RU2534935C2 - System and method of adaptive control and monitoring of user actions based on user behaviour - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to systems of control and restriction of actions performed by a user on a PC. The method to adjust a parental control restriction rules base includes a stage of tracking of completed events in the operating system initiated by user actions on a PC. Further, in accordance with the method, context is generated, which includes actions performed by a user, and events initiated by completed actions. Also the generated context is analysed with the help of regulation rules. Besides, the action completed by the user is detected on the basis of the specified analysis, at the same time the detected action is a prohibited action for a user, but at the same time this action was not blocked with the help of rules of user restriction from the base of parental control restriction rules.

EFFECT: technical result is increased efficiency of monitoring over access to network resources.

13 cl, 5 dwg

Description

Technical field

The invention relates to systems for monitoring and restricting actions performed by a user on a personal computer, and more particularly, to systems for adaptive control settings and restricting user actions to be performed on a personal computer, depending on user behavior.

State of the art

Currently, for most users of personal computers (hereinafter referred to as PCs), the Internet has become an integral part of life. Using the Internet, users search for the necessary information, as well as exchange information with other users via social networks, various chat rooms, instant messaging systems (such as ICQ) and email. Also, using the Internet, users pay bills, make various purchases, play computer games, watch various videos, etc. In addition, the Internet contains a variety of information, primarily aimed at an adult user audience, in other words, not intended for children and adolescents. Such information is pornographic material that may appear on various sites, such as dating sites. Obviously, such information resources should be closed to children.

Moreover, every year more and more Internet visitors are children and adolescents who seek to learn and use its capabilities. The Internet allows them to learn, grow, and engage in virtual communication. At the same time, young Internet users are often not ready to adequately perceive found or received data, which may be of poor quality, unverified or dangerous and, therefore, can harm not only the computer, but also the users themselves. Therefore, there is a need for both the control of children and their protection in the Internet environment.

Currently, these tasks in one form or another are solved by various systems known as “parental control”. The main objectives of such systems are to protect children from threats associated with working on a PC and the Internet, as well as limiting their time on a PC. Parental control allows you to set flexible rules for using both Internet resources and programs installed on the user's PC. In addition, parental control can generate a report on the actions performed by the controlled user. This report is provided to the user-administrator (for example, the parent) in order to familiarize and further customize the rules for restricting access if necessary.

So, in the patent US 7809797 B2 describes a control system for children with social media accounts. This system is aimed at controlling, blocking, restricting work in networks while communicating with other users, for example, strangers. Another type of control is the time control of viewing the video. For example, the system described in US Pat. No. 7,739,707 B2 blocks video viewing when the threshold time is exceeded. There are also patent publications describing parental control when working with media files, for example, application US 20100235923 A1. In the application US 20110034242 A1 describes a parental control system for gaming applications, which restricts access to a particular gaming application or Internet resource of this application.

It can also be noted that in the modern world, children and adolescents are becoming more and more inventive when trying to get to a private resource or install and run an unknown application. Such attempts include the use of special applications and devices to obtain access rights to the necessary resources or the removal of the parental control application (s) to obtain general access rights. To solve this problem, more and more complex parental control systems are being created that allow you to control the actions of the child by monitoring the activities (processes) in the operating system and, if necessary, neutralize these actions.

So, in patent US 7046139 B2 describes a system that allows you to impose restrictions on the use of any device connected to the home network, or an application installed on the device. A feature of this system is a module for tracking user actions. If a user tries to perform one of the prohibited actions using an application, the system completely restricts the user's access to this application.

In the patent US 7600019 B2 describes a system containing a number of modules responsible for monitoring (control), report generation, storage of information about user actions and notification to the administrator. The system can also be configured for each user by an administrator who enters the necessary rules for restricting a user.

However, the above inventions have one drawback - a long reaction time to user actions (for example, a child), which are controlled by the presented systems, in the event that the user performs an abnormal action. The presented systems restrict access on the basis of an initially generated list of access restriction rules and provide information on the actions taken in the form of a report to the administrator. After that, the administrator decides on the regulation of the rules. Thus, if the controlled user bypasses the restriction rules, then the response time to an abnormal action can be long, because Depends on the reaction of the administrator. An abnormal action is understood to mean an action prohibited for the controlled user, but which was not blocked by user restriction rules. In other words, the administrator would block such an action, but for various reasons did not. Examples of such causes include:

1. the administrator forgot to do this;

2. the administrator has not thoroughly worked out the restriction rules;

3. The administrator does not know about the possibility of blocking the prohibited application or content.

Another problem is that the administrator must be competent in understanding the report received from the system, on the basis of which he will have to make appropriate changes to the rules for restricting access or form new rules.

Also, these inventions are not able to solve the problem of accounting for external data. In the case of complete automation of various training systems, external data can be provided, for example, from a school or other educational institutions or training organizations. An example of external data is information in the form of feedback from a school teacher or an assessment received by a user at a school. Based on the information received, user access rights can also be regulated in the direction of tightening or weakening.

These tasks can be solved by adaptively adjusting the rules for restricting access to PC and Internet resources, depending on the identified abnormal actions of the child.

Thus, you need to create a solution that will allow you to automatically configure user restriction rules by analyzing his behavior on a PC or network. The system of adaptive management and control of user actions based on user behavior, which will be described later, allows us to solve the tasks.

SUMMARY OF THE INVENTION

The present invention is intended to adaptively configure access rights to PC and Internet resources for each user in order to limit the user from inappropriate content and PC usage time.

The technical result of this invention is to increase the effectiveness of parental control by setting up a rule base containing user restriction rules based on the identified abnormal user actions.

This result is achieved through the use of a method for setting up a database of parental control restriction rules, which contains the steps in which: they monitor events that have occurred in the operating system, initiated by user actions on a personal computer; form a context containing actions performed by the user and events initiated by the committed actions; analyze the formed context using regulatory rules; identify the action performed by the user on the basis of the specified analysis, while the detected action is a prohibited action for the user, but this action was not blocked using user restriction rules from the mentioned rule base; configure the parental control restriction rule base, depending on the detected action.

In one embodiment, as a setting for said rule base, is to adjust the restriction rules contained in said rule base, or to create a new restriction rule that blocks the identified action.

In yet another embodiment, a regulated or new rule is assigned the status of a temporary rule.

In another embodiment, statistics on the operation of temporary restriction rules are collected.

In one implementation variant, the time rules are adjusted based on the collected statistics.

In yet another embodiment, an adjustment is made in the event of a false positive.

In another embodiment, the identified action is an action aimed at educating the user or illustrating the lack of launch of entertainment applications.

In one implementation variant, the regulation rules contain signs of identified actions and a decision on the type of perfect action.

In another embodiment, controls for and blocking user behavior are part of parental controls.

A system for setting up a database of rules for restricting user actions, which includes: a monitoring tool designed to collect information about events that have occurred in the operating system, initiated by user actions, and transmit the information to the analysis tool; analysis tool designed to form a context based on the processing of information received from the monitoring tool and information provided from external means of monitoring user actions, and provides the generated context to the regulatory tool; a base of regulatory rules designed to store regulatory rules and provide them to a regulatory tool; a regulatory tool designed to analyze the provided context, on the basis of which it reveals at least one user action that is prohibited, but not a single restriction rule from the restriction rule base has worked, settings of the restriction rule base based on the detected action, where setting the restriction rule base is the adjustment of restriction rules from the restriction rule base to block the detected action, creating a new restriction rule that will be blocked revealed action.

In one embodiment, the system contains a means of analyzing the results of the rules, which is designed to collect statistics on the adjusted and new restriction rules from the database of restriction rules, analyze the statistics collected, identify false positives based on the analysis and inform the regulatory tool about the false positive.

In another embodiment, at least the means of controlling and blocking the parental control system are external controls for user actions.

In another embodiment, regulation rules are rules that contain criteria for determining the type of actions performed, a decision on the type of action, and a restriction rule template with which you can create a restriction rule for a specific type of action.

In one embodiment, an action aimed at least to educate a user is identified as an action detected by means of regulation.

Brief description of the attached drawings

The claimed invention is illustrated by the following drawings, in which:

Figure 1 illustrates an example of a parental control system for which the invention is implemented.

Figure 2 illustrates an example implementation of a system for adaptively setting restriction rules based on an analysis of user behavior.

Figure 3 illustrates an adaptive tuning algorithm for a parental control rule base containing user restriction rules based on an analysis of user behavior.

Figure 4 shows a diagram of the algorithm for analyzing the results of the rules in the adaptive configuration of restriction rules based on the analysis of user behavior.

5 shows an example of a general purpose computer system on which the invention may be implemented.

Description of implementation options

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

The system of adaptive management and control of user actions described below based on user behavior (hereinafter referred to as the adaptation system) is part of the parental control system.

All modern inventions related to parental control provide a whole range of components for controlling actions performed on a computer by a user (usually a child) or events that occur as a result of these actions, and, if necessary, blocking these actions and events.

Figure 1 presents an example of a parental control system (hereinafter - the system) 130, for which the present invention can be implemented.

System 130 controls all actions 110 performed by user 100 on PC 120. User 100 can be any user whose actions need to be controlled or who do not have administrator access to system 130. The most common actions performed by a user (eg, a child) 100, are:

- actions performed while working on the Internet (for example, browsing the web or chatting),

- launching applications (for example, launching a computer game),

- actions performed while working with data (for example, reading, writing, editing files), viewing video or music content.

To monitor the actions performed by the user 100, the system 130 contains a set of modules 140, which are responsible for various types of control. One module is responsible for regularly creating and saving screenshots for subsequent submission to the administrator (for example, the parent). Another module controls conversations (correspondence) that are conducted using instant messaging clients, for example, by listening to ports, analyzing protocols such as MSNP, AIM / ICQ, and XMP (Jabber), etc. Another module is responsible for monitoring sites that is visited or can be visited by user 100, for example, by monitoring the HTTP and HTTPS protocols. Another module controls the appearance of unwanted information on 100 sites visited by the user, for example, reveals the word “erotica” and blocks the site if the word is included in the content blocking rule. The control module for running applications can limit the launch of applications, for example, by the name of the application or the hash of the executable file. The system 130 also contains a number of modules that detect and monitor various events (activities) occurring on a PC, for example, printing files, writing files to optical media, opening web pages, etc. An example of modules is the various performance counters that are contained in the operating system.

During the control of actions, the above modules, as a rule, work proactively, preventing the child 100 from performing prohibited actions at computer 120 (for example, visiting a forbidden site or launching a forbidden application), because have functional blocking actions. The action is blocked if the restriction rule responsible for blocking the detected prohibited action is triggered. All restriction rules are stored in the parental control rule database (hereinafter - RC) 150, which is filled with the help of a user - administrator. The administrator can create restriction rules both independently and use various databases. An example of such a database is a database containing a list of prohibited or permitted sites. Another example is a database that contains rules for allowing or restricting user actions while working on a PC or on the Internet (computer network). Such a database can be created with the help of a software company. During the operation of the system 130, the RK 150 rule base provides the entire contained list of restriction rules to modules 140.

It is worth noting that during operation, the system 130 generates a report - a notification of all committed actions and events that occurred on the basis of the committed actions, as well as attempts to violate the restriction rules from the RK 150 rule base. As a result, the administrator is always aware of what he does or another user 100 at the computer 120, and can always respond to the committed actions 110, namely to adjust an existing rule or create a new restriction rule.

The system 130 for automating the process of responding to actions committed by the user 100 includes an adaptation system 200 that configures restriction rules based on an analysis of the behavior of the user 100. The system is shown in FIG. 2. Adaptation system 200 is designed to analyze the behavior of user 100 in order to identify abnormal or prohibited actions that were not detected using the restriction rules contained in the rule base of RK 150, and then configure the rule base of RK 150. The rule base of RK 150 is configured restrictions contained in the specified database, or the creation of new restriction rules based on the identified actions. During operation, adaptation system 200 interacts with control modules 140 to obtain information about all actions performed by user 100 on PC 120 and events in the operating system (hereinafter referred to as OS) that occurred during user 100’s operation, and also has access to the database rules of RK 150, containing rules restricting user actions 100.

Figure 2 presents a system for adaptive tuning of restriction rules based on analysis of user behavior (hereinafter referred to as the adaptation system). In one embodiment, the adaptation system 200 comprises monitoring means 210, analysis tools 220, regulatory tools 230, and a regulatory framework 240.

The monitoring tool 210 is designed to collect information about all the events (activities) that occurred in the OS during the operation of the user 100 on the PC 120 (i.e., events initiated by the actions of the user 100). After that, the collected information is provided by the monitoring tool 210 to the analysis tool 220.

The analysis tool 220 is intended to form a context based on the processing of information received from the modules 140 and the monitoring tool 210. The information received from the modules 140 contains information about all the actions performed by the user 100 on the PC 120, and about all the restriction rules from the rule base of the Republic of Kazakhstan 150 that worked (i.e. blocked user actions 100). The information received from the monitoring tool 210 contains information about all events (activities) that occurred in the OS during and after the execution of the indicated actions by the user 100 (i.e., the events were initiated by the actions of the user 100). Examples of committed actions and events that have occurred are: increased load on the central processing unit (CPU), increased use of physical memory, increased load on the graphics processor (GPU), the presence of a running full-screen application, the exchange of network packets, launching the application, downloading a file from the network, downloading Web pages, the use of input devices (e.g., mice), audio output, file activity, determination of the loading of certain content (HTML, Hash, etc.), etc. Information processing consists in determining the relationship between the committed actions of the user 100 and the events that occurred in the OS. The connection between the user’s action and the event that has occurred can be determined within a certain period of time. For example, if user 100 has launched an application - a game, then analysis tool 220 will receive information from modules 140 about this perfect action of user 100, as well as information from monitoring tool 210 about ongoing activities, such as file activity, increasing load on the CPU and GPU. Since within a short period of time a user’s action was recorded (for example, double-clicking on the file icon) and the subsequent events described above, the analysis tool 220 will determine the relationship between them, i.e. events occurred from the specified action. Another way to determine the relationship between actions and events can be to determine the relationship using the information provided by various performance counters. Performance counters provide information on various resource usage metrics in the OS. The analysis tool 220, based on the analysis of the received information, forms the context in the form of a list, which provides the control tool 230. It should be noted that the context will be formed and provided as new data (events and / or actions) arrive. Depending on the implementation, the context may also contain information about the user’s actions with different levels of detail, information about events related to the action, information about the duration of the events (for example, CPU load), additional information about the events. Examples of additional information can be: information about the file from which the process was launched, the execution of which loads the CPU and GPU; information about the sites visited and about the content on these sites (for example, website addresses, contacts on social networks, etc.); Information about connected devices and actions performed with them.

The regulatory tool 230 is intended to configure the RK 150 rule base. In the framework of the submitted application, the setting of the RK 150 rule base is understood as the adjustment of the restriction rules contained in it or the creation of new restriction rules with their subsequent addition to the RK 150 rule base. The regulatory tool 230 analyzes the provided context in order to identify abnormal actions of user 100. An abnormal action is an action that is prohibited for the controlled user (eg, child) 100, but was not о is blocked using the restriction rules contained in the RK 150 rule base (in other words, there was a bypass of parental control protection). Examples of abnormal actions are the following types of actions:

1. Actions aimed at gaining control over the operating system, as These actions are usually possible only if you have administrator rights. Examples of such actions are:

- an attempt to run or install software (hereinafter - software), which belongs to the category of system programs;

- an attempt to change the OS boot process or make changes to the BIOS;

- Creation of new partitions on the disk;

- driver installation;

- An attempt to remove the parental control application, if it is a separate program, or change its settings.

- An attempt to add a new user to the system or change an existing one;

- An attempt to boot the operating system in safe mode.

2. Actions aimed at working with software that is unknown, ie parental control 130 could not attribute it to any software category. In the absence of a ban on launching unknown software, user 100 will be able to access the Internet or play a computer game. An example of such actions is an attempt to run modified or special programs, for example, games or browsers.

3. Actions identified by indirect signs or their combination. Examples of indirect signs of launching a game application are: access to game websites, access to game files, creation of synchronization objects unique to the game, tracking the long-term operation of one of the programs in full-screen mode, high load of resources, such as a central processing unit (CPU) or graphic processor (GPU).

4. Actions performed on the Internet. Examples of such actions are:

- actions performed on unknown sites, for example, entering information into various input fields (chatting or using IM applications);

- actions aimed at filling out questionnaires, registration on an unknown site with the input of personal / confidential data, for example, entering passport data;

- periodic requests to an unknown / banned site;

- work on the Internet through proxy servers or using software to ensure anonymity (for example. Tor). The analysis of the context is carried out using regulation rules from the base of regulation rules 240. Regulation rules contain criteria for determining the type of action taken, a decision on the type of action and a restriction rule template by which a restriction rule can be created for a specific type of action. For example, a regulatory rule may contain the conclusion that an unknown application (which was not categorized using the RK 150 rule base) should be categorized as “Games” if at least two of the following criteria (actions) are met:

- the application runs in full screen mode;

- application execution leads to high CPU and GPU load;

- there is a certain work profile with the input tool (for example, using the keys W, S, A, D, space, E, Ctrl);

- certain API applications are used, for example Direct 3D, OpenGL.

Here are examples of other types (categories) of applications:

Browsers:

- keyboard input,

- the presence of several windows,

- use of flash player,

- use of a script interpreter (e.g. Javascript),

- network activity (downloading data over the network) "Video Players":

- frequent access to the disk (for reading), while reading large files may occur,

- the application runs in full screen mode,

- lack of input for a long period,

- prohibition of displaying a screen saver (screensaver).

Thus, the regulatory tool 230 compares the resulting context with the regulatory rules. In the event that any regulation rule worked, and no restriction rule from the RK 150 rule base responded to the detected action, then this action is a potentially anomalous action. In such a situation, the regulatory tool 230 determines the presence of any restriction rule in the base of the rules of RK 150, which will correspond to the template from the worked regulation rule. If the restriction rule from the rule base of RK 150 has not been identified, then the potential anomalous action is a permitted action and is skipped. The control means 230 returns to the analysis provided by the context analysis tool 220. If the restriction rule from the RK 150 rule base is identified, then the potential anomalous action becomes an abnormal action, because the detected restriction rule did not work. In this case, the regulatory tool 230 decides to configure the RK 150 rule base in accordance with the anomalous action. As a solution, you can either adjust the existing restriction rules in the RK 150 rule base, or create a new restriction rule and add it to the RK 150 rule base. The decision to further configure the RK 150 rule base depends on the type of anomalous action detected and the restriction rule, which did not work.

It is worth noting that the configuration of the RK 150 rule base based on the analysis of user behavior can be carried out both directly during the operation of user 100 on PC 120, and upon completion of its work.

In the event that the restriction rule that was identified in the RK 150 rule base is regulated, the regulatory tool 230 adjusts the rule so that this rule works the next time the specified anomalous action is detected. For example, a sign of a detected anomaly can be introduced into a rule so that upon the subsequent detection of this sign, the rule works and blocks the corresponding action. Consider examples of such a setting:

Example 1

The RK 150 rule base contains a rule that prohibits the launch of all types of browsers until 7 pm, i.e. the rule will limit the operation of all browsers known to him. During user 100’s operation on PC 120, a control rule worked, which detected a set of abnormal actions (abnormal behavior) indicating operation in an unknown browser. The set of abnormal actions was determined using the following criteria (actions and events): an unknown application was launched that increased network activity; network packet exchange has increased significantly; requests for information resources were identified at various URLs, which, for example, contained GET or POST requests. Therefore, the control means 230 must decide to adjust the restriction rule responsible for the restriction based on the detected abnormal action. In this case, the adjustment will consist in adding the sign of detecting a new browser (for example, the hash of the executable file of the browser) to the corresponding restriction rule.

Example 2

By analogy with Example 1, with the difference that in this case the regulation rule determined operation in an unknown browser by detecting HTTP traffic (for example, GET and / or POST requests) when analyzing the network diagram. It also determined the path (for example, the URL) from where an unknown browser was downloaded.

Example 3

The RK 150 rule base contains a rule that prohibits access to certain sites (i.e., the rule provides an exhaustive list of such sites), while these sites can be assigned to the same category (for example, sites with erotic content). In the event that a visit to a site by user 100 is determined and a site category is defined as a category of sites with erotic content, then the regulatory tool 230 may add this site to the list of sites blocked by an already defined rule.

In the event that the regulatory tool 230 has decided to create a new rule, the new rule is formed on the basis of the detected anomalous action and using the restriction rule that did not work (i.e., the rule that should have been responsible for blocking the detected anomalous action). This decision can be made when the logic of the existing restriction rule does not allow covering all possible options for blocking the corresponding actions of user 100 (for example, if the existing rule from the database of RK 150 has to be updated regularly, i.e. it is constantly bypass). After the formation of a new restriction rule, which contains a more stringent restriction compared to the failed restriction rule, the regulatory tool 230 adds it to the RK 150 rule base. Examples of cases where the regulatory tool 230 can make such a decision are:

Example 1

RK 150 rule base contains a rule prohibiting user 100 from playing online games. In this case, the regulation rule worked, which detected an abnormal action indicating an unknown online game that was launched. This abnormal action was identified on the basis of the following events: there is a strong load on the graphic processor (GPU), a full-screen application is launched, and a large exchange of network packets is performed. Also, the category of the application cannot be determined. Therefore, the control means 230 creates a more stringent restriction rule to limit this abnormal action, for example, a rule prohibiting the launch of applications whose processes will heavily load the GPU, for example, more than 70%.

Example 2

RK 150 rule base contains a restriction rule prohibiting the launch of any web browsers. At the same time, the principle of operation of this rule is based on the ban on launching all applications whose hash sums are in the database containing the hash sums of executable files. However, this restriction rule works inefficiently, because regulatory tool 230 constantly detects new versions of web browsers. Then, the regulatory tool 230 decides to create a new restriction rule to block applications that send requests to URLs.

Example 3

By analogy with example 2. In the event that the regulatory tool 230 also determines that the existing rule from the RK 150 rule base is constantly being modified, for example, information about new browsers is constantly being added, the launch of which should be prohibited until 7 pm, a decision is made to create more stringent rule that will stop any further use of browsers. For this purpose, a rule is added to the RK 150 rule base that will block any network activity associated with the transfer of data on the ports used by browsers - usually these are ports 80 or 8080. Thus, despite the fact that new browsers will be launched using them , you will not be able to send standard http requests.

Example 4

The RK 150 rule base contains a rule that prohibits access to certain sites (i.e., the rule provides an exhaustive list of such sites), while these sites can be assigned to the same category (for example, sites with erotic content). The definition of a category can be based on a number of rules for the analysis of data downloaded on a web page: for example, the presence of a large number of images, flash videos and a small amount of text may indicate a site containing erotic or pornographic materials or an entertainment site, and the presence of a large number of updated text with frequent input from the user may indicate chat, etc. In addition, categorization based on data (for example, textual) can be based on fuzzy logic methods, the use of regular expressions and other ways to get a probable conclusion about the category of a site.

In the event that the visit to the site by the user 100 is periodically determined and the site category is defined as the category of sites with erotic content, the regulatory tool 230 can change the existing rule for blocking content (sites), making the rule more strict - prohibiting the downloading of all sites from the category of sites with content erotica. This example illustrates well the addition of an unfinished parental control configuration.

Example 5

The RK 150 rule base has a restriction rule prohibiting communication with a number of contacts in a social network (chat, IM application). Moreover, the principle of this rule is based on the use of both white (whitelist) and black lists (blacklist) to enable / disable communication with the contact. Such lists can be replenished on the basis of a number of low-level rules that take into account the analysis of the text from an unknown contact, his age and other data, communication time, etc.

In one embodiment, regulatory system 230 creates new temporary rules. Temporary rules are intended to limit the actions of the user 100, which are aimed at performing prohibited actions at a certain frequency. Examples of the implementation of this option are:

Example 1

The regulatory tool 230 determines with a certain frequency the actions aimed at launching the prohibited application and attempts to bypass the restriction rule from the rule base of RK 150, which is responsible for blocking the specified application. In this case, the regulatory tool 230 decides to create a new temporary rule, which, for example, will block all actions of the controlled user 100 until the administrator user cancels this rule. Therefore, a temporary rule will be created, which will then be added to the RK 150 rule base with a temporary mark. After that, a notification will be created for the administrator user to add a temporary rule to the RK rule base 150.

Example 2

For the first time, the regulator 230 detected an abnormal action aimed at launching an application, such as a media player, although there is a rule restricting the opening of any media file. Also, the regulatory tool 230 determined that the rule responsible for this restriction does not contain a sign of a running media player. Therefore, the regulatory tool 230 decides to adjust the restriction rule responsible for prohibiting this action. The adjustment will be made by adding the hash of the unknown player to the restriction rule. Further, when the user 100 was working on PC 120, the tool 230 detected yet another anomalous action aimed at starting another unknown media player. In this case, the tool 230 decides to create a restriction rule with a more restrictive restriction, which will be added to the RK 150 rule base. If, subsequently, the tool 230 detects yet another anomalous action aimed at launching the media file player, it will decide to create a temporary rule , which will significantly limit the actions of user 100 on PC 120, for example, restrict work on PC 120 to the ability to access only a number of educational sites using only one browser.

In one embodiment, the created new restriction rule at the initial stage may have the status of a temporary rule.

Another implementation option involves creating a user profile 100 based on data from the monitoring tool 210. The profile can contain information about the type of applications used, computer usage time, downloaded / viewed media data, visited web pages, etc. Based on these data, the regulatory tool 230 can generate new restriction rules, which will be added to the RK 150 rule base. An example of such a rule is the notification of parents / system administrator, if the user 100 previously used the computer from 7 to 9 pm and started only a certain type of application (for example, browsers), changed the time of use and began to use other applications (for example, games).

In a particular embodiment, the means of regulation 230, when analyzing the provided content by means 220, detects permitted or positive actions committed by the user 100. Positive actions are actions aimed at educating the user (child) 100 or indicating the absence of launching entertainment applications. For example, user 100 did not play computer games for several days or did not exceed the limited time for using the Internet. Another example of positive actions is the use of certain programs that the administrator has identified as useful for the user 100 (for example, an application that teaches a foreign language). Further, the regulatory tool 230 may decide to reward the user 100. Such a reward may be the abolition of certain restriction rules or the adjustment of restriction rules in order to increase the access rights of the user (child) 100, for example, increase the time for using gaming applications.

In another particular case of implementation, the regulatory tool 230 analyzes the information 280 received from external sources via the Internet. Information 280 contains information about the actions / behavior of user 100 outside of work on PC 120. An example of such information 280 is information in the form of feedback from the school teacher, which describes the behavior of the child and / or his assessment. It is assumed that this information can be arranged as a separate message (for example, an e-mail), or be transferred to parental control 130 using a special data transfer interface (i.e., parental control 130 can have an implemented interface with a list of API functions to receive or provide data). Actions can be either positive (for example, a good grade is obtained) or negative (for example, the teacher reported bad behavior in the classroom). Depending on the actions performed outside of work on PC 120, the control tool 230 will make decisions on setting restriction rules in order to tighten or weaken them.

Also in a particular embodiment, the adaptation system 200 contains a means of analyzing the results of the rules 260, which collects statistics on the performance of 150 adjusted, new or temporary restriction rules added to the RK database during the trial period. After collecting statistics, tool 260 conducts an analysis to identify false positives. In the event that no false positives were detected for a particular rule, this rule becomes a permanent rule. In the event that an incorrect operation of the restriction rules has been detected, the control means 230 carries out additional adjustment of the corresponding restriction rule. The trial period is regulated by the user - administrator or is set by default. Another objective of the tool 260 may be to inform the regulatory tool 230 about the triggered restriction rules from the RK 150 rule base.

In the particular case of implementation, the tool 260 may request statistics on the analyzed rules in the cloud service. The cloud service may be the Kaspersky Security Network service. The cloud service contains statistical information about restriction rules, which is added by various users and software development companies.

In yet another particular embodiment, the adaptation system 200 may be associated with similar systems on other user devices. Communication can be carried out both over the Internet and through wireless technologies, such as Bluetooth connections, Wi-Fi connections, NFC connections. In this case, the rules of the rule base of RK 150 apply to all devices of the user 100. Therefore, if some actions are limited on one device of the user, similar actions will be limited on the other devices. For example, if the restriction rule on one device (for example, on a PC) blocked the use of social networks, because If the time of daily use was exceeded, the corresponding blocking will occur on other devices (for example, on a smartphone).

Figure 3 shows the adaptive tuning algorithm of the parental control rule base containing user restriction rules based on an analysis of user behavior. At step 310, the adaptation system 200 collects information about all actions performed by the controlled user 100 and events that occurred in the OS during the operation of the controlled user 100, namely, events initiated by the actions of the user 100. Information about the completed actions is received by the adaptation system 200 from modules 140, and information about the events that form the monitoring tool 210. Next, all information is transmitted to the analysis tool 220. At step 320, the analysis tool 220 analyzes the received information and forms ruet context in a list, which contains all the committed actions of the user 100 and all the events in the OS related to the fulfillment of actions. As the context builds, analyzer 220 will provide it to regulator 230 in a list. At 330, the regulatory tool 230 analyzes the provided context using the regulatory rules from the base of the regulatory rules 240. The regulatory rules contain criteria for determining the type of action taken, a decision on the type of action, and a restriction rule template with which to create a restriction rule for a specific type of action . After determining the type of the committed action, the regulatory tool 230 checks the information about the triggered restriction rules from the RK 150 rule base. If this action was blocked by one of the restriction rules from the RK 150 rule base, the action is skipped. This indicates that parental control rules are working efficiently. Otherwise, if none of the restriction rules has worked, at step 340, the regulator 230 checks in the rule base of RK 150 the presence of the restriction rule, which should block the detected action.

Consider an example of context analysis using a regulatory rule and then identifying the corresponding restriction rule. RK 150 rule base contains a restriction rule, which consists in blocking the launch of applications from the "Games" category after 8 pm. The regulatory tool 230 identifies the following events and actions in the analyzed context: the application is launched (it was not possible to determine the category), high CPU and GPU resources are used, the Direct3D API is used, the application runs in full screen mode. Further, the regulatory tool 230 from the base of the regulatory rules 240 finds the following regulatory rule: If the context = <the context described above>, then the application is included in the "Games" category.

A rule may also have additional conditions, for example:

- If such an abnormal action occurs for the first time (i.e., the first time the RC missed the game), then the application is added to the "Games" category;

- If such an anomalous action occurs more than once, then a temporary rule is created to block the launch of all applications except a number of allowed (if any) and a report is sent to the administrator about the triggering of this condition;

- If the user tries repeatedly (for example, more than five times) to launch a prohibited application, then the above temporary rule is translated into a permanent rule and a report is sent to the administrator about the triggering of this condition.

In the event that the restriction rule in the rule base of RK 150 was not found, the identified action is skipped, because the administrator has not imposed a restriction on the corresponding action, and the control means 230 returns to step 320 for the following context. In the event that a restriction rule was found, the detected action is considered an abnormal action, because the restriction rule did not block the detected action. An abnormal action is an action that is prohibited for the controlled user, but has not been blocked by user restriction rules. At step 350, the type of tuning of the rule base of RK 150 is determined. The type of tuning is determined in accordance with the assessment of the possibility of adjusting the non-triggered restriction rule. For example, an assessment indicates that the restriction rule can be adjusted by adding a sign of the detected action to it, which will subsequently identify this action and, accordingly, block it. If the evaluation of the adjustment of the restriction rule shows that this restriction rule cannot be adjusted, a new restriction rule will be created. An example of such an assessment is the following implementation option: parental control contains, for example, at least two signs of the assessment of user control: “strong restriction” and “weak restriction”. The type of restriction is imposed on the user in accordance with the restriction rules originally introduced by the administrator. If the restriction rules block all actions that do not correspond to the list of allowed actions, then this is a “strong restriction”. If restriction rules block only sites containing pornographic materials, and other actions on the computer are allowed, then this is a “weak restriction”. Thus, the decision to adjust the restriction rules will be made on the basis of a previously defined type of restriction. So, if the type of restriction is defined as a “strong restriction”, then in the event of an abnormal action, a new stricter rule will be created. If the type of restriction is defined as “weak restriction”, then only the restriction rule will be adjusted, which is responsible for limiting the detected anomalous action.

As described in the example, the new restriction rule will have more stringent restriction (blocking actions) parameters that will cover the detected anomalous action. Thus, the setting of the RK 150 rule base will be done by adjusting the restriction rules contained in it or by creating a new restriction rule that will allow restricting the anomalous action, with its subsequent addition to the RK 150 rule base.

It is worth noting that the configuration of the RK 150 rule base based on the analysis of user behavior can be carried out both directly during the operation of user 100 on PC 120, and upon completion of its work.

In a particular embodiment, new restriction rules may be formed as temporary restriction rules. In this case, the regulatory tool 230 will also notify the administrator of the existence of the created temporary restriction rule. The administrator, in turn, will be able to verify the correctness of the imposed restriction and, if the restriction rule is created correctly, will mark it as the main (normal) restriction rule.

In another particular embodiment, the analysis of the correctness of the edited, new or temporary restriction rule is performed using the analysis tool for the results of the rules 260. In other words, the restriction rules will be checked for false positives. This implementation case is considered in FIG. 4.

It is worth noting that in one embodiment, at step 340, when analyzing the provided context as anomalous behavior, the regulatory tool 230 will also determine the positive actions performed by the user 100. Positive actions are actions aimed at educating the user (child) 100 or indicating lack of launching entertainment applications (for example, user 100 did not play computer games for several days). In the event that the regulatory tool 230 determines a positive action, the rule base of rules of RK 150 will also be set up, but in order to increase the access rights of user 100. Thus, the rule base of RK 150 will be changed so that the restriction rules contained in it are relaxed ( i.e. the number of blocking criteria will decrease) or deleted. For example, setting up the RK 150 rule base will lead to an increase in the allowable time for PC 120 to be used by a user (child) 100 or to permit user 100 to use web resources that were previously blocked.

In another embodiment, the example of the system, shown in Figure 3, you can also pre-set the rules in the rule base of RK 150, based on the behavior model of some "ideal" user 100. A similar model can be based on statistics of averaged actions of all known users 100, which will allow creating such rules of the Republic of Kazakhstan that will be suitable with different degrees of probability for all future users 100.

Figure 4 shows a diagram of the algorithm for analyzing the results of the rules 260 in the system of adaptive tuning of restriction rules based on the analysis of user behavior. At step 410, a tool for analyzing the results of the work of rules 260 collects statistics on the results of the work of the restriction rules that were added to the rule base of RK 150. The added rules are adjusted, new or temporary rules. Information about the added rules can be collected both by monitoring the response of the corresponding rules to restrictions on the actions performed by the user 100 on the PC 120, and by requesting to the cloud service. After collecting statistics at step 420, an analysis of the collected information is carried out, on the basis of which an assessment of the operation of the added rule is given. The assessment is to determine the false positive, i.e. cases when the added rule blocks the permitted actions of the user 100. The determination of a false positive can occur by feedback of the user 100 with the administrator. In this case, the administrator may mark this rule as incorrect. Another way to detect a false positive is to compare blocked applications with lists of legitimate applications using hash sums. At step 430, an analysis tool for rules 260 determines whether an adjustment to the added rule is necessary. When? if it was determined that the added rule needs to be adjusted, then at step 440 the criteria of the restriction rule are determined that need to be corrected or deleted. These criteria are transferred to the control means 230. At step 450, the control means 230 adjusts the corresponding restriction rule according to the information received, and then replaces the corresponding rule from the RK 150 rule base with the adjusted rule. In the event that it was determined that the added rule does not need to be adjusted, at step 460 the status “adjusted”, “temporary” or “new” is removed from the added rule, this rule becomes a permanent rule, and the means of analyzing the results of rules 260 continues to work.

5 is an example of a general-purpose computer system (it can be either a personal computer or a server) 20, comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus Noah architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc.

Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 through an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 5. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are only examples describing the main inventive concept of the author, which do not limit the scope of the present invention to those examples that were mentioned earlier. The above information is primarily intended to solve a narrow problem. Over time and with the development of technological progress, such a task becomes more complicated or evolves. New tools are emerging that are able to fulfill new requirements. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (13)

1. A method for setting up a parental control restriction rule base, comprising the steps of:
a) monitor the events that occurred in the operating system, initiated by user actions on a personal computer;
b) form a context containing the actions committed by the user and the events initiated by the committed actions;
c) analyze the formed context using regulatory rules;
d) identify the action performed by the user on the basis of the specified analysis, while the detected action is a prohibited action for the user, but at the same time, this action was not blocked using the user restriction rules from the database of parental control restriction rules;
e) set up the rule base for parental control restrictions, depending on the detected action,
- where, as the setting of the parental control restriction rule base, at least, is to adjust the restriction rules contained in the said parental control restriction rule base, or create a new restriction rule that blocks the identified action. 2. The method of claim 1, wherein the adjusted or new rule is assigned the status of a temporary rule. 3. The method according to claim 2, in which statistics are collected on the operation of temporary restriction rules. 4. The method according to claim 3, in which the time rules are adjusted based on the collected statistics. 5. The method according to claim 4, in which the adjustment is carried out in the event of a false positive. 6. The method according to claim 1, in which the action identified in step g) is an action aimed at educating the user or illustrating the lack of launching entertainment applications. 7. The method according to claim 1, in which the regulatory rules contain the signs identified in step g) of the action and the decision on the type of perfect action. 8. The method according to claim 1, in which means of control and blocking user behavior are part of parental control. 9. A system for setting up a database of parental control restriction rules, which includes:
a) a monitoring tool designed to collect information about events that occurred in the operating system, initiated by the actions of the user, and transfers the above information to the analysis tool;
b) at least one external means of monitoring the user's actions, designed to collect information about all the actions performed by the user, and about all the restriction rules that worked on these actions, and transfers the information to the analysis tool;
c) an analysis tool designed to form a context based on the processing of information received from the monitoring tool and information provided by at least one external means of monitoring user actions, and provides the generated context to the regulatory tool,
where processing refers to the analysis of the information received in order to determine the relationship between the committed user actions and the events that occurred in the operating system,
where the context is at least information about user actions and events that have occurred associated with these actions;
d) a base of regulatory rules designed to store regulatory rules and provide them to a regulatory tool;
d) a means of regulation intended for:
- analysis of the provided context, on the basis of which at least one user action that is prohibited is detected, but at the same time not a single restriction rule from the database of parental control restriction rules has worked,
- settings of the parental control restriction rule base based on the detected action,
- where the configuration of the parental control restriction rule base is at least:
- adjustment of restriction rules from the database of parental control restriction rules to block the detected action,
- creating a new restriction rule that will block the detected action. 10. The system according to claim 9, which contains a means of analyzing the results of the rules, which is designed to collect statistics on regulated and new restriction rules from the database of parental control restriction rules, analyze collected statistics, identify false positives based on the analysis and inform the regulatory tool about false positive. 11. The system according to claim 9, in which at least the means of control and blocking the parental control system are external controls for user actions. 12. The system according to claim 9, in which the regulatory rules are the rules containing the criteria for determining the type of actions performed, the decision on the type of action and the template of restriction rules by which a restriction rule can be created for a certain type of action. 13. The system according to claim 9, in which, as identified by means of regulation of the action is an action aimed at least to educate the user.

Images