IM software screenshot behavior recognition blocking method and system

Abstract

The invention provides an IM software screenshot behavior recognition blocking method and system, and relates to the technical field of information security, and the method comprises the steps: respectively constructing API functions for screenshot cache picture loading and clipboard bitmap pasting; loading parameters of an API function based on the screenshot cache picture, obtaining a picture path of the currently loaded screenshot cache picture, combining screenshot cache directories of different IM software, checking whether the currently loaded screenshot cache picture is in the screenshot cache directories or not, judging whether the current process is a picture loading process in the screenshot or not, and if yes, querying whether the loading operation is blocked or not; querying whether the clipboard has screenshot bitmap information or not based on the parameter of the API function pasted by the clipboard bitmap, and if the clipboard has the bitmap information, querying whether the pasting operation is blocked or not; wherein the pictures needing to be blocked are operated, API error values are set, errors are directly returned, and for the pictures allowed to be loaded, an original hook interface is called, and result values of the pictures are returned.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method and system for identifying and blocking IM software screenshot behavior. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] When using IM software to communicate or discuss issues, I always like to use some pictures or screenshots to better express my ideas, because pictures can better describe the points that need to be expressed.

[0004] Therefore, IM chat software basically has the function of screenshot, which can capture content from any location at any time and send it to the other party. This also increases the risk of information leakage.

[0005] However, there are screenshot tool software and screenshot content recognition software on the market, but in the screenshot operation recognition method, if the screenshot operation is accurately identified during the screenshot process, if it is identified that the screenshot content contains key information, the picture will be blocked from being pasted into the editing box. At present, this screenshot behavior recognition and blocking technical method cannot effectively track the key positions in the screenshot operation, and cannot effectively identify the entire screenshot process to make corresponding screenshot operation judgments and thus block it. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a method and system for identifying and blocking IM software screenshot behavior. According to the characteristics of the IM software screenshot operation process and combined with the API Hook monitoring method, the path of the screenshot cache directory and the API function for loading pictures are analyzed, and the operation of loading pictures by the API is monitored through the API hook.

[0007] According to some embodiments, the present disclosure adopts the following technical solutions:

[0008] A method for identifying and blocking IM software screenshot behavior, comprising:

[0009] Construct API functions for loading screenshot cache images and pasting clipboard bitmaps respectively;

[0010] Based on the parameters of the screenshot cache image loading API function, the image path of the currently loaded screenshot cache image is obtained. Combined with the screenshot cache directories of different IM software, it is verified whether the currently loaded screenshot cache image is in the screenshot cache directory, and it is determined whether the current process is loading the image in the screenshot. If so, it is queried whether to block the loading operation.

[0011] Based on the parameters of the API function for pasting the clipboard bitmap, query whether the clipboard has the screenshot bitmap information. If there is bitmap information, query whether to block the paste operation;

[0012] For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0013] According to some embodiments, the present disclosure adopts the following technical solutions:

[0014] An IM software screenshot behavior recognition and blocking system, comprising:

[0015] Function construction module, used to construct API functions for loading screenshot cache images and pasting clipboard bitmaps;

[0016] The image loading identification module is used to obtain the image path of the currently loaded screenshot cache image based on the parameters of the screenshot cache image loading API function, and verify whether the currently loaded screenshot cache image is in the screenshot cache directory in combination with the screenshot cache directories of different IM software, and determine whether the current process is loading the image in the screenshot. If so, query whether to block the loading operation;

[0017] The image paste recognition module is used to query whether the clipboard has the screenshot bitmap information based on the parameters of the API function of the clipboard bitmap paste. If there is bitmap information, it queries whether to block the paste operation;

[0018] For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0019] According to some embodiments, the present disclosure adopts the following technical solutions:

[0020] A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method for identifying and blocking IM software screenshot behavior is implemented.

[0021] According to some embodiments, the present disclosure adopts the following technical solutions:

[0022] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the method for identifying and blocking IM software screenshot behavior.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] The present invention discloses a method for identifying and blocking IM software screenshot behavior. In the screenshot process of IM software, the path of the screenshot cache directory and the API function for loading pictures are analyzed by debugging software. After obtaining the above two pieces of information, the operation of loading pictures by the APIhook can be monitored. Another key point of hook monitoring is clipboard pasting. The commonly used screenshot function usually saves the picture in the clipboard as a bitmap after the screenshot, so it is necessary to focus on the clipboard paste operation to prevent the screenshot from being directly pasted from the clipboard to the edit box and sent out; by analyzing the screenshot characteristics of IM software and the screenshot cache directory, identifying and blocking the screenshot behavior, by intercepting and filtering the picture loading operation and the clipboard bitmap pasting operation in a fixed directory, it is possible to block the outbound sending of the screenshot picture from the screenshot button and right-click pasting bitmap; at the same time, the result is highly accurate and has no effect on other functions. At the same time, it can make up for the lack of relevant technologies on the market, and it is impossible to identify and block the screenshot behavior of IM software. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0026] Figure 1 This is a schematic diagram of the interactive process of the IM software screenshot recognition operation according to an embodiment of the present disclosure;

[0027] Figure 2 This is a flowchart of implementing screenshot monitoring and blocking according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0029] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0030] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0031] Example 1

[0032] In one embodiment of the present disclosure, a method for identifying and blocking IM software screenshot behavior is provided. The method finds key positions based on the characteristics of the IM software screenshot operation process and is implemented in combination with API Hook monitoring technology. The method identifies and blocks screenshot behavior by analyzing the IM software screenshot characteristics and the screenshot cache directory, including:

[0033] Step 1: Construct the API functions for loading screenshot cache images and pasting clipboard bitmaps respectively;

[0034] Step 2: Based on the parameters of the screenshot cache image loading API function, obtain the image path of the currently loaded screenshot cache image, and combine the screenshot cache directories of different IM software to verify whether the currently loaded screenshot cache image is in the screenshot cache directory, and determine whether the current process is loading the image in the screenshot. If so, query whether to block the loading operation;

[0035] Step 4: Based on the parameters of the API function for pasting the clipboard bitmap, query whether the clipboard has the screenshot bitmap information. If there is bitmap information, query whether to block the paste operation;

[0036] For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0037] As an embodiment, the specific implementation process of a method for identifying and blocking IM software screenshot behavior disclosed in the present invention includes:

[0038] Under normal rules, after the IM software takes a screenshot, it will save the screenshot to a directory with a special name under the %TEMP% directory (referred to as the screenshot cache directory, the same below), and only the screenshot will be saved in this directory. Then the notification window will load the cached image just saved into the edit box, and the entire screenshot process can be completed.

[0039] This interaction structure is structurally divided into two parts: IM software and hook module:

[0040] One of them is to analyze the screenshot cache directory path and the API function for loading pictures through debugging software in the screenshot process of IM software. After obtaining the above two pieces of information, the operation of loading pictures by the API can be monitored through API hook.

[0041] Another key point of hook monitoring is clipboard paste. The screenshot function we often use usually saves the image in the clipboard as a bitmap after taking the screenshot, so we should pay special attention to the clipboard paste operation to prevent the screenshot from being pasted directly from the clipboard outside the edit box and sent out.

[0042] Furthermore, hook two APIs to monitor when loading pictures and pasting clipboard pictures. This flowchart mainly describes the internal implementation logic of the monitoring API callback for analysis and explanation:

[0043] Use the screenshot cache image to load the API function callback, including:

[0044] Step 1. First, the screenshot cache image is loaded. The path of the image to be loaded can be obtained from the API function parameters for loading the screenshot cache image.

[0045] Step 2. Combine the screenshot cache directories of different IM software (different IM software has different corresponding directories, which need to be monitored and adapted through debugging software) to verify whether the currently loaded image is in the screenshot cache directory, so as to determine whether the current image is loaded after the screenshot operation. If not, ignore it.

[0046] Step 3. When loading the screenshot file in the screenshot cache directory, determine again whether the file suffix type is a picture file type, if not, ignore it.

[0047] Step 4. If it is confirmed to be an image file and the path is located in the screenshot cache directory, it is considered to be the process of loading the image in the screenshot, and the server is reported here to query whether the loading operation is blocked.

[0048] Furthermore, the callback of the API function for pasting the clipboard bitmap includes:

[0049] Step 1. First check whether the clipboard has the screenshot bitmap information, if not, ignore it.

[0050] Step 2. If there is bitmap information in the clipboard, save the bitmap image to disk as a local image.

[0051] Step 3. Report the saved image to the server to check whether the paste operation is blocked.

[0052] Finally, for the image operations that need to be blocked, directly set the API error value and return the error directly.

[0053] For images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0054] Example 2

[0055] In one embodiment of the present disclosure, a system for identifying and blocking IM software screenshot behavior is provided, comprising:

[0056] Function construction module, used to construct API functions for loading screenshot cache images and pasting clipboard bitmaps;

[0057] The image loading identification module is used to obtain the image path of the currently loaded screenshot cache image based on the parameters of the screenshot cache image loading API function, and verify whether the currently loaded screenshot cache image is in the screenshot cache directory in combination with the screenshot cache directories of different IM software, and determine whether the current process is loading the image in the screenshot. If so, query whether to block the loading operation;

[0058] The image paste recognition module is used to query whether the clipboard has the screenshot bitmap information based on the parameters of the API function of the clipboard bitmap paste. If there is bitmap information, it queries whether to block the paste operation;

[0059] For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0060] As an embodiment, two APIs are hooked to monitor when loading pictures and pasting clipboard pictures. The flowchart mainly describes the internal implementation logic of the monitoring API callback for analysis and explanation:

[0061] Use the screenshot cache image to load the API function callback, including:

[0062] Step 1. First, the screenshot cache image is loaded. The path of the image to be loaded can be obtained from the API function parameters for loading the screenshot cache image.

[0063] Step 2. Combine the screenshot cache directories of different IM software (different IM software has different corresponding directories, which need to be monitored and adapted through debugging software) to verify whether the currently loaded image is in the screenshot cache directory, so as to determine whether the current image is loaded after the screenshot operation. If not, ignore it.

[0064] Step 3. When loading the screenshot file in the screenshot cache directory, determine again whether the file suffix type is a picture file type, if not, ignore it.

[0065] Step 4. If it is confirmed to be an image file and the path is located in the screenshot cache directory, it is considered to be the process of loading the image in the screenshot, and the server is reported here to query whether the loading operation is blocked.

[0066] Furthermore, the callback of the API function for pasting the clipboard bitmap includes:

[0067] Step 1. First check whether the clipboard has the screenshot bitmap information, if not, ignore it.

[0068] Step 2. If there is bitmap information in the clipboard, save the bitmap image to disk as a local image.

[0069] Step 3. Report the saved image to the server to check whether the paste operation is blocked.

[0070] Finally, for the image operations that need to be blocked, directly set the API error value and return the error directly.

[0071] For images that are allowed to be loaded, the original hook interface is called and the result value is returned.

[0072] Example 3

[0073] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the method for identifying and blocking IM software screenshot behavior is implemented.

[0074] Example 4

[0075] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the method for identifying and blocking IM software screenshot behavior.

[0076] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0078] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A method for identifying and blocking IM software screenshot behavior, characterized in that: include: Construct API functions for loading screenshot cache images and pasting clipboard bitmaps respectively; Based on the parameters of the screenshot cache image loading API function, the image path of the currently loaded screenshot cache image is obtained. Combined with the screenshot cache directories of different IM software, it is verified whether the currently loaded screenshot cache image is in the screenshot cache directory, and it is determined whether the current process is loading the image in the screenshot. If so, it is queried whether to block the loading operation. Based on the parameters of the API function for pasting the clipboard bitmap, query whether the clipboard has the screenshot bitmap information. If there is bitmap information, query whether to block the paste operation; For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

2. A method for identifying and blocking IM software screenshot behavior as claimed in claim 1, characterized in that: After the IM software completes the screenshot, it will save the screenshot image to a screenshot cache directory with a special name under the %TEMP% directory, and only the screenshot image will be saved in the screenshot cache directory.

3. A method for identifying and blocking IM software screenshot behavior as claimed in claim 1, characterized in that: In the screenshot process of IM software, the path of the screenshot cache directory and the API function for loading pictures are obtained through debugging software analysis.

4. The method for identifying and blocking IM software screenshot behavior according to claim 1, characterized in that: Utilize the callback of screenshot cache image loading API function, first load the screenshot cache image, obtain the path of the image to be loaded based on the API function parameters of loading cache image, and verify whether the currently loaded image is in the screenshot cache directory in combination with the screenshot cache directories of different IM software, so as to determine whether the current image is loaded after the screenshot operation, if not, ignore it. When loading the screenshot file in the screenshot cache directory, determine again whether the file suffix type is the image file type, if not, ignore it.

5. A method for identifying and blocking IM software screenshot behavior as claimed in claim 4, characterized in that: If it is confirmed to be an image file and the path is located in the screenshot cache directory, it is considered to be the process of loading the image in the screenshot, and the server is reported here to query whether the loading operation is blocked.

6. The method for identifying and blocking IM software screenshot behavior according to claim 1, characterized in that: Utilize the callback of the API function of clipboard bitmap paste to query whether the clipboard has screenshot bitmap information. If not, ignore it. If the clipboard has bitmap information, save the bitmap image to disk as a local image, and report the saved image to the server to query whether to block the paste operation.

7. A method for identifying and blocking IM software screenshot behavior as claimed in claim 6, characterized in that: Report to the server to check whether it is allowed to send pictures externally. If it is allowed, call the original API and return the result. If it is not allowed, set the API error value and return the error directly.

8. An IM software screenshot behavior recognition and blocking system, characterized in that: include: Function construction module, used to construct API functions for loading screenshot cache images and pasting clipboard bitmaps; The image loading identification module is used to obtain the image path of the currently loaded screenshot cache image based on the parameters of the screenshot cache image loading API function, and verify whether the currently loaded screenshot cache image is in the screenshot cache directory in combination with the screenshot cache directories of different IM software, and determine whether the current process is loading the image in the screenshot. If so, query whether to block the loading operation; The image paste recognition module is used to query whether the clipboard has the screenshot bitmap information based on the parameters of the API function of the clipboard bitmap paste. If there is bitmap information, it queries whether to block the paste operation; For the image operations that need to be blocked, the API error value is set and the error is directly returned. For the images that are allowed to be loaded, the original hook interface is called and the result value is returned.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the method for identifying and blocking IM software screenshot behavior as described in any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement a method for identifying and blocking IM software screenshot behavior as described in any one of claims 1-7.

Images