Method, device and equipment for distinguishing operators

Abstract

The invention relates to the technical field of information security, in particular to a method, device and equipment for distinguishing operators. The method comprises the following steps: determining a first video including a process of logging in any account through a display interface of equipment, and determining a second video including a process of accessing target information corresponding to the any account through the display interface; determining a first parameter of the first video, and determining a second parameter of the second video; and if the first parameter is matched with the second parameter, determining that the first operator and the second operator are the same operator, otherwise, determining that the first operator and the second operator are not the same operator. Through the method, whether the first operator and the second operator are the same operator can be determined, and then whether the equipment suffers from offline attacks can be determined.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device and equipment for distinguishing operators. Background Art

[0002] When operators perform offline and local operations on some devices, they need to log in to an account. After successful login, they can perform related operations according to the account's permissions. However, when the operator leaves the device, other operators may use the logged-in account to operate the device and obtain some sensitive information, such as adding their own private accounts locally and opening sensitive permissions. This attack is difficult for operators to detect.

[0003] In order to prevent other operators from operating the device, the current practice is to detect the operating status of the device after the operator logs in to the account. If it is detected that the device has not been operated for a period of time (for example, 1800 seconds), the account will be automatically logged out. Although this practice can prevent other operators from operating the device to a certain extent, during the process of detecting the operating status of the device (within 1800 seconds), the device is still easy to be operated by other operators, and it is still not easy to find that the device has been operated by other operators. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, and device for distinguishing operators, which can determine whether the person who logs into a device and subsequently operates the device is the same person.

[0005] In a first aspect, an embodiment of the present application provides a method for distinguishing operators, the method comprising: Determine a first video including a process of logging into any one account through a display interface of a device, and determine a second video including a process of accessing target information corresponding to the any one account through the display interface, wherein the second video is collected when it is determined that the device logs into the any one account and no operation instruction is received for a preset continuous time; Determine a first parameter of the first video, and determine a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video; If the first parameter matches the second parameter, it is determined that the first operator and the second operator are the same person; otherwise, the first operator and the second operator are not the same person.

[0006] In the above embodiment, by comparing the first parameter of the video of the process of logging into the account and the second parameter of the video of the process of accessing the target information in the account, it can be determined whether the first operator who logs into the account and the second operator who accesses the target information are the same person, and then it can be determined whether the device is suffering from an offline attack; in addition, the second video is captured when no operation instructions are received for a preset continuous time. That is to say, after logging into the account, if the device continues to receive operation instructions, the second video will not be obtained, and the subsequent parameter comparison process will not be executed. This method can avoid unnecessary comparison processes.

[0007] In a possible implementation manner, determining the first parameter of the first video includes: Determine a plurality of first target images from the first video, and determine a first pixel coordinate of a mouse cursor in each first target image, wherein the plurality of first target images are continuous in time, each first target image contains a mouse cursor, and the first pixel coordinate of the mouse cursor in each first target image is different; Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates; Determining a first movement rate of the mouse cursor based on the first pixel distance; The determining a second parameter of the second video includes: Determine a plurality of second target images from the second video, and determine a second pixel coordinate of a mouse cursor in each second target image, wherein the plurality of second target images are continuous in time, each second target image contains a mouse cursor, and the second pixel coordinate of the mouse cursor in each second target image is different; Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates; Based on the second pixel distance, a second movement rate of the mouse cursor is determined.

[0008] In the above embodiment, the movement rate of the mouse cursor is used as a parameter of the video to determine whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same person, and a relatively accurate determination result can be obtained.

[0009] In a possible implementation manner, determining the first parameter of the first video includes: Counting a first number of times a mouse command is received in the first video; Based on the first number of times, determining a first instruction sending frequency of the mouse; The determining a second parameter of the second video includes: Counting a second number of times the mouse command is received in the second video; Based on the second number of times, a second instruction sending frequency of the mouse is determined.

[0010] In the above embodiment, the command sending frequency of the mouse is used as a parameter of the video to determine whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same person, so that a relatively accurate judgment result can be obtained.

[0011] In a possible implementation manner, whether the first parameter matches the second parameter is determined in the following manner: When it is determined that the resolution of the first video and the resolution of the second video are the same, if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, then it is determined that the first parameter and the second parameter match.

[0012] In the above embodiment, if the first movement rate of the mouse cursor matches the second movement rate of the mouse cursor, and the first command sending frequency of the mouse matches the second command sending frequency of the mouse, it indicates that the operating habits of the first operator corresponding to the first video and the operating habits of the second operator corresponding to the second video are the same, which means that the first operator and the second operator are determined to be the same.

[0013] In a possible implementation manner, determining that the first moving rate and the second moving rate match is performed in the following manner: If a first difference between a first movement rate of the mouse cursor and a second movement rate of the mouse cursor is within a first preset range, determining that the first movement rate and the second movement rate match; The first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse are matched by: If a second difference between the first instruction sending frequency and the second instruction sending frequency is within a second preset range, it is determined that the first instruction sending frequency and the second instruction sending frequency match.

[0014] In the above embodiment, when matching the first moving rate and the second moving rate, and when matching the first instruction sending frequency and the second instruction sending frequency, a certain error is allowed to obtain a more accurate matching result.

[0015] In a possible implementation, the method further includes: If the resolution of the first video is different from the resolution of the second video, the second movement rate of the mouse cursor is updated using the resolution of the first video and the resolution of the second video to obtain an updated second movement rate.

[0016] In the above embodiment, when the resolutions of the first video and the second video are different, the original second motion rate of the second video is updated using the resolution of the first video and the resolution of the second video to obtain an updated second motion rate, and the updated second motion rate is compared with the first motion rate, thereby shielding the impact of the display difference and making the judgment result more reliable.

[0017] In a second aspect, an embodiment of the present application provides a device for distinguishing operators, the device comprising: A video determination module, used to determine a first video including a process of logging into any one account through a display interface of a device, and to determine a second video including a process of accessing target information corresponding to any one account through the display interface, wherein the second video is collected when it is determined that the device logs into any one account and no operation instruction is received for a preset continuous time; a parsing module, configured to determine a first parameter of the first video and a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video; A distinguishing module is used to determine that when the first parameter matches the second parameter, the first operator and the second operator are the same person, and when the first parameter does not match the second parameter, the first operator and the second operator are not the same person.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method in the first aspect above.

[0019] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method of the first aspect above.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method of the first aspect when the computer program is executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic flow chart of a method for distinguishing operators according to an exemplary embodiment of the present invention; Figure 2A schematic diagram of a local account login according to an exemplary embodiment of the present invention; Figure 3 A schematic diagram of a specific flow chart of a method for distinguishing operators according to an exemplary embodiment of the present invention; Figure 4 A schematic diagram of a device for distinguishing operators according to an exemplary embodiment of the present invention; Figure 5 The figure is a schematic diagram of an electronic device according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0022] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present application, and are not intended to limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0023] Those skilled in the art know that the embodiments of the present application can be implemented as a system, device, method or computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0024] It should be understood herein that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0025] The following is an introduction to some concepts involved in the embodiments of the present application.

[0026] Equipment: In the embodiments of the present application, the equipment may refer to a device that is relatively large in size, not easy to carry around, and can be connected to an external mouse or display, such as a security device.

[0027] Because security equipment may be installed in supermarkets, hospital duty rooms, community security rooms and other places with large traffic, offline attacks are very feasible, and the current security equipment in the industry does not prevent such offline attacks, so offline attacks are very effective. Once an offline attack is successful, such as adding an account, it will create favorable conditions for subsequent network attacks, which can lead to a complete collapse of device security.

[0028] Target information: can refer to sensitive information or security information in any account, for example, the user management interface in any account.

[0029] Operation instructions: instructions entered by operators through the mouse, keyboard, etc. connected to the device.

[0030] Offline attack: An attacker, without knowing the device login account and password, can directly and quickly perform unauthorized and sensitive operations on the device while the local login is valid and the actual user is not around the device.

[0031] A method for distinguishing operators in an embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0032] In view of the problem that offline workers are difficult to be found, the present application embodiment provides a method for distinguishing operators, such as Figure 1 As shown, the method includes: S101: Determine a first video including a process of logging into any one account through a display interface of a device, and determine a second video including a process of accessing target information corresponding to the any one account through the display interface.

[0033] In the embodiment of the present application, the device may be a security device, and the login is a local account login, that is, the operator logs in through the display connected to the device, and the local account login requires identity authentication by entering a password through the keyboard or mouse. Figure 2 The figure shows the process of operators logging into any account. Operators can log into the local account by clicking the mouse and entering the password. Because the local account login requires a password verification and requires zero-distance operation login on the device, the local account login is safe. After the login is successful, the device can be operated while the login status persists.

[0034] After the local login is successful, the timing detection is started, that is, the continuous time for which the device has not received an operation instruction is detected to determine whether the operator who performs the local account login has left the device. When the device has not received an operation instruction for a preset continuous time, that is, has not received an instruction from an external mouse or external keyboard, it can be determined that the device is currently unattended, and the second video can be determined at this time. If the time for which the device has not received an operation instruction does not exceed the preset continuous time, it indicates that the device is currently being attended by someone, and there is no need to capture the second video.

[0035] If an offline attack occurs, the offline attacker may perform unauthorized or sensitive operations or add other accounts in the account currently logged in to the device. Therefore, the second video includes target information in any account, such as the user management interface.

[0036] When the target information is detected, the subsequent steps will be executed. Otherwise, it is determined that the device is not currently under offline attack and there is no need to perform subsequent offline attacker detection.

[0037] S102: Determine a first parameter of the first video, and determine a second parameter of the second video.

[0038] In an embodiment of the present application, the first parameter represents the operating habits of the first operator corresponding to the first video, and the second parameter represents the operating habits of the second operator corresponding to the second video. By comparing the first parameter and the second parameter, it can be determined whether the operator who operates the device to log in to the account is the same as the operator who accesses the target information in the account.

[0039] In the embodiment of the present application, the first parameter may include the following two types.

[0040] (1) The first movement rate of the mouse cursor. (Unit: pixels / second) The first movement speed of the mouse cursor can be obtained by the following implementation: Determine a plurality of first target images from the first video, and determine a first pixel coordinate of a mouse cursor in each first target image, wherein the plurality of first target images are continuous in time, each first target image contains a mouse cursor, and the first pixel coordinate of the mouse cursor in each first target image is different; Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates; Based on the first pixel distance, a first movement rate of the mouse cursor is determined.

[0041] For example, the process of logging into any account through the display interface of the device takes 15 seconds, during which the mouse cursor moves for 5 consecutive seconds, that is, the pixel coordinates of the mouse cursor in these 5 seconds are different. At this time, the pixel coordinates of the mouse cursor in these 5 seconds are obtained to obtain a first pixel coordinate set, and the total distance moved by the mouse cursor in these 5 seconds is calculated based on the pixel coordinates in the first pixel coordinate set according to the Euclidean distance calculation formula.

[0042] Specifically, the distance moved by the mouse cursor in the first second is W1; the distance moved by the mouse cursor in the second second is W2; the distance moved by the mouse cursor in the third second is W3; the distance moved by the mouse cursor in the fourth second is W4; the distance moved by the mouse cursor in the fifth second is W5, and the total distance moved by the mouse cursor in these 5 seconds is W1+W2+W3+W4+W5. After obtaining the total distance, the first movement speed of the mouse cursor is calculated according to the total distance as v1=(W1+W2+W3+W4+W5) / 5.

[0043] (2) The frequency at which the mouse sends the first command.

[0044] Since the first video includes the process of logging into an account through a display interface, such as Figure 2As shown, the process of the operator logging into the account is the process of the operator inputting the login password through the mouse, and therefore, the first instruction sending frequency of the mouse is used as the first parameter of the first video.

[0045] The process of determining the first instruction sending frequency may be implemented as follows: Counting a first number of times a mouse command is received in the first video; Based on the first number of times, a first instruction sending frequency of the mouse is determined.

[0046] For example, the operator takes 15 seconds to log into an account and clicks the mouse 30 times, that is, the number of times the device receives the mouse command is 30, and the frequency of sending the first mouse command is 30 / 15=2.

[0047] In a possible implementation, the instructions sent by the operator through the mouse can also be detected, and each time a mouse click message is captured, the current graphical user interface is intercepted, and then the frequency of sending the first instruction of the mouse is determined based on the number of intercepted graphical user interfaces. For example, 30 graphical user interfaces are intercepted, and then the frequency of sending the first instruction of the mouse is calculated to be 30 / 15=2.

[0048] In the embodiment of the present application, the second parameter corresponds to the first parameter and may include the following two types.

[0049] (1) The second movement rate of the mouse cursor (unit: pixels / ms).

[0050] The second movement speed of the mouse cursor can be obtained by the following implementation: Determine a plurality of second target images from the second video, and determine a second pixel coordinate of a mouse cursor in each second target image, wherein the plurality of second target images are continuous in time, each second target image contains a mouse cursor, and the second pixel coordinate of the mouse cursor in each second target image is different; Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates; Based on the second pixel distance, a second movement rate of the mouse cursor is determined.

[0051] For example, the process of accessing target information corresponding to any account through the display interface of the device takes 30 seconds, during which the mouse cursor moves for 5 consecutive seconds, that is, the pixel coordinates of the mouse cursor in these 5 seconds are different. At this time, the pixel coordinates of the mouse cursor in these 5 seconds are obtained to obtain a second pixel coordinate set, and the total distance moved by the mouse cursor in these 5 seconds is calculated based on the pixel coordinates in the second pixel coordinate set according to the Euclidean distance calculation formula.

[0052] Specifically, the distance moved by the mouse cursor in the first second is W6; the distance moved by the mouse cursor in the second second is W7; the distance moved by the mouse cursor in the third second is W8; the distance moved by the mouse cursor in the fourth second is W9; the distance moved by the mouse cursor in the fifth second is W10, and the total distance moved by the mouse cursor in these 5 seconds is W6+W7+W8+W9+W10. After obtaining the total distance, the second movement speed of the mouse cursor is calculated according to the total distance as v2=(W6+W7+W8+W9+W10) / 5.

[0053] (2) The frequency at which the mouse sends the second command.

[0054] Since the second video includes the process of accessing the target information corresponding to any account through the display interface, that is, the operator will keep clicking the mouse to enter the relevant interface to access the target information during the process of accessing the target information, the second command sending frequency of the mouse is used as the second parameter of the second video.

[0055] The process of determining the second instruction sending frequency may be implemented as follows: Counting a second number of times the mouse command is received in the second video; Based on the second number of times, a second instruction sending frequency of the mouse is determined.

[0056] For example, the process of an operator accessing target information corresponding to an account is 30 seconds, and the operator clicks the mouse 30 times, that is, the number of times the device receives the mouse command is 30, and the frequency of sending the first mouse command is 30 / 30=1.

[0057] In a possible implementation, the instructions sent by the operator through the mouse can also be detected, and each time a mouse click message is captured, the current graphical user interface is intercepted, and then the frequency of sending the second instruction of the mouse is determined based on the number of intercepted graphical user interfaces. For example, 30 graphical user interfaces are intercepted, and then the frequency of sending the second instruction of the mouse is calculated to be 30 / 30=1.

[0058] S103: If the first parameter matches the second parameter, it is determined that the first operator and the second operator are the same person; otherwise, the first operator and the second operator are not the same person.

[0059] After obtaining the first parameter and the second parameter, the parameters of the two videos are compared, and it is determined whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same according to the comparison result. The specific determination method is as follows: When it is determined that the resolution of the first video and the resolution of the second video are the same, if the first difference between the first movement rate of the mouse cursor and the second movement rate of the mouse cursor is within a first preset range, and the second difference between the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse is within a second preset range, then it indicates that the first movement rate of the mouse cursor and the second movement rate of the mouse cursor match, and the first instruction sending frequency and the second instruction sending frequency match, that is, the first operator and the second operator are the same person; if the first movement rate and the second movement rate do not match, or the first instruction sending frequency and the second instruction sending frequency do not match, or the first movement rate and the second movement rate, and the first instruction sending frequency and the second instruction sending do not match, then it indicates that the first operator and the second operator are different.

[0060] In addition, in addition to judging whether two parameters are the same by whether the difference between the two parameters is within a preset range, the parameters can also be divided into gears. For example, for the movement rate of the mouse, the gears are shown in Table 1, and the rate is divided into n gears. The first movement rate and the second movement rate belonging to the same gear are matched. The embodiment of the present application does not specifically limit the gear division of the movement rate.

[0061] Table 1

[0062] For the command sending frequency of the mouse, its gears are shown in Table 2. The frequency is divided into m gears, and the first command sending frequency and the second command sending frequency belonging to the same gear are matched. The embodiment of the present application does not specifically limit the gear division of the command sending frequency.

[0063] Table 2

[0064] In an embodiment of the present application, the first video and the second video are generated based on real-time encoding of mouse signals. That is to say, the faster the operator clicks the mouse, the greater the frame rate of the encoded video (i.e., the frequency of sending mouse commands); the faster the operator moves the mouse, the better the quality of the encoded video. For this reason, the resolutions of the first video and the second video may be different. Because the movement rate is in pixels, when the video resolution is different, the number of pixels is different, and the mouse movement rate may be different. Therefore, in order to ensure the accuracy of the comparison results of the first parameter and the second parameter, before performing the parameter comparison process, it is necessary to determine whether the resolution of the first video and the resolution of the second video are the same. If they are the same, the subsequent parameter comparison process can be performed. If they are different, it is necessary to use the resolution of the first video and the resolution of the second video to update the second movement rate of the mouse cursor to obtain an updated second movement rate. Specifically, the formula Determine, wherein v3 represents the updated second movement rate, R1 represents the resolution of the first video, v2 represents the original second movement rate, and R2 represents the resolution of the second video. The embodiment of the present application does not specifically limit the reason for the different resolutions.

[0065] Afterwards, the updated second movement rate is compared with the first movement rate to determine whether they match.

[0066] In a possible implementation, if it is determined that the first operator and the second operator are not the same person, it indicates that the device is currently under offline attack. At this time, the device will send an alarm to the relevant personnel through email or text message, or directly close the interface currently being accessed by the offline attacker to protect the target information in the account. The embodiment of this application does not specifically limit the protection method of the target information. In addition, the first video and the second video can also be saved for subsequent investigation.

[0067] The following is based on Figure 3 The specific process of a method for distinguishing operators provided in an embodiment of the present application is described in detail.

[0068] S301: When logging in to a local account, determining a first video, wherein the first video includes a process of logging in to the local account through a display interface; S302: Real-time monitoring of the content displayed on the display interface; S303: Determine whether no operation instruction is received within a preset continuous time, if so, execute S304, otherwise, repeat S302; S304: Determine whether the display interface displays the target information. If so, execute S305, otherwise repeat S302; wherein the target information is sensitive information contained in the local account, such as a user management interface; S305: Determine a second video, wherein the second video includes a process of accessing target information corresponding to the local account through the display interface; S306: Compare the first parameter of the first video with the second parameter of the second video. The process of determining the first parameter and the second parameter is as in the implementation of S102 above, and the comparison process is as in the implementation of S103 above, which will not be repeated here.

[0069] S307: Determine whether an offline attack has occurred. If so, execute S308, otherwise repeat S302. Wherein, whether an offline attack has occurred can be determined based on the comparison result in S306. The specific comparison process is the same as the implementation in S103 above, which will not be repeated here. S308: Alert relevant personnel by email, text message, etc.; in addition, the currently displayed interface can be further closed, and then the process ends.

[0070] The embodiment of the present application provides a method for distinguishing operators. A method for defending against offline attacks in the prior art is to pop up an identity authentication interface for identity confirmation each time the target information is accessed, and the method can be continued only after successful confirmation. The advantage of this method is simplicity, and the disadvantage is that the operator needs to perform authentication operations each time, which is cumbersome. The method proposed in the embodiment of the present application is completely performed automatically and silently by the device, which simplifies the operation of the operator; moreover, password and command verification is the first feature, and keyboard and mouse behavior analysis is the second feature. The second feature can be used as an auxiliary means of biometric identification, and features such as mouse command input and mouse cursor movement rate are directly judged, and the method is simple; in addition, in order to address the problem that the resolution is different due to hardware reasons, and the movement rate of the mouse cursor may be different, the embodiment of the present application proposes a method of converting the mouse signal into a video signal, which shields the influence caused by differences in hardware devices (display, mouse), making the judgment more reliable.

[0071] Based on the same inventive concept, the embodiment of the present application provides a device for distinguishing operators, such as Figure 4 As shown, the device comprises: The video determination module 401 is used to determine a first video including a process of logging into any one account through a display interface of a device, and to determine a second video including a process of accessing target information corresponding to the any one account through the display interface, wherein the second video is collected when it is determined that the device logs into the any one account and no operation instruction is received for a preset continuous time; The parsing module 402 is used to determine a first parameter of the first video and a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video; The distinguishing module 403 is used to determine that when the first parameter matches the second parameter, the first operator and the second operator are the same person, and when the first parameter does not match the second parameter, the first operator and the second operator are not the same person.

[0072] In a possible implementation, the parsing module 402 is used to: Determine a plurality of first target images from the first video, and determine a first pixel coordinate of a mouse cursor in each first target image, wherein the plurality of first target images are continuous in time, each first target image contains a mouse cursor, and the first pixel coordinate of the mouse cursor in each first target image is different; Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates; Determining a first movement rate of the mouse cursor based on the first pixel distance; Determine a plurality of second target images from the second video, and determine a second pixel coordinate of a mouse cursor in each second target image, wherein the plurality of second target images are continuous in time, each second target image contains a mouse cursor, and the second pixel coordinate of the mouse cursor in each second target image is different; Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates; Based on the second pixel distance, a second movement rate of the mouse cursor is determined.

[0073] In a possible implementation, the parsing module 402 is used to: Counting a first number of times a mouse command is received in the first video; Based on the first number of times, determining a first instruction sending frequency of the mouse; The parsing the second video to obtain the second parameter includes: Counting a second number of times the mouse command is received in the second video; Based on the second number of times, a second instruction sending frequency of the mouse is determined.

[0074] In a possible implementation, the distinguishing module 403 is used to: When it is determined that the resolution of the first video and the resolution of the second video are the same, if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, then it is determined that the first parameter and the second parameter match.

[0075] In a possible implementation, the distinguishing module 403 is used to: When a first difference between a first movement rate of the mouse cursor and a second movement rate of the mouse cursor is within a first preset range, determining that the first movement rate and the second movement rate match; When a second difference between the first instruction sending frequency and the second instruction sending frequency is within a second preset range, it is determined that the first instruction sending frequency and the second instruction sending frequency match.

[0076] In a possible implementation, the distinguishing module 403 is used to: When the resolution of the first video is different from the resolution of the second video, the second movement rate of the mouse cursor is updated using the resolution of the first video and the resolution of the second video to obtain an updated second movement rate.

[0077] Based on the same inventive concept, an embodiment of the present application provides an electronic device, the device comprising: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any method for distinguishing operators provided in the embodiments of the present application.

[0078] Refer to the following Figure 5 An electronic device 50 according to this embodiment of the present application will be described. Figure 5 The electronic device 50 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0079] like Figure 5 As shown, the electronic device 50 is in the form of a general electronic device. The components of the electronic device 50 may include but are not limited to: at least one processor 51, at least one memory 52, and a bus 53 connecting different system components (including the memory 52 and the processor 51).

[0080] The processor 51 is used to read and execute instructions in the memory 52, so that the at least one processor can execute a method for distinguishing operators provided in the above embodiment.

[0081] Bus 53 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor or local bus using any of a variety of bus architectures.

[0082] The memory 52 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 521 and / or a cache memory 522 , and may further include a read-only memory (ROM) 523 .

[0083] The memory 52 may also include a program / utility 525 having a set (at least one) of program modules 524, such program modules 524 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0084] The electronic device 50 may also communicate with one or more external devices 54 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 50, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device 50 to communicate with one or more other electronic devices. Such communication may be performed through an input / output (I / O) interface 55. In addition, the electronic device 50 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 56. As shown, the network adapter 56 communicates with other modules for the electronic device 50 through a bus 53. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 50, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0085] In some possible implementations, various aspects of a method for distinguishing operators provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for distinguishing operators according to various exemplary implementations of the present application described above in this specification.

[0086] In addition, the present application also provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program is used to enable a computer to execute any of the methods described in the above embodiments.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0089] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0090] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for distinguishing operators, characterized in that: The method comprises: Determine a first video including a process of logging into any one account through a display interface of a device, and determine a second video including a process of accessing target information corresponding to the any one account through the display interface, wherein the second video is collected when it is determined that the device logs into the any one account and no operation instruction is received for a preset continuous time; Determine a first parameter of the first video, and determine a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video; If the first parameter matches the second parameter, it is determined that the first operator and the second operator are the same person; otherwise, the first operator and the second operator are not the same person.

2. The method according to claim 1, characterized in that The determining a first parameter of the first video includes: Determine a plurality of first target images from the first video, and determine a first pixel coordinate of a mouse cursor in each first target image, wherein the plurality of first target images are continuous in time, each first target image contains a mouse cursor, and the first pixel coordinate of the mouse cursor in each first target image is different; Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates; Determining a first movement rate of the mouse cursor based on the first pixel distance; The determining a second parameter of the second video includes: Determine a plurality of second target images from the second video, and determine a second pixel coordinate of a mouse cursor in each second target image, wherein the plurality of second target images are continuous in time, each second target image contains a mouse cursor, and the second pixel coordinate of the mouse cursor in each second target image is different; Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates; Based on the second pixel distance, a second movement rate of the mouse cursor is determined.

3. The method according to claim 1, characterized in that: The determining a first parameter of the first video includes: Counting a first number of times a mouse command is received in the first video; Based on the first number of times, determining a first instruction sending frequency of the mouse; The determining a second parameter of the second video includes: Counting a second number of times the mouse command is received in the second video; Based on the second number of times, a second instruction sending frequency of the mouse is determined.

4. The method according to any one of claims 1 to 3, characterized in that: Whether the first parameter and the second parameter match is determined in the following manner: When it is determined that the resolution of the first video and the resolution of the second video are the same, if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, then it is determined that the first parameter and the second parameter match.

5. The method according to claim 4, characterized in that The first movement rate and the second movement rate match is determined in the following manner: If a first difference between a first movement rate of the mouse cursor and a second movement rate of the mouse cursor is within a first preset range, determining that the first movement rate and the second movement rate match; The first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse are matched by: If a second difference between the first instruction sending frequency and the second instruction sending frequency is within a second preset range, it is determined that the first instruction sending frequency and the second instruction sending frequency match.

6. The method according to claim 4, characterized in that The method further comprises: If the resolution of the first video is different from the resolution of the second video, the second movement rate of the mouse cursor is updated using the resolution of the first video and the resolution of the second video to obtain an updated second movement rate.

7. A device for distinguishing operators, characterized in that: The device comprises: A video determination module, used to determine a first video including a process of logging into any one account through a display interface of a device, and to determine a second video including a process of accessing target information corresponding to any one account through the display interface, wherein the second video is collected when it is determined that the device logs into any one account and no operation instruction is received for a preset continuous time; a parsing module, configured to determine a first parameter of the first video and a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video; A distinguishing module is used to determine that when the first parameter matches the second parameter, the first operator and the second operator are the same person, and when the first parameter does not match the second parameter, the first operator and the second operator are not the same person.

8. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor executes a method as claimed in any one of claims 1 to 6.

9. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images