A method, device, and equipment for distinguishing operators

Abstract

This application relates to the field of information security technology, and particularly to a method, device and equipment for differentiating operators. The method includes: determining a first video containing the process of logging in to any account through the display interface of the device, and determining a second video containing the process of accessing target information corresponding to the any account through the display interface; determining a first parameter of the first video and determining a second parameter of the second video; if the first parameter matches the second parameter, determining that the first operator and the second operator are the same person, otherwise, the first operator and the second operator are not the same person. Through the above method, it is possible to determine whether the first operator and the second operator are the same person, and further determine whether the device has suffered an offline attack.

Description

Technical Field

[0001] This application relates to the field of information security technology, and particularly to a method, device and equipment for differentiating operators. Background Art

[0002] When an operator performs offline or local operations on some equipment, account login is required. After successful login, relevant operations can be carried out according to the permissions of the account. However, when the operator leaves the equipment, it is possible that other operators use the logged-in account to operate the equipment and obtain some sensitive information, such as adding their own private accounts locally and opening sensitive permissions. Such attacks are difficult for the operator to detect.

[0003] In order to prevent other operators from operating the equipment, the current practice is to detect the operating status of the equipment after the operator logs in to the account. If it is detected that the duration of continuous non-operation of the equipment reaches a certain period of time (for example, 1800s), the login of the account will be automatically exited. Although this approach can avoid the operation of other operators to a certain extent, during the detection of the operating status of the equipment (within 1800s), the equipment is still easily operated by other operators, and it is still not easy to find that the equipment has been operated by other operators. Summary of the Invention

[0004] Embodiments of this application provide a method, device and equipment for differentiating operators, which can determine whether the person logging in to the equipment and the person operating the equipment subsequently is the same person.

[0005] In a first aspect, embodiments of this application provide a method for differentiating operators, the method includes:

[0006] Determine a first video including the process of logging in to any account through the display interface of the equipment, and determine a second video including the process of accessing the target information corresponding to the any account through the display interface, where the second video is collected when it is determined that the equipment logs in to the any account and no operation instruction is received within a preset continuous time;

[0007] Determine a first parameter of the first video and a second parameter of the second video, where the first parameter characterizes the operation habit of a first operator corresponding to the first video, and the second parameter characterizes the operation habit of a second operator corresponding to the second video;

[0008] If the first parameter matches the second parameter, determine that the first operator and the second operator are the same person, otherwise, the first operator and the second operator are not the same person.

[0009] In the above embodiments, by comparing the first parameters of the video of the login account process and the second parameters of the video of the process of accessing the target information in the account, it can be determined whether the first operator who logs in to the account and the second operator who accesses the target information are the same person, and further it can be determined whether the device is under an offline attack; in addition, the second video is collected when no operation instruction is received within a preset continuous time. That is to say, after logging in to the account, if the device continuously receives operation instructions, the second video will not be obtained, nor will the subsequent process of comparing parameters be executed. This method can avoid unnecessary comparison processes.

[0010] In a possible implementation manner, determining the first parameters of the first video includes:

[0011] Determine a plurality of first target images from the first video, and determine the first pixel coordinates of the mouse cursor in each first target image. The times of the plurality of first target images are continuous, each first target image contains the mouse cursor, and the first pixel coordinates of the mouse cursor in each first target image are different;

[0012] Determine the first pixel distance of the mouse cursor based on the obtained plurality of first pixel coordinates;

[0013] Determine the first moving rate of the mouse cursor based on the first pixel distance;

[0014] Determining the second parameters of the second video includes:

[0015] Determine a plurality of second target images from the second video, and determine the second pixel coordinates of the mouse cursor in each second target image. The times of the plurality of second target images are continuous, each second target image contains the mouse cursor, and the second pixel coordinates of the mouse cursor in each second target image are different;

[0016] Determine the second pixel distance of the mouse cursor based on the obtained plurality of second pixel coordinates;

[0017] Determine the second moving rate of the mouse cursor based on the second pixel distance.

[0018] In the above embodiments, taking the moving rate of the mouse cursor as a parameter of the video to determine whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same person can obtain a relatively accurate judgment result.

[0019] In a possible implementation manner, determining the first parameters of the first video includes:

[0020] Count the first number of times of receiving mouse instructions in the first video;

[0021] Determine a first instruction sending frequency of the mouse based on the first number;

[0022] The determining of the second parameter of the second video includes:

[0023] Count a second number of received mouse instructions in the second video;

[0024] Determine a second instruction sending frequency of the mouse based on the second number.

[0025] In the above embodiments, using the instruction sending frequency of the mouse as a parameter of the video to determine whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same person can obtain a relatively accurate determination result.

[0026] In a possible implementation manner, determine whether the first parameter and the second parameter match through the following method:

[0027] When it is determined that the resolutions of the first video and the second video are the same, if the first moving speed of the mouse cursor and the second moving speed of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, then determine that the first parameter and the second parameter match.

[0028] In the above embodiments, if the first moving speed of the mouse cursor and the second moving speed of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, it indicates that the operation habits of the first operator corresponding to the first video and the second operator corresponding to the second video are the same, that is, it can be determined that the first operator and the second operator are the same.

[0029] In a possible implementation manner, determine that the first moving speed and the second moving speed match through the following method:

[0030] If a first difference between the first moving speed of the mouse cursor and the second moving speed of the mouse cursor is within a first preset range, then determine that the first moving speed and the second moving speed match;

[0031] Determine that the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match through the following method:

[0032] If a second difference between the first instruction sending frequency and the second instruction sending frequency is within a second preset range, then determine that the first instruction sending frequency and the second instruction sending frequency match.

[0033] In the above embodiments, when matching the first moving speed and the second moving speed, and when matching the first instruction sending frequency and the second instruction sending frequency, a certain error is allowed to obtain a more accurate matching result.

[0034] In a possible implementation manner, the method further includes:

[0035] If the resolutions of the first video and the second video are different, the second moving speed of the mouse cursor is updated by using the resolution of the first video and the resolution of the second video to obtain an updated second moving speed.

[0036] In the above embodiments, when the resolutions of the first video and the second video are different, the original second moving speed of the second video is updated by using the resolution of the first video and the resolution of the second video to obtain an updated second moving speed, so as to compare the updated second moving speed with the first moving speed, shielding the influence caused by the display difference and making the determination result more reliable.

[0037] In a second aspect, an embodiment of the present application provides a device for distinguishing operators, and the device includes:

[0038] A determination video module, configured to determine a first video including a process of logging in to any account through a display interface of a device, and determine a second video including a process of accessing target information corresponding to the any account through the display interface, where the second video is collected when it is determined that the device logs in to the any account and no operation instruction is received within a preset continuous time;

[0039] An analysis module, configured to determine a first parameter of the first video and determine a second parameter of the second video, where the first parameter represents the operation habit of a first operator corresponding to the first video, and the second parameter represents the operation habit of a second operator corresponding to the second video;

[0040] A distinguishing module, configured to determine that the first operator and the second operator are the same person when determining that the first parameter matches the second parameter, and determine that the first operator and the second operator are not the same person when determining that the first parameter does not match the second parameter.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, and the electronic device includes:

[0042] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to cause the at least one processor to execute the method in the first aspect above.

[0043] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program for causing a computer to execute the method in the first aspect above.

[0044] In a fifth aspect, an embodiment of the present application provides a computer program product including a computer program which, when executed by a processor, implements the method in the first aspect above. Description of the Drawings

[0045] Figure 1 A schematic flowchart of a method for distinguishing operators according to an exemplary embodiment of the present invention;

[0046] Figure 2 A schematic diagram of a local account login according to an exemplary embodiment of the present invention;

[0047] Figure 3 A schematic detailed flowchart of a method for distinguishing operators according to an exemplary embodiment of the present invention;

[0048] Figure 4 A schematic diagram of a device for distinguishing operators according to an exemplary embodiment of the present invention;

[0049] Figure 5 A schematic diagram of an electronic device according to an exemplary embodiment of the present invention. Detailed Embodiments

[0050] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are given only to enable those skilled in the art to better understand and thus implement the present application, and are not intended to limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to be able to fully convey the scope of the present disclosure to those skilled in the art.

[0051] Those skilled in the art know that the embodiments of the present application can be implemented as a system, a device, a method, or a computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: completely hardware, completely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0052] In this text, it should be understood that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any restrictive meaning.

[0053] Some concepts involved in the embodiments of the present application are introduced below.

[0054] Device: In the embodiments of the present application, a device may refer to a device with a relatively large volume, not easy to carry around, and can be externally connected to a mouse and a display, such as a security device.

[0055] Because security devices may be installed in places such as supermarkets, hospital duty rooms, and community security rooms, where there is a large flow of people, the feasibility of offline attacks is very strong. And currently, security devices in the industry do not have any prevention measures against such offline attacks, so the effectiveness of offline attacks is extremely strong. Once an offline attack is successful, such as adding an account, it will create favorable conditions for subsequent network attacks, and thus can cause a complete collapse of the device's security.

[0056] Target information: It may refer to sensitive information or security information in any account, such as the user management interface in any account.

[0057] Operation instruction: An instruction input by an operator through an externally connected mouse, keyboard, etc. of the device.

[0058] Offline attack: An attack method in which an attacker directly performs unauthorized and sensitive operations locally on the device quickly when the device is logged in locally and the actual user of the device is not around, without knowing the login account and password of the device.

[0059] A method for distinguishing operators in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0060] In view of the problem that it is difficult to detect offline workers currently, the embodiments of the present application provide a method for distinguishing operators, as Figure 1 shown, the method includes:

[0061] S101: Determine a first video including the process of logging in to any account through the display interface of the device, and determine a second video including the process of accessing the target information corresponding to the any account through the display interface.

[0062] In the embodiments of the present application, the device may be a security device, and the login is a local account login, that is, the operator operates and logs in through an externally connected display of the device, and the local account login requires password authentication by inputting a password through a keyboard or a mouse. As Figure 2The figure shows a schematic diagram of the process for an operator to log in to any account. The operator can enter the password by clicking the mouse to log in to the local account. Since logging in to the local account requires verifying the password and performing the login operation at zero distance on the device, the local account login is secure. After successful login, the device can be operated during the duration of the logged-in state.

[0063] After successful local login, start timing detection, that is, detect whether the continuous time during which the device does not receive operation instructions is the preset continuous time to determine whether the operator who performed the local account login has left the device. When the device does not receive operation instructions for the preset continuous time, that is, does not receive instructions from an external mouse or external keyboard, it can be determined that the device is currently unattended, and then the second video can be determined. If the time when the device does not receive operation instructions does not exceed the preset continuous time, it indicates that the device is currently attended, and there is no need to collect the second video at this time.

[0064] In the event of an offline attack, the offline attacker may perform unauthorized or sensitive operations or add other accounts in the currently logged-in account on the device. Therefore, the second video includes target information in any account, such as the user management interface.

[0065] When the target information is detected, the subsequent steps will be executed; otherwise, it is determined that the device is not currently under an offline attack, and there is no need to perform subsequent detection of the offline attacker.

[0066] S102: Determine the first parameter of the first video and the second parameter of the second video.

[0067] In the embodiment of the present application, the first parameter characterizes the operating habits of the first operator corresponding to the first video, and the second parameter characterizes the operating habits of the second operator corresponding to the second video. By comparing the first parameter and the second parameter, it can be determined whether the operator who operates the device to log in to the account is the same as the operator who accesses the target information in the account.

[0068] In the embodiment of the present application, the first parameter may include the following two types.

[0069] (1) The first moving speed of the mouse cursor. (Unit: pixel / second)

[0070] The first moving speed of the mouse cursor can be obtained through the following implementation method:

[0071] Determine a plurality of first target images from the first video, and determine the first pixel coordinates of the mouse cursor in each first target image. The time of the plurality of first target images is continuous, each first target image contains the mouse cursor, and the first pixel coordinates of the mouse cursor in each first target image are different;

[0072] Determine the first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates;

[0073] Based on the first pixel distance, determine the first movement rate of the mouse cursor.

[0074] For example, the process of logging in to any account through the display interface of the device takes 15 seconds. Among them, the mouse cursor moves continuously for 5 seconds, that is, the pixel coordinates of the mouse cursor are different in these 5 seconds. At this time, obtain the pixel coordinates of the mouse cursor in these 5 seconds to get the first pixel coordinate set. According to the Euclidean distance calculation formula, based on the pixel coordinates in the first pixel coordinate set, calculate the total distance that the mouse cursor moves within these 5 seconds.

[0075] Specifically, the distance that the mouse cursor moves in the first second is W1; the distance that the mouse cursor moves in the second second is W2; the distance that the mouse cursor moves in the third second is W3; the distance that the mouse cursor moves in the fourth second is W4; the distance that the mouse cursor moves in the fifth second is W5. The total distance that the mouse cursor moves within these 5 seconds is W1 + W2 + W3 + W4 + W5. After obtaining the total distance, calculate the first movement rate of the mouse cursor as v1 = (W1 + W2 + W3 + W4 + W5) / 5.

[0076] (2) The first instruction sending frequency of the mouse.

[0077] Since the first video includes the process of logging in to an account through the display interface, as Figure 2 shown, the process of the operator logging in to the account is the process of the operator inputting the login password through the mouse. Therefore, use the first instruction sending frequency of the mouse as the first parameter of the first video.

[0078] The process of determining the first instruction sending frequency can be as follows:

[0079] Count the first number of times of receiving mouse instructions in the first video;

[0080] Based on the first number of times, determine the first instruction sending frequency of the mouse.

[0081] For example, the process of the operator logging in to the account takes 15 seconds and clicks the mouse 30 times, that is, the number of times the device receives the mouse instruction is 30, and the first instruction sending frequency of the mouse is 30 / 15 = 2.

[0082] In a possible implementation manner, it is also possible to detect the instructions sent by the operator through the mouse. Each time a mouse click message is captured, intercept the current graphical user interface, and then determine the first instruction sending frequency of the mouse based on the number of intercepted graphical user interfaces. For example, 30 graphical user interfaces are intercepted, and then calculate the first instruction sending frequency of the mouse as 30 / 15 = 2.

[0083] In the embodiments of the present application, the second parameter corresponds to the first parameter and may include the following two types.

[0084] (1) The second moving speed of the mouse cursor (unit: pixel / ms).

[0085] The second moving speed of the mouse cursor can be obtained through the following implementation:

[0086] Determine a plurality of second target images from the second video, and determine the second pixel coordinates of the mouse cursor in each second target image. The time of the plurality of second target images is continuous. Each second target image contains the mouse cursor, and the second pixel coordinates of the mouse cursor in each second target image are different;

[0087] Determine the second pixel distance of the mouse cursor based on the obtained plurality of second pixel coordinates;

[0088] Determine the second moving speed of the mouse cursor based on the second pixel distance.

[0089] For example, the process of accessing the target information corresponding to any account through the display interface of the device takes 30 seconds. Among them, the mouse cursor moves continuously for 5 seconds, that is, the pixel coordinates of the mouse cursor are different in these 5 seconds. At this time, obtain the pixel coordinates of the mouse cursor in these 5 seconds to obtain a set of second pixel coordinates. According to the Euclidean distance calculation formula, calculate the total distance that the mouse cursor moves within these 5 seconds based on the pixel coordinates in the set of second pixel coordinates.

[0090] Specifically, the distance that the mouse cursor moves in the first second is W6; the distance that the mouse cursor moves in the second second is W7; the distance that the mouse cursor moves in the third second is W8; the distance that the mouse cursor moves in the fourth second is W9; the distance that the mouse cursor moves in the fifth second is W10. The total distance that the mouse cursor moves within these 5 seconds is W6 + W7 + W8 + W9 + W10. After obtaining the total distance, calculate the second moving speed of the mouse cursor as v2 = (W6 + W7 + W8 + W9 + W10) / 5.

[0091] (2) The second instruction sending frequency of the mouse.

[0092] Since the second video contains the process of accessing the target information corresponding to any account through the display interface, that is to say, the operator will keep clicking the mouse during the process of accessing the target information to enter the relevant interface to access the target information. Therefore, the second instruction sending frequency of the mouse is used as the second parameter of the second video.

[0093] The process of determining the second instruction sending frequency can be as follows:

[0094] Count the second number of mouse instructions received in the second video;

[0095] Based on the second number, determine the second instruction sending frequency of the mouse.

[0096] For example, the process for an operator to access the target information corresponding to an account is 30 seconds, and the mouse is clicked 30 times. That is, the number of times the device receives the mouse instruction is 30, and the first instruction sending frequency of the mouse is 30 / 30 = 1.

[0097] In a possible implementation manner, it is also possible to detect the instructions sent by the operator through the mouse. Each time a mouse click message is captured, the current graphical user interface is intercepted, and then based on the number of intercepted graphical user interfaces, the second instruction sending frequency of the mouse is determined. For example, 30 graphical user interfaces are intercepted, and then the second instruction sending frequency of the mouse is calculated as 30 / 30 = 1.

[0098] S103: If the first parameter matches the second parameter, determine that the first operator and the second operator are the same person; otherwise, the first operator and the second operator are not the same person.

[0099] After obtaining the first parameter and the second parameter, compare the parameters of the two videos, and determine whether the first operator corresponding to the first video and the second operator corresponding to the second video are the same according to the comparison result. The specific determination method is as follows:

[0100] When it is determined that the resolutions of the first video and the second video are the same, if the first difference between the first moving rate of the mouse cursor and the second moving rate of the mouse cursor is within the first preset range, and the second difference between the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse is within the second preset range, it indicates that the first moving rate of the mouse cursor and the second moving rate of the mouse cursor match, and the first instruction sending frequency and the second instruction sending frequency match, that is, the first operator and the second operator are the same person; if the first moving rate and the second moving rate do not match, or the first instruction sending frequency and the second instruction sending frequency do not match, or both the first moving rate and the second moving rate, and the first instruction sending frequency and the second instruction sending frequency do not match, it indicates that the first operator and the second operator are different.

[0101] In addition, in addition to judging whether two parameters are the same by whether the difference between the two parameters is within the preset range, the parameters can also be divided into grades. For example, for the moving rate of the mouse, its grades are shown in Table 1, and the rate is divided into n grades. The first moving rate and the second moving rate belonging to the same grade are matched. The embodiments of the present application do not specifically limit the grade division of the moving rate.

[0102] Table 1

[0103]

[0104] For the instruction sending frequency of the mouse, its gears are shown in Table 2. The frequency is divided into m gears. The first instruction sending frequency and the second instruction sending frequency belonging to the same gear are matched. The embodiments of the present application do not specifically limit the gear division of the instruction sending frequency.

[0105] Table 2

[0106]

[0107] In the embodiments of the present application, the first video and the second video are formed by real-time encoding based on the mouse signal. That is to say, the faster the operator clicks the mouse, the greater the frame rate of the encoded video (i.e., the instruction sending frequency of the mouse); the faster the operator moves the mouse, the better the image quality of the encoded video. For this reason, it may cause the resolutions of the first video and the second video to be different. Also, since the movement rate is in pixels, when the video resolutions are different, the number of pixels is different, and thus the movement rate of the mouse may be different. Therefore, in order to ensure the accuracy of the comparison result of the first parameter and the second parameter, before the parameter comparison process, it is necessary to determine whether the resolutions of the first video and the second video are the same. If they are the same, the subsequent parameter comparison process can be executed. If they are different, it is necessary to update the second movement rate of the mouse cursor using the resolutions of the first video and the second video to obtain the updated second movement rate. Specifically, it can be determined by the formula where v3 represents the updated second movement rate, R1 represents the resolution of the first video, v2 represents the original second movement rate, and R2 represents the resolution of the second video. The embodiments of the present application do not specifically limit the reasons for different resolutions.

[0108] After that, compare the updated second movement rate with the first movement rate to determine whether they match.

[0109] In a possible implementation manner, if it is determined that the first operator and the second operator are not the same person, it indicates that the device is currently under an offline attack. At this time, the device will send an alarm to relevant personnel by email or text message, or directly close the interface that the offline attacker is currently accessing to protect the target information in the account. The embodiments of the present application do not specifically limit the protection method of the target information. In addition, the first video and the second video can also be saved for subsequent investigation.

[0110] Next, based on Figure 3The specific process of a method for differentiating operators provided by an embodiment of the present application is described in detail.

[0111] S301: When logging in to the local account, determine the first video, where the first video includes the process of logging in to the local account through the display interface;

[0112] S302: Monitor the content displayed on the display interface in real time;

[0113] S303: Determine whether no operation instruction has been received for a preset continuous time. If so, execute S304; otherwise, repeat S302;

[0114] S304: Determine whether the display interface displays the target information. If so, execute S305; otherwise, repeat S302; where the target information is sensitive information included in the local account, such as the user management interface;

[0115] S305: Determine the second video, where the second video includes the process of accessing the target information corresponding to the local account through the display interface;

[0116] S306: Compare the first parameter of the first video with the second parameter of the second video. The process of determining the first parameter and the second parameter is as described in the implementation manner in S102 above, and the comparison process is as described in the implementation manner in S103 above, which will not be elaborated here.

[0117] S307: Determine whether an offline attack has occurred. If so, execute S308; otherwise, repeat S302; where it can be determined whether an offline attack has occurred according to the comparison result in S306. The specific comparison process is as described in the implementation manner in S103 above, which will not be elaborated here;

[0118] S308: Send an alarm to relevant personnel by means of email, text message, etc.; in addition, the currently displayed interface can be further closed, and then it ends.

[0119] The embodiment of the present application provides a method for distinguishing operators. In the prior art, a method for defending against offline attacks is that every time the target information is accessed, an identity authentication interface pops up for identity confirmation, and only after successful confirmation can the method continue. The advantage of this method is simplicity, but the disadvantage is that the operator needs to perform authentication operations every time, which is cumbersome. The method proposed in the embodiment of the present application is completely automatic and silent by the device, which simplifies the operation of the operator; moreover, password and password verification are the first feature, and keyboard and mouse behavior analysis are the second feature. The second feature can be used as an auxiliary means for biometric identification, and features such as mouse instruction input and the moving speed of the mouse cursor are directly determined, and the method is simple; in addition, for the problem that different resolutions may be caused by hardware reasons, and thus the moving speed of the mouse cursor may be different, the embodiment of the present application proposes a method of converting the mouse signal into a video signal, which shields the influence caused by differences in hardware devices (display, mouse), making the determination more reliable.

[0120] Based on the same inventive concept, the embodiment of the present application provides a device for distinguishing operators, as Figure 4 shown. The device includes:

[0121] A determination video module 401, configured to determine a first video including the process of logging in to any account through the display interface of the device, and determine a second video including the process of accessing the target information corresponding to the any account through the display interface, where the second video is collected when it is determined that the device logs in to the any account and no operation instruction is received within a preset continuous time;

[0122] An analysis module 402, configured to determine a first parameter of the first video and a second parameter of the second video, where the first parameter characterizes the operation habit of a first operator corresponding to the first video, and the second parameter characterizes the operation habit of a second operator corresponding to the second video;

[0123] A distinguishing module 403, configured to determine that when the first parameter matches the second parameter, the first operator and the second operator are the same person, and determine that when the first parameter does not match the second parameter, the first operator and the second operator are not the same person.

[0124] In a possible implementation manner, the analysis module 402 is configured to:

[0125] Determine a plurality of first target images from the first video, and determine the first pixel coordinates of the mouse cursor in each first target image. The time of the plurality of first target images is continuous, each first target image includes a mouse cursor, and the first pixel coordinates of the mouse cursor in each first target image are different;

[0126] Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates;

[0127] Determine a first movement rate of the mouse cursor based on the first pixel distance;

[0128] Determine multiple second target images from the second video, and determine second pixel coordinates of the mouse cursor in each second target image. The times of the multiple second target images are consecutive, each second target image contains the mouse cursor, and the second pixel coordinates of the mouse cursor in each second target image are different;

[0129] Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates;

[0130] Determine a second movement rate of the mouse cursor based on the second pixel distance.

[0131] In a possible implementation manner, the parsing module 402 is configured to:

[0132] Count a first number of times of receiving mouse instructions in the first video;

[0133] Determine a first instruction sending frequency of the mouse based on the first number of times;

[0134] Parsing the second video to obtain a second parameter, including:

[0135] Count a second number of times of receiving mouse instructions in the second video;

[0136] Determine a second instruction sending frequency of the mouse based on the second number of times.

[0137] In a possible implementation manner, the distinguishing module 403 is configured to:

[0138] When it is determined that the resolutions of the first video and the second video are the same, if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor match, and the first instruction sending frequency of the mouse and the second instruction sending frequency of the mouse match, then determine that the first parameter and the second parameter match.

[0139] In a possible implementation manner, the distinguishing module 403 is configured to:

[0140] When a first difference between the first movement rate of the mouse cursor and the second movement rate of the mouse cursor is within a first preset range, determine that the first movement rate and the second movement rate match;

[0141] When a second difference between a first instruction sending frequency and a second instruction sending frequency is within a second preset range, it is determined that the first instruction sending frequency and the second instruction sending frequency match.

[0142] In a possible implementation, the distinguishing module 403 is configured to:

[0143] When the resolution of the first video is different from the resolution of the second video, the second moving speed of the mouse cursor is updated by using the resolution of the first video and the resolution of the second video to obtain an updated second moving speed.

[0144] Based on the same inventive concept, an embodiment of the present application provides an electronic device, and the device includes:

[0145] At least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any method for distinguishing an operator provided by the embodiments of the present application.

[0146] Next, with reference to Figure 5 the electronic device 50 according to this embodiment of the present application will be described. Figure 5 The illustrated electronic device 50 is only an example and should not impose any limitation on the functions and usage scope of the embodiments of the present application.

[0147] As Figure 5 shown, the electronic device 50 is presented in the form of a general-purpose electronic device. The components of the electronic device 50 may include but are not limited to: the above-mentioned at least one processor 51, the above-mentioned at least one memory 52, and a bus 53 connecting different system components (including the memory 52 and the processor 51).

[0148] The processor 51 is configured to read and execute instructions in the memory 52 so that the at least one processor can execute a method for distinguishing an operator provided in the above embodiment.

[0149] The bus 53 represents one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a processor, or a local bus using any bus structure in a variety of bus structures.

[0150] The memory 52 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 521 and / or a cache memory 522, and may further include a read-only memory (ROM) 523.

[0151] The memory 52 may also include a program / utilities 525 having a set (at least one) of program modules 524. Such program modules 524 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment.

[0152] The electronic device 50 may also communicate with one or more external devices 54 (such as a keyboard, a pointing device, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 50, and / or may communicate with any device that enables the electronic device 50 to communicate with one or more other electronic devices (such as a router, a modem, etc.). Such communication may be carried out through an input / output (I / O) interface 55. Moreover, the electronic device 50 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 56. As shown in the figure, the network adapter 56 communicates with other modules for the electronic device 50 through a bus 53. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 50, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0153] In some possible implementation manners, various aspects of a method for differentiating operators provided in this application may also be implemented in the form of a program product, which includes program code. When the program product runs on a computer device, the program code is used to cause the computer device to execute the steps of a method for differentiating operators according to various exemplary implementation manners of this application described above in this specification.

[0154] In addition, this application also provides a computer-readable storage medium. The computer storage medium stores a computer program, and the computer program is used to cause a computer to execute the method described in any one of the above embodiments.

[0155] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, and the instruction device implements the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 specified in one block or multiple blocks.

[0156] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, causing a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one flow Figure 1 one or more flows and / or blocks Figure 1 or steps for implementing the functions specified in a block or blocks.

[0157] Although the preferred embodiments of the present application have been described, additional changes and modifications can be made by those skilled in the art once they learn of the basic creative concept. Therefore, the appended claims are intended to be construed to cover the preferred embodiments as well as all changes and modifications falling within the scope of the present application.

[0158] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

1. A method for distinguishing operators, characterized in that: The method comprises: Determine a first video including a process of logging into any one account through a display interface of a device, and determine a second video including a process of accessing target information corresponding to any one account through the display interface, wherein the second video is collected when it is determined that the device logs into any one account and no operation instruction is received for a preset continuous time, and the first video and the second video are formed based on real-time encoding of mouse signals; Determine a first parameter of the first video and determine a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video, wherein the first parameter includes a first movement rate of a mouse cursor and a first command sending frequency of the mouse, and the second parameter includes a second movement rate of the mouse cursor and a second command sending frequency of the mouse; When the resolution of the first video is the same as that of the second video, if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor belong to the same gear, and the first command sending frequency of the mouse and the second command sending frequency of the mouse belong to the same gear, then it is determined that the first operator and the second operator are the same person, otherwise, the first operator and the second operator are not the same person, wherein, if the resolution of the first video is different from that of the second video, the formula v3=(R1*v2) / R2 is used to obtain the updated second movement rate, v3 represents the updated second movement rate, v2 represents the original second movement rate, R1 represents the resolution of the first video, and R2 represents the resolution of the second video.

2. The method according to claim 1, characterized in that The determining a first parameter of the first video includes: Determine a plurality of first target images from the first video, and determine a first pixel coordinate of a mouse cursor in each first target image, wherein the plurality of first target images are continuous in time, each first target image contains a mouse cursor, and the first pixel coordinate of the mouse cursor in each first target image is different; Determine a first pixel distance of the mouse cursor based on the obtained multiple first pixel coordinates; Determining a first movement rate of the mouse cursor based on the first pixel distance; The determining a second parameter of the second video includes: Determine a plurality of second target images from the second video, and determine a second pixel coordinate of a mouse cursor in each second target image, wherein the plurality of second target images are continuous in time, each second target image contains a mouse cursor, and the second pixel coordinate of the mouse cursor in each second target image is different; Determine a second pixel distance of the mouse cursor based on the obtained multiple second pixel coordinates; Based on the second pixel distance, a second movement rate of the mouse cursor is determined.

3. The method according to claim 1, characterized in that The determining a first parameter of the first video includes: Counting a first number of times a mouse command is received in the first video; Based on the first number of times, determining a first instruction sending frequency of the mouse; The determining a second parameter of the second video includes: Counting a second number of times the mouse command is received in the second video; Based on the second number of times, a second instruction sending frequency of the mouse is determined.

4. A device for distinguishing operators, characterized in that: The device comprises: A video determination module is used to determine a first video including a process of logging into any one account through a display interface of a device, and to determine a second video including a process of accessing target information corresponding to any one account through the display interface, wherein the second video is collected when it is determined that the device logs into any one account and no operation instruction is received for a preset continuous time, and the first video and the second video are formed based on real-time encoding of mouse signals; a parsing module, configured to determine a first parameter of the first video and a second parameter of the second video, wherein the first parameter represents an operation habit of a first operator corresponding to the first video, and the second parameter represents an operation habit of a second operator corresponding to the second video, wherein the first parameter includes a first movement rate of a mouse cursor and a first instruction sending frequency of the mouse, and the second parameter includes a second movement rate of the mouse cursor and a second instruction sending frequency of the mouse; A distinguishing module is used to determine that the first operator and the second operator are the same person if the first movement rate of the mouse cursor and the second movement rate of the mouse cursor belong to the same gear, and the first command sending frequency of the mouse and the second command sending frequency of the mouse belong to the same gear when the resolution of the first video is the same as the resolution of the second video; otherwise, the first operator and the second operator are not the same person, wherein if the resolution of the first video is different from the resolution of the second video, the formula v3=(R1*v2) / R2 is used to obtain the updated second movement rate, v3 represents the updated second movement rate, v2 represents the original second movement rate, R1 represents the resolution of the first video, and R2 represents the resolution of the second video.

5. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor executes a method as claimed in any one of claims 1 to 3.

6. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images