WO2020258658A1 - Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement - Google Patents

Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement Download PDF

Info

Publication number
WO2020258658A1
WO2020258658A1 PCT/CN2019/117611 CN2019117611W WO2020258658A1 WO 2020258658 A1 WO2020258658 A1 WO 2020258658A1 CN 2019117611 W CN2019117611 W CN 2019117611W WO 2020258658 A1 WO2020258658 A1 WO 2020258658A1
Authority
WO
WIPO (PCT)
Prior art keywords
cursor
trigger data
trigger
abnormal
event type
Prior art date
Application number
PCT/CN2019/117611
Other languages
English (en)
Chinese (zh)
Inventor
黎立桂
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020258658A1 publication Critical patent/WO2020258658A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
    • G06F3/0487—Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser

Definitions

  • This application relates to the field of computer application technology. Specifically, this application relates to an abnormal operation identification method, device, computer equipment, and storage medium.
  • Abnormal user behavior refers to "abnormal" behavior that violates the social civilized norms or group behavior habits and standards. Especially with the improvement of people's awareness of public safety and network safety, there is an increasing focus on the detection of abnormal behavior in crowd scenes, networks and other environments.
  • Abnormal user behaviors are usually identified by using acquired data characterizing user behavior characteristics.
  • data characterizing user behavior characteristics There are many kinds of data characterizing user behavior characteristics, which can easily lead to inaccurate character behavior recognition data.
  • mouse movement data is used as user behavior data, usually with a display screen.
  • coordinates data such as webpages opened on the display screen are not positioned.
  • multiple variables will appear, which may easily lead to inaccurate judgments of the last identified abnormal data and poor user experience.
  • the purpose of this application is to solve at least one of the above technical defects, and to disclose an abnormal operation identification method, device, computer equipment and storage medium, which can comprehensively obtain cursor trigger data to accurately identify abnormal cursor trigger data .
  • this application discloses a method for identifying abnormal operations, including:
  • cursor trigger data in the display screen, where the cursor trigger data includes the relative position of the cursor obtained by taking a specified position in the display screen as the origin of coordinates;
  • an alarm message is sent to the back-end server to perform a trigger action that limits the cursor.
  • an abnormal operation recognition device including:
  • Obtaining module configured to perform acquisition of cursor trigger data in the display screen, wherein the cursor trigger data includes a cursor obtained by taking the specified position of the opened application in the display screen and/or the screen as the origin of coordinates Relative position
  • Processing module configured to execute an event type for determining cursor movement according to the relative position, where the event type is a user operation instruction represented by the cursor trigger data;
  • Judging module Judging whether the cursor trigger data is abnormal trigger data according to the event type
  • Execution module configured to execute when the cursor trigger data is abnormal trigger data, send alarm information to the back-end server to restrict the triggering action of the cursor.
  • the present application discloses a computer device including a memory and a processor.
  • the memory stores computer-readable instructions.
  • the processor executes the foregoing Any of the steps of the abnormal operation identification method.
  • the present application discloses a storage medium storing computer-readable instructions.
  • the computer-readable instructions are executed by one or more processors, the one or more processors execute any of the above The steps of the abnormal operation identification method.
  • Figure 1 is a schematic diagram of an abnormal operation identification method according to this application.
  • Figure 2 is a flow chart of a method for obtaining cursor trigger data on a display screen in this application
  • Figure 3 is a flow chart of the method for obtaining the application event type
  • FIG. 4 is a flowchart of a method for judging whether cursor trigger data is abnormal trigger data in this application
  • Fig. 5 is a flowchart of a method for obtaining a moving speed in this application
  • FIG. 6 is a flowchart of a method for matching cursor trigger thresholds in this application.
  • Fig. 7 is a flow chart of a method for sending alarm information to restrict cursor triggering actions in this application;
  • FIG. 8 is a schematic structural diagram of a block diagram of an abnormal operation recognition device of this application.
  • FIG. 9 is a block diagram of the basic structure of the computer equipment of this application.
  • terminal and “terminal equipment” used herein include both wireless signal receiver equipment, equipment that only has wireless signal receivers without transmitting capability, and equipment receiving and transmitting hardware.
  • a device which has a device capable of performing two-way communication receiving and transmitting hardware on a two-way communication link.
  • Such equipment may include: cellular or other communication equipment, which has a single-line display or a multi-line display or a cellular or other communication device without a multi-line display; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and/or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which can include radio frequency receivers, pagers, Internet/Intranet access, web browsers, notepads, calendars, and/or GPS (Global Positioning System (Global Positioning System) receiver; conventional laptop and/or palmtop computer or other device, which has and/or includes a radio frequency receiver, conventional laptop and/or palmtop computer or other device.
  • GPS Global Positioning System (Global Positioning System) receiver
  • conventional laptop and/or palmtop computer or other device which has and/or includes a radio frequency receiver, conventional laptop and/or palmtop computer or other device.
  • terminal and terminal equipment used here may be portable, transportable, installed in vehicles (aviation, sea and/or land), or suitable and/or configured to operate locally, and/or In a distributed form, it runs on the earth and/or any other location in space.
  • the "terminal” and “terminal equipment” used here can also be communication terminals, internet terminals, music/video playback terminals, such as PDA, MID (Mobile Internet Device, mobile Internet device) and/or mobile phone with music/video playback function, it can also be a smart TV, set-top box and other devices.
  • This application discloses an abnormal operation identification method, including:
  • the display screen is the interface used for display in the mobile terminal.
  • the display screen in this application includes the display screens on smart products such as mobile phones, tablets, computers, smart watches and smart bracelets, and the display screens also include ordinary display screens and touch screens. display screen.
  • the way in which the cursor on the display screen is triggered can be a cursor controlled by a mouse, or a cursor controlled by touching the display screen, controlled by a human hand, or controlled by a touch pen.
  • Cursor triggering means that the cursor is moved or a work instruction is applied.
  • the application of a work instruction includes locking the current input position after being clicked, or popping up a setting or editing interface after the cursor is clicked.
  • moving the mouse will control the relative movement of the cursor on the display screen.
  • click the left button of the mouse usually to lock the current position of the cursor as input Position, when the current position is an input box for text input, you can enter character information in the input box by keyboard or handwriting; when you click the right button of the mouse, the editing or setting interface for the current display interface of the display screen will pop up .
  • the locked position of the cursor when the locked position of the cursor is the desktop position, click the right mouse button, and the setting interface for the desktop position will pop up.
  • the locked position of the cursor is in the WORD interface, click the right mouse button, and the related editing interface for WORD will pop up.
  • the locked position of the cursor is the interface of the application program, click the right mouse button, and a setting or editing interface for the browser will pop up.
  • the cursor trigger data is related data obtained through the cursor, including the relative position of the cursor on the display screen.
  • the specified position on the display screen is used as the coordinate origin to obtain the relative position of the cursor in the entire display screen.
  • the designated position here can be the center of the entire display screen.
  • the center position of the display screen is the focal point of the cross line of the four top corners of the display screen, which is the origin of the coordinates in turn, dividing the display screen into four Item image to obtain the relative position of the cursor.
  • any top corner of the display screen can be used as the origin of coordinates to determine the relative position of the cursor.
  • this application uses a certain point in the entire display screen as the coordinate origin, rather than a certain position of an application program interface displayed on the display screen as the coordinate origin. In this way, it is possible to prevent the application from being expanded or contracted to cause the cursor's coordinate position to be abnormally sudden, or even lost, and need to be re-acquired. This increases the workload of computer processing. At the same time, it can better track the cursor, and you are not afraid of the cursor. After the interface of the application program changes, the relationship between the cursor and the application program is lost, so that the user's input behavior can be better recognized.
  • S3000 Determine whether the cursor trigger data is abnormal trigger data according to the event type
  • the cursor trigger data includes the relative position of the cursor with respect to the origin of the coordinate, through the relative position, it is possible to know where the cursor is currently, what kind of trigger is performed, and where the previous unit time period is at, within this unit time period What is the movement direction?
  • Different trigger types and different cursor movement directions represent different event types, where the event type is a user operation instruction represented by the cursor trigger data.
  • the event type of the cursor is cursor right movement; the last relative position of the cursor is lower and right of the current position, then the time type of the cursor is cursor Move up left.
  • the relative position of the cursor also includes identifying the relative position of the cursor on the display screen and the relative position of the cursor on the opened application. By comparing the relative positions of the two states, you can further The event type of the cursor is broken down. For example, when the cursor moves to the right and moves from the opened application to the desktop of the display screen, the recognized event type is moving out of the current application.
  • the cursor moves within the range opened by the application.
  • the relative position in is the relative position obtained by taking the specified position on the display screen as the origin.
  • the relative position is in the application.
  • the position in the program such as when the cursor is at the position of the input box in the application.
  • the event type obtained at this time is not only the cursor Move to the right, but the cursor moves from the input box of the application to the right to the desktop of the display screen.
  • the subdivided event type by determining the subdivided event type, it is possible to determine whether the obtained cursor trigger data is abnormal according to the event type. For example, there are multiple applications open on the display screen at the same time, and there is a certain position difference between the "close" icons of each application.
  • the trigger event type of the cursor When the trigger event type of the cursor is to close the application window, it closes the current application There will be a time interval between closing the next application. This time interval usually has a critical value, which is the fastest speed to manually move the cursor and trigger the cursor. When this threshold is exceeded, it can be deemed to be closed manually. It may be an abnormal operation event.
  • the back-end server may also restrict the triggering actions of the cursor according to the alarm information.
  • restrict such as prohibiting cursor movement, prohibiting the cursor from performing trigger actions such as clicking, right-clicking, and double-clicking. , By restricting the triggering action of the cursor to restrict the operation of the application or the display screen through the cursor.
  • the abnormal operation recognition method disclosed in this application recognizes the relative position of the cursor according to the specified position in the display screen as the origin of the coordinate, and obtains the type of event triggered by the cursor according to the recognized cursor trigger data, and judges the type according to the event type. Whether the trigger data is abnormal trigger data, so that the cursor is restricted according to the judgment result.
  • the difference from the prior art is that the relative position of the judgment cursor is not based on a certain position of the application program as the coordinate, which will be affected by the scaling of the application program. The relative position changes, or the cursor data is lost, but a certain position on the display screen is used as the origin of the coordinates.
  • the position in the application program and the current display state of the application program relative to the display screen can be verified whether the current position information of the cursor is correct, so that the data is more accurate. Further, through the acquired relative positions, the triggered event types are subdivided, and according to the specific criteria of each subdivided event type, it is recognized whether the cursor trigger data is abnormal, and the judgment result is more accurate.
  • the method for obtaining cursor trigger data on the display screen includes:
  • S1100 Acquire the relative position of the cursor with respect to the origin of the coordinates after the interface of the application program is loaded;
  • the cursor trigger data is directly obtained, and when there is an application to be opened or already opened on the display screen, the cursor relative to the display screen is re-acquired after the application interface is loaded.
  • the relative position of the origin of the coordinates in order to identify the relationship between the cursor and the display screen and the application during the triggering process according to the relative position of the application on the display screen and the position of the cursor in the application.
  • the application program here includes an application on the PC side, an APP on a mobile terminal, etc., specific examples are programs that can perform a certain function such as a browser, word, WeChat, or QQ.
  • the cursor may be moving, in order to identify the relative position of the previous time period and the next time period, it is necessary to continuously monitor the relative position of the cursor, and there is a time interval for data collection. Therefore, in this In the embodiment, the relative position of the cursor with respect to the origin of the coordinates is continuously collected with the first preset time as the unit time.
  • the first preset time is a time interval.
  • the first preset time should be as short as possible, but should be less than the time period that humans can perceive. Humans can perceive the stuttering of continuous actions at intervals greater than 24 milliseconds. Prior art applications can efficiently process user-generated requests at 8 millisecond intervals. Based on performance and actual user behavior considerations, in this embodiment, the first The preset time period is accurate to the millisecond level, for example, a standard time interval of 20 milliseconds is set to collect cursor trigger data.
  • the event type is a user operation instruction represented by the cursor trigger data
  • the method for determining the event type of cursor movement according to the relative position includes:
  • the second preset time is also a period of time, which is different from the first preset time.
  • the second preset time is greater than the first preset time.
  • the first preset time collects the relative position of a specific cursor.
  • the second preset time is the time interval for continuously collecting the relative positions of multiple cursors. Since in one embodiment, the first preset time can be set to 20 milliseconds, the second preset time should be greater than 20 milliseconds , The longer the second preset time is, the more relative positions of the cursor are collected, and these relative positions are connected in series to form the movement path of the cursor. For example, when the moving path is that the cursor moves to the right, the path is a set of relative positions of the cursor collected at the first preset time within the second preset time.
  • the movement direction and movement state of the cursor can be obtained, where the movement state includes the state of the cursor on the display screen and the state on the corresponding application program, so that the fine classification of the cursor movement can be obtained.
  • a cursor trigger type list is preset and stored, and the cursor trigger type list is a set of instructions that may be executed by the cursor and its corresponding movement paths that are pre-verified and counted according to the movement path of the cursor. Each path corresponds to its own time type. After obtaining the movement path of the cursor through the above step S2100, the corresponding event type can be matched in the cursor trigger type list.
  • the method of judging whether the cursor trigger data is abnormal trigger data according to the event type represented by the cursor trigger data includes:
  • the second preset time period is the time interval of the above-disclosed statistical movement path, where the movement speed is calculated based on the movement path obtained during the second preset time period.
  • the method for moving the cursor in the second preset time period includes:
  • S2320 Calculate the moving speed of the cursor according to the distance value.
  • step S2100 the movement path within the second preset time period has been obtained, and the distance value of the movement path can be calculated according to the extension direction of the movement path.
  • the distance value and the distance value The ratio of the second preset time obtains the moving speed of the cursor.
  • the abnormal database is a database that collects cursor trigger thresholds of all event types.
  • the cursor trigger threshold is a critical value when the cursor is triggered.
  • the cursor trigger threshold includes the fastest speed of cursor movement. It should be noted that the maximum speed of cursor movement here refers to the fastest control speed that humans can achieve, whether the cursor is controlled by the mouse, the touch screen is clicked, touched, or the touch-sensitive pen is operated. When the acquired movement speed is greater than When it is faster than the cursor trigger threshold, it can be considered that the current operation is not manual operation.
  • the cursor trigger type list also includes the code of the event type, and the cursor trigger corresponding to the event type is matched in a preset abnormal database according to the event type.
  • Threshold methods include:
  • the cursor trigger type list is a collection of pre-verified and counted cursor possible instructions and their corresponding movement paths based on the movement path of the cursor, in order to reduce the time of data reading and recognition, the corresponding cursor actions are assigned different Code, similarly, in the abnormal database, the cursor trigger threshold is associated with the code, and the cursor trigger threshold corresponding to the event type with the same code is matched in the abnormal database through the code.
  • the data is simplified to the greatest extent and the data transmission is safe and fast.
  • the event type such as 0 represents mousedown, 1 represents mousemove, etc.
  • the coordinate data is controlled at the pixel level, which can effectively compress the data volume by 20%, greatly improving the network transmission speed.
  • the acquired movement speed is compared with the cursor trigger threshold to determine whether the movement speed exceeds the cursor trigger threshold, and when it exceeds
  • the cursor trigger threshold indicates that the current operation is non-human operation.
  • the cursor trigger threshold is not exceeded, it indicates that the current operation is not non-human operation.
  • the normal operation is to enter five characters in one of the applications, then activate the other application and enter five characters.
  • the first character is input to the fifth character is input in the second application
  • the trigger threshold is 3cm/s
  • the movement speed obtained according to the trigger data of the cursor is 1cm/ s, obviously faster than the trigger threshold, so it can be judged that the current trigger data is abnormal trigger data.
  • the method of sending alarm information to a back-end server to restrict the triggering action of the cursor includes:
  • alarm information is generated according to the abnormal trigger data.
  • the generated alarm information includes the specific value of the cursor trigger data and the account information logged in the opened application.
  • the end server will list the identified account information logged in the application into the blacklist, and set permissions on the blacklist to restrict the triggering actions of the cursor in the application, such as prohibiting cursor movement or Prohibit the cursor from performing clicks and other related trigger actions to restrict user input.
  • FIG. 8 This application also discloses an abnormal operation recognition device, including:
  • Obtaining module 1000 configured to perform acquisition of cursor trigger data in the display screen, where the cursor trigger data includes data obtained by taking a specified position of the opened application on the display screen and/or on the screen as the origin of coordinates The relative position of the cursor; the processing module 2000: configured to execute the event type for determining the cursor movement according to the relative position, wherein the event type is a user operation instruction represented by the cursor trigger data; the judgment module 3000: according to the The event type determines whether the cursor trigger data is abnormal trigger data; the execution module 4000: is configured to execute when the cursor trigger data is abnormal trigger data, send alarm information to the back-end server to restrict the trigger action of the cursor .
  • the acquiring module includes: a position locking module: configured to execute to acquire the relative position of the cursor with respect to the coordinate origin after the interface of the application program is loaded; the position acquiring module: configured to execute the first preset Set time as the unit time to continuously obtain the relative position of the cursor with respect to the origin of the coordinate.
  • a position locking module configured to execute to acquire the relative position of the cursor with respect to the coordinate origin after the interface of the application program is loaded
  • the position acquiring module configured to execute the first preset Set time as the unit time to continuously obtain the relative position of the cursor with respect to the origin of the coordinate.
  • the processing module includes: Path acquisition module: configured to perform acquisition of the movement path of the cursor, wherein the movement path is a set of relative positions of the cursor within a second preset time period; the matching module: configured to execute The movement path matches the corresponding event type in the cursor trigger type list.
  • the processing module further includes: a speed acquiring module: configured to execute acquiring the moving speed of the cursor in the second preset time period; a threshold matching module: configured to execute The cursor trigger threshold corresponding to the event type is matched in the preset abnormal database, wherein the cursor trigger threshold includes the fastest speed value of the cursor movement; the comparison module is configured to perform the comparison between the movement speed and the cursor Trigger threshold comparison; judging module: configured to execute when the movement speed exceeds the cursor trigger threshold, judging that the cursor trigger data is abnormal trigger data.
  • the speed acquiring module includes: a distance acquiring module: configured to execute acquiring the distance value of the movement path of the cursor in the second preset time period; and a calculating module: configured to execute the distance based on the distance Value to calculate the moving speed of the cursor.
  • the cursor trigger type list further includes a code name of the event type
  • the threshold matching module includes: a code acquisition module: configured to execute acquiring the code name of the event type in the cursor trigger type list; code name Threshold matching module: configured to perform matching the cursor trigger threshold corresponding to the event type with the same code in the abnormal database according to the code.
  • the execution module includes: an account information identification module: configured to execute identification of account information logged in the application; a restriction module: configured to execute blacklisting account information corresponding to abnormal trigger data , Restricting the triggering actions performed by the cursor in the application by the account information.
  • abnormal operation identification device is a one-to-one corresponding device for the abnormal operation identification method, its function and execution principle are the same, and will not be repeated here.
  • FIG. 9 Please refer to FIG. 9 for the basic structure block diagram of the computer equipment provided by the embodiment of the present application.
  • the computer device includes a processor, a nonvolatile storage medium, a memory, and a network interface connected through a system bus.
  • the non-volatile storage medium of the computer device stores an operating system, a database, and computer-readable instructions.
  • the database may store control information sequences.
  • the processor can realize a An abnormal operation identification method.
  • the processor of the computer equipment is used to provide calculation and control capabilities, and supports the operation of the entire computer equipment.
  • a computer readable instruction may be stored in the memory of the computer device, and when the computer readable instruction is executed by the processor, the processor may execute an abnormal operation identification method.
  • the network interface of the computer device is used to connect and communicate with the terminal.
  • the computer device receives the status information of the prompt behavior sent by the associated client, that is, whether the associated terminal opens the prompt and whether the lender closes the prompt task. By verifying whether the above-mentioned task conditions are fulfilled, the corresponding preset instruction is sent to the associated terminal, so that the associated terminal can perform corresponding operations according to the preset instruction, thereby realizing effective supervision of the associated terminal.
  • the server side controls the associated terminal to continue ringing to prevent the prompt task of the associated terminal from being automatically terminated after a period of time.
  • the application also provides a storage medium storing computer-readable instructions.
  • the storage medium may be a non-volatile readable storage medium.
  • the computer-readable instructions are executed by one or more processors, one or more Each processor executes the abnormal operation identification method described in any of the foregoing embodiments.
  • the aforementioned storage medium may be a magnetic disk, an optical disk, a read-only storage memory (Read-Only Non-volatile storage media such as Memory, ROM, or Random Access Memory (RAM), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement. Le procédé comprend : l'obtention de données de déclenchement de curseur dans un écran d'affichage, les données de déclenchement de curseur comprenant une position relative, obtenue en utilisant une position spécifiée d'un programme d'application ouvert dans l'écran d'affichage et/ou un écran en tant qu'origine de coordonnées, d'un curseur (S1000) ; la détermination d'un type d'événement de mouvement de curseur en fonction de la position relative, le type d'événement étant une instruction d'opération d'utilisateur représentée par les données de déclenchement de curseur (S2000) ; la détermination, selon le type d'événement, si les données de déclenchement de curseur sont des données de déclenchement anormales (S3000) ; et lorsque les données de déclenchement de curseur sont des données de déclenchement anormales, l'envoi des informations d'alarme à un serveur dorsal pour restreindre une action de déclenchement du curseur (S4000). Le procédé n'est pas affecté par l'état de mise à l'échelle du programme d'application sur l'écran d'affichage, détermine de manière complète si les données de déclenchement de curseur sont anormales ou non, subdivise le type d'événement déclenché au moyen d'une acquisition, et sélectionne une norme de détermination correspondante pour identifier si les données de déclenchement de curseur sont anormales, de telle sorte que le résultat de détermination est plus précis.
PCT/CN2019/117611 2019-06-28 2019-11-12 Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement WO2020258658A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910575554.7 2019-06-28
CN201910575554.7A CN110399281A (zh) 2019-06-28 2019-06-28 异常操作识别方法、装置、计算机设备及存储介质

Publications (1)

Publication Number Publication Date
WO2020258658A1 true WO2020258658A1 (fr) 2020-12-30

Family

ID=68323903

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/117611 WO2020258658A1 (fr) 2019-06-28 2019-11-12 Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement

Country Status (2)

Country Link
CN (1) CN110399281A (fr)
WO (1) WO2020258658A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110399281A (zh) * 2019-06-28 2019-11-01 平安科技（深圳）有限公司 异常操作识别方法、装置、计算机设备及存储介质
CN112967418B (zh) * 2021-01-29 2023-01-06 惠州市大圣和乘科技有限公司 车载数据记录显示方法、装置、计算机设备和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102163251A (zh) * 2010-02-22 2011-08-24 深圳市腾讯计算机系统有限公司 一种游戏作弊的识别方法和设备
US20150067835A1 (en) * 2013-08-27 2015-03-05 International Business Machines Corporation Detecting Anomalous User Behavior Using Generative Models of User Actions
CN106484279A (zh) * 2016-09-12 2017-03-08 努比亚技术有限公司 一种识别和处理终端异常操作的方法及终端
CN109726550A (zh) * 2017-10-27 2019-05-07 腾讯科技（深圳）有限公司 异常操作行为检测方法、装置及计算机可读存储介质
CN109873813A (zh) * 2019-01-28 2019-06-11 平安科技（深圳）有限公司 文本输入异常监控方法、装置、计算机设备及存储介质
CN110399281A (zh) * 2019-06-28 2019-11-01 平安科技（深圳）有限公司 异常操作识别方法、装置、计算机设备及存储介质

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101571768A (zh) * 2009-06-11 2009-11-04 埃派克森微电子(上海)有限公司 防止屏幕光标异常运动的方法
JP5813317B2 (ja) * 2010-12-28 2015-11-17 株式会社東芝 プロセス状態監視装置
CN102722286B (zh) * 2012-06-08 2014-12-31 深圳市汇顶科技股份有限公司 可排除大面积干扰的触摸检测终端的基准更新方法及系统
CN103870170B (zh) * 2012-12-10 2019-01-29 腾讯科技（深圳）有限公司 一种光标控制方法、终端及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102163251A (zh) * 2010-02-22 2011-08-24 深圳市腾讯计算机系统有限公司 一种游戏作弊的识别方法和设备
US20150067835A1 (en) * 2013-08-27 2015-03-05 International Business Machines Corporation Detecting Anomalous User Behavior Using Generative Models of User Actions
CN106484279A (zh) * 2016-09-12 2017-03-08 努比亚技术有限公司 一种识别和处理终端异常操作的方法及终端
CN109726550A (zh) * 2017-10-27 2019-05-07 腾讯科技（深圳）有限公司 异常操作行为检测方法、装置及计算机可读存储介质
CN109873813A (zh) * 2019-01-28 2019-06-11 平安科技（深圳）有限公司 文本输入异常监控方法、装置、计算机设备及存储介质
CN110399281A (zh) * 2019-06-28 2019-11-01 平安科技（深圳）有限公司 异常操作识别方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN110399281A (zh) 2019-11-01

Similar Documents

Publication Publication Date Title
WO2017078361A1 (fr) Dispositif électronique et procédé de reconnaissance vocale
WO2020258657A1 (fr) Procédé et appareil de détection d'anomalie, dispositif informatique et support d'informations
WO2020215681A1 (fr) Procédé et appareil de génération d'informations d'indication, terminal et support de stockage
WO2019037197A1 (fr) Procédé et dispositif d'apprentissage de classificateur de sujets, et support de stockage lisible par ordinateur
WO2015182964A1 (fr) Dispositif électronique comportant un dispositif d'affichage pliable et son procédé de fonctionnement
WO2015119485A1 (fr) Dispositif de terminal utilisateur et son procédé d'affichage
WO2014157806A1 (fr) Dispositif d'affichage et son procédé de commande
WO2020155773A1 (fr) Procédé de surveillance d'entrée de texte suspecte, dispositif, appareil informatique et support de sockage
WO2015020354A1 (fr) Appareil, serveur et procédé pour fournir un sujet de conversation
WO2015167236A1 (fr) Dispositif électronique et procédé de fourniture de service d'appel vidéo d'urgence
EP3497593A1 (fr) Système de gestion de stockage de données récapitulées destiné à des données de diffusion en continu
WO2016080747A1 (fr) Terminal utilisateur et procédé de commande d'un appareil d'affichage
WO2020258658A1 (fr) Procédé et appareil d'identification d'opération anormale, dispositif informatique et support d'enregistrement
WO2020015060A1 (fr) Procédé et appareil d'estimation d'anomalie de consommation d'énergie, et support d'enregistrement informatique
WO2020258672A1 (fr) Procédé et dispositif de détection d'anomalie d'accès au réseau
WO2014193065A1 (fr) Procédé et appareil de recherche de vidéo
WO2016072678A1 (fr) Dispositif de terminal utilisateur et son procédé de commande
WO2019024485A1 (fr) Procédé et dispositif de partage de données, et support de stockage lisible par ordinateur
WO2016099211A1 (fr) Dispositif électronique et procédé de commande d'affichage
WO2020233060A1 (fr) Procédé et appareil de notification d'événement, serveur de notification d'événement et support de stockage
WO2016190652A1 (fr) Dispositif électronique, système de fourniture d'informations et procédé de fourniture d'informations associé
WO2014003354A1 (fr) Procédé de commande de terminal ayant recours à la sensibilité au contexte et terminal correspondant
WO2012022215A1 (fr) Procédé, dispositif et système d'interaction permettant un message interactif sur internet
WO2013191408A1 (fr) Procédé pour améliorer une reconnaissance tactile et dispositif électronique correspondant
WO2019124770A1 (fr) Appareil terminal et procédé de commande d'appareil terminal

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19935220

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19935220

Country of ref document: EP

Kind code of ref document: A1