Remote desktop real-time monitoring method, system, equipment and medium

Abstract

The invention is applicable to the technical field of computers, and provides a remote desktop real-time monitoring method, which comprises the following steps: performing event monitoring by adopting an event hook technology, responding to each event through a preset event callback function, and returning monitoring data; characteristic behavior analysis is carried out on the monitored data, the source type of each event is preliminarily judged, and the source type comprises a local user event and a remote desktop control event; performing data processing on the monitored data to generate a data packet; performing secondary judgment on an event corresponding to each data packet by adopting an event circulation method to obtain a remote control result; based on the remote control result, an early warning prompt is sent out, monitoring early warning data are uploaded to background service, and the monitoring early warning data are data generated in the monitoring process. The system has high real-time performance, monitoring and early warning are carried out in real time, real-time monitoring and immediate early warning can be achieved, and accuracy is high.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a remote desktop real-time monitoring method, system, device and medium. Background Art

[0002] With the rapid development of information technology, computer security has become an important issue of global concern. In particular, with the popularization of the Internet and the development of cloud computing technology, computers, as key carriers for personal information storage and business processing, are facing increasingly serious challenges in security, especially unauthorized remote desktop control attacks. This type of attack uses malware, vulnerability exploits, etc. to enable attackers to remotely control the target computer system without the user's knowledge or consent, steal sensitive information, implant Trojan programs, or perform other malicious behaviors. Therefore, how to effectively detect whether a computer is controlled by a remote desktop has become an important issue that needs to be solved in the current field of network security.

[0003] In the prior art, how to effectively detect whether a computer is controlled by a remote desktop usually includes the following two solutions: (1) A detection method based on system log analysis, which mainly detects whether a computer is controlled by a remote desktop by collecting and analyzing the log information of the operating system. This method usually includes the following steps: first, collect the log information generated by the operating system, application programs, and network services; then, use log analysis tools to parse and filter the collected logs to extract features related to remote desktop control; finally, use comparative analysis or machine learning methods to determine whether the computer is controlled by a remote desktop. (2) A detection method based on network traffic monitoring, which monitors the transmission of network data packets to detect abnormal network connections and remote desktop control behaviors. This method usually uses network monitoring tools to capture and analyze network traffic in real time, and determines whether there is remote desktop control behavior by identifying specific network protocols and data packet features.

[0004] Of the above two methods, although method (I) can detect remote desktop control behavior more accurately, it requires in-depth analysis and processing of system logs, which has high technical and personnel requirements and high costs, making it unfavorable for promotion. At the same time, since it takes a long time to process and analyze logs, its real-time performance is poor and it is unable to respond to remote desktop control behavior in a timely manner. Solution (II) has the advantage of strong real-time performance and can detect remote desktop control behavior in a timely manner, but it may also be affected by network noise and interference, and is limited by the integrity and accuracy of the data, resulting in a high false alarm rate and insufficient accuracy. Summary of the invention

[0005] The embodiments of the present application provide a remote desktop real-time monitoring method, system, device and medium, which can solve one of the above-mentioned existing technical problems.

[0006] In a first aspect, an embodiment of the present application provides a remote desktop real-time monitoring method, comprising:

[0007] The event hook technology is used to monitor events, and each event is responded to and the monitoring data is returned through the preset event callback function, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click;

[0008] Performing characteristic behavior analysis on the monitoring data to preliminarily determine the source type of each of the events, the source type including local user events and remote desktop control events;

[0009] Processing the monitored data to generate a data packet;

[0010] Using the event loop method, a secondary judgment is performed on the event corresponding to each data packet to obtain a remote control result;

[0011] Based on the remote control result, an early warning prompt is issued, and the monitoring early warning data is uploaded to the background service, and the monitoring early warning data is the data generated during the monitoring process.

[0012] Furthermore, the method is applied to monitoring and early warning equipment;

[0013] Before using event hook technology to monitor events, respond to each event through the preset event callback function and return the monitored data, including:

[0014] The monitoring and early warning device is installed on a computer device, the operating environment of the computer device is initialized, and the background service process of the computer device is started.

[0015] Further, the monitoring data is subjected to characteristic behavior analysis to preliminarily determine the source type of each event, wherein the source type includes local user events and remote desktop control events, including:

[0016] Based on a preset unit time threshold, preprocessing the plurality of monitoring data, removing the interfering monitoring data, and obtaining preprocessed monitoring data, wherein the interfering monitoring data is invalid or repeated monitoring data;

[0017] Adding a plurality of events corresponding to the pre-processed monitoring data to a preset event sequence, wherein the pre-processed monitoring data includes event type, mouse data, keyboard data, event injection mark data and event generation time;

[0018] Determining whether the event injection mark data of the plurality of events in the preset event sequence meet a preset injection event mark value, wherein the preset injection event mark value includes a remote mouse mark value and a remote keyboard mark value;

[0019] If the preset injection event mark value is met, it can be preliminarily determined that the source type of the event is a remote desktop control event;

[0020] If the preset injection event mark value is not satisfied, it indicates that the source type of the event is a local user event.

[0021] Furthermore, the adding of the events corresponding to the plurality of pre-processed monitoring data to a preset event sequence includes:

[0022] Mark the event to be added as a new event, and obtain the event generation time of the new event;

[0023] Calculating the time difference between the event generation time of the new event and the event generation time of the last event in the preset event sequence;

[0024] If the time difference is less than a preset event time threshold, adding the new event to the preset event sequence;

[0025] If the event difference is greater than a preset event time threshold, the events in the preset event sequence are cleared, and then the new event is added to the preset event sequence.

[0026] Further, the monitoring data in the data processing of the monitoring data is pre-processed monitoring data corresponding to the event added to the preset event sequence;

[0027] The step of processing the monitored data to generate a data packet includes:

[0028] Parsing the pre-processed monitoring data to obtain key variable data, the key variable data including event type, key code, event injection mark data and event generation time;

[0029] Setting an injection field, and determining a field value of the injection field based on the event injection tag data, wherein the injection field is used to identify a source type of the event;

[0030] The event type, the key code, the injection field and the event generation time are compiled and constructed into a data packet, the data format of the data packet is json format, and the event types include mouse click type, mouse press type, mouse movement type and keyboard key type.

[0031] Further, each event in the preset event sequence corresponds to a data packet;

[0032] The method of adopting the event loop to perform a secondary judgment on the event corresponding to each data packet to obtain the remote control result includes:

[0033] Determine whether to enable the soft keyboard setting. If the soft keyboard setting is enabled, trigger a first ignore event, where the first ignore event is to ignore all events in the soft keyboard enabled state.

[0034] Determine whether a local mouse click event occurs, and if a local mouse click event occurs, trigger a second ignore event, wherein the second ignore event is to ignore a remote desktop control event generated within a preset ignore time threshold;

[0035] Determine whether a touch screen event occurs, and if a touch screen event occurs, trigger a third ignore event, wherein the third ignore event is to ignore a remote desktop control event corresponding to the touch screen event under a preset ignore event threshold;

[0036] Based on the first ignored event, the second ignored event and the third ignored event, obtaining a final event in the preset event sequence;

[0037] Determining whether the final event is a remote desktop control event according to the field value of the tag field;

[0038] If there are multiple final events that are remote desktop control events, it means that the current computer is controlled by the remote desktop, and a remote control result is generated.

[0039] Furthermore, the method of issuing the warning prompt is to pop up a desktop pop-up window prompt, and the pop-up window prompt clearly states the relevant remote desktop control matters;

[0040] The monitoring and early warning data include data packets, remote control results, and basic information of monitoring and early warning equipment and computer equipment;

[0041] Before uploading the monitoring and early warning data to the background service, the monitoring and early warning data are encrypted using an interface signature encryption method and a bytecode encryption method.

[0042] In a second aspect, an embodiment of the present application provides a remote desktop real-time monitoring system, including:

[0043] Event monitoring and response module: used to monitor events using event hook technology, respond to each event through a preset event callback function and return monitoring data, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click;

[0044] Characteristic behavior analysis module: used to perform characteristic behavior analysis on the monitoring data, and preliminarily determine the source type of each event, the source type including local user events and remote desktop control events;

[0045] Data packet generation module: used for processing the monitored data to generate data packets;

[0046] Secondary judgment module: used to perform secondary judgment on the event corresponding to each data packet by using the event loop method to obtain the remote control result;

[0047] Early warning module: used to issue early warning prompts based on the remote control results and upload monitoring early warning data to the background service. The monitoring early warning data is the data generated during the monitoring process.

[0048] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned remote desktop real-time monitoring method when executing the computer program.

[0049] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, including a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned remote desktop real-time monitoring method is implemented.

[0050] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0051] The present application discloses a remote desktop real-time monitoring method, which uses event hook technology to monitor keyboard and mouse events, and uses a specific logic method to determine whether the current mouse and keyboard events are generated remotely or by a local user, so as to determine whether the computer is controlled by the remote desktop. The method has high real-time performance, and monitoring and early warning are both carried out in real time. When remote desktop control occurs, real-time monitoring and immediate early warning can be achieved. In addition, the method makes judgments based on the behaviors of the two necessary peripherals of the computer, the mouse and the keyboard, with high accuracy and the characteristics of high accuracy, and is not affected by network noise and interference, and has a low false alarm rate. In addition, the method can be dynamically expanded according to actual business conditions and effects, and has high scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0053] Figure 1 It is a flowchart of a remote desktop real-time monitoring method provided by an embodiment of the present invention;

[0054] Figure 2It is a structural diagram of a remote desktop real-time monitoring system provided by an embodiment of the present invention;

[0055] Figure 3 It is a schematic diagram of the structure of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0057] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0058] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0059] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0060] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0061] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0062] See also Figure 1 As shown, the present invention is a remote desktop real-time monitoring method, comprising the following steps:

[0063] S100, using event hook technology to monitor events, responding to each event through a preset event callback function and returning monitoring data, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click;

[0064] In this embodiment, the event hook technology is applied to monitor a series of user-computer interaction events, including but not limited to: keyboard key operation, mouse press, mouse release, mouse movement and mouse click. Specifically, each event corresponds to a preset event callback function, which can be divided into keyboard key callback function, mouse action callback function, etc. according to the trigger type of the event. Each event callback function contains the logic required to process a specific event, and can automatically call the corresponding event callback function when the relevant event is monitored, and return the corresponding monitoring data. For example, when a keyboard key operation is monitored, the keyboard key callback function is called to record the ASCII code of the key, the key timestamp and other information; when a mouse click operation is monitored, the mouse action callback function is called to record the coordinate position of the click, the button clicked (left button, right button or middle button) and whether other modifier keys (such as Ctrl, Shift, etc.) are pressed at the same time when clicking. When each callback function is executed, the above recorded event data is processed accordingly and the corresponding monitoring data is returned.

[0065] In some embodiments, the method is applied to monitoring early warning equipment, wherein step S100 includes:

[0066] The monitoring and early warning device is installed on a computer device, the operating environment of the computer device is initialized, and the background service process of the computer device is started.

[0067] A remote desktop real-time monitoring method of the present application is used to monitor the computer desktop in real time, and then determine whether the computer is remotely controlled, so as to achieve network security. Specifically, in the present application, a monitoring and early warning device is set up as a carrier of a remote desktop real-time monitoring method, and the monitoring and early warning device is installed on the computer to achieve real-time monitoring of the computer desktop.

[0068] In this embodiment, the monitoring and early warning device is installed in a one-click seamless installation mode. The monitoring and early warning device runs silently in the background of the computer, and the user cannot perceive the existence of the monitoring and early warning device. This simplifies the installation process, improves the user experience, enhances the compatibility and flexibility of the system, and reduces maintenance costs.

[0069] In this embodiment, after the monitoring and early warning device is installed, it is necessary to perform context initialization on the computer's operating environment, such as threshold initialization. Threshold initialization is to initialize various judgment thresholds used in the real-time monitoring method, that is, to pre-set various judgment thresholds. Specifically, the judgment thresholds include unit time thresholds, event time thresholds and ignore time thresholds.

[0070] In this embodiment, the purpose of starting the background service process of the computer device is to make the running process corresponding to the monitoring and early warning device resident in the background of the computer operating system. When the running process is forcibly killed by external factors such as system failure, malware, etc., the background of the computer operating system will restart the process to provide real-time and comprehensive monitoring and early warning of remote desktop control, thereby improving the continuity and availability of the remote desktop real-time monitoring method.

[0071] S200, performing characteristic behavior analysis on the monitoring data, and preliminarily determining the source type of each of the events, the source type including local user events and remote desktop control events;

[0072] In the present application, a multi-level monitoring data processing method is adopted to determine whether the current computer is remotely controlled. Specifically, by performing characteristic behavior analysis on the monitoring data, the source type of the event is distinguished, that is, a preliminary judgment is made as to whether the event is directly triggered by the local user or generated through remote desktop control, and then a secondary judgment is made from the events generated by the remote desktop control to reduce the possibility of misjudgment, obtain the final event, and then determine whether the current computer is remotely controlled. The above-mentioned multi-level monitoring data processing method improves the efficiency of data processing and early warning capability in the monitoring process, and improves the practicality of the remote desktop real-time monitoring method.

[0073] In some embodiments, the step S200 includes:

[0074] Based on a preset unit time threshold, preprocessing the plurality of monitoring data, removing the interfering monitoring data, and obtaining preprocessed monitoring data, wherein the interfering monitoring data is invalid or repeated monitoring data;

[0075] Adding a plurality of events corresponding to the pre-processed monitoring data to a preset event sequence, wherein the pre-processed monitoring data includes event type, mouse data, keyboard data, event injection mark data and event generation time;

[0076] Determining whether the event injection mark data of the plurality of events in the preset event sequence meet a preset injection event mark value, wherein the preset injection event mark value includes a remote mouse mark value and a remote keyboard mark value;

[0077] If the preset injection event mark value is met, it can be preliminarily determined that the source type of the event is a remote desktop control event;

[0078] If the preset injection event mark value is not satisfied, it indicates that the source type of the event is a local user event.

[0079] In this embodiment, in the process of monitoring the computer, interference data, that is, invalid and repeated data, is usually generated due to user misoperation, system interference or other non-user intentions, which interferes with the analysis and judgment of the monitoring data. Therefore, it is necessary to pre-process the multiple monitoring data monitored during the monitoring process to improve the availability of the monitoring data.

[0080] Specifically, invalid monitoring data generally refers to monitoring data generated when a non-monitoring function key is triggered when a user performs keyboard key operations, wherein the non-monitoring function key is a key that the system does not care about, such as a keyboard function key, a control key, etc. Repeated monitoring data refers to monitoring data generated when a user performs the same operation on the keyboard and mouse within a preset unit time threshold, wherein the same operation on the keyboard and mouse specifically includes events of the same event type triggered within a preset unit time threshold, mouse click events with the same position coordinates generated within a preset unit time threshold, and events of the same mouse press or keyboard key press within a preset unit time threshold, such as pressing the left mouse button at the same time or pressing a certain monitoring function key of the keyboard at the same time. In this embodiment, the above method is used to remove the interfering monitoring data in the monitoring data, thereby obtaining pre-processed monitoring data.

[0081] In this embodiment, the monitoring data returned by event monitoring through event hook technology is a low-level input event, which is usually a raw input event related to hardware interaction that occurs at the bottom layer of the operating system. Specifically, it is directly generated by input devices such as keyboards, mice, touch screens, etc., and is captured and processed by the operating system kernel. The monitoring data returned usually includes event type, mouse data, keyboard data, event injection marker data and event generation time.

[0082] It is understandable that the pre-processed monitoring data selected from the monitoring data also includes event type, mouse data, keyboard data, event injection mark data and event generation time. In addition, the mouse data and keyboard data in the monitoring data or pre-processed monitoring data are usually determined by the event type. If the event type is generated by mouse triggering, the monitoring data includes mouse data, if the event type is generated by keyboard triggering, the monitoring data includes keyboard data, and if the event type is generated by keyboard and mouse triggering at the same time, the monitoring data includes keyboard data and mouse data.

[0083] Specifically, for a mouse click event, the monitoring data returned is "{event:'mouseclick', x:1, y:1, event_time:'2024-04-04 09:40:01:600', flag:0}", wherein event:'mouseclick' indicates that the event type of the event is a mouse click, x:1, y:1 indicates the mouse data corresponding to the mouse click, which is specifically represented by the position coordinates of the mouse in the current embodiment, event_time indicates the event generation time of the event, and flag indicates the event injection flag, which is used to indicate the injection method of the event.

[0084] In this embodiment, the event injection mark bit is represented by setting a flag in the monitoring data, and the corresponding event injection mark data is generated by the bottom layer of the operating system, which is used to indicate that the event is an injection event directly injected by the system process, rather than a local event generated by the user's active input. Therefore, for local events, the event injection mark data corresponding to its event injection mark bit is 0; and for injection events, each mouse and keyboard event will generate a corresponding injection event mark value, and each injection event mark value corresponds to an injection method, wherein the injection methods include remote mouse injection and remote keyboard injection. Correspondingly, the injection event mark value of remote mouse injection is 0x00000001, and the injection event mark value of remote keyboard injection is 0x00000010.

[0085] Since the event injection marker data is generated by the underlying operating system and cannot be changed at will, and it can be used to indicate the injection method of the event, the source type of each event is preliminarily determined in this application by judging whether the event injection marker data of each event is the injection event marker value.

[0086] In some embodiments, adding the events corresponding to the plurality of pre-processed monitoring data to a preset event sequence includes:

[0087] Mark the event to be added as a new event, and obtain the event generation time of the new event;

[0088] Calculating the time difference between the event generation time of the new event and the event generation time of the last event in the preset event sequence;

[0089] If the time difference is less than a preset event time threshold, adding the new event to the preset event sequence;

[0090] If the time difference is greater than a preset event time threshold, the events in the preset event sequence are cleared, and then the new event is added to the preset event sequence.

[0091] In this embodiment, a series of events that meet the preset event time threshold are screened out in real time through the event generation time and the preset event time threshold, which facilitates the subsequent processing of the pre-processed monitoring data, while ensuring the real-time nature of the monitoring data and improving the data processing efficiency.

[0092] In this embodiment, the preset event sequence is used to store remote desktop control events that meet the preset event time threshold. Specifically, the event to be added to the preset event sequence is marked as a new event, and the event generation time of the new event is obtained and marked as eventTime1, the preset event time threshold is obtained and recorded as eventTime, the event generation time of the last event in the preset event sequence is obtained and marked as eventTime2, the time difference between eventTime1 and eventTime2 is calculated and marked as timeDiff, and the preset event sequence is determined by comparing timeDiff and eventTime. When timeDiff is greater than eventTime, all events in the preset event sequence are cleared, and then the new event is added to the preset event sequence as the beginning of a new preset event sequence, to ensure that the events in the preset event sequence are events generated within the preset event time threshold, thereby ensuring the real-time nature of the data.

[0093] It can be understood that the events in the preset event sequence are sorted according to the time when the events are generated.

[0094] S300, performing data processing on the monitored data to generate a data packet;

[0095] In this embodiment, the pre-processed monitoring data obtained through the above step S200 is essentially still binary data, so the above binary data needs to be converted into a data structure in json format before data transmission can be performed. Therefore, the monitoring data generated by the remote desktop control event needs to be processed to generate a data packet, wherein the data packet is data in json format.

[0096] In some embodiments, the monitoring data in the above step S300 is pre-processed monitoring data corresponding to the event added to the preset event sequence, and the above step S300 includes:

[0097] Parsing the pre-processed monitoring data to obtain key variable data, the key variable data including event type, key code, event injection mark data and event generation time;

[0098] Setting an injection field, and determining a field value of the injection field based on the event injection tag data, wherein the injection field is used to identify a source type of the event;

[0099] The event type, the key code, the injection field and the event generation time are compiled and constructed into a data packet, the data format of the data packet is json format, and the event types include mouse click type, mouse press type, mouse movement type and keyboard key type.

[0100] In this embodiment, the key variable data is the data required for secondary judgment, which facilitates the processing of monitoring data to determine whether the current computer is remotely controlled. Therefore, the key variable data includes event type, key code, event injection mark data and event generation time.

[0101] In this embodiment, an injection field is set to indicate whether the current event is a remote mouse injection or a remote keyboard injection, wherein the field value of the injection field is determined by the event injection mark data generated by the underlying system operation. Specifically, when the event injection mark data is 0x00000010 or 0x00000001, the field value of the injection field is determined to be 1, at which time it can be preliminarily determined that the event type of the current event is a remote desktop control event; when the event injection mark data is 0, the field value of the injection field is determined to be 0, at which time it can be determined that the event type of the current event is a local user event.

[0102] Specifically, taking the above-mentioned mouse click event, the returned monitoring data "{event:'mouseclick', x:1, y:1, event_time:'2024-04-04 09:40:01:600', flag:0}" is taken as an example, and it is compiled and constructed into a data packet, and the representation of the data packet is {type:'mouseclick', position, time:'2024-04-0409:40:01:600', injected:0}, wherein type represents the event type, time represents the event generation time, and injected represents the injected field. In addition, since the event type of the current event is the mouse click type of mouseclick, there is no value related to the key code, and thus, the placeholder for the key code is represented by position. It can be understood that when the event type is the mousedown type or the keydown type, the position will be replaced by the keycode field, and the field value corresponding to the keycode field is the key code. It is worth noting that the key code of the mousedown type is "left" or "right", which means pressing the left mouse button or the right mouse button respectively.

[0103] S400, using an event loop method, performing a secondary judgment on the event corresponding to each of the data packets to obtain a remote control result;

[0104] In this embodiment, for the event in which the field value of the injection field obtained in the above step S300 is 1, it cannot be accurately determined as a remote desktop control event, and there is a possibility of misjudgment. For example, when the soft keyboard is turned on in the monitored computer device, the events related to the mouse and keyboard generated during the monitoring process will be identified as remote desktop control events, which will result in the inability to accurately monitor the accurate remote desktop control events according to the event hook technology. For example, keyboard events triggered by specific software, such as the input of emoticons and characters in emoticon tools or keyboard software, are essentially events triggered by local mouse clicks, but will be identified as remote desktop control events during the monitoring process. In addition, touch screen events under the computer operating system mechanism will also be identified as remote desktop control events. The above situations will cause misjudgment in monitoring, thereby making the field value of the injection field 1. Therefore, it is necessary to perform a secondary judgment on each event in the preset event sequence, and then determine that the accurate remote desktop control event is the final event.

[0105] In some embodiments, each event in the preset event sequence corresponds to a data packet, and the above step S400 includes:

[0106] Determine whether to enable the soft keyboard setting. If the soft keyboard setting is enabled, trigger a first ignore event, where the first ignore event is to ignore all events in the soft keyboard enabled state.

[0107] Determine whether a local mouse click event occurs, and if a local mouse click event occurs, trigger a second ignore event, wherein the second ignore event is to ignore a remote desktop control event generated within a preset ignore time threshold;

[0108] Determine whether a touch screen event occurs, and if a touch screen event occurs, trigger a third ignore event, wherein the third ignore event is to ignore a remote desktop control event corresponding to the touch screen event under a preset ignore event threshold;

[0109] Based on the first ignored event, the second ignored event and the third ignored event, obtaining a final event in the preset event sequence;

[0110] Determining whether the final event is a remote desktop control event according to the field value of the tag field;

[0111] If there are multiple final events that are remote desktop control events, it means that the current computer is controlled by the remote desktop, and a remote control result is generated.

[0112] In this embodiment, the process.lookup method is used to query the "osk" process in the monitoring process list to determine whether the soft keyboard of the currently monitored computer device is turned on. When it is detected that the osk process is turned on in the process, it means that the soft keyboard is turned on in the computer, triggering the first ignore event. At this time, events related to the mouse and keyboard will be judged as remote desktop control events. Therefore, all events when the soft keyboard is turned on need to be ignored, which in turn causes the monitoring of remote desktop control events to not meet the requirements. At this time, the real-time monitoring process of the computer's remote desktop ends. In a preferred embodiment, a warning message is usually issued to remind the user to turn off the soft keyboard in the computer device before performing the monitoring operation, thereby improving the availability of the remote desktop real-time monitoring method.

[0113] In this embodiment, the possibility of misjudgment of remote desktop control events caused by keyboard events triggered by specific software is reduced by ignoring remote desktop control events generated within a preset ignore time threshold. Specifically, when it is monitored that the computer is being controlled by a local keyboard or mouse, the remote desktop control events within the preset ignore time threshold will be ignored, that is, when injected=0 in any data packet in the preset event sequence, the event with injected=1 in the data packet within the preset ignore time threshold will be ignored.

[0114] In this embodiment, whether a touch screen event occurs in the currently monitored computer is determined based on the characteristics of the touch screen event. Specifically, there must first be a mouse press event, followed by a mouse move event to trigger the touch screen event. That is, when the user performs a touch screen event, he must first press the screen to cause a mouse press event to occur on the computer, and then drag the relevant items on the screen to cause a mouse move event to occur on the computer. Therefore, events that first trigger a mouse press event and then trigger a mouse move event under the preset ignore time threshold will be ignored.

[0115] In this embodiment, the preset ignore time threshold is set to a shorter time. It is reasonable to ignore within the time interval of the preset ignore time threshold, which will not affect the recognition of normal remote control events and will not affect the continuity and accuracy of remote control. In a preferred embodiment, the preset ignore time threshold is 1s.

[0116] In this embodiment, after screening the first ignored event, the second ignored event and the third ignored event, most of the false alarm events have been eliminated in the preset event sequence, and the remaining events in the preset event sequence are final events, and the injected of the corresponding data packet can be used to measure whether the current computer has been controlled by the remote desktop. Specifically, by judging whether the field value of injected of each final variable is 1, it is judged whether the final event is a remote desktop control event; if there are multiple final events that are remote desktop control events, it means that the current computer is controlled by the remote desktop, and a remote control result is generated at the same time.

[0117] S500: Based on the remote control result, an early warning prompt is issued, and the monitoring early warning data is uploaded to the background service, where the monitoring early warning data is the data generated during the monitoring process.

[0118] In some embodiments, the warning prompt is issued in the form of a pop-up desktop window prompt, wherein the pop-up window prompt specifies the relevant remote desktop control matters;

[0119] The monitoring and early warning data include data packets, remote control results, and basic information of monitoring and early warning equipment and computer equipment;

[0120] Before uploading the monitoring and early warning data to the background service, the monitoring and early warning data are encrypted using an interface signature encryption method and a bytecode encryption method.

[0121] In this embodiment, after the above steps S100-S400, the remote control results of the currently monitored computer can be obtained. In order to achieve the function of prompting and warning the user, a desktop pop-up window prompt is used to attract the user's attention instantly and intuitively, ensuring that key information is not ignored. In the remote desktop control scenario, by popping up a desktop pop-up window prompt, the user can immediately learn detailed information about the remote control results and respond quickly. This method effectively improves the efficiency and accuracy of information communication and avoids potential problems caused by negligence or delayed processing. In addition, the pop-up window content is clear and specific, which helps users quickly understand and make decisions, enhancing the security of the system and user experience.

[0122] In this embodiment, a data uploading function is also included. Specifically, the monitoring and early warning device will upload the data generated during the monitoring process to the background service program, ensuring the timeliness and accuracy of the information, so that the background can quickly obtain the latest monitoring results and basic information of the computer, so as to respond to possible risks or abnormal situations in a timely manner. This not only improves the timeliness of the early warning, but also enhances the system's response capability and decision-making support capability.

[0123] In this embodiment, in order to prevent data from being tampered with during upload, an interface signature encryption method is also used before uploading the monitoring and early warning data to the background service to prevent third parties from calling the system public interface. In addition, in order to prevent the leakage of signature keys, bytecode encryption is used, which effectively prevents the key from being obtained through decompilation, further improving network security.

[0124] In some embodiments, in order to ensure the effectiveness and security of the remote desktop real-time monitoring method, the monitoring and early warning equipment will be regularly updated and maintained, including: optimizing the monitoring and early warning method, repairing potential security vulnerabilities, etc. In addition, through continuous updates and maintenance, it constantly adapts to new threats and changes, improves the accuracy and reliability of detection, and users can also complete software update operations through the built-in hot update mechanism, thereby making the remote desktop real-time monitoring method highly scalable.

[0125] In order to further illustrate a remote desktop real-time monitoring method of the present application, the present application provides an exemplary embodiment of the above method, which is as follows:

[0126] Assume that in this embodiment, the user's computer has been infected with a remote desktop control Trojan virus. At this time, the user uses a one-click seamless installation method to install the monitoring and early warning device that carries the above-mentioned remote desktop real-time monitoring method on the computer. After the installation is completed, the context initialization of the operating environment is automatically performed, and the background service process of the computer is started, so that the monitoring and early warning device can run silently in the background of the computer. This process is carried out in the background and the user cannot perceive it.

[0127] When the monitoring and early warning device is running silently, it will monitor and respond to the mouse events and keyboard events generated in the computer operating system. For example, when the user actively operates the mouse and keyboard, it is assumed that a series of event data similar to the following is generated:

[0128] a.{event:'mousedown',x:0,y:0,

[0129] event_time:'2024-04-04 09:40:00:000', flag:0}

[0130] b.{event:'mousedown',x:1,y:1,

[0131] event_time:'2024-04-04 09:40:00:100', flag:0}

[0132] c.{event:'mousedown',x:1,y:1,keycode:'left',

[0133] event_time:'2024-04-04 09:40:00:300', flag:0}

[0134] d.{event:'mousedown',x:2,y:2,keycode:'left',

[0135] event_time:'2024-04-04 09:40:00:500', flag:0x00000001}

[0136] e.{event:'keydown', keycode:'a',

[0137] event_time:'2024-04-04 09:41:00:100', flag:0}

[0138] f.{event:'keydown', keycode:'a',

[0139] event_time:'2024-04-04 09:41:00:300', flag:0x00000001}

[0140] g.{event:'keydown', keycode:'F1',

[0141] event_time:'2024-04-04 09:41:00:600', flag:0}

[0142] h.{event:'mousedown',x:1,y:1,

[0143] event_time:'2024-04-04 09:41:00:100', flag:0x00000001}

[0144] i.{event:'mousemove',x:1,y:1,

[0145] event_time:'2024-04-04 09:41:00:500', flag:0x00000001}

[0146] j.{event:'mousemove',x:1,y:1,

[0147] event_time:'2024-04-04 09:4100:800', flag:0x00000001}

[0148] k.{event:'mousemove',x:1,y:1,

[0149] event_time:'2024-04-04 09:40:01:300', flag:0x00000001}

[0150] l.{event:'mouseclick',x:1,y:1,

[0151] event_time:'2024-04-04 09:40:01:600', flag:0}

[0152] m.{event:'keydown', keycode:'xx',

[0153] event_time:'2024-04-04 09:40:01:700', flag:0x00000010}

[0154] The above series of events are recorded as E, Ea represents the monitoring data returned by event a among the above am events, and the process of preprocessing the above Ea-Em monitoring data is as follows:

[0155] 1. Remove the same events triggered within the preset unit time threshold. In this embodiment, the preset unit time threshold is 200ms. In the Ea-Em monitoring data, since Ea and Eb are events of the same event type triggered within 200ms, that is, mousedown is triggered at the same time, Ea will be eliminated. At this time, only Eb-Em can be accessed in the monitoring data.

[0156] 2. Remove the mouse click events with the same position coordinates generated within the preset unit time threshold. Specifically, since Eb and Ec were clicked at x=1, y=1 on the screen within 200ms, Eb will be removed, and only Ec-Em can be accessed.

[0157] 3. Remove the events of mouse press or keyboard key press within the preset unit time threshold. Specifically, since within 200ms, Ec and Ed are both mouse press events, and both press the left button; Ee and Ef are both keyboard press events, and both press the letter a, Ec and Ee will be removed, and only Ed, Ef-Em can be accessed.

[0158] 4. Remove the monitoring data generated by the non-monitoring function keys being triggered. Specifically, since Eg is a keyboard press event, and the key pressed is F1, which is one of the non-monitoring function keys, it will be removed. At this time, only Ed, Ef, Eh-Em can be accessed.

[0159] At this time, the remaining events in E after the above preprocessing are added to the preset event sequence, and then it is determined whether the value of the event injection mark flag in the preset event sequence satisfies 0x00000010 or 0x00000001. Among the above Ed, Ef, Eh-Em, only Ed, Ef, Eh, Ei, Ej, Ek, and Em meet the requirements. Therefore, when the preprocessed monitoring data of Ed, Ef, Eh-Em is compiled and constructed into a data packet, the field value of the injected field of Ed, Ef, Eh, Ei, Ej, Ek, and Em is 1, indicating a remote desktop control event, and the field value of the injected field of El is 0, indicating a local user event. The specific situation of the data packet in the current preset event sequence is as follows:

[0160] d.{type:'mousedown', position, keycode: 'left',

[0161] time:'2024-04-04 09:40:00:500',injected:1}

[0162] f.{type:'keydown', keycode:'a',

[0163] time:'2024-04-04 09:41:00:300',injected:1}

[0164] h.{type:'mousedown', position,

[0165] time:'2024-04-04 09:41:00:100',injected:1}

[0166] i.{type:'mousemove',position,

[0167] time:'2024-04-04 09:41:00:500', flag:0x00000010, injected:1}

[0168] j.{type:'mousemove',position,

[0169] time:'2024-04-04 09:41:00:800',injected:1}

[0170] k.{type:'mousemove',position,

[0171] time:'2024-04-04 09:41:02:300', flag:0x00000010, injected:1}

[0172] l.{type:'mouseclick',position,

[0173] time:'2024-04-04 09:40:01:600',injected:0}

[0174] m.{type:'keydown', keycode:'xx',

[0175] time:'2024-04-04 09:40:01:700', flag:0, injected:1}

[0176] At this time, a second judgment is made on each event in the above preset event sequence to determine the accurate remote desktop control event as the final event. The specific situation is as follows:

[0177] 1. Use the process.lookup method to check whether there is an osk process. If the osk process is detected to be turned on, all mouse and keyboard related events in E need to be ignored, which will end the monitoring process of the computer's remote desktop.

[0178] 2. In order to prevent the misjudgment of remote desktop control events caused by keyboard events triggered by specific software, remote keyboard events generated within a preset ignore time threshold are ignored. In this embodiment, the preset ignore time threshold is 1s. In the above Ed, Ef, Eh-Em, since El is a click event controlled by the local mouse, and Em is a remote keyboard press event, and the interval between the two events is within 1s, events related to El and Em are ignored. At this time, Ed, Ef, Eh-k can be accessed.

[0179] 3. For touch screen events, according to the characteristics of touch screen events that the mouse click is triggered first and then the mouse movement is triggered, judgment is made. In the above Ed, Ef, Eh-k, Eh, Ei, and Ej will be ignored. At this time, only Ed, Ef, El, and Em can be accessed. At this time, Ed, Ef, El, and Em are the final events.

[0180] 4. For the data packets of Ed, Ef, El, and Em, the event type is distinguished according to the value of the injected field in the event data packet. When injected=0, it is a local user event, and when injected=1, it is a remote desktop control event. Specifically, El is a local user event, and Ed, Ef, and Em are remote desktop control events. It can be seen that there are 3 events with injected=1 on the current computer. Therefore, it is determined that the current computer has been controlled by the remote desktop and a remote control result is generated.

[0181] According to the above remote control results, an early warning prompt is issued, mainly a pop-up window on the desktop to inform the user of the situation, with the content: "The current computer is at risk of being controlled by the remote desktop, suspected of being controlled by the remote mouse and remote keyboard." In addition, data is reported, and the monitoring and early warning data is passed to the background service through the https interface for auditing. Finally, if the background service has optimized adjustments for the overall process, the optimized code will be released, and the user will perform adaptive updates through hot updates.

[0182] In summary, a remote desktop real-time monitoring method of the present application adopts event hook technology to monitor events generated by the keyboard and mouse, and judges whether the current mouse and keyboard events are generated remotely or by the local user through a specific logical method, so as to judge whether the computer is controlled by the remote desktop. It has high real-time performance, and monitoring and early warning are both carried out in real time. When remote desktop control occurs, it can achieve real-time monitoring and immediate early warning. In addition, it makes judgments based on the behavior of the two necessary peripherals of the computer, the mouse and keyboard, with high accuracy and high accuracy, and is not affected by network noise and interference, and has a low false alarm rate. In addition, it can be dynamically expanded according to actual business conditions and effects, and has high scalability.

[0183] See also Figure 2 As shown, the present invention also provides a remote desktop real-time monitoring system, the system comprising:

[0184] Event monitoring and response module 201: used to monitor events using event hook technology, respond to each event through a preset event callback function and return monitoring data, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click;

[0185] Characteristic behavior analysis module 202: used to perform characteristic behavior analysis on the monitoring data, and preliminarily determine the source type of each event, wherein the source type includes local user events and remote desktop control events;

[0186] Data packet generation module 203: used to process the monitored data and generate a data packet;

[0187] Secondary judgment module 204: used to perform secondary judgment on the event corresponding to each data packet by using an event loop method to obtain a remote control result;

[0188] The early warning module 205 is used to issue an early warning prompt based on the remote control result, and upload the monitoring early warning data to the background service. The monitoring early warning data is the data generated during the monitoring process.

[0189] It is understandable that if Figure 1 The contents of the remote desktop real-time monitoring method embodiment shown in the figure are applicable to the remote desktop real-time monitoring system embodiment. The functions specifically implemented by the remote desktop real-time monitoring system embodiment are similar to those in the example shown in the figure. Figure 1 The remote desktop real-time monitoring method embodiment shown is the same as that shown in the embodiment, and the beneficial effects achieved are the same as those of the embodiment shown in the embodiment. Figure 1 The beneficial effects achieved by the remote desktop real-time monitoring method embodiment shown are also the same.

[0190] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0191] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0192] See also Figure 3 As shown, an embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, a remote desktop real-time monitoring method as described in any one of the above methods is implemented.

[0193] The computer device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of computer device 3 and does not constitute a limitation on computer device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0194] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0195] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 3. Further, the memory 302 may also include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0196] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the remote desktop real-time monitoring method as described in any one of the above methods is implemented.

[0197] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0198] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A remote desktop real-time monitoring method, characterized in that: include: The event hook technology is used to monitor events, and each event is responded to and the monitoring data is returned through the preset event callback function, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click; Performing characteristic behavior analysis on the monitoring data to preliminarily determine the source type of each of the events, the source type including local user events and remote desktop control events; Processing the monitored data to generate a data packet; Using the event loop method, a secondary judgment is performed on the event corresponding to each data packet to obtain a remote control result; Based on the remote control result, an early warning prompt is issued, and the monitoring early warning data is uploaded to the background service, and the monitoring early warning data is the data generated during the monitoring process.

2. The method according to claim 1, characterized in that The method is applied to monitoring early warning equipment; Before using event hook technology to monitor events, respond to each event through the preset event callback function and return the monitored data, including: The monitoring and early warning device is installed on a computer device, the operating environment of the computer device is initialized, and the background service process of the computer device is started.

3. The method according to claim 1, characterized in that The characteristic behavior analysis of the monitoring data is performed to preliminarily determine the source type of each event, wherein the source type includes local user events and remote desktop control events, including: Based on a preset unit time threshold, preprocessing the plurality of monitoring data, removing the interfering monitoring data, and obtaining preprocessed monitoring data, wherein the interfering monitoring data is invalid or repeated monitoring data; Adding a plurality of events corresponding to the pre-processed monitoring data to a preset event sequence, wherein the pre-processed monitoring data includes event type, mouse data, keyboard data, event injection mark data and event generation time; Determining whether the event injection mark data of the plurality of events in the preset event sequence meet a preset injection event mark value, wherein the preset injection event mark value includes a remote mouse mark value and a remote keyboard mark value; If the preset injection event mark value is met, it can be preliminarily determined that the source type of the event is a remote desktop control event; If the preset injection event mark value is not satisfied, it indicates that the source type of the event is a local user event.

4. The method according to claim 3, characterized in that The adding the events corresponding to the plurality of pre-processed monitoring data to a preset event sequence comprises: Mark the event to be added as a new event, and obtain the event generation time of the new event; Calculating the time difference between the event generation time of the new event and the event generation time of the last event in the preset event sequence; If the time difference is less than a preset event time threshold, adding the new event to the preset event sequence; If the event difference is greater than a preset event time threshold, the events in the preset event sequence are cleared, and then the new event is added to the preset event sequence.

5. The method according to claim 3, characterized in that The monitoring data in the data processing of the monitoring data is pre-processed monitoring data corresponding to the event added to the preset event sequence; The step of processing the monitored data to generate a data packet includes: Parsing the pre-processed monitoring data to obtain key variable data, the key variable data including event type, key code, event injection mark data and event generation time; Setting an injection field, and determining a field value of the injection field based on the event injection tag data, wherein the injection field is used to identify a source type of the event; The event type, the key code, the injection field and the event generation time are compiled and constructed into a data packet, the data format of the data packet is json format, and the event types include mouse click type, mouse press type, mouse movement type and keyboard key type.

6. The method according to claim 5, characterized in that Each event in the preset event sequence corresponds to a data packet; The method of adopting the event loop to perform a secondary judgment on the event corresponding to each data packet to obtain the remote control result includes: Determine whether to enable the soft keyboard setting. If the soft keyboard setting is enabled, trigger a first ignore event, where the first ignore event is to ignore all events in the soft keyboard enabled state. Determine whether a local mouse click event occurs, and if a local mouse click event occurs, trigger a second ignore event, wherein the second ignore event is to ignore a remote desktop control event generated within a preset ignore time threshold; Determine whether a touch screen event occurs, and if a touch screen event occurs, trigger a third ignore event, wherein the third ignore event is to ignore a remote desktop control event corresponding to the touch screen event under a preset ignore event threshold; Based on the first ignored event, the second ignored event and the third ignored event, obtaining a final event in the preset event sequence; Determining whether the final event is a remote desktop control event according to the field value of the tag field; If there are multiple final events that are remote desktop control events, it means that the current computer is controlled by the remote desktop, and a remote control result is generated.

7. The method according to claim 2, characterized in that The method of issuing the warning prompt is to pop up a desktop pop-up window prompt, and the pop-up window prompt specifies the relevant remote desktop control matters; The monitoring and early warning data include data packets, remote control results, and basic information of monitoring and early warning equipment and computer equipment; Before uploading the monitoring and early warning data to the background service, the monitoring and early warning data are encrypted using an interface signature encryption method and a bytecode encryption method.

8. A remote desktop real-time monitoring system, characterized in that: include: Event monitoring and response module: used to monitor events using event hook technology, respond to each event through a preset event callback function and return monitoring data, wherein the events include keyboard key operation, mouse press, mouse release, mouse movement and mouse click; Characteristic behavior analysis module: used to perform characteristic behavior analysis on the monitoring data, and preliminarily determine the source type of each event, the source type including local user events and remote desktop control events; Data packet generation module: used for processing the monitored data to generate data packets; Secondary judgment module: used to perform secondary judgment on the event corresponding to each data packet by using the event loop method to obtain the remote control result; Early warning module: used to issue early warning prompts based on the remote control results and upload monitoring early warning data to the background service. The monitoring early warning data is the data generated during the monitoring process.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images