An intelligent control system of keyboard and mouse based on Internet of Things

Abstract

The present invention relates to the technical field of user abnormal behavior recognition, and discloses a keyboard and mouse intelligent control system based on the Internet of Things, including: a data acquisition module, which is used to obtain operation data, environmental data and screen images when a user uses a computer; a data processing module, which is used to pre-process the operation data and environmental data to obtain first feature data; a user behavior analysis module, which is used to analyze the first feature data, and judge whether the user's current behavior is abnormal based on rule thresholds and support vector machines; an intervention assessment module, which is used to obtain a behavior feature score according to the first feature data, obtain a context-sensitive feature score according to the operation data and environmental data, and calculate the behavior feature score and the context-sensitive feature score through a nonlinear combination formula to obtain a comprehensive risk score, and then take intervention measures. The present invention realizes real-time recognition, accurate prediction and dynamic intervention of abnormal behaviors of users when using computers.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormal user behavior recognition, and in particular relates to an intelligent keyboard and mouse control system based on the Internet of Things. Background Art

[0002] When operating a computer, users may make abnormal operations due to misoperation, fatigue or malicious behavior, such as accidentally deleting important files, unnecessary confirmation operations or triggering potential risky behaviors. These abnormal operations may lead to data loss, property loss and even information security issues. Therefore, real-time detection of user behavior and intervention when necessary has become a technical problem that needs to be solved urgently.

[0003] Existing user behavior monitoring technologies usually rely on single features or static rules for detection, such as analyzing operation logs to determine whether the behavior is abnormal. These methods have significant limitations: single feature analysis is prone to missed detection, static rules lack adaptability and are difficult to cope with complex and changing user behaviors. In addition, traditional methods usually cannot monitor in real time and can only analyze after the fact, which makes it difficult to effectively avoid risky operations. Summary of the invention

[0004] The present invention provides an Internet of Things-based keyboard and mouse intelligent control system to solve the technical problems in related technologies of lack of real-time and adaptability, difficulty in accurately identifying complex and changeable abnormal behaviors of users, and inability to effectively avoid potentially risky operations.

[0005] The present invention provides a keyboard and mouse intelligent control system based on the Internet of Things, comprising:

[0006] A data acquisition module, which is used to acquire operation data, environmental data and screen images when a user uses a computer within a first preset time period T and at a preset time interval t, wherein the operation data includes: mouse pointer position, mouse click force, keyboard click force and keyboard click frequency, and the environmental data includes: currently running software type and current operation behavior type, and T and t are custom parameters;

[0007] The data processing module is used to pre-process the operation data and the environment data to obtain the first feature data. The specific steps include:

[0008] Step S201, using a sliding time window method to convert the operation data and environment data of N time points into the operation data and environment data of M time windows, each time window contains the operation data and environment data of Q time points, where M and Q are custom parameters;

[0009] Step S202, extracting the mouse pointer speed feature and the mouse pointer speed fluctuation rate feature according to the mouse pointer position in each time window, wherein the calculation formula of the mouse pointer movement speed feature is: ,in represents the average speed of the mouse pointer in the i-th time window, and Represents the displacement of the mouse pointer in the i-th time window, represents the time of the time window, i represents the index of the time window; the calculation formula of the mouse pointer speed fluctuation rate feature is: ,in, represents the volatility of the mouse pointer in the i-th time window, Q represents the number of time points in each time window, represents the speed of the mouse pointer at the jth time point in the i-th time window, where j represents the index of the time point;

[0010] Step S203, extracting the maximum mouse click force feature and the mouse click force fluctuation rate feature according to the mouse click force in each time window, wherein the calculation formula of the mouse click force fluctuation rate feature is: ,in, represents the fluctuation rate of the mouse click force in the i-th time window, represents the number of mouse clicks in the i-th time window, represents the intensity of the a-th mouse click in the i-th time window, where a represents the index of the number of mouse clicks;

[0011] Step S204, extracting the keyboard click force mutation rate feature according to the keyboard click force in each time window, wherein the calculation formula of the keyboard click force mutation rate feature is: ,in, represents the mutation rate of the keyboard force in the i-th time window, represents the number of keyboard clicks in the i-th time window, and They represent the strength of the c+1th and cth keyboard clicks in the i-th time window, respectively. c represents the index of the number of keyboard clicks in the i-th time window. Indicates the preset mutation threshold, Indicates an indicator function, which returns 1 when the condition is met, otherwise it returns 0;

[0012] Step S205, using a z-score normalization method to normalize the mouse pointer speed feature, the mouse pointer speed fluctuation rate feature, the maximum mouse click force feature, the mouse click force fluctuation rate feature, and the keyboard click force mutation rate feature, and concatenate them to obtain first feature data;

[0013] A user behavior analysis module, which is used to analyze the first feature data and determine whether the user's current behavior is abnormal based on a rule threshold and a support vector machine;

[0014] The intervention assessment module is used to obtain a behavioral feature score based on the first feature data, obtain a context-sensitive feature score based on the operation data and the environmental data, and calculate the behavioral feature score and the context-sensitive feature score through a nonlinear combination formula to obtain a comprehensive risk score, and finally take intervention measures based on the comprehensive risk score.

[0015] Furthermore, the currently running software type includes: common software and sensitive software, and the currently running software type is represented by a real number code; the current operation behavior type includes: common operation and sensitive operation, and the current operation behavior type is represented by a real number code.

[0016] Furthermore, the step of obtaining the type of currently running software and the type of current operation behavior includes:

[0017] Step S301, obtaining the currently active window and window information of the computer, the window information including: window title and process name;

[0018] Step S302, querying a predefined "sensitive software library", if the window title or process name successfully matches the "sensitive software library", then determining that the currently running software type is sensitive software, wherein the "sensitive software library" includes the software name and process name of the running software;

[0019] Step S303, setting the region of interest of the active window according to the screen image, and extracting text content of the region of interest;

[0020] Step S304, matching the extracted text content with the predefined "sensitive keyword library", if the match is successful, it means that the current operation behavior type is a sensitive behavior, otherwise it means that the current operation behavior type is a common type.

[0021] Furthermore, the user's current behavior is judged by combining the first feature data with the preset exception rules. The specific method is: each feature value extracted based on the time window in the first feature data is compared with the threshold of the preset exception rule one by one. When any item exceeds the corresponding threshold, the current behavior is judged to be abnormal.

[0022] Furthermore, a support vector machine is used to determine whether the user's current behavior is abnormal. The specific steps include:

[0023] Step S401, collecting historical operation data and environmental data, pre-processing them, and annotating each piece of data by manual annotation to obtain second sample data, and building a support vector machine model based on the second sample data, wherein the second sample data includes: data with a target value of 0 indicating normal behavior, and data with a target value of 1 indicating abnormal behavior;

[0024] Step S402: construct an objective function and constraint conditions of a support vector machine according to the second sample data. The objective function is: ,in, represents the normal vector of the classification hyperplane, represents the regularization strength parameter, represents the dimension of the second sample data, represents the weight coefficient associated with the e-th feature, e represents the feature index, C represents the loss term weight coefficient, f represents the number of second sample data, and p represents the exponential coefficient. Indicates the distance that the g-th sample deviates from the classification interval, g represents the sample index, and the constraints are: ,in, represents the g-th sample, represents the target value of the g-th sample, represents the bias vector of the hyperplane;

[0025] Step S403, preprocessing the real-time acquired operation data and environment data to obtain first feature data, and judging through a support vector machine model to obtain a result of whether the user behavior is abnormal.

[0026] Further, a behavior feature score is obtained according to the first feature data, wherein the first feature data includes: a mouse pointer speed feature, a mouse pointer speed fluctuation rate feature, a maximum click mouse force feature, a click mouse force fluctuation rate feature, and a keyboard click force mutation rate feature. The correlation between each feature and a target variable indicating whether the user behavior is abnormal is analyzed using the Pearson correlation coefficient, and each feature is weighted by a normalized weight, wherein the target variable is represented by binary coding. The specific steps of obtaining the behavior feature score include:

[0027] Step S501, calculate the Pearson correlation coefficient between each feature in the first feature data and the target variable. The calculation formula of the Pearson correlation coefficient is: ,in, represents the Pearson correlation coefficient of the e-th feature, and represents the value of the e-th feature in the first feature data of the i-th time window and the target variable of the e-th feature, and represents the mean of the value of the e-th feature in the i-th time window and the mean of the target variable of the e-th feature in the i-th time window, h is the number of time windows, and e represents the feature index;

[0028] Step S502, normalizing the absolute value of the Pearson correlation coefficient into a weight;

[0029] Step S503, calculate the behavior feature score according to the value of each feature and the weight of the feature, and the calculation formula is: ,in, represents the behavioral trait score, represents the value of the e-th feature in the first feature data, represents the weight of the e-th feature in the first feature data, and z represents the number of features in the first feature data.

[0030] Furthermore, a context-sensitive feature score is obtained based on the operation data and the environment data. The specific steps include:

[0031] Step S601, when the currently running software type and the current operation behavior type are classified as sensitive software and sensitive behavior, respectively set the software type score and the operation behavior score;

[0032] Step S602, according to the distance between the mouse pointer position and the region of interest of the active window in step S303, a mouse position sensitivity score is set, and the mathematical expression of the mouse position sensitivity score is:

[0033] ,in, represents the context-sensitive feature score, Indicates the distance between the mouse pointer position and the area of ​​interest. Indicates the set minimum distance, that is, the mouse pointer is completely within the area of ​​interest. Indicates the maximum distance set;

[0034] Step S603: Calculate the context-sensitive feature score by weighted summing the software type score, the operation behavior score and the mouse position sensitivity score.

[0035] Furthermore, the comprehensive risk score is calculated based on the behavioral feature score and the context-sensitive feature score through a nonlinear combination formula. The nonlinear combination formula is: ,in, represents the comprehensive risk score, represents the context-sensitive feature score, represents the behavioral feature scoring weight coefficient, Indicates the smoothing coefficient, ranging from 0 to 1.

[0036] The beneficial effects of the present invention are as follows: the present invention collects user operation data and environmental data in real time and uses a sliding time window method to quickly process the data, thereby significantly improving the real-time performance and processing efficiency of behavior anomaly detection;

[0037] The present invention uses a dual detection mechanism combining rule thresholds and support vector machine models to quickly identify abnormal behaviors, which can reduce the risk of false alarms, effectively reduce the amount of calculation, and avoid wasting computing resources;

[0038] The present invention calculates the comprehensive risk score through nonlinear combination based on the user behavior feature score and the context-sensitive feature score, and classifies it, and takes corresponding intervention measures, ranging from slight prompts to mandatory operation interception, which not only ensures security but also optimizes the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a module schematic diagram of a keyboard and mouse intelligent control system based on the Internet of Things of the present invention;

[0040] Figure 2 is a flow chart of preprocessing operation data and environmental data of the present invention;

[0041] Figure 3 It is a flow chart of obtaining a behavior characteristic score based on first characteristic data of the present invention.

[0042] In the figure: data acquisition module 101, data processing module 102, user behavior analysis module 103 and intervention evaluation module 104. DETAILED DESCRIPTION

[0043] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and implement the subject matter described herein, and the functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the contents of this specification. Each example may omit, replace or add various processes or components as needed. In addition, the features described relative to some examples may also be combined in other examples.

[0044] like Figure 1-Figure 3 As shown, a keyboard and mouse intelligent control system based on the Internet of Things includes:

[0045] The data acquisition module 101 is used to acquire the operation data, environment data and screen image of the user when using the computer at a preset time interval t within a first preset time period T, wherein the operation data includes: the position of the mouse pointer, the mouse click force, the keyboard click force and the keyboard click frequency, and the environment data includes: the type of the currently running software and the type of the current operation behavior, and T and t are custom parameters;

[0046] The data processing module 102 is used to pre-process the operation data and the environment data to obtain the first feature data. The specific steps include:

[0047] Step S201, using a sliding time window method to convert the operation data and environment data of N time points into the operation data and environment data of M time windows, each time window contains the operation data and environment data of Q time points, where M and Q are custom parameters;

[0048] Step S202, extracting the mouse pointer speed feature and the mouse pointer speed fluctuation rate feature according to the mouse pointer position in each time window, wherein the calculation formula of the mouse pointer movement speed feature is: ,in represents the average speed of the mouse pointer in the i-th time window, and Represents the displacement of the mouse pointer in the i-th time window, represents the time of the time window, i represents the index of the time window; the calculation formula of the mouse pointer speed fluctuation rate feature is: ,in, represents the volatility of the mouse pointer in the i-th time window, Q represents the number of time points in each time window, represents the speed of the mouse pointer at the jth time point in the i-th time window, where j represents the index of the time point;

[0049] Step S203, extracting the maximum mouse click force feature and the mouse click force fluctuation rate feature according to the mouse click force in each time window, wherein the calculation formula of the mouse click force fluctuation rate feature is: ,in, represents the fluctuation rate of the mouse click force in the i-th time window, represents the number of mouse clicks in the i-th time window, represents the intensity of the a-th mouse click in the i-th time window, where a represents the index of the number of mouse clicks;

[0050] Step S204, extracting the keyboard click force mutation rate feature according to the keyboard click force in each time window, wherein the calculation formula of the keyboard click force mutation rate feature is: ,in, represents the mutation rate of the keyboard force in the i-th time window, represents the number of keyboard clicks in the i-th time window, and They represent the strength of the c+1th and cth keyboard clicks in the i-th time window, respectively. c represents the index of the number of keyboard clicks in the i-th time window. Indicates the preset mutation threshold, Indicates an indicator function, which returns 1 when the condition is met, otherwise it returns 0;

[0051] Step S205, using a z-score normalization method to normalize the mouse pointer speed feature, the mouse pointer speed fluctuation rate feature, the maximum mouse click force feature, the mouse click force fluctuation rate feature, and the keyboard click force mutation rate feature, and concatenate them to obtain first feature data;

[0052] A user behavior analysis module 103, which is used to analyze the first feature data and determine whether the user's current behavior is abnormal based on a rule threshold and a support vector machine;

[0053] The intervention assessment module 104 is used to obtain a behavioral feature score based on the first feature data, obtain a context-sensitive feature score based on the operation data and the environmental data, and calculate the behavioral feature score and the context-sensitive feature score through a nonlinear combination formula to obtain a comprehensive risk score, and finally take intervention measures based on the comprehensive risk score.

[0054] In one embodiment of the present invention, the screen coordinates of the mouse pointer can be obtained in real time using the API provided by the system, the mouse click force can be obtained through the driver using a mouse device that supports pressure detection, the keyboard click force can be read through a dedicated SDK using a keyboard device that supports key force perception, and the keyboard click force can be captured using the API provided by the system to obtain the keyboard click frequency.

[0055] In one embodiment of the present invention, the currently running software types include: ordinary software and sensitive software, sensitive software means software with high risks or involving important operations, such as stock trading platforms, enterprise financial management systems, file managers and other software, and the currently running software types are represented by real number codes; the current operation behavior types include: ordinary operations and sensitive operations, sensitive operations mean high-risk operations that may have a significant impact on users, such as deleting files, emptying the recycle bin, confirming payments, submitting orders and other operations, and the current operation behavior types are represented by real number codes.

[0056] In one embodiment of the present invention, the step of obtaining the type of currently running software and the type of current operation behavior includes:

[0057] Step S301, obtaining the current active window and window information by calling a computer API, the window information including: window title and process name;

[0058] Step S302, query the predefined "sensitive software library", if the window title or process name matches the "sensitive software library", then determine that the currently running software type is sensitive software, where the "sensitive software library" includes the software name and process name of the running software, for example: {["Tonghuashun": "zdsj.exe", "dexin.exe"],

[0059] [“File Manager”: “explorer.exe”],

[0060] [“UFIDA U8”: “U8Client.exe”]};

[0061] Step S303, setting the region of interest of the active window according to the screen image, extracting text content from the region of interest using Tesseract OCR technology, and loading a preset language package to improve recognition accuracy and reduce the amount of calculation. The region of interest of the active window in the present invention is the area where the button is located, usually the bottom of the active window, and the area of ​​20% of the bottom of the active window is intercepted and used as the region of interest, which can reduce the time of content recognition and improve response efficiency;

[0062] Step S304, matching the extracted text content with the predefined "sensitive keyword library", a successful match indicates that the current operation behavior type is a sensitive behavior, otherwise it indicates that the current operation behavior type is a common type, the "sensitive keyword library" includes keywords for different sensitive operation behaviors, for example: ["delete", "clear", "confirm", "confirm"].

[0063] In one embodiment of the present invention, the user's current behavior is judged by combining the first feature data with the preset exception rules. The specific method is: each feature value extracted based on the time window in the first feature data is compared with the threshold of the preset exception rule one by one. When any item exceeds the corresponding threshold, the current behavior is judged to be abnormal.

[0064] In one embodiment of the present invention, a support vector machine is used to determine whether the current behavior of the user is abnormal. The specific steps include:

[0065] Step S401, collecting historical operation data and environmental data, pre-processing them, and annotating each piece of data by manual annotation to obtain second sample data, and building a support vector machine model based on the second sample data, wherein the second sample data includes: data with a target value of 0 indicating normal behavior, and data with a target value of 1 indicating abnormal behavior;

[0066] Step S402: construct an objective function and constraint conditions of a support vector machine according to the second sample data. The objective function is: ,in, represents the normal vector of the classification hyperplane, represents the regularization strength parameter, represents the dimension of the second sample data, represents the weight coefficient associated with the e-th feature, e represents the feature index, C represents the loss term weight coefficient, f represents the number of second sample data, and p represents the exponential coefficient. Indicates the distance that the g-th sample deviates from the classification interval, g represents the sample index, and the constraints are: ,in, represents the g-th sample, represents the target value of the g-th sample, represents the bias vector of the hyperplane;

[0067] The first feature data participates in the classification process and indirectly determines the position of the objective function and the hyperplane. The goal of the support vector machine is to find a classification hyperplane that maximizes the interval between the two types of data.

[0068] Step S403, preprocessing the real-time acquired operation data and environmental data to obtain the first feature data, and judging through the support vector machine model to obtain the result of whether the user behavior is abnormal. When the result is 1, it indicates that the current behavior is normal, and when the result is -1, it indicates that the current behavior is abnormal.

[0069] In one embodiment of the present invention, the user behavior analysis module can quickly identify whether the user behavior is abnormal through simple rule thresholds and support vector machines, and exclude normal behavior, which can effectively reduce the amount of calculation and avoid wasting computing resources. The screened abnormal behavior will be handed over to the subsequent intervention evaluation module for detailed analysis.

[0070] In one embodiment of the present invention, a behavior feature score is obtained according to first feature data, wherein the first feature data includes: a mouse pointer speed feature, a mouse pointer speed fluctuation rate feature, a maximum click mouse force feature, a click mouse force fluctuation rate feature, and a keyboard click force mutation rate feature. The correlation between each feature and a target variable indicating whether the user behavior is abnormal is analyzed using a Pearson correlation coefficient, and each feature is weighted by a normalized weight, wherein the target variable is represented by a binary code, for example, 0 represents normal behavior and 1 represents abnormal behavior. The specific steps of obtaining the behavior feature score include:

[0071] Step S501, calculate the Pearson correlation coefficient between each feature in the first feature data and the target variable. The calculation formula of the Pearson correlation coefficient is: ,in, represents the Pearson correlation coefficient of the e-th feature, and represents the value of the e-th feature in the first feature data of the i-th time window and the target variable of the e-th feature, and represents the mean of the value of the e-th feature in the i-th time window and the mean of the target variable of the e-th feature in the i-th time window, h is the number of time windows, and e represents the feature index;

[0072] Step S502, normalizing the absolute value of the Pearson correlation coefficient into a weight. By normalizing the Pearson correlation coefficient, it can be mapped to a range of 0 to 1, wherein the normalized calculation formula is: ,in, represents the weight of the feature in the first feature data, and represents the i-th feature and the k-th feature in the first feature data, and z represents the number of features in the first feature data;

[0073] Step S503, calculate the behavior feature score according to the value of each feature and the weight of the feature, and the calculation formula is: ,in, represents the behavioral trait score, represents the value of the e-th feature in the first feature data, represents the weight of the e-th feature in the first feature data, and z represents the number of features in the first feature data.

[0074] In one embodiment of the present invention, the weight of the feature is determined by calculating the Pearson correlation coefficient of the feature. This method can intuitively quantify the linear correlation between the feature and the user behavior, and has low computational complexity, simple implementation, and strong real-time performance.

[0075] In one embodiment of the present invention, the context-sensitive feature score is obtained according to the operation data and the environment data, and the specific steps include:

[0076] Step S601: When the currently running software type and the current operation behavior type are classified as sensitive software and sensitive behavior, respectively set the software type score and the operation behavior score. For example, when the currently running software type is sensitive software, the software type score is set to 1, otherwise it is set to 0.2. When the current operation behavior type is sensitive behavior, the operation behavior score is set to 1, otherwise it is set to 0.

[0077] Step S602, according to the distance between the mouse pointer position and the region of interest of the active window in step S303, a mouse position sensitivity score is set, and the mathematical expression of the mouse position sensitivity score is:

[0078] ,in, represents the mouse position sensitivity score, Indicates the distance between the mouse pointer position and the area of ​​interest. Indicates the set minimum distance, that is, the mouse pointer is completely within the area of ​​interest. Indicates the maximum distance set;

[0079] Step S603: Calculate the context sensitive feature score by weighted summation based on the software type score, operation behavior score and mouse position sensitivity score. , the calculation formula is:

[0080] ,in, represents the context-sensitive feature score, , and They represent software type score, operation behavior score and mouse position sensitivity score respectively. , and They represent software type weight, operation behavior weight and mouse position weight respectively.

[0081] In one embodiment of the present invention, a comprehensive risk score is calculated based on the behavior feature score and the context-sensitive feature score through a nonlinear combination formula, and the nonlinear combination formula is: ,in, represents the comprehensive risk score, represents the behavioral feature scoring weight coefficient, Represents the smoothing coefficient, which ranges from 0 to 1 and is used to limit the extreme fluctuations of the risk score.

[0082] In one embodiment of the present invention, the comprehensive risk score is divided into different levels for classifying the severity of abnormal behavior. Specifically, when the risk score is between 0 and 0.3, the risk level is low risk, and the intervention measures for this risk level are: recording the behavior in the background and displaying non-intrusive prompts, such as pop-ups in the corners of the screen; when the risk score is between 0.3 and 0.6, the risk level is medium risk, and the intervention measures for this risk level are: displaying an obvious but non-mandatory pop-up window in the center of the screen, requiring the user to confirm the operation, and at the same time, the keyboard light flashes to remind the user of the risk; when the risk score is between 0.6 and 0.8, the risk level is high risk, and the intervention measures for this risk level are: popping up a mandatory confirmation window in the center of the screen, requiring the user to enter a preset password; when the risk score is between 0.8 and 1, the risk level is extremely high risk, and the intervention measures for this risk level are: interrupting the current operation and requiring the user to perform multiple verifications to confirm the identity and current status.

[0083] The above describes an embodiment of the present embodiment, but the present embodiment is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present embodiment, ordinary technicians in this field can also make many forms, all of which are within the protection of the present embodiment.

Claims

1. A keyboard and mouse intelligent control system based on the Internet of Things, characterized in that: include: A data acquisition module, which is used to acquire operation data, environmental data and screen images when a user uses a computer within a first preset time period T and at a preset time interval t, wherein the operation data includes: mouse pointer position, mouse click force, keyboard click force and keyboard click frequency, and the environmental data includes: currently running software type and current operation behavior type, and T and t are custom parameters; The data processing module is used to pre-process the operation data and the environment data to obtain the first feature data. The specific steps include: Step S201, using a sliding time window method to convert the operation data and environment data of N time points into the operation data and environment data of M time windows, each time window contains the operation data and environment data of Q time points, where M and Q are custom parameters; Step S202, extracting the mouse pointer speed feature and the mouse pointer speed fluctuation rate feature according to the mouse pointer position in each time window, wherein the calculation formula of the mouse pointer movement speed feature is: ,in represents the average speed of the mouse pointer in the i-th time window, and Represents the displacement of the mouse pointer in the i-th time window, represents the time of the time window, i represents the index of the time window; the calculation formula of the mouse pointer speed fluctuation rate feature is: ,in, represents the volatility of the mouse pointer in the i-th time window, Q represents the number of time points in each time window, represents the speed of the mouse pointer at the jth time point in the i-th time window, where j represents the index of the time point; Step S203, extracting the maximum mouse click force feature and the mouse click force fluctuation rate feature according to the mouse click force in each time window, wherein the calculation formula of the mouse click force fluctuation rate feature is: ,in, represents the fluctuation rate of the mouse click force in the i-th time window, represents the number of mouse clicks in the i-th time window, represents the intensity of the a-th mouse click in the i-th time window, where a represents the index of the number of mouse clicks; Step S204, extracting the keyboard click force mutation rate feature according to the keyboard click force in each time window, wherein the calculation formula of the keyboard click force mutation rate feature is: ,in, represents the mutation rate of the keyboard force in the i-th time window, represents the number of keyboard clicks in the i-th time window, and They represent the strength of the c+1th and cth keyboard clicks in the i-th time window, respectively. c represents the index of the number of keyboard clicks in the i-th time window. Indicates the preset mutation threshold, Indicates an indicator function, which returns 1 when the condition is met, otherwise it returns 0; Step S205, using a z-score normalization method to normalize the mouse pointer speed feature, the mouse pointer speed fluctuation rate feature, the maximum mouse click force feature, the mouse click force fluctuation rate feature, and the keyboard click force mutation rate feature, and concatenate them to obtain first feature data; A user behavior analysis module, which is used to analyze the first feature data and determine whether the user's current behavior is abnormal based on a rule threshold and a support vector machine; An intervention assessment module, which is used to obtain a behavior feature score according to the first feature data, obtain a context-sensitive feature score according to the operation data and the environment data, and calculate the behavior feature score and the context-sensitive feature score through a nonlinear combination formula to obtain a comprehensive risk score, and finally take intervention measures according to the comprehensive risk score; Among them, the nonlinear combination formula is: , represents the behavioral trait score, represents the comprehensive risk score, represents the context-sensitive feature score, represents the behavioral feature scoring weight coefficient, Indicates the smoothing coefficient, ranging from 0 to 1.

2. According to the Internet of Things-based keyboard and mouse intelligent control system according to claim 1, it is characterized in that: The currently running software types include: common software and sensitive software, and the currently running software types are represented by real number codes; the current operation behavior types include: common operations and sensitive operations, and the current operation behavior types are represented by real number codes.

3. According to the Internet of Things-based keyboard and mouse intelligent control system according to claim 1, it is characterized in that: The steps for obtaining the type of the currently running software and the type of the current operation behavior include: Step S301, obtaining the currently active window and window information of the computer, the window information including: window title and process name; Step S302, querying a predefined sensitive software library, if the window title or process name matches the sensitive software library successfully, then determining that the currently running software type is sensitive software, wherein the sensitive software library includes the software name and process name of the running software; Step S303, setting the region of interest of the active window according to the screen image, and extracting text content of the region of interest; Step S304, matching the extracted text content with a predefined sensitive keyword library, if the match is successful, it indicates that the current operation behavior type is a sensitive behavior, otherwise it indicates that the current operation behavior type is a common type.

4. According to the Internet of Things-based keyboard and mouse intelligent control system according to claim 1, it is characterized in that: The user's current behavior is judged by combining the first feature data with the preset exception rules. The specific method is: each feature value extracted based on the time window in the first feature data is compared with the threshold of the preset exception rule one by one. When any item exceeds the corresponding threshold, the current behavior is judged to be abnormal.

5. According to the Internet of Things-based keyboard and mouse intelligent control system according to claim 1, it is characterized in that: Use support vector machine to determine whether the user's current behavior is abnormal. The specific steps include: Step S401, collecting historical operation data and environmental data, pre-processing them, and annotating each piece of data by manual annotation to obtain second sample data, and building a support vector machine model based on the second sample data, wherein the second sample data includes: data with a target value of 0 indicating normal behavior, and data with a target value of 1 indicating abnormal behavior; Step S402: construct an objective function and constraint conditions of a support vector machine according to the second sample data. The objective function is: ,in, represents the normal vector of the classification hyperplane, represents the regularization strength parameter, represents the dimension of the second sample data, represents the weight coefficient associated with the e-th feature, e represents the feature index, C represents the loss term weight coefficient, f represents the number of second sample data, and p represents the exponential coefficient. Indicates the distance that the g-th sample deviates from the classification interval, g represents the sample index, and the constraints are: ,in, represents the g-th sample, represents the target value of the g-th sample, represents the bias vector of the hyperplane; Step S403, preprocessing the real-time acquired operation data and environment data to obtain first feature data, and judging through a support vector machine model to obtain a result of whether the user behavior is abnormal.

6. The keyboard and mouse intelligent control system based on the Internet of Things according to claim 1 is characterized in that: A behavior feature score is obtained according to the first feature data, wherein the first feature data includes: a mouse pointer speed feature, a mouse pointer speed fluctuation rate feature, a maximum click mouse force feature, a click mouse force fluctuation rate feature, and a keyboard click force mutation rate feature. The correlation between each feature and a target variable indicating whether the user behavior is abnormal is analyzed using the Pearson correlation coefficient, and each feature is weighted by a normalized weight, wherein the target variable is represented by binary coding. The specific steps of obtaining the behavior feature score include: Step S501, calculate the Pearson correlation coefficient between each feature in the first feature data and the target variable. The calculation formula of the Pearson correlation coefficient is: ,in, represents the Pearson correlation coefficient of the e-th feature, and represents the value of the e-th feature in the first feature data of the i-th time window and the target variable of the e-th feature, and represents the mean of the value of the e-th feature in the i-th time window and the mean of the target variable of the e-th feature in the i-th time window, h is the number of time windows, and e represents the feature index; Step S502, normalizing the absolute value of the Pearson correlation coefficient into a weight; Step S503, calculate the behavior feature score according to the value of each feature and the weight of the feature, and the calculation formula is: ,in, represents the behavioral trait score, represents the value of the e-th feature in the first feature data, represents the weight of the e-th feature obtained in step S502, and z represents the number of features in the first feature data.

7. The keyboard and mouse intelligent control system based on the Internet of Things according to claim 3 is characterized in that: The context-sensitive feature scores are obtained based on the operation data and the environment data. The specific steps include: Step S601, when the currently running software type and the current operation behavior type are classified as sensitive software and sensitive behavior, respectively set the software type score and the operation behavior score; Step S602, according to the distance between the mouse pointer position and the region of interest of the active window in step S303, a mouse position sensitivity score is set, and the mathematical expression of the mouse position sensitivity score is: ,in, represents the context-sensitive feature score, Indicates the distance between the mouse pointer position and the area of ​​interest. Indicates the set minimum distance, that is, the mouse pointer is completely within the area of ​​interest. Indicates the maximum distance set; Step S603: Calculate the context-sensitive feature score by weighted summing the software type score, the operation behavior score and the mouse position sensitivity score.

Images