WO2020077890A1

WO2020077890A1 - System security method and apparatus, computer device, and storage medium

Info

Publication number: WO2020077890A1
Application number: PCT/CN2019/070374
Authority: WO
Inventors: 李其刚
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2018-10-15
Filing date: 2019-01-04
Publication date: 2020-04-23
Also published as: CN109325335A

Abstract

A system security method and apparatus, a computer device, and a storage medium. The method comprises the following steps: obtaining a screenshot of a display image in a display region (S1100); inputting the screenshot into a preset first neural network model and obtaining a first classification result of the screenshot output by the first neural network model (S1200); and comparing the first classification result with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, responding to a user instruction of the user (S1300). The classification result is user behavior information represented by the screenshot, i.e., a user is using the computer device to perform which operation. Therefore, whether the user uses a computer to perform a planning behavior operation instead of performing other operations can be determined by comparing whether the behavior planning information set when the user uses the computer is consistent with the classification result, thereby achieving a task of helping the user stop the improper use of the computer.

Description

System security method, device, computer equipment and storage medium

This application requires the priority of the Chinese patent application filed on October 15, 2018 in the Chinese Patent Office with the application number 201811198452.X and the invention titled "System Security Methods, Devices, Computer Equipment, and Storage Media." The reference is incorporated in this application.

Technical field

The embodiments of the present application relate to the field of network security, and particularly to a system security method, device, computer equipment, and storage medium.

Background technique

With the popularization of computer equipment in people's lives, the number of people using computers is rapidly expanding, and the youth population is the mainstream population of new computer users, and with the acceleration of the popularity of computers, the age of teenagers using computers is decreasing year by year. Due to the lack of self-control ability of the young people, the transition to online use of computers will cause young people to suffer from "Internet addiction", which in turn will make them lack interest in learning and other matters in life, which will adversely affect the growth of young people.

In the prior art, the method generally adopted to prevent young people from surfing the Internet is to check their identity information before surfing the Internet, and if they are confirmed to be young, they are prohibited from surfing the Internet.

However, the inventors created in this application found in research that computers, as one of the most important information tools in today's society, completely prohibiting the use of computers is detrimental to the growth of young people. It is helpful for young people to learn and grow by reasonably guiding users to use computers.

Summary of the invention

Embodiments of the present application provide a system security method, apparatus, computer equipment, and storage medium that can guide users to use computer equipment correctly.

In order to solve the above technical problems, a technical solution adopted by the embodiment created by the present application is: to provide a system security method, including the following steps: obtaining a screen shot of a display screen in a display area; and inputting the screen shot into a preset In the first neural network model, and obtain a first classification result of the screen shots output by the first neural network model, where the first classification result is user behavior information represented by the screen shots; the first The classification result is compared with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, it responds to a user instruction of the user.

To solve the above technical problems, embodiments of the present application also provide a system security device, including: an acquisition module for acquiring a screen shot of a display screen in a display area; and a processing module for inputting the screen shot into a preset first In a neural network model, and obtain the first classification result of the screen shots output by the first neural network model, wherein the first classification result is user behavior information represented by the screen shots; the execution module is used to The first classification result is compared with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, it responds to a user instruction of the user.

To solve the above technical problems, the embodiments of the present application further provide a computer device, including a memory and a processor, and the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, The processor executes the following steps of a system security method: obtaining a screen shot of a display screen in a display area; inputting the screen shot into a preset first neural network model, and obtaining an output of the first neural network model The first classification result of the screenshot of the screen, wherein the first classification result is the user behavior information represented by the screenshot; the first classification result is compared with the preset behavior planning information, when the first When a classification result is consistent with the behavior planning information, it responds to the user's user instruction.

To solve the above technical problems, embodiments of the present application also provide a non-volatile storage medium storing computer-readable instructions, which when executed by one or more processors, cause one or more processes The device performs the following steps of a system security method: obtaining a screen shot of the display screen in the display area; inputting the screen shot into the preset first neural network model, and obtaining the screen output by the first neural network model The first classification result of the screenshot, where the first classification result is the user behavior information represented by the screenshot; compare the first classification result with preset behavior planning information, when the first classification When the result is consistent with the behavior planning information, it responds to the user's user instruction.

The beneficial effect of the embodiment of the present application is that when the user uses the computer, the user is prompted to fill out the usage plan, and the usage plan includes the operation content performed by the user using the computer. When the user officially operates the computer, a screenshot of the content displayed on the computer screen is obtained, the screenshot is input into the preset first neural network model, and the classification result is obtained. Because the classification result is the user behavior information represented by the screenshot, that is, what kind of operation the user is using the computer device. By comparing whether the behavior planning information set by the user when using the computer is consistent with the classification result, it is possible to determine whether the user is using the computer to perform the behavior operation in the planning, rather than using the computer to perform other operations. When the user's computer is performing other operations, it is forbidden to respond to the user's operation instructions, forcing the user to operate the computer to respond as planned, to achieve the purpose of guiding the user to use the computer correctly, and to realize the task of helping the user to avoid improper use of the computer.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present application, the drawings required in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application For those skilled in the art, without paying any creative work, other drawings can also be obtained based on these drawings.

FIG. 1 is a schematic flowchart of a system security method in an embodiment of this application;

2 is a schematic diagram of a process of verifying user identity information according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of user biometric verification according to an embodiment of the present application;

4 is a schematic diagram of a process for limiting a user's usage time according to an embodiment of this application;

5 is a schematic diagram of a process of restricting online payment by users according to an embodiment of the present application;

6 is a schematic diagram of a process of verifying excess payment according to an embodiment of the application;

7 is a schematic flowchart of obtaining an associated terminal according to an embodiment of the present application;

8 is a block diagram of a basic structure of a system security device according to an embodiment of this application;

9 is a block diagram of a basic structure of a computer device according to an embodiment of the present application.

detailed description

In order to enable those skilled in the art to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application.

Some processes described in the specification and claims of the present application and the above drawings include multiple operations in a specific order, but it should be clearly understood that these operations may not be in the order in which they appear in this document Execution or parallel execution. The sequence numbers of operations such as 101 and 102 are only used to distinguish different operations. The sequence number itself does not represent any execution sequence. In addition, these processes may include more or fewer operations, and these operations may be performed sequentially or in parallel. It should be noted that the descriptions of "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order, nor limit "first" and "second". Are different types.

The technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work fall within the protection scope of the present application.

Those skilled in the art can understand that the term “terminal” and “terminal device” used here include not only devices with wireless signal receivers, but only devices with wireless signal receivers that do not have transmitting capabilities, but also devices that receive and transmit hardware. A device having a device capable of performing reception and transmission hardware of two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices with single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Services), which can combine voice and data Processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant), which can include radio frequency receivers, pagers, Internet / Intranet access, web browsers, notepads, calendars and / or GPS (Global Positioning System (Global Positioning System) receiver; conventional laptop and / or palmtop computer or other device that has and / or includes a conventional laptop and / or palmtop computer or other device of a radio frequency receiver. As used herein, "terminal" and "terminal equipment" may be portable, transportable, installed in a vehicle (aeronautical, maritime, and / or terrestrial), or suitable and / or configured to operate locally, and / or In a distributed form, it operates at any other location on the earth and / or space. The "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playback terminal, for example, may be a PDA, MID (Mobile Internet Device), and / or have music / video playback Functional mobile phones can also be smart TVs, set-top boxes and other devices.

Please refer to FIG. 1, which is a schematic diagram of the basic process of the system security method in this embodiment.

As shown in Figure 1, a system security method includes the following steps:

S1100. Acquire a screenshot of the display screen in the display area;

When using a computer device, the user obtains a screen shot of the current display screen of the computer device by sending a system screenshot instruction. But it is not limited to this. Depending on the specific application scenario, the capture of screenshots is not limited to this. In some optional embodiments, the computer device has an independent graphics card device, and the computer device only needs to read the graphics card device space when working You can get a screenshot of the screen.

In this embodiment, the screenshots are acquired at regular intervals. For example, the screenshots are acquired every 3 minutes, but it is not limited to this. The acquisition duration of the screenshots can be any set length of time. In some alternative embodiments, the screenshots can also be acquired in real time.

S1200. Input the screen shot into the preset first neural network model, and obtain a first classification result of the screen shot output by the first neural network model, where the first classification result is the screen User behavior information characterized by screenshots;

Input the captured screen shot into the preset first neural network model. Wherein, the first neural network model can be a convolutional neural network model (CNN), but the first neural network model can also be: deep neural network model (DNN), recurrent neural network model (RNN), or the above three networks Deformation model of the model.

In this embodiment, the first neural network model is pre-trained to convergence, and is used for feature extraction and classification of the screenshots, and the user behavior information represented by the screenshots. User behavior information includes using a computer (not limited to): playing games, listening to music, doing homework, browsing the web, etc. In some optional embodiments, the user behavior information can also be undesirable behaviors (not limited to) online gambling, watching unhealthy film and television works performed by users using computer equipment, or making transfer payments beyond their capabilities.

In this embodiment, the training process of the first neural network model is:

The training sample set of this embodiment is obtained through a web crawler or an existing image database. The training sample set includes different kinds of computer screenshots.

In this embodiment, during training, the neural network model uses several training sample sets (for example, 1 million), where each training sample set includes a screenshot of a computer device. Before training the screenshots, it is necessary to prejudge the user behavior represented by the images in each training sample set. The prejudgement can be performed manually. For example, if the content in the screenshot is a game screen, then the result of the calibration prejudgement is "Playing games" can obtain the pre-judgment results of all training sample sets in the above manner. And define the pre-judgment result as the classification judgment information of the screenshot.

The training sample set is sequentially input into the first neural network model, and the screen shots sequentially pass through the convolutional layer, the fully connected layer, and the classification layer of the first neural network model. The output result of the classification layer is the classification result of the screenshot of the excitation output of the first neural network model. In this embodiment, the classification result of the first neural network model is user behavior information determined by the model. The result of defining the excitation output is classified reference information.

The model classification reference information is the excitation data output by the first neural network model according to the input screen shot. Before the first neural network model is trained to converge, the classification reference information is a numerical value with a large discreteness. When the first neural network After the model has not been trained to converge, the classification reference information is relatively stable data.

The loss function of the first neural network model determines whether the classification reference information is consistent with the classification judgment information. The loss function is a detection function configured to detect the model classification reference information in the first neural network model and to determine whether the information is consistent with the classification classification expected by people. When the output result of the first neural network model is inconsistent with the expected result of the classification judgment information, the weights in the first neural network model need to be corrected by a reverse algorithm, so that the output result of the first neural network model and the classification judgment information The expected result is the same.

When the classification output output result of the first neural network model is inconsistent with the expected result of classification judgment information, the weights in the first neural network model need to be corrected, so that the output result of the first neural network model and the classification judgment information expectation The result is the same. During training, multiple training samples are used for training (for example, 1 million screenshots). After repeated training and correction, when the first neural network model outputs classification data and the classification reference information of each training sample, the correct rate is reached (not limited to ) 99.9%, the training is over. At this time, the training of the first neural network model ends, the first neural network model is trained to convergence, and the user behavior information represented by the screenshot can be accurately judged.

S1300. Compare the first classification result with preset behavior planning information, and respond to a user instruction of the user when the first classification result is consistent with the behavior planning information.

The first classification result (ie, user behavior information) output by the first neural network model trained to the convergence state is compared with the behavior planning information. When the comparison is consistent, the user is allowed to continue using the computer, and when the comparison is inconsistent, the execution of user instructions is prohibited.

The behavior planning information is that when the user uses the computer device to enter the operation interface, a plan for using the computer appears. The user needs to fill in the actual situation of using the computer in the plan according to his own needs. The format is XX moment-XX moment. "Homework writing", etc. will list the time and matters of using the computer. The computer planning book filled in by the user is defined as behavior planning information.

In some optional embodiments, the user's behavior planning information needs to be reviewed. For example, the length of time that the computer equipment is used for entertainment in the planning book should not exceed 1 hour, or the behavior planning information such as watching pornographic movies or Unhealthy information such as gambling.

When the first classification result is inconsistent with the behavior planning information, it indicates that the user ’s use of the computer device is different from the planned use behavior that the user filled in. At this time, the computer device stops responding to the user ’s operation instruction. In some optional embodiments, after the execution of the user instruction is prohibited, the display screen is switched to the screen characterized by the user's behavior planning information, or the application program characterized by the behavior planning information is started, and then, the execution of the user's new instruction is continued. In order to guide users to use computer equipment correctly.

The above-mentioned embodiment prompts the user to fill in the usage plan when the user uses the computer, and the usage plan includes the operation content performed by the user using the computer. When the user officially operates the computer, a screenshot of the content displayed on the computer screen is obtained, the screenshot is input into the preset first neural network model, and the classification result is obtained. Because the classification result is the user behavior information represented by the screenshot, that is, what kind of operation the user is using the computer device. By comparing whether the behavior planning information set by the user when using the computer is consistent with the classification result, it is possible to determine whether the user is using the computer to perform the behavior operation in the planning, rather than using the computer to perform other operations. When the user's computer is performing other operations, it is forbidden to respond to the user's operation instructions, forcing the user to operate the computer to respond as planned, to achieve the purpose of guiding the user to use the computer correctly, and to realize the task of helping the user to avoid improper computer use.

In some optional embodiments, in order to prevent teenagers who do not meet the age of going online to restrict access to the Internet, they are restricted from accessing the Internet by verifying their identity documents (identity card, household registration book or passport, etc.). but. Some young people use the identity information of others to surf the Internet repeatedly, but the behavior of young people using their identity to surf the Internet needs to be restricted. Please refer to FIG. 2, which is a schematic diagram of a process of verifying user identity information in this embodiment.

As shown in FIG. 2, before step S1100, the following steps are also included:

S1011: Collect the face image of the user;

When the user uses the computer, the power of the computer device is turned on. When the user enters the operating system interface, the user's identity needs to be verified. The first step of verification is to perform the user's authentication through the camera of the computer device or the camera of the peripheral device. Face image collection.

S1012. Input the face image and the preset ID image of the user into a preset second neural network model, and obtain a first judgment result output by the second neural network model, where The second neural network model is a neural network model trained to a convergence state for judging the similarity of images;

The collected face image is input into a second neural network model, and the second neural network model is a neural network model trained to a convergence state for judging image similarity. After the face image is input to the second neural network model, the second neural network model outputs the first judgment result. The first judgment result is the comparison result of the similarity of the face image and the pre-stored ID photo by the second neural network model, or the comparison result of the similarity of the registered avatar retained during the registration of the user image and the face image.

Wherein, the second neural network model can be a convolutional neural network model (CNN), but the second neural network model can also be: deep neural network model (DNN), recurrent neural network model (RNN) or the above three networks Deformation model of the model.

In this embodiment, the training process of the second neural network model is:

The training sample set of this embodiment is obtained through a web crawler or an existing image database. The training sample set includes different kinds of face images.

In this embodiment, the neural network model uses several training sample sets (for example, 1 million) when training, wherein each training sample set includes a face image data pair, including a face image, and the person A comparison image of face images for comparison, where the comparison image is also a face image, and in the same training sample set, the face image and the comparison image can be the same or different. Before training the screenshots, you need to predict the user behavior represented by the images in each training sample set. The pre-judgment can be performed manually. For example, the two pictures in the training sample set are the same person in different periods or spaces When the human face image is determined that the two images are the same, the prediction results of all training sample sets can be obtained in the above manner. And define the pre-judgment result as the classification judgment information of the screenshot.

The training sample set is sequentially input into the second neural network model, and the screen shots sequentially pass through the convolutional layer, the fully connected layer, and the classification layer of the second neural network model. The result of the classification layer output is the comparison classification result of the excitation output of the second neural network model. In this embodiment, the classification result of the second neural network model is user behavior information determined by the model. The result of defining the excitation output is classified reference information. The classification reference information is the comparison result of the feature vectors of the face image and the comparison image extracted by the second neural network model.

The model classification reference information is the excitation data output by the second neural network model according to the input screen shot. Before the second neural network model is trained to converge, the classification reference information is a numerical value with a large discreteness. When the second neural network After the model has not been trained to converge, the classification reference information is relatively stable data.

The loss function of the second neural network model determines whether the classification reference information is consistent with the classification judgment information. The loss function is a detection function that is configured to detect model classification reference information in the second neural network model and to determine whether the information is consistent with people's desired classification judgment information. When the output result of the second neural network model is inconsistent with the expected result of the classification judgment information, the weights in the second neural network model need to be corrected by a reverse algorithm, so that the output result of the second neural network model and the classification judgment information The expected result is the same.

When the classification output of the second neural network model is not consistent with the expected result of classification judgment information, the weights in the second neural network model need to be corrected so that the output result of the second neural network model and the expected result of classification judgment information the same. During training, multiple training samples are used for training (for example, 100 training sample sets are repeatedly trained). Through repeated training and correction, when the second neural network model outputs the classification data and the classification reference information of each training sample, the correct rate is reached ( Not limited to) 99.9%, the training is over. At this time, the training of the second neural network model ends, and the second neural network model is trained to converge, and the user behavior information represented by the face image can be accurately judged.

S1013. When the content characterized by the first judgment result is that the face image and the certificate image are inconsistent, prohibit the user's login request.

When the content characterized by the first judgment result is that the face image and the certificate image are inconsistent, it is determined that the similarity between the face image and the certificate photo of the user's certificate or the retained user image is low, and the verification result is inconsistent. The computer device prohibits the execution of the user's login request, and the user cannot log in to the operating system interface to control the computer device.

Through user image verification, it is possible to identify whether the user has the legal right to use a computer device to access the Internet. At the same time, it can also enhance the safety of computer equipment.

In some embodiments, in order to prevent the user from deceiving the computer by using other people's face image photos, and successfully unlock the login operating system interface, it is necessary to identify whether the user is alive when the user logs in. Please refer to FIG. 3, which is a schematic flowchart of the user biometric verification according to this embodiment.

As shown in FIG. 3, after step S1011, it further includes:

S1021: Input the face image into a preset third neural network model, and obtain a second classification result output by the third neural network model, where the third neural network model is trained to a converged state Neural network model for judging the deflection direction and angle of face images;

When collecting the user's face image, the computer device sends an instruction to the user through the built-in impression device or the peripheral audio. The instruction content is to control the angle of the user's face in the camera's field of view, for example, deflect 30 degrees to the left and lift up 45. Degrees or deflection 60 degrees to the right and other commands. After the voice command is issued, the computer device collects the user's face image. And input the face image into the third neural network model.

The third neural network model is a neural network model trained to a converged state and used to judge the deflection direction and deflection angle of the face image. Wherein, the third neural network model can be a convolutional neural network model (CNN), but the third neural network model can also be: deep neural network model (DNN), recurrent neural network model (RNN) or the above three networks Deformation model of the model.

In this embodiment, the third neural network model is trained in the same way as the first neural network model, but the training sample set is changed from a screenshot to a face image, and the classification result is changed from user behavior information to the deflection direction and deflection of the human head angle. The third neural network model through a large number of training sample sets can accurately determine the deflection direction and deflection angle of the user's human head.

S1022: Compare the second classification result with preset instruction information, and when the second classification result is inconsistent with the instruction information, prohibit the user's login request.

The second classification result of the output of the third neural network model is compared with the set instruction information, and the instruction information and the information instruction that the computer device controls the rotation of the user's face through the sound. For example, if the command information is "turn 30 ° to the right", the deflection angle of the face judged by the third neural network model is "deflection to the right by 30 degrees", and if the two match completely, the judgment result will be the same. If the deflection angle of the face judged by the third neural network model is “deflection 0 °”, it indicates that the user has not rotated following the execution. At this time, the comparison result is inconsistent, and the computer device is prohibited from responding to the user ’s login request.

By performing live detection on the face image, it can effectively avoid the problem of illegal users or users who are not suitable for surfing the Internet by deceiving the computer to log in.

In some optional embodiments, in order to control the time when the user uses the computer device, by counting the length of time the user uses the computer and comparing it with a set time threshold, when the preset time is exceeded, the computer device prohibits responding to the user Any operation instructions to guide the user to use the computer equipment correctly.

Please refer to FIG. 4. FIG. 4 is a schematic diagram of a process for limiting user usage time in this embodiment.

As shown in FIG. 4, after step S1300, the following steps are also included:

S1311: Obtain the duration of user behavior of the user;

The computer device records the startup time of the computer device through a built-in timer, and then checks the usage time in the timer through the method of timing acquisition. The usage time is the duration of the user's user behavior.

S1312: Compare the duration with a preset time threshold;

The acquired duration is compared with the set time threshold, and the time threshold of different user behaviors is different according to different user behaviors. For example, the time threshold for user behavior when playing games is 1 hour, the time threshold for user behavior for learning is 2 hours, and the total online time of users must not exceed 3 hours.

According to the duration of different user behaviors or the total duration of the user's use of the computer device, it is compared with the corresponding user behavior or total usage threshold.

S1313. When the duration is greater than the time threshold, responding to the user's user instruction is prohibited.

When the duration of the comparison result is greater than the time threshold, the computer device is prohibited from responding to the operation instructions issued by the user, so as to force the user to stop using the computer device, so as to control the user's use of the computer device overtime.

In some embodiments, some minor users often use a parent's credit card, debit card or electronic account for online consumption or recharge when using computer devices. Therefore, the online consumption of underage users needs to be additionally controlled. Please refer to FIG. 5, which is a schematic diagram of a process of restricting online payment by a user in this embodiment.

As shown in FIG. 5, after step S1300, the method further includes:

S1321: Identify the payment amount in the screenshot of the screen;

When a user uses a computer device to make a payment, the computer device obtains a screenshot of the screen and inputs the screenshot into the first neural network model. Since the classification result set in the classification result in the first neural network model includes payment behavior, so The classification result of the first neural network model can determine whether the user is paying.

After confirming that the user makes a payment, the payment amount in the screen shot is extracted through text extraction technology, for example, OCR is used to recognize the image text and the payment amount in the screen shot is extracted.

S1322: Compare the payment amount with a preset amount threshold;

The read payment amount is compared with a preset amount threshold value. The amount threshold value is the maximum consumption amount of minors set by the parent, which can be set by the parent according to their own consumption ability or the amount of the child's consumption control.

S1323: When the payment amount is greater than the amount threshold, it is prohibited to respond to the user's user instruction.

When the payment amount is greater than the amount threshold, the computer device prohibits responding to the user's user instruction. By controlling the upper limit of the user's transaction amount, the user's spending power can be controlled within a limited range without causing unnecessary trouble to the family because of the user's impulse.

In some embodiments, in order to prevent the user from avoiding the monitoring of the above technical solutions through multiple payments, by monitoring the user's consumption records within a set time period (for example, one day), when the cumulative sum of the consumption records is greater than the amount threshold , Forbid to respond to the user's user instructions.

In some implementations, when the user makes an overpayment, it cannot be executed until it is approved by the parent or guardian. Please refer to FIG. 6, which is a schematic diagram of a process of verifying overpayment in this embodiment.

As shown in FIG. 6, after step S1323, the following steps are also included:

S1411: Send warning information to a preset associated terminal, where the warning information includes inquiry information about whether to agree to pay;

When it is detected that the user is making a payment and the amount paid is greater than the set amount threshold, warning information is sent to the associated terminal, and the warning information includes inquiry information. For example, the warning message that user XX pays 5,000 yuan on the XX platform and agrees to pay.

Among them, the associated terminal is the phone number, mailbox number, or other instant messaging account reserved during registration with administrator authority. In some embodiments, the associated terminal refers to the phone number reserved by the user for the payment account or payment bank card used during registration.

S1412: Receive response information from the associated terminal in response to the warning information;

Obtaining reply information to reply to the warning information sent by the associated terminal, the content of the reply information is whether the user is allowed to pay.

S1413. When the reply content represented by the reply information is payment approval, execute the user's payment instruction.

When the reply content characterized by the content of the reply information is to agree to payment, the computer device executes the user's payment instruction, and sends the user's payment information to the corresponding server to implement payment. If the content indicated in the reply message is that the payment is not approved, the user's payment operation is prohibited.

In some embodiments, the user's payment behavior is sent to the corresponding guardian or account holder for more accurate payment. When the user makes a payment, he needs to find the associated terminal. Please refer to FIG. 7, which is a schematic flowchart of obtaining an associated terminal according to this embodiment.

As shown in FIG. 7, before step S1411, the following steps are also included:

S1401: Obtain the payment account used by the payment behavior;

Obtain the payment card number or electronic account used by the user for payment. At the same time, read the payment card number used by the user and the payment account number of the electronic account.

S1402: Obtain the payment terminal number bound to the payment account according to the payment account;

In this embodiment, when the administrator (parent) performs registration, it will collect all payment card numbers and electronic account information that can be provided at home but does not include the password, and the payment card number and payment terminal number corresponding to the electronic account. The payment terminal number bound to the payment account can be directly obtained through the information of the electronic account.

In some embodiments, after the payment account is obtained, the type of the payment account and the account opening bank or platform are identified. All of the above identifications can be identified through the identification rules of each bank card number, and then send request information to the server system where the registered institution is located to request the payment terminal number bound to the payment account.

S1403. Determine that the terminal represented by the payment terminal number is the associated terminal.

After obtaining the payment terminal number bound to the payment account, it is determined that the terminal represented by the payment terminal number is an associated terminal. Through the confirmation of the associated terminal, the warning information can be sent to the most relevant user terminal, which maximizes the protection of the direct interests of the owner of the payment account.

To solve the above technical problems, embodiments of the present application also provide a system security device.

Please refer to FIG. 8, which is a block diagram of the basic structure of the system security device of this embodiment.

As shown in FIG. 8, a system security device includes: an acquisition module 2100, a processing module 2200, and a processing module 2300. Wherein, the obtaining module 2100 is used to obtain a screen shot of the display screen in the display area; the processing module 2200 is used to input the screen shot into the preset first neural network model and obtain the first screen shot output by the first neural network model Classification results, where the first classification result is user behavior information characterized by screenshots; the execution module 2300 is used to compare the first classification result with preset behavior planning information, when the first classification result is inconsistent with the behavior planning information , It is forbidden to respond to user's user instructions.

The system security device prompts the user to fill in a usage plan when the user uses the computer, and the usage plan includes the operation content performed by the user using the computer. When the user officially operates the computer, a screenshot of the content displayed on the computer screen is obtained, the screenshot is input into the preset first neural network model, and the classification result is obtained. Because the classification result is the user behavior information represented by the screenshot, that is, what kind of operation the user is using the computer device. By comparing whether the behavior planning information set by the user when using the computer is consistent with the classification result, it is possible to determine whether the user is using the computer to perform the behavior operation in the planning, rather than using the computer to perform other operations. When the user's computer is performing other operations, it is forbidden to respond to the user's operation instructions, forcing the user to operate the computer to respond as planned, to achieve the purpose of guiding the user to use the computer correctly, and to realize the task of helping the user to avoid improper use of the computer.

In some optional embodiments, the system security device further includes: a first acquisition submodule, a first processing submodule, and a first execution submodule. Among them, the first acquisition sub-module is used to collect the user's face image; the first processing sub-module is used to input the face image and the preset user's ID image into the preset second neural network model, and obtain the first The first judgment result output by the second neural network model, where the second neural network model is a neural network model trained to a convergence state for judging image similarity; the first execution submodule is used when the content characterized by the first judgment result is human When the face image and the certificate image are inconsistent, the user's login request is prohibited.

In some optional embodiments, the system security device further includes: a second processing submodule and a second execution submodule. Among them, the second processing sub-module is used to input the face image into the preset third neural network model and obtain the second classification result output by the third neural network model, wherein the third neural network model is training to convergence The neural network model whose state is used to judge the deflection direction and deflection angle of the face image; the second execution submodule is used to compare the second classification result with preset instruction information, when the second classification result is inconsistent with the instruction information, The user's login request is prohibited.

In some optional embodiments, the system security device further includes: a second acquisition submodule, a third processing submodule, and a third execution submodule. Among them, the second acquisition submodule is used to acquire the duration of the user's user behavior; the third processing submodule is used to compare the duration with a preset time threshold; the third execution submodule is used when the duration is greater than the time At the threshold, it is forbidden to respond to user instructions.

In some optional embodiments, when the user behavior payment behavior is characterized by the user behavior information; the system security device further includes: a first recognition submodule, a fourth processing submodule, and a fourth execution submodule. Among them, the first identification submodule is used to identify the payment amount in the screenshot; the fourth processing submodule is used to compare the payment amount with the preset amount threshold; the fourth execution submodule is used when the payment amount is greater than the amount threshold , It is forbidden to respond to user's user instructions.

In some optional embodiments, the system security device further includes: a first sending submodule, a first accepting submodule, and a fifth executing submodule. Among them, the first sending sub-module is used to send warning information to the preset associated terminal, where the warning information includes inquiry information about whether to agree to pay; the first accepting sub-module is used to receive reply information from the associated terminal to reply to the warning information; Five execution sub-modules are used to execute the user's payment instruction when the response content represented by the response information is to agree to payment.

In some optional embodiments, the system security device further includes: a third acquisition submodule, a third acquisition submodule, and a fifth processing submodule. Among them, the third obtaining sub-module is used to obtain the payment account used for payment; the fifth processing sub-module is used to obtain the payment terminal number bound to the payment account according to the payment account; the sixth execution sub-module is used to determine the payment terminal number representation Is the associated terminal.

To solve the above technical problems, embodiments of the present application also provide computer equipment. For details, please refer to FIG. 9, which is a block diagram of the basic structure of the computer device of this embodiment.

As shown in FIG. 9, a schematic diagram of the internal structure of the computer device. The computer device includes a processor, a non-volatile storage medium, a memory, and a network interface connected through a system bus. The non-volatile storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a sequence of control information. When the computer-readable instructions are executed by the processor, the processor may implement a A system security method. The processor of the computer device is used to provide computing and control capabilities, and support the operation of the entire computer device. The memory of the computer device may store computer readable instructions. When the computer readable instructions are executed by the processor, the processor may cause the processor to execute a system security method. The network interface of the computer device is used to connect and communicate with the terminal. Those skilled in the art can understand that the structure shown in FIG. 9 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may Include more or less components than shown in the figure, or combine certain components, or have a different arrangement of components.

In this embodiment, the processor is used to perform specific functions of the acquisition module 2100, the processing module 2200, and the execution module 2300 in FIG. 8, and the memory stores program codes and various types of data required to execute the above modules. The network interface is used for data transmission to user terminals or servers. The memory in this embodiment stores the program codes and data required to execute all submodules in the face image key point detection device, and the server can call the server program codes and data to execute the functions of all submodules.

The computer device prompts the user to fill in a usage plan when the user uses the computer, and the usage plan includes the operation content performed by the user using the computer. When the user officially operates the computer, a screenshot of the content displayed on the computer screen is obtained, the screenshot is input into the preset first neural network model, and the classification result is obtained. Because the classification result is the user behavior information represented by the screenshot, that is, what kind of operation the user is using the computer device. By comparing whether the behavior planning information set by the user when using the computer is consistent with the classification result, it is possible to determine whether the user is using the computer to perform the behavior operation in the planning, rather than using the computer to perform other operations. When the user's computer is performing other operations, it is forbidden to respond to the user's operation instructions, forcing the user to operate the computer to respond as planned, to achieve the purpose of guiding the user to use the computer correctly, and to realize the task of helping the user to avoid improper use of the computer.

The present application also provides a storage medium that stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the system security method described in any one of the foregoing embodiments A step of.

A person of ordinary skill in the art may understand that all or part of the processes in the method of the foregoing embodiments may be completed by instructing relevant hardware through a computer program. The computer program may be stored in a computer-readable storage medium, When executed, it may include the processes of the foregoing method embodiments. The aforementioned storage medium may be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

It should be understood that although the steps in the flowchart of the drawings are displayed in order according to the arrows, the steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear description in this article, there is no strict order limitation for the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the order of execution is also It is not necessarily carried out sequentially, but may be executed in turn or alternately with at least a part of other steps or sub-steps or stages of other steps.

Claims

A system security method, including the following steps:

Get a screenshot of the display screen in the display area;

Input the screen shot into a preset first neural network model, and obtain a first classification result of the screen shot output by the first neural network model, wherein the first classification result is a representation of the screen shot Of user behavior information;

Comparing the first classification result with preset behavior planning information, and responding to a user instruction of the user when the first classification result is consistent with the behavior planning information.
According to the system security method of claim 1, before the step of obtaining a screenshot of the display screen of the display area, the method further includes the following steps:

Collecting the face image of the user;

Input the face image and the preset ID image of the user into a preset second neural network model, and obtain a first judgment result output by the second neural network model, wherein the second The neural network model is a neural network model trained to a convergent state for judging the similarity of images;

When the content characterized by the first judgment result is that the face image and the certificate image are inconsistent, the user's login request is prohibited.
The system security method according to claim 2, after the step of collecting the user's face image, further comprising the following steps:

Input the face image into a preset third neural network model, and obtain a second classification result output by the third neural network model, wherein the third neural network model is trained to a converged state for Neural network model to judge the deflection direction and deflection angle of face images;

Comparing the second classification result with preset instruction information, and when the second classification result is inconsistent with the instruction information, prohibiting the user's login request.
The system security method according to claim 1, wherein the first classification result is compared with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, responding to the After the steps of the user's instruction, the following steps are also included:

Obtaining the duration of the user's user behavior;

Compare the duration with a preset time threshold;

When the duration is greater than the time threshold, it is prohibited to respond to user instructions of the user.
The system security method according to claim 1, when the user behavior payment behavior represented by the user behavior information is compared; the comparison of the first classification result with preset behavior planning information, when the first When the classification result is consistent with the behavior planning information, after the step of responding to the user's user instruction, the following steps are further included:

Identify the payment amount in the screenshot of the screen;

Compare the payment amount with a preset amount threshold;

When the payment amount is greater than the amount threshold, it is prohibited to respond to the user's user instruction.
The system security method according to claim 5,

After the step of prohibiting response to the user's user instruction when the payment amount is greater than the amount threshold, the following steps are further included:

Send warning information to a preset associated terminal, where the warning information includes inquiry information about whether to agree to pay;

Receiving reply information from the associated terminal replying to the warning information;

When the reply content represented by the reply information is payment approval, the user's payment instruction is executed.
According to the system security method of claim 6, the step of sending warning information to a preset associated terminal further includes the following steps:

Obtain the payment account used for the payment;

Obtaining the payment terminal number bound to the payment account according to the payment account;

It is determined that the terminal represented by the payment terminal number is the associated terminal.
A system security device, including:

The acquisition module is used to obtain a screenshot of the display screen in the display area;

The processing module is configured to input the screen shot into the preset first neural network model and obtain a first classification result of the screen shot output by the first neural network model, wherein the first classification result is User behavior information represented by the screenshots;

The execution module is configured to compare the first classification result with preset behavior planning information, and respond to a user instruction of the user when the first classification result is consistent with the behavior planning information.
A computer device includes a memory and a processor. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor causes the processor to perform a system security method as described below step:

Get a screenshot of the display screen in the display area;

Input the screen shot into a preset first neural network model, and obtain a first classification result of the screen shot output by the first neural network model, wherein the first classification result is a representation of the screen shot Of user behavior information;

Comparing the first classification result with preset behavior planning information, and responding to a user instruction of the user when the first classification result is consistent with the behavior planning information.
According to the computer device of claim 9, before the step of obtaining a screenshot of the display screen of the display area, the method further comprises the following steps:

Collecting the face image of the user;

Input the face image and the preset ID image of the user into a preset second neural network model, and obtain a first judgment result output by the second neural network model, wherein the second The neural network model is a neural network model trained to a convergent state for judging the similarity of images;

When the content characterized by the first judgment result is that the face image and the certificate image are inconsistent, the user's login request is prohibited.
The computer device according to claim 10, after the step of collecting the user's face image, further comprising the following steps:

Input the face image into a preset third neural network model and obtain a second classification result output by the third neural network model, wherein the third neural network model is trained to a converged state for Neural network model to judge the deflection direction and deflection angle of face images;

Comparing the second classification result with preset instruction information, and when the second classification result is inconsistent with the instruction information, prohibiting the user's login request.
The computer device according to claim 9, wherein the first classification result is compared with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, responding to the user After the steps instructed by the user, the following steps are also included:

Obtaining the duration of the user's user behavior;

Compare the duration with a preset time threshold;

When the duration is greater than the time threshold, it is prohibited to respond to user instructions of the user.
The computer device according to claim 9, when the user behavior payment behavior represented by the user behavior information is compared; the comparison of the first classification result with preset behavior planning information, when the first classification When the result is consistent with the behavior planning information, after the step of responding to the user's user instruction, the following steps are further included:

Identify the payment amount in the screenshot of the screen;

Compare the payment amount with a preset amount threshold;

When the payment amount is greater than the amount threshold, it is prohibited to respond to the user's user instruction.
The computer device according to claim 13, after the step of prohibiting responding to a user instruction of the user when the payment amount is greater than the amount threshold, further comprising the following steps:

Send warning information to a preset associated terminal, where the warning information includes inquiry information about whether to agree to pay;

Receiving reply information from the associated terminal replying to the warning information;

When the reply content represented by the reply information is payment approval, the user's payment instruction is executed.
The computer device according to claim 14, before the step of sending warning information to a preset associated terminal, further comprising the following steps:

Obtain the payment account used for the payment;

Obtaining the payment terminal number bound to the payment account according to the payment account;

It is determined that the terminal represented by the payment terminal number is the associated terminal.
A non-volatile storage medium storing computer-readable instructions, which when executed by one or more processors, causes the one or more processors to perform the following steps of a system security method: Get a screenshot of the display screen in the display area;

Input the screen shot into a preset first neural network model, and obtain a first classification result of the screen shot output by the first neural network model, wherein the first classification result is a representation of the screen shot Of user behavior information;

Comparing the first classification result with preset behavior planning information, and responding to a user instruction of the user when the first classification result is consistent with the behavior planning information.
According to the non-volatile storage medium of claim 16, before the step of obtaining a screenshot of the display screen of the display area, the method further includes the following steps:

Collecting the face image of the user;

Input the face image and the preset ID image of the user into a preset second neural network model, and obtain a first judgment result output by the second neural network model, wherein the second The neural network model is a neural network model trained to a convergent state for judging the similarity of images;

When the content characterized by the first judgment result is that the face image and the certificate image are inconsistent, the user's login request is prohibited.
The non-volatile storage medium according to claim 17, after the step of collecting the user's face image, further comprising the following steps:

Input the face image into a preset third neural network model, and obtain a second classification result output by the third neural network model, wherein the third neural network model is trained to a converged state for Neural network model to judge the deflection direction and deflection angle of face images;

Comparing the second classification result with preset instruction information, and when the second classification result is inconsistent with the instruction information, prohibiting the user's login request.
The non-volatile storage medium according to claim 16, wherein the first classification result is compared with preset behavior planning information, and when the first classification result is consistent with the behavior planning information, After the step of responding to the user instruction of the user, the following steps are further included:

Obtaining the duration of the user's user behavior;

Compare the duration with a preset time threshold;

When the duration is greater than the time threshold, it is prohibited to respond to user instructions of the user.
The non-volatile storage medium according to claim 16, when the user behavior payment behavior represented by the user behavior information is compared; the comparing the first classification result with preset behavior planning information, when the When the first classification result is consistent with the behavior planning information, after the step of responding to the user instruction of the user, the method further includes the following steps:

Identify the payment amount in the screenshot of the screen;

Compare the payment amount with a preset amount threshold;

When the payment amount is greater than the amount threshold, it is prohibited to respond to the user's user instruction.