining of the request information of the plurality of mouse operation events and the response information of the plurality of mouse operation events within the preset time period includes:
acquiring a plurality of RDP data packets in a preset time period;
and traversing and analyzing all the RDP data packets to acquire a plurality of mouse operation event request information and a plurality of mouse operation event response information in a preset time period.
Optionally, the traversing and analyzing all RDP data packets to obtain a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period includes:
traversing and analyzing all RDP data packets;
determining the analyzed RDP data packet of which the data of the preset field accords with a first preset threshold as mouse operation event request information;
and determining the analyzed RDP data packet of which the data of the preset field accords with a second preset threshold as the response information of the mouse operation event.
Optionally, the determining, based on the plurality of mouse operation event request information, mouse coordinate information corresponding to each request information includes:
and determining data of a preset field in the mouse operation event request information as the mouse coordinate information corresponding to the mouse operation event based on the plurality of pieces of mouse operation event request information.
Optionally, the determining, based on the plurality of mouse operation event response information, the mouse coordinate information and the operation content corresponding to each response information includes:
and determining the content corresponding to the preset field data in the response information of the mouse operation events as the mouse coordinate information and the operation content corresponding to the mouse operation events based on the response information of the mouse operation events.
Optionally, before determining the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information, the method further includes:
traversing all the mouse operation event response information, and combining the operation contents of which the mouse coordinate information meets the preset conditions into the operation contents corresponding to the mouse operation event.
Optionally, wherein the method further comprises:
and using the mouse coordinate information and the operation content corresponding to each mouse operation event for operation and maintenance auditing of the mouse events.
According to another aspect of the present application, there is also provided an apparatus for acquiring mouse operation event information, wherein the apparatus includes:
the first device is used for acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
the second device is used for determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information;
the third device is used for determining mouse coordinate information and operation content corresponding to each piece of response information based on the plurality of pieces of mouse operation event response information;
and the fourth device is used for determining the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
Optionally, wherein the first apparatus comprises:
the first module is used for acquiring a plurality of RDP data packets in a preset time period;
and the first and second modules are used for traversing and analyzing all the RDP data packets so as to acquire a plurality of mouse operation event request information and a plurality of mouse operation event request response information in a preset time period.
According to another aspect of the present application, there is also provided a system for acquiring mouse operation event information, wherein the system includes:
the client device is used for sending mouse operation event request information to the agent device;
the proxy end equipment is used for acquiring the mouse operation event request information sent by the client end equipment, sending the mouse operation event request information to the server end equipment, acquiring the mouse operation event response information returned by the server end equipment, and acquiring the mouse coordinate information and the operation content corresponding to each mouse operation event based on a plurality of mouse operation event request information and a plurality of mouse operation event response information in a preset time period;
and the server-side equipment is used for receiving the mouse operation event request information sent by the agent-side equipment, acquiring response information corresponding to the mouse operation event request information and returning the response information to the agent-side equipment.
According to still another aspect of the present application, there is also provided a system for acquiring mouse operation event information, wherein the system includes:
the client device is used for sending mouse operation event request information to the agent device;
the proxy end equipment is used for acquiring the mouse operation event request information sent by the client end equipment, sending the mouse operation event request information to the server end equipment and acquiring the mouse operation event response information returned by the server end equipment;
the server-side equipment is used for receiving the mouse operation event request information sent by the agent-side equipment, acquiring response information corresponding to the mouse operation event request information and returning the response information to the agent-side equipment;
and the processing end equipment is used for acquiring a plurality of pieces of mouse operation event request information and a plurality of pieces of mouse operation event response information in a preset time period from the agent end equipment, and acquiring mouse coordinate information and operation content corresponding to each mouse operation event based on the plurality of pieces of mouse operation event request information and the plurality of pieces of mouse operation event response information in the preset time period.
Compared with the prior art, according to the method, the device and the system for acquiring the mouse operation event information, firstly, a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period are acquired, then, mouse coordinate information corresponding to each request information is determined based on the plurality of mouse operation event request information, then, mouse coordinate information and operation content corresponding to each response information are determined based on the plurality of mouse operation event response information, and finally, mouse coordinate information and operation content corresponding to each mouse operation event are determined based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information. By the method, the operation position information of each mouse operation event in a certain time period can be acquired, the specific mouse operation content corresponding to the mouse operation event can be acquired, and the remote operation and maintenance audit accuracy of the mouse operation event is realized.
Drawings
Other features, objects and advantages of the invention will become more apparent upon reading of the detailed description of non-limiting embodiments made with reference to the following drawings:
FIG. 1 illustrates a remote mouse operation flow based on a remote communication protocol;
FIG. 2 illustrates a flow diagram of a method for obtaining mouse operation event information, according to an aspect of the subject application;
FIG. 3 illustrates a partial data packet structure of mouse operation event request information based on the RDP protocol;
FIG. 4 shows a text information packet structure corresponding to a screen refreshing process of a server device based on the RDP protocol;
FIG. 5 illustrates a schematic diagram of an apparatus for obtaining mouse operation event information according to another aspect of the subject application;
FIG. 6 illustrates a schematic diagram of a system for obtaining mouse operation event information, according to yet another aspect of the present application;
FIG. 7 illustrates a schematic diagram of a system for obtaining mouse operation event information, in accordance with yet another aspect of the subject application;
the same or similar reference numbers in the drawings identify the same or similar elements.
Detailed Description
The present invention is described in further detail below with reference to the attached drawing figures.
In a typical configuration of the present application, each module and trusted party of the system includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media (transient media), such as modulated data signals and carrier waves.
In order to further explain the technical means and effects adopted by the present application, the following description clearly and completely describes the technical solution of the present application with reference to the accompanying drawings and preferred embodiments.
FIG. 2 illustrates a flow diagram of a method for obtaining mouse operation event information in one aspect of the present application, wherein the method of one embodiment comprises:
s11, acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
s12, determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information;
s13, determining mouse coordinate information and operation content corresponding to each response message based on the plurality of mouse operation event response messages;
s14 specifies the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
In the present application, the method is performed by a device 1, the device 1 is a computer device and/or a cloud, the computer device includes but is not limited to a personal computer, a notebook computer, an industrial computer, a network host, a single network server, a plurality of network server sets; the Cloud is made up of a large number of computers or web servers based on Cloud Computing (Cloud Computing), which is a type of distributed Computing, a virtual supercomputer consisting of a collection of loosely coupled computers.
The computer device and/or cloud are merely examples, and other existing or future devices and/or resource sharing platforms, as applicable to the present application, are also intended to be included within the scope of the present application and are hereby incorporated by reference.
In this embodiment, in the step S11, the device 1 obtains a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period, where the plurality of mouse operation event request information and the plurality of mouse operation event response information may be obtained from a proxy device, or the device 1 may be the proxy device, obtains the plurality of mouse operation event request information from a client device, and obtains the plurality of mouse operation event response information from a server device.
Optionally, wherein step S11 includes:
s111, acquiring a plurality of RDP data packets in a preset time period;
s112, traversing and analyzing all RDP data packets to obtain a plurality of mouse operation event request information and a plurality of mouse operation event response information in a preset time period.
The remote communication protocol between the client device and the agent device and between the agent device and the server device is an RDP (remote data protocol), and a user remotely logs in the agent device to realize remote operation and maintenance of the server device.
The client equipment sends an RDP data packet containing mouse operation event request information to the proxy equipment, and the proxy equipment stores the RDP data packet and forwards the RDP data packet to the server equipment; the server-side equipment sends an RDP data packet containing mouse operation event response information to the proxy-side equipment, and the proxy-side equipment stores the RDP data packet.
The device 1 acquires the RDP data packets containing the mouse operation event request information and the RDP data packets containing the mouse operation event response information within a preset time period, and traverses and analyzes all the acquired RDP data packets to acquire a plurality of mouse operation event request information and a plurality of mouse operation event response information within the preset time period.
Optionally, wherein the step S112 includes:
traversing and analyzing all RDP data packets;
determining the analyzed RDP data packet of which the data of the preset field accords with a first preset threshold as mouse operation event request information;
and determining the analyzed RDP data packet of which the data of the preset field accords with a second preset threshold as the response information of the mouse operation event.
According to the related definition of the RDP protocol, a structure of a part of the RDP packet related to the mouse operation event request information is shown in fig. 3, where a field pointerFlags is used to indicate the operation of the mouse, for example: pressing and releasing a left mouse button, pressing and releasing a right mouse button, rolling a middle button (if any) and moving the mouse. Therefore, the RDP data packet sent by the client device is analyzed, and if the data content in the field is data representing mouse operation, it is determined that mouse operation event request information can be obtained by analyzing the RDP data packet.
According to the related definition of the RDP protocol, the structure of the text information packet corresponding to the screen refreshing process of the server device in the RDP packet is shown in fig. 4, where a field ForeColor is used to represent the foreground color of the screen, and the data of the field is 0 in normal circumstances, but if the screen is refreshed by mouse operation, the field is reassigned to 0x 92. Therefore, the RDP data packet sent by the server device is parsed, and if the data in the field is 0x92, it is determined that mouse operation event response information can be obtained by parsing the RDP data packet.
Continuing in this embodiment, in the step S12, the device 1 determines mouse coordinate information corresponding to each request information based on the acquired several mouse operation event request information.
Optionally, wherein the step S12 includes:
and determining data of a preset field in the mouse operation event request information as the mouse coordinate information corresponding to the mouse operation event based on the plurality of pieces of mouse operation event request information.
For example, as shown in fig. 3, the RDP packet structure based on the RDP communication protocol includes a partial packet structure of an RDP packet containing mouse operation event request information, where related fields xPos and yPos are respectively used to represent coordinate information of the mouse in the X direction and the Y direction of the screen (usually, the origin of the coordinates of the screen is located at the upper left corner of the screen), and the data content in these fields in the packet is parsed, so that the position information of the mouse operation can be obtained.
In this embodiment, in step S13, the device 1 acquires the response information based on the mouse operation events, and determines the mouse coordinate information and the operation content corresponding to each response information.
Optionally, wherein the step S13 includes:
and determining the content corresponding to the preset field data in the response information of the mouse operation events as the mouse coordinate information and the operation content corresponding to the mouse operation events based on the response information of the mouse operation events.
For example, as shown in fig. 4, the content of the mouse operation event response information based on the RDP communication protocol includes a text information data packet structure corresponding to a screen refreshing process of the server device, where data of a field ForeColor is 0x92, and if data of a related field facredundant is 0, a serial number of a character cache stored in the related field cacheId is obtained, and text information corresponding to a mouse operation is obtained from the character cache through the serial number, so as to determine an operation content corresponding to the mouse operation; in addition, the relevant fields X and Y are respectively used for representing an X-direction coordinate and a Y-direction coordinate corresponding to the mouse operation, and when the data of the field facreandnt is 0, the operation content corresponding to the mouse operation is determined through the data of the field cacheId, and the coordinate information corresponding to the mouse operation is also determined through the data of the fields X and Y. The fOpRedundant field is used for representing a redundancy mode of data storage, for mouse operation and maintenance auditing, only a data packet with the field being 0 needs to be taken, otherwise, the repeated situation of data content extraction can occur, and the operation and maintenance auditing efficiency is affected.
Optionally, before the step S14, the method further includes:
traversing all the mouse operation event response information, and combining the operation contents of which the mouse coordinate information meets the preset conditions into the operation contents corresponding to the mouse operation event.
For example, if it is an operational event that selects a large text segment by mouse, multiple data packets may be required to be transmitted, the data carried by each packet of the response information data packet sent by the server device is incomplete, and may be only 1 or more, so that on the basis of confirming that the data packet is a mouse operation event, whether the data packets are data packets of the same mouse operation event is determined according to the data of the relevant fields X and Y in each data packet, for example, as shown in FIG. 4, after the RDP data packet is analyzed, for each data packet with the data of the related field ForeCoor being 0X92, if the Y field data are the same and the X field data are sequentially increased, each data packet belongs to the response information of the same mouse operation event, and combining the operation contents acquired according to the serial numbers corresponding to the cacheId fields of the data packets into the operation contents corresponding to the mouse operation event. If the Y field data in each data packet are the same and the sequence of the X field data is increased to the end of the row, judging whether the Y field data of the subsequent data packet is sequentially increased, if so, judging the X field data, and sequentially judging whether each data packet belongs to the response information of the same mouse operation event according to the rule.
Continuing in this embodiment, in said step S14, the device 1 determines the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the acquired request information and the mouse coordinate information corresponding to all the response information.
Therefore, by using this rule, the device 1 determines the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information within the acquired preset time period, and combines the position of the mouse and the content of the mouse operation.
Optionally, wherein the method further comprises:
and using the mouse coordinate information and the operation content corresponding to each mouse operation event for operation and maintenance auditing of the mouse events.
For example, in a cloud network, for network security, each server device is usually isolated and protected by a bastion machine, and each client accesses each server device through the bastion machine. And the operation and maintenance auditor also realizes the operation and maintenance audit of each server side device through the bastion machine, and the operation and maintenance auditor audits various operations of various accounts on the server side device remotely, wherein the operation of the server side device through a mouse is also included.
By adopting the method, the mouse operation audit of the server-side equipment can be directly obtained, and not only can the coordinate position of the mouse operation event be directly obtained, but also the specific content of the mouse operation corresponding to the mouse operation event can be obtained.
FIG. 5 shows a schematic diagram of an apparatus for obtaining mouse operation event information according to another aspect of the present application, wherein the apparatus comprises:
a first device 51, configured to obtain a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
a second device 52, configured to determine, based on the plurality of mouse operation event request information, mouse coordinate information corresponding to each request information;
a third device 53, configured to determine, based on the response information of the mouse operation events, mouse coordinate information and operation content corresponding to each response information;
and a fourth means 54 for determining mouse coordinate information and operation contents corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
The first device 51 of the device 1 obtains a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period, then the second device 52 determines mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information, the third device 53 determines mouse coordinate information and operation content corresponding to each response information based on the plurality of mouse operation event response information, and then the fourth device 54 determines mouse coordinate information and operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
Optionally, wherein the first device 51 comprises:
a first module 511 (not shown) configured to obtain a number of RDP packets within a preset time period;
the first and second modules 512 (not shown) are configured to traverse and parse all RDP data packets to obtain a plurality of mouse operation event request messages and a plurality of mouse operation event request response messages within a preset time period.
In one embodiment, the first module 511 of the first device 51 of the apparatus 1 obtains a plurality of RDP packets within a preset time period, the first second module 512 parses all RDP packets to obtain a plurality of mouse operation event request information and a plurality of mouse operation event request response information within the preset time period, then the second device 52 determines mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information, the third device 53 determines mouse coordinate information and operation content corresponding to each response information based on the plurality of mouse operation event response information, and then the fourth device 54 determines mouse coordinate information and operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all request information and the mouse coordinate information corresponding to all response information.
FIG. 6 is a schematic diagram of a system for obtaining mouse operation event information according to another aspect of the present application, wherein the system comprises:
the client device 61 is used for sending mouse operation event request information to the proxy device;
the agent-side device 62 is configured to obtain mouse operation event request information sent by the client device, send the mouse operation event request information to the server device, obtain mouse operation event response information returned by the server device, and obtain mouse coordinate information and operation content corresponding to each mouse operation event based on a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
and the server device 63 is configured to receive the mouse operation event request information sent by the agent device, obtain response information corresponding to the mouse operation event request information, and return the response information to the agent device.
The client device 61, the agent device 62 and the server device 63 are computer devices and/or clouds, and the computer devices include but are not limited to personal computers, notebook computers, industrial computers, network hosts, a single network server, and multiple network server sets; the Cloud is made up of a large number of computers or web servers based on Cloud Computing (Cloud Computing), which is a type of distributed Computing, a virtual supercomputer consisting of a collection of loosely coupled computers.
The computer device and/or cloud are merely examples, and other existing or future devices and/or resource sharing platforms, as applicable to the present application, are also intended to be included within the scope of the present application and are hereby incorporated by reference.
In one embodiment, the client device 61 sends a protocol packet including mouse operation event request information to the proxy device 62 based on the RDP protocol (or other similar telecommunication protocol); the agent side equipment 62 acquires a protocol data packet which is sent by the client side equipment 61 and comprises mouse operation event request information, analyzes the protocol data packet to acquire the mouse operation event request information, and sends the protocol data packet comprising the mouse operation event request information to the server side equipment 63; the server side equipment 63 receives the protocol data packet which is sent by the agent side equipment 62 and comprises the mouse operation event request information, acquires the protocol data packet which comprises the response information corresponding to the mouse operation event request information, and returns the protocol data packet to the agent side equipment 62; the agent side equipment 62 acquires a protocol data packet including mouse operation event response information returned by the server side equipment 63, and analyzes the protocol data packet to acquire the mouse operation event response information; the agent-side device 62 obtains mouse coordinate information and operation content corresponding to each mouse operation event based on the plurality of mouse operation event request information and the plurality of mouse operation event response information within the preset time period.
FIG. 7 is a schematic diagram of a system for obtaining mouse operation event information according to yet another aspect of the present application, wherein the system comprises:
the client device 71 is configured to send mouse operation event request information to the proxy device;
the agent-side device 72 is configured to obtain mouse operation event request information sent by the client device, send the mouse operation event request information to the server device, and obtain mouse operation event response information returned by the server device;
the server-side device 73 is configured to receive the mouse operation event request information sent by the agent-side device, obtain response information corresponding to the mouse operation event request information, and return the response information to the agent-side device;
and the processing end device 74 is configured to obtain, from the agent end device, a plurality of pieces of mouse operation event request information and a plurality of pieces of mouse operation event response information within a preset time period, and obtain, based on the plurality of pieces of mouse operation event request information and the plurality of pieces of mouse operation event response information within the preset time period, mouse coordinate information and operation content corresponding to each mouse operation event.
The client device 71, the agent device 72, the server device 73 and the processing device 74 are computer devices and/or clouds, wherein the computer devices include but are not limited to personal computers, notebook computers, industrial computers, network hosts, a single network server, and multiple network server sets; the Cloud is made up of a large number of computers or web servers based on Cloud Computing (Cloud Computing), which is a type of distributed Computing, a virtual supercomputer consisting of a collection of loosely coupled computers.
The computer device and/or cloud are merely examples, and other existing or future devices and/or resource sharing platforms, as applicable to the present application, are also intended to be included within the scope of the present application and are hereby incorporated by reference.
In one embodiment, the client device 71 sends a protocol packet including mouse operation event request information to the proxy device 72 based on the RDP protocol (or other similar telecommunications protocol); the agent-side device 72 acquires a protocol data packet including mouse operation event request information sent by the client-side device 71, analyzes the protocol data packet to acquire the mouse operation event request information, and sends the protocol data packet including the mouse operation event request information to the server-side device 73; the server-side device 73 receives the protocol data packet including the mouse operation event request information sent by the agent-side device 72, acquires the protocol data packet including the response information corresponding to the mouse operation event request information, and returns the protocol data packet to the agent-side device 72; the agent device 72 acquires a protocol data packet including mouse operation event response information returned by the server device 73, and analyzes the protocol data packet to acquire the mouse operation event response information; the agent-side equipment 72 sends the acquired request information of the mouse operation events and the acquired response information of the mouse operation events in the preset time period to the processing-side equipment 74; the processing-side device 74 receives the plurality of mouse operation event request information and the plurality of mouse operation event response information within the preset time period sent by the agent-side device 72, and acquires mouse coordinate information and operation content corresponding to each mouse operation event based on the plurality of mouse operation event request information and the plurality of mouse operation event response information within the preset time period.
In another embodiment, the client device 71 sends a protocol packet including mouse operation event request information to the proxy device 72 based on the RDP protocol (or other similar telecommunication protocol); the proxy device 72 acquires the protocol data packet including the mouse operation event request information sent by the client device 71, and sends the protocol data packet including the mouse operation event request information to the server device 73; the server-side device 73 receives the protocol data packet including the mouse operation event request information sent by the agent-side device 72, acquires the protocol data packet including the response information corresponding to the mouse operation event request information, and returns the protocol data packet to the agent-side device 72; the agent-side device 72 acquires the protocol data packets including the mouse operation event response information returned by the server-side device 73, and sends a plurality of acquired protocol data packets including the mouse operation event request information and a plurality of acquired protocol data packets including the mouse operation event response information within a preset time period to the processing-side device 74; the processing end device 74 receives a plurality of protocol data packets including mouse operation event request information and a plurality of protocol data packets including mouse operation event response information within a preset time period sent by the agent end device 72, analyzes all the protocol data packets, obtains a plurality of mouse operation event request information and a plurality of mouse operation event response information within the preset time period, and obtains mouse coordinate information and operation content corresponding to each mouse operation event based on the plurality of mouse operation event request information and the plurality of mouse operation event response information within the preset time period.
According to yet another aspect of the present application, there is also provided a computer readable medium having stored thereon computer readable instructions executable by a processor to implement the foregoing method.
According to yet another aspect of the present application, there is also provided an apparatus, wherein the apparatus comprises:
one or more processors; and
a memory storing computer readable instructions that, when executed, cause the processor to perform operations of the method as previously described.
For example, the computer readable instructions, when executed, cause the one or more processors to: acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period; determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information; determining mouse coordinate information and operation content corresponding to each response message based on the plurality of mouse operation event response messages; and determining mouse coordinate information and operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned. Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the apparatus claims may also be implemented by one unit or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.
Claims (13)
1. A method for obtaining information of mouse operation events, the method comprising:
acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information;
determining mouse coordinate information and operation content corresponding to each response message based on the plurality of mouse operation event response messages;
and determining mouse coordinate information and operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
2. The method of claim 1, wherein the obtaining of the plurality of mouse operation event request messages and the plurality of mouse operation event response messages within the preset time period comprises:
acquiring a plurality of RDP data packets in a preset time period;
and traversing and analyzing all the RDP data packets to acquire a plurality of mouse operation event request information and a plurality of mouse operation event response information in a preset time period.
3. The method of claim 2, wherein the parsing all RDP packets through traversal to obtain the mouse operation event request information and the mouse operation event response information within a preset time period comprises:
traversing and analyzing all RDP data packets;
determining the analyzed RDP data packet of which the data of the preset field accords with a first preset threshold as mouse operation event request information;
and determining the analyzed RDP data packet of which the data of the preset field accords with a second preset threshold as the response information of the mouse operation event.
4. The method of claim 1, wherein the determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information comprises:
and determining data of a preset field in the mouse operation event request information as the mouse coordinate information corresponding to the mouse operation event based on the plurality of pieces of mouse operation event request information.
5. The method of claim 1, wherein the determining, based on the plurality of mouse operation event response messages, the mouse coordinate information and the operation content corresponding to each response message comprises:
and determining the content corresponding to the preset field data in the response information of the mouse operation events as the mouse coordinate information and the operation content corresponding to the mouse operation events based on the response information of the mouse operation events.
6. The method of claim 1, wherein before determining the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information, the method further comprises:
traversing all the mouse operation event response information, and combining the operation contents of which the mouse coordinate information meets the preset conditions into the operation contents corresponding to the mouse operation event.
7. The method of claim 1, further comprising:
and using the mouse coordinate information and the operation content corresponding to each mouse operation event for operation and maintenance auditing of the mouse events.
8. An apparatus for acquiring mouse operation event information, the apparatus comprising:
the first device is used for acquiring a plurality of mouse operation event request information and a plurality of mouse operation event response information within a preset time period;
the second device is used for determining mouse coordinate information corresponding to each request information based on the plurality of mouse operation event request information;
the third device is used for determining mouse coordinate information and operation content corresponding to each piece of response information based on the plurality of pieces of mouse operation event response information;
and the fourth device is used for determining the mouse coordinate information and the operation content corresponding to each mouse operation event based on the mouse coordinate information corresponding to all the request information and the mouse coordinate information corresponding to all the response information.
9. The apparatus of claim 8, wherein the first means comprises:
the first module is used for acquiring a plurality of RDP data packets in a preset time period;
and the first and second modules are used for traversing and analyzing all the RDP data packets so as to acquire a plurality of mouse operation event request information and a plurality of mouse operation event request response information in a preset time period.
10. A system for obtaining mouse operation event information, the system comprising:
the client device is used for sending mouse operation event request information to the agent device;
the proxy end equipment is used for acquiring the mouse operation event request information sent by the client end equipment, sending the mouse operation event request information to the server end equipment, acquiring the mouse operation event response information returned by the server end equipment, and acquiring the mouse coordinate information and the operation content corresponding to each mouse operation event based on a plurality of mouse operation event request information and a plurality of mouse operation event response information in a preset time period;
and the server-side equipment is used for receiving the mouse operation event request information sent by the agent-side equipment, acquiring response information corresponding to the mouse operation event request information and returning the response information to the agent-side equipment.
11. A system for obtaining mouse operation event information, the system comprising:
the client device is used for sending mouse operation event request information to the agent device;
the proxy end equipment is used for acquiring the mouse operation event request information sent by the client end equipment, sending the mouse operation event request information to the server end equipment and acquiring the mouse operation event response information returned by the server end equipment;
the server-side equipment is used for receiving the mouse operation event request information sent by the agent-side equipment, acquiring response information corresponding to the mouse operation event request information and returning the response information to the agent-side equipment;
and the processing end equipment is used for acquiring a plurality of pieces of mouse operation event request information and a plurality of pieces of mouse operation event response information in a preset time period from the agent end equipment, and acquiring mouse coordinate information and operation content corresponding to each mouse operation event based on the plurality of pieces of mouse operation event request information and the plurality of pieces of mouse operation event response information in the preset time period.
12. A computer-readable medium comprising, in combination,
stored thereon computer readable instructions executable by a processor to implement the method of any one of claims 1 to 7.
13. An apparatus, characterized in that the apparatus comprises:
one or more processors; and
a memory storing computer readable instructions that, when executed, cause the processor to perform the operations of the method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010983683.2A CN112131076A (en) | 2020-09-17 | 2020-09-17 | Method, equipment and system for acquiring mouse operation event information |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010983683.2A CN112131076A (en) | 2020-09-17 | 2020-09-17 | Method, equipment and system for acquiring mouse operation event information |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112131076A true CN112131076A (en) | 2020-12-25 |
Family
ID=73841949
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010983683.2A Pending CN112131076A (en) | 2020-09-17 | 2020-09-17 | Method, equipment and system for acquiring mouse operation event information |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112131076A (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5799267A (en) * | 1994-07-22 | 1998-08-25 | Siegel; Steven H. | Phonic engine |
| US6208329B1 (en) * | 1996-08-13 | 2001-03-27 | Lsi Logic Corporation | Supplemental mouse button emulation system, method and apparatus for a coordinate based data input device |
| US7027039B1 (en) * | 2000-10-17 | 2006-04-11 | Henty David L | Computer system with passive wireless mouse |
| CN102508675A (en) * | 2011-12-28 | 2012-06-20 | Tcl集团股份有限公司 | Response processing method and device for mouse motion based on android platform |
| CN103150116A (en) * | 2013-03-05 | 2013-06-12 | 福建升腾资讯有限公司 | RDP-based method for magnification display of cloud desktop |
| CN104317390A (en) * | 2014-09-24 | 2015-01-28 | 北京云巢动脉科技有限公司 | Method and system for replacing mouse operation by multiple gestures based on virtual machine of mobile terminal |
| CN106528695A (en) * | 2016-11-02 | 2017-03-22 | 上海幻电信息科技有限公司 | Method for showing video thumbnail through mouse dragging |
| CN106713494A (en) * | 2017-01-23 | 2017-05-24 | 上海上讯信息技术股份有限公司 | Intelligent auditing method and device |
| WO2017112714A1 (en) * | 2015-12-20 | 2017-06-29 | Michael Farr | Combination computer keyboard and computer pointing device |
| CN110489042A (en) * | 2019-07-17 | 2019-11-22 | 视联动力信息技术股份有限公司 | A kind of networked based on view simulates the method and system of dragging |
| CN110609628A (en) * | 2018-05-28 | 2019-12-24 | 敦泰电子有限公司 | Mouse control method and mouse |
-
2020
- 2020-09-17 CN CN202010983683.2A patent/CN112131076A/en active Pending
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5799267A (en) * | 1994-07-22 | 1998-08-25 | Siegel; Steven H. | Phonic engine |
| US6208329B1 (en) * | 1996-08-13 | 2001-03-27 | Lsi Logic Corporation | Supplemental mouse button emulation system, method and apparatus for a coordinate based data input device |
| US7027039B1 (en) * | 2000-10-17 | 2006-04-11 | Henty David L | Computer system with passive wireless mouse |
| CN102508675A (en) * | 2011-12-28 | 2012-06-20 | Tcl集团股份有限公司 | Response processing method and device for mouse motion based on android platform |
| CN103150116A (en) * | 2013-03-05 | 2013-06-12 | 福建升腾资讯有限公司 | RDP-based method for magnification display of cloud desktop |
| CN104317390A (en) * | 2014-09-24 | 2015-01-28 | 北京云巢动脉科技有限公司 | Method and system for replacing mouse operation by multiple gestures based on virtual machine of mobile terminal |
| WO2017112714A1 (en) * | 2015-12-20 | 2017-06-29 | Michael Farr | Combination computer keyboard and computer pointing device |
| CN106528695A (en) * | 2016-11-02 | 2017-03-22 | 上海幻电信息科技有限公司 | Method for showing video thumbnail through mouse dragging |
| CN106713494A (en) * | 2017-01-23 | 2017-05-24 | 上海上讯信息技术股份有限公司 | Intelligent auditing method and device |
| CN110609628A (en) * | 2018-05-28 | 2019-12-24 | 敦泰电子有限公司 | Mouse control method and mouse |
| CN110489042A (en) * | 2019-07-17 | 2019-11-22 | 视联动力信息技术股份有限公司 | A kind of networked based on view simulates the method and system of dragging |
Non-Patent Citations (2)
| Title |
|---|
| 周香凝: "基于PB Data Window的数据拖动", 《微计算机应用》 * |
| 孟祥飞, 北京理工大学出版社 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10701030B2 (en) | Real-time monitoring of web page code | |
| US10511496B2 (en) | Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems | |
| US10284441B2 (en) | Data delivery | |
| US10148675B1 (en) | Block-level forensics for distributed computing systems | |
| US10304084B2 (en) | Real-time monitoring of ads inserted in real-time into a web page | |
| US10447560B2 (en) | Data leakage protection in cloud applications | |
| US9923977B2 (en) | Transferring cookie data to another domain | |
| CN109068153B (en) | Video playing method and device and computer readable storage medium | |
| CN111885007B (en) | Information tracing method, device, system and storage medium | |
| US9628515B2 (en) | Method, system and computer program product for enforcing access controls to features and subfeatures on uncontrolled web application | |
| CN111818035B (en) | Permission verification method and device based on API gateway | |
| JP2018533803A (en) | IP address acquisition method and apparatus | |
| US11665187B1 (en) | Time bounded lossy counters for network data | |
| CN112671876B (en) | Method and equipment for page operation and maintenance | |
| US10956468B2 (en) | Cognitive template question system | |
| US10686834B1 (en) | Inert parameters for detection of malicious activity | |
| US9723017B1 (en) | Method, apparatus and computer program product for detecting risky communications | |
| CN110737835A (en) | browser anti-tracking method and device | |
| CN112131076A (en) | Method, equipment and system for acquiring mouse operation event information | |
| US20110282980A1 (en) | Dynamic protection of a resource during sudden surges in traffic | |
| US11388250B1 (en) | Reduction of data transmissions based on end-user content | |
| CN114756530A (en) | Client information processing method based on bastion machine | |
| CN111818038B (en) | Network data acquisition and identification method and device | |
| CN112395591A (en) | Encryption method and system | |
| CN110557465A (en) | method and device for acquiring IP address of user side |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201225 |
|
| RJ01 | Rejection of invention patent application after publication |