Multi-dimensional data authority management and privacy protection method for electric power information network

Abstract

The invention provides a multi-dimensional data authority management and privacy protection method for an electric power information network, and the method comprises the steps: dynamically selecting the type of a watermark according to the leakage risk level of a screenshot event, and enabling the watermark type to comprise a simple character watermark, a character and image mixed watermark, an invisible watermark, and a two-dimensional code watermark; user screenshot content factors are added in a screenshot event distribution curve of user historical data to judge the risk level of a user, the risk level of a user group is updated, and when the screenshot frequency, time interval, screenshot mode, distribution mode and curve volatility of the user are all normal and screenshot content only aims at sensitive data screenshot, the risk level is improved; a screen capture auditing and monitoring mechanism is established, full-life-cycle recording and tracking are carried out on screen capture behaviors of a user, and screen capture events, watermark embedding conditions and abnormal behavior information in a system are monitored in real time through a visual instrument panel and a report.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a multi-dimensional data authority management and privacy protection method for an electric power information network. Background Art

[0002] Data rights management and privacy protection in power information networks is a complex technical problem. When introducing the screenshot watermark embedding mechanism, there are many contradictions and challenges. First, the system needs to monitor the user's various screenshot behaviors in real time, including full screen, window, area, scrolling, delay and recording, and accurately capture the screenshot events. However, different screenshot methods have different requirements for the embedding position and size of the watermark. How to design the optimal watermark embedding solution for different screenshot methods without affecting the user's normal reading is a technical difficulty. Secondly, the type and content of the watermark also need to be dynamically generated according to the sensitivity level of the data. The higher the sensitivity level of the data, the richer the information carried in the watermark should be, and the larger the coverage should be. However, the increase in the complexity of the watermark may affect the performance and response speed of the system. How to find the best balance between data security and user experience is a problem worthy of in-depth study. In addition, there are also technical challenges for the identification and processing of frequent screenshots and potential risk users. The system needs to calculate the user's screenshot behavior pattern in real time through parameters such as screenshot frequency and time interval, and dynamically adjust the complexity of the watermark according to the risk level. This dynamic watermark generation mechanism based on user behavior places higher demands on the real-time and intelligent nature of the system. At the same time, how to avoid excessive watermarking and causing user disgust also requires optimization in technical implementation. Summary of the invention

[0003] The present invention provides a multi-dimensional data authority management and privacy protection method for an electric power information network, which mainly includes:

[0004] Obtain and identify the user's screenshot method and the characteristics of different screenshots, including the full-screen screenshot image resolution and screen resolution, the window screenshot image size and position corresponding to a specific window, the area screenshot image shape manually selected by the user, the scrolling screenshot image height is greater than the screen height, the screen recording has a fixed time interval for each consecutive frame, and the screen recording screenshot content has a consistent interval on the timeline;

[0005] Image recognition is used to extract screenshot content. The sensitivity of the content is identified based on keyword analysis of the screenshot content and customer personal information, electricity bills, power generation equipment operation and maintenance records, power load dispatching orders, power supplier contract documents, power company business plans, power system backend codes, and technical research reports. The sensitivity of the screenshot content is graded to determine the risk level of screenshot leakage.

[0006] Dynamically select the watermark type based on the risk level of screenshot leakage. The watermark types include simple text watermark, text and image mixed watermark, invisible watermark and QR code watermark;

[0007] Generate corresponding watermark content according to different characteristics of user screenshot methods. The window screenshot watermark content includes the window title and window application name, the full-screen screenshot watermark includes the screenshot time and taskbar application name, the scrolling screenshot watermark includes the scrolling start and end position information, and the screen recording watermark includes the image recording start and end time and the recording frame information;

[0008] Formulate corresponding watermark embedding methods according to different screenshot methods. For full-screen screenshots, watermarks are evenly distributed in the entire screenshot area according to a grid. For window screenshots, watermarks are embedded in the four corners of the window border. For area screenshots, watermarks are embedded in the center of the captured area. For scrolling screenshots, the transparency of the embedded watermark gradually fades according to the scrolling direction of the screenshot. For screen recordings, continuous dynamic watermarks are embedded in different frames of the video.

[0009] Record the total screenshot frequency, screenshot time interval, and usage frequency of different screenshot methods in the historical data of user screenshot events, develop a distribution curve of user screenshot events, analyze the screenshot frequency, time interval, screenshot method, distribution pattern, and curve volatility in the screenshot event distribution curve, and use machine learning algorithms to divide user groups into different risk levels;

[0010] Add the user screenshot content factor to the screenshot event distribution curve of user historical data to determine the user risk level, and update the risk level of the user group. When the user's screenshot frequency, time interval, screenshot method, distribution pattern and curve volatility are all normal, and the screenshot content is only for sensitive data screenshots, the risk level is increased;

[0011] Establish a screenshot audit and monitoring mechanism to record and track users' screenshot behavior throughout the entire life cycle, and monitor screenshot events, watermark embedding, and abnormal behavior information in the system in real time through visual dashboards and reports.

[0012] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0013] The present invention discloses a multi-dimensional data authority management and privacy protection method for an electric power information network. By identifying the characteristics of different screenshot methods, the screenshot behavior can be accurately determined. According to the sensitivity of the screenshot, a suitable watermark type is dynamically selected and a watermark embedding method for different screenshot methods is formulated. While ensuring the effectiveness and concealment of the watermark, the dynamic embedding of the watermark under different screenshot methods is realized, and the normal reading is not affected during the watermark embedding process, thereby providing personalized watermark protection and enhancing the security of information. In addition, the user risk level is updated in combination with the screenshot content, and the risk level population is divided, so that the evaluation is more comprehensive and accurate. In the embedding process, the system performance and response speed will not be affected by the complexity of the watermark, and the identification and processing of frequent screenshots and potential risk users are avoided.

[0014] In summary, by identifying and analyzing different screenshot methods, the embedding of watermarks is made more accurate and effective, thereby enhancing the security of information without interfering with the normal use of users, and being able to timely discover and prevent potential information leakage risks, ensuring the security of corporate information, and thus providing a comprehensive information protection solution, which greatly improves the company's information security management level. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 The present invention is a flowchart of a method for multi-dimensional data authority management and privacy protection of a power information network.

[0016] Figure 2 It is a schematic diagram of a multi-dimensional data authority management and privacy protection method for a power information network of the present invention.

[0017] Figure 3 This is another schematic diagram of a multi-dimensional data authority management and privacy protection method for a power information network of the present invention. DETAILED DESCRIPTION

[0018] The following will describe the technical solutions in the embodiments of the present invention in detail in conjunction with the accompanying drawings in the embodiments of the present invention. The described embodiments are only part of the embodiments of the present invention.

[0019] like Figure 1-3 In this embodiment, a multi-dimensional data authority management and privacy protection method for a power information network may specifically include:

[0020] S101. Acquire and identify the user's screenshot method and features of different screenshots, including the full-screen screenshot image resolution and the screen resolution, the window screenshot image size and position corresponding to a specific window, the area screenshot image shape manually selected by the user, the height of the scrolling screenshot image being greater than the screen height, the screen recording having a fixed time interval for each consecutive frame, and the screen recording screenshot content having a consistent interval on the timeline.

[0021] Obtain a user screenshot image, and determine whether the user screenshot image is a full-screen screenshot by comparing the image resolution with the current system screen resolution. If the image resolution is the same as the current system screen resolution, determine that the user screenshot image is a full-screen screenshot; if the image resolution is less than the current system screen resolution, obtain the position coordinates of the user screenshot image in the screen through a screen coordinate mapping algorithm, and for non-full-screen and window screenshot images, use an edge detection algorithm to extract the edge contour of the image, perform polygon approximation based on the edge contour to obtain an approximated polygon, and if the number of sides of the approximated polygon is less than a preset threshold and the shape is regular, determine that the non-full-screen and window screenshot image is a rectangular or circular regular area screenshot; comprehensively analyze the feature information of each dimension of image resolution, position coordinates, and edge contour, build a screenshot classification model through decision trees and support vector machine machine learning algorithms, use a cross-validation method to train the screenshot classification model based on different parameter combinations, obtain the optimal model hyperparameters with the highest classification accuracy, and tune the screenshot classification model.

[0022] Specifically, the user screenshot image is obtained, and the image resolution is obtained based on the user screenshot image; the image height, content continuity, scroll bar position, and splicing trace features are analyzed to comprehensively determine whether it is a scrolling screenshot; OCR and target detection algorithms are used to identify the text and key elements of the control in the image content, and the possibility of scrolling screenshots is further verified by analyzing the distribution law of the elements in the vertical direction. For multiple images captured continuously, the timestamp information and content similarity of adjacent images are analyzed. If the interval between multiple consecutive frames of images is fixed and the frequency is higher than the preset threshold, and the similarity between frames is very high, it is preliminarily determined to be a screen recording screenshot; the key frame extraction algorithm is used to extract the key frames of the recording, and the continuity and integrity of the key frame content are analyzed, and combined with the continuity and interval of the timestamp, it is finally determined whether it is a screen recording screenshot. Comprehensively analyze the feature information of each dimension, and build a screenshot classification model through machine learning algorithms such as decision trees and support vector machines; according to the characteristics of different screenshot types, select image size, aspect ratio, edge features, and color histogram features for modeling, and tune the model hyperparameters through cross-validation methods. Obtain user screenshot behavior data, build user portraits, and implement personalized screenshot type recommendations; adapt and optimize for different application scenarios to improve the practicality of the classification model; use multi-threading and parallel computing technology to improve processing efficiency, and continuously update and optimize the model through incremental learning and online learning methods. After obtaining the user screenshot, first compare the image resolution with the system screen resolution to determine whether it is a full-screen screenshot. For example, if the screenshot resolution is 1920*1080, which is exactly the same as the current system screen resolution, it can be determined to be a full-screen screenshot. For non-full-screen screenshots, the screen coordinate mapping algorithm is used to map the image pixel coordinates to the screen coordinate system, and the screen coordinate values ​​of the upper left and lower right corners of the image are calculated (such as the upper left corner is (100,200), and the lower right corner is (800,600)), and then the image position information on the screen is obtained. Next, the screenshot is compared with each window program on the current screen using an image similarity comparison algorithm, such as the pHash algorithm or the SSIM algorithm. If the pHash value similarity between the screenshot and a window reaches 98%, exceeding the preset 95% threshold, the screenshot can be determined to be a window screenshot of the corresponding window, and the title, class name and other information of the window program are recorded. For images that are not full-screen or window screenshots, the Canny edge detection algorithm is used to extract the image edge, obtain the pixel coordinate sequence of the edge contour, and calculate the shape parameters such as the rectangularity and convexity of the contour. If the image aspect ratio is 0.3 and the proportion of curved pixels in the edge contour reaches 30%, it can be preliminarily determined to be an irregularly shaped regional screenshot. Further, the main color tone of the screenshot area is obtained through color clustering analysis of the pixels within the contour, and the difference is calculated with the main color tone of the full-screen screenshot. If the difference is greater than 50%, the determination result of the regional screenshot is further verified.In the determination of scrolling screenshots, we first check whether the image height exceeds 1.5 times the screen height. For example, if a 3000*800 long image has a height that is 2.78 times the screen height (1080), it is initially determined to be a scrolling screenshot. Then, OCR technology is used to perform text recognition on the image content, extract the position coordinates of the text lines, and analyze the variation pattern of the spacing of the text lines in the vertical direction. If it is found that the vertical spacing of the text lines presents an arithmetic progression with a tolerance of 20 pixels, it can be inferred that the image is a scrolling screenshot composed of multiple screenshots of the same height. For a continuous image sequence suspected of being a screen recording screenshot, first extract the image timestamp information and analyze the time interval between adjacent images. If it is found that the timestamps of 20 consecutive frames of images are all 100ms and the frequency is 10Hz, it is initially determined to be a screen recording screenshot. The inter-frame difference algorithm is further used to calculate the difference of the content of the continuous images. If the difference is less than 5%, the continuity and integrity of the video image can be determined, and it is finally determined to be a screen recording screenshot. In order to further improve the accuracy of screenshot classification, a decision tree algorithm can be used to construct a classification model. Extract feature vectors of various screenshots from sample data, including image size, aspect ratio, edge regularity, color distribution, key element density, etc., as input features of the decision tree. At the same time, combine external information such as the user's screenshot tool type and operating habits as auxiliary judgment conditions of the decision tree. Select the optimal classification features and branch thresholds through indicators such as information gain to generate a decision tree model. In practical applications, extract features in real time based on the screenshots submitted by users, input them into the decision tree model for classification prediction, and obtain the category to which the screenshot belongs. By continuously collecting screenshot category annotation data from user feedback, retrain and optimize the decision tree model to continuously improve the classification accuracy. At the same time, use user portrait analysis technology to personalize the classification results according to factors such as user usage preferences and color preferences, and realize personalized recommendations of screenshot types. In addition, by introducing deep learning algorithms, high-dimensional features of screenshot images can be extracted, and convolutional neural network models can be constructed for screenshot classification. Select a large number of screenshot samples of different types, and construct a training data set through operations such as data enhancement and image preprocessing. Design the CNN network structure, add convolutional layers, pooling layers, fully connected layers, etc., and use activation functions such as ReLU and Softmax. Taking the cross entropy loss function as the optimization target, the gradient descent algorithm is used for model training, and the network weights are continuously adjusted to improve the classification accuracy. When applied, the screenshots uploaded by users are input into the trained CNN model to obtain the confidence probability values ​​of each category, and the category with the highest confidence is selected as the prediction result. At the same time, the screenshot category annotation data fed back by users is collected online, and the CNN model is incrementally trained regularly to continuously optimize the model performance. By introducing technologies such as attention mechanism and transfer learning, the generalization ability and adaptability of the model are further improved, and more accurate and efficient automatic screenshot classification is achieved.

[0023] S102. Use image recognition to extract the screenshot content, identify the sensitivity of the content based on keyword analysis in the screenshot content and customer personal information, electricity bills, power generation equipment operation and maintenance records, power load dispatching commands, power supplier contract documents, power company business plans, power system background codes and technical research reports, grade the sensitivity of the screenshot content, and determine the risk level of leakage of the screenshot event.

[0024] After obtaining the user's screenshot image, OCR optical character recognition is used to extract the text content in the image to obtain text information. For the text information, natural language processing algorithms are used to perform word segmentation, part-of-speech tagging and named entity recognition to obtain key information such as names of people, places and organizations. The target detection algorithm is used to analyze the image to identify key targets of power equipment and power lines, and obtain a structured representation of the image content. According to the pre-built sensitive word library of the power industry, key information is matched to determine whether there are keywords involving customer privacy, electricity bills, equipment operation and maintenance, power grid dispatching and commercial secrets. Structured representation of electricity bills and operation and maintenance records is performed. The data is analyzed using anomaly detection algorithms to identify anomalies and suspicious data items. If the screenshot image contains code snippets, program language recognition and code abstract syntax tree analysis are used to determine the programming language and functional module to which the code snippet belongs. The pre-trained knowledge graph of the power industry is used to perform concept extraction and entity linking on the key contents of the technical research report to obtain sensitive information on the key technologies, algorithms, and experimental data involved in the report. The frequency of the sensitive keywords, the distribution of sensitive targets, code functions, and technical importance factors are comprehensively considered, and the weighted summation and regularization methods are used to quantitatively evaluate the overall sensitivity of the screenshot content to obtain a comprehensive sensitivity score.

[0025] Specifically, after obtaining the user's screenshot image, Google Cloud Vision API or Tesseract is used to perform OCR text recognition on the image, and the recognition language is set to Chinese. The accuracy of text extraction is improved by adjusting the preprocessing parameters such as image resolution and contrast. For the recognized text content, the natural language processing algorithm BERT-BiLSTM-CRF named entity recognition model is used for processing. By fine-tuning on the power field corpus, key information such as names, place names and organizations are recognized, and the F1 value reaches more than 95%. Using the regular expression library re, matching rules for private information such as ID card number and mobile phone number are constructed, and sensitive information is masked, such as replacing the date of birth part in the ID card number "32091119881234" with "". At the same time, the YOLOv5 or Faster R-CNN target detection algorithm is used to identify and locate power targets such as transmission lines and substation equipment on the COCO dataset with 99.5% mAP, and a structured representation of the image content is obtained. According to the pre-built sensitive word library of the power industry, the extracted text keywords are matched to identify keywords related to sensitive information such as customer privacy, electricity bills, equipment operation and maintenance, power grid dispatching, and commercial secrets, and the frequency and distribution of various sensitive words are counted. Through the Word2Vec word vector model trained on 5 million power industry document corpora, the vocabulary in the sensitive word library is semantically expanded to generate an extended sensitive word library containing synonyms and related words. The AC automaton multi-mode matching algorithm is used to achieve efficient search of sensitive words, and the matching speed reaches 10MB / s. The FP-Growth or Apriori association rule mining algorithm is used to mine the frequent co-occurrence rules between sensitive words with the parameters of minimum support 0.05 and minimum confidence 0.8, and construct a sensitive information association map. Isolation forest anomaly detection is performed on structured data such as electricity bills and operation and maintenance records. Anomaly detection algorithms such as isolation forest and One-ClassSVM are used. By setting parameters such as the number of samples to 100 and the abnormal sample ratio to 0.1, outliers and suspicious records can be identified. The target objects identified in the image are classified and attributes are extracted to determine whether the image information of key equipment in the power system is included. The MaskR-CNN instance segmentation algorithm is used to identify equipment or scenes in sensitive area images such as substations and distribution rooms with an accuracy of 95%, and automatically annotate them as highly sensitive images. By extracting the image EXIF ​​information, the GPS latitude and longitude coordinates and shooting angle of the shooting location are obtained, and the image is fused and analyzed with the geographic information data of the power system to infer the difficulty of image acquisition and the risk of leakage. The spatial distance between the image coordinates and the geographic information data of the power GIS system is calculated. If the distance between the image location and the center of the sensitive area is less than 50 meters, it is marked as a high-risk image.For the code snippets contained in the screenshots, program language identification and code abstract syntax tree analysis are used to determine the programming language and functional module to which the code belongs. Through control flow analysis and data flow analysis, key features of the code, such as function calls and data dependencies, are extracted, and compared with the code security feature library of common power system components to identify potential sensitive code snippets. At the same time, external resource information such as database connections and file paths called by the code is analyzed to evaluate the data security risks that may be caused by code leakage. Using the code abstract syntax tree analysis tool astroid, the function call relationship, data dependency and other features of Python code are extracted, and the frequent subgraph mining algorithm gSpan is used to identify sensitive code snippets in the 100,000-line power system component code library, with the minimum support set to 0.8. Sensitive data resources accessed in the code are identified through database connection string parsing and file path pattern matching. Based on the Wikidata knowledge base and the knowledge of power industry experts, a knowledge graph of the power industry containing 2,000 concepts and 5,000 relationships is constructed. The BERT Transformer model is used to represent the semantic vector of the technical research report. The K-means clustering algorithm is used to cluster the report. The number of clusters K is set to 10. The TopK keywords of each topic cluster are extracted. The sentiment analysis algorithm SnowNLP based on the sentiment dictionary is used to analyze the sentiment tendency score of each technical point in the report. If the positive sentiment ratio exceeds 80%, it is marked as a key technology. Thematic models such as LDA and LSA are used to cluster the technical content and extract key topics. In combination with sentiment analysis techniques such as deep learning models based on sentiment dictionaries and attention mechanisms, the sentiment tendency and importance of technical descriptions are analyzed. By constructing a semantic association network between technical information, the dependency relationship and sensitivity level between different technical contents are analyzed. After completing the extraction and analysis of various types of sensitive information, the overall sensitivity of the screenshot content is quantitatively evaluated and scored by comprehensively considering factors such as the frequency of sensitive words, the distribution of sensitive targets, the function of code, and the importance of technology. The weight coefficients of each factor are reasonably set by using weighted summation and regularization methods to obtain a comprehensive score of sensitivity. The score is compared with the preset multi-level sensitivity threshold to obtain the preliminary judgment result of the content sensitivity level. In order to further improve the accuracy of risk judgment, user portrait and behavior analysis data are introduced to conduct comprehensive research and judgment on the user's identity characteristics, access rights, operation behavior, etc. By building a user behavior baseline model and anomaly detection rules, high-risk users and abnormal behavior patterns are identified, such as unauthorized users, remote logins, and non-working hours. Combined with abnormal user behavior and sensitive screenshot content, risk events are correlated and analyzed, and the sensitivity level of the content is dynamically adjusted. At the same time, differentiated security strategies and disposal measures are customized for different risk levels, such as sensitive information desensitization, dynamic adjustment of permissions, watermark tracking, etc., to form an adaptive screenshot security protection closed loop.Specifically, through the topic model LDA or LSA, with the hyperparameters of α=50 / K and β=0.1, the technical topic keywords are associated and mined to construct a technical association network map. Based on the sensitive information analysis results of the above dimensions, the weighted sum of various sensitive features is performed, and the weight coefficients are set as: sensitive word frequency 0.3, target distribution 0.2, code snippet 0.2, technical theme 0.3, and the comprehensive content sensitivity score is obtained. The score is compared with the preset sensitivity level threshold [0.3, 0.6, 0.8]. The sensitivity score less than 0.3 is low risk, 0.3-0.6 is medium risk, and greater than 0.8 is high risk. Finally, combined with the results of user abnormal behavior analysis, the logistic regression model is used to realize the risk event association inference. If the conditions of [highly sensitive content, high-risk users, non-working hours] are met at the same time, security protection measures such as content desensitization, screenshot interception, and permission recovery are automatically triggered. By deploying components such as sensitive information detection, user behavior analysis, and risk decision engine, adaptive hierarchical prevention and control of screenshot security risks are achieved.

[0026] S103. Dynamically select a watermark type according to the risk level of screenshot event leakage, where the watermark types include simple text watermark, text and image mixed watermark, invisible watermark and QR code watermark.

[0027] According to the sensitive content analysis and leakage risk assessment results of the screenshot event, and combined with the user authentication and access control mechanism, the watermark embedding strategy and algorithm selection are dynamically determined. If the screenshot event is high-risk, the invisible watermark technology is used. By selecting the DCT transform domain watermark algorithm, the DCT coefficient energy distribution of the screenshot image is analyzed, and the embedding strength parameters are adaptively set. For high-frequency areas, more watermark information is embedded; for low-frequency areas, the embedding amount is reduced. In order to achieve full life cycle management of watermark images, combined with digital rights management DRM technology, the watermark synchronization code mechanism is introduced to embed synchronization positioning information into the watermark image, and the correlation peak detection method is used to achieve blind watermark extraction.

[0028] Specifically, in order to achieve dynamic selection of watermarking schemes, we first need to perform sensitivity analysis based on the screenshot content. By comparing the content sensitivity score with the preset risk level threshold, we can get the risk level classification, where the sensitivity score less than 0.3 is low risk, 0.30.6 is medium risk, 0.60.8 is high risk, and greater than 0.8 is extremely high risk. Different risk levels are mapped to corresponding watermarking schemes, and differentiated watermark configurations are set for different user roles, access rights, and time limits. After determining the risk level, we first introduce the basic principles and advantages of frequency domain watermarking. Frequency domain watermarking embeds watermark information into the frequency domain coefficients of the carrier image, and watermark embedding is achieved by slightly modulating the coefficients. Compared with spatial domain watermarking, frequency domain watermarking has stronger robustness and imperceptibility, and can resist a variety of image attacks. Common frequency domain watermarking algorithms include DCT transform domain watermarking, DWT wavelet transform watermarking, etc. For low-risk screenshot events, a simple text watermarking method is used. By selecting the watermark text content, the watermark text is superimposed on the corners of the screenshot image using the Alpha channel synthesis algorithm. The specific implementation steps are: determine the watermark text and font size, adjust the watermark position adaptively according to the image size, generate the Alpha mask image, set the watermark transparency to 20%, and use the weighted average formula to superimpose the original image and the watermark mask to obtain the watermarked image output. If the screenshot event is of medium risk, the text and image mixed watermark method is used. On the basis of the text watermark, image watermark elements such as the company logo are added. The watermark contour is extracted using an image segmentation algorithm based on threshold segmentation, such as the Otsu threshold segmentation method, which divides the image into foreground and background by setting the threshold, and extracts the watermark foreground as a mask. Use image processing operations such as transparency superposition and affine transformation to control the coverage ratio and angle of the image watermark to achieve semi-transparent fusion with the screenshot content. For high-risk screenshot events, invisible watermark technology is used. The DCT transform domain watermark algorithm is selected. By analyzing the DCT coefficient energy distribution of the screenshot image, the embedding strength parameters are adaptively set to embed more watermark information in the high-frequency area and reduce the embedding amount in the low-frequency area, taking into account the robustness and imperceptibility of the watermark. The watermark embedding process introduces digital fingerprints such as user ID and timestamp, and generates a unique watermark payload through an encrypted hash function to achieve the traceability function. In the selection of watermark position, an adaptive strategy is adopted. For text watermarks, OCR text area detection methods such as CTPN connection sequence text detection algorithm are used to avoid important text areas in the image. For image watermarks, the improved ITTI visual saliency model is used. Through multi-scale analysis and center prior guidance, the salient areas of the image are extracted, and the non-salient areas are selected to embed the watermark to reduce visual interference. For invisible watermarks, the complex texture areas and edge areas of the image are given priority, and the visual masking effect is used to improve the watermark concealment. In order to enhance the security of watermarks, QR code technology is introduced as a supplementary watermark method.The QR code encoding algorithm is used in combination with the RS error correction coding mechanism to generate a high-tolerance two-dimensional code watermark image. The watermark information is encrypted and embedded in the QR code data. The high capacity characteristics of the QR code are used to achieve multi-level authorized access control. By setting different error correction levels, such as 7% for level L, 15% for level M, 25% for level Q, and 30% for level H, the anti-tampering requirements of different risk levels can be adapted. Finally, the digital rights management DRM technology is combined to achieve the full life cycle control of the watermark image. The watermark synchronization code mechanism is introduced to embed the synchronous positioning information into the watermark image, and the blind watermark extraction is realized through the correlation peak detection. The key encryption algorithm is used to digitally sign the watermark information to prevent the watermark from being maliciously tampered with. Watermark detection points are set at different links of the screenshot process to monitor the integrity of the watermark in real time. When the watermark is damaged, it is warned in time and illegal dissemination is blocked to form an adaptive watermark security protection system. By combining natural language processing and computer vision technology, multimodal information such as text, images, and videos in the screenshot is extracted and semantically understood. The pre-trained BERT model is used to perform word segmentation, part-of-speech tagging and named entity recognition on the text content, extract keywords and calculate TF-IDF weights to generate text feature vectors; deep convolutional neural networks such as ResNet50 are used to extract features from image content to obtain image feature vectors; video key frames are extracted through PaddlePaddle's video classification model, and video understanding is performed in combination with spatiotemporal features. Then the multimodal feature fusion is input into the pre-trained sensitivity assessment model, such as using support vector machine SVM for sensitivity scoring to obtain content sensitivity scores. Next, the risk level is determined by comparing the sensitivity score with the preset risk threshold, such as 0.3, 0.6, 0.8, etc. In low-risk situations, a text watermark method is used. First, the text area in the screenshot is extracted using OCR technology, and the bounding box coordinates of the text are obtained through text detection algorithms such as EAST, and then the corner area is selected to adaptively embed the watermark text. The watermark text uses white with a transparency of 0.2, the font is Arial, and the size is 1 / 20 of the image height. The Image.alpha_composite() function of the PIL image library is used to implement watermark superposition, and the superposition weight is set to 0.2 to ensure that the watermark does not affect the original image content. For screenshots with medium risk, a combination of image watermark and text watermark is used. The foreground area of ​​the Logo watermark is extracted by the Grabcut image segmentation algorithm, and the watermark contour is extracted by morphological operations such as corrosion and expansion. The watermark image is scaled proportionally according to the screenshot size, and the watermark size is controlled to be no more than 1 / 8 of the original image. The affine transformation is used to randomly rotate the watermark geometric direction, and the rotation angle is within the range of ±10°, and the perspective transformation is performed to adjust the watermark position to avoid concentrated superposition of watermarks. The watermark image and the screenshot are weighted fused with a weight ratio of 0.3:0.7 to maintain the semi-transparent effect of the watermark pattern.Frequency domain watermarking is used for high-risk screenshots, and the DCT transform is used to decompose the image into coefficient blocks of different frequencies. The psychological threshold T of the DCT coefficient is calculated according to the screenshot quality factor QF. When QF is 75, T is 0.02, and when QF is 85, T is 0.015. For medium and high frequency DCT coefficients greater than T, 1-bit watermark information is embedded, while low frequency coefficients less than T are not modified. The watermark embedding strength factor α is controlled below 0.1 to balance the robustness of the watermark and the loss of image quality. The embedded watermark payload includes 32-bit MD5 digital fingerprint, 12-bit timestamp, 8-bit carrier ID, etc. The ECDSA elliptic curve signature algorithm is used to generate a 64-byte digital signature to ensure the security of the watermark information. When selecting the watermark embedding position, a text mask is generated for the text line position detected by the CTPN algorithm for the text watermark to avoid covering key text. The saliency detection model BASNet is used for image watermarking to extract the foreground salient area of ​​the image. The image is segmented into foreground / background areas through the Meanshift segmentation algorithm, and the background area is selected as the embedding position to reduce the interference of the watermark on the salient target. The QR code watermark is introduced to enhance the tampering location capability, and the QArt algorithm is used to generate artistic QR codes. The image style is transferred through the convolutional neural network model to disguise the QR code as a pattern similar to the carrier content. The QR code version 4 is selected, the fault tolerance level is H, the embedding capacity can reach 2953 bytes, and the AES encryption algorithm is used to encrypt the watermark information with a key length of 128 bits. The QR code watermark is embedded in the edge and corner area of ​​the image with a coverage rate of 10%, and has a 40% fault tolerance and error correction capability. Finally, the DRM digital copyright protection scheme based on blockchain is applied to extract the digital fingerprint of the watermark image information, calculate the SHA256 hash value as the watermark DNA, and store it in the blockchain. The blind watermark detection algorithm is used to use the pseudo-random sequence characteristics of the watermark, design a sliding window for fast matching, locate the watermark position, extract the watermark payload information, and verify the integrity of the digital signature. Through watermark DNA comparison and tracing analysis, we can quickly detect and accurately locate pirated screenshots, providing a credible chain of evidence for copyright protection.

[0029] S104. Generate corresponding watermark content according to different characteristics of the user's screenshot method. The window screenshot watermark content includes the window title and the window application name, the full-screen screenshot watermark includes the screenshot time and the taskbar application name, the scrolling screenshot watermark includes the scrolling start position and end position information, and the screen recording watermark includes the initial time and end time of the image recording and the frame information of the recording.

[0030] The screenshot image submitted by the user is obtained, and the resolution, aspect ratio and color histogram features of the image are extracted and input into the pre-trained screenshot classification model to determine the type of the screenshot. If the screenshot type is a window screenshot, the YOLOv5 target detection algorithm is used to detect the window area in the image, and the OCR text recognition is used to extract the text information in the window title bar to obtain the window application name; if the screenshot type is a full-screen screenshot, the screenshot timestamp is extracted from the EXIF ​​metadata of the image, and the timestamp is converted into a standard format string; if the screenshot type is a scrolling screenshot, the number of pages contained in the scrolling screenshot is obtained by calculating the ratio of the image height to the screen resolution height, and the watermark content is determined according to the screenshot type and the extracted key information. For the watermark content, the watermark security level is dynamically divided according to its confidentiality and importance factors. If the watermark security level is lower than the preset threshold, the spatial domain LSB embedding method is used to embed the watermark into the image; if the watermark security level is higher than the preset threshold, the frequency domain DCT transform domain watermark algorithm is selected, and the watermark is embedded in combination with the image visual saliency features.

[0031] Specifically, after obtaining the user's screenshot image, the screenshot method is first identified by analyzing the image's resolution, aspect ratio, color histogram and other features using a pre-trained screenshot classification model. The model uses ResNet50 as the backbone network and performs transfer learning and fine-tuning on a large-scale screenshot dataset to improve the model's generalization ability and classification accuracy. The output results of the model include four types: window screenshots, full-screen screenshots, scrolling screenshots and screen recordings. If the screenshot type is determined to be a window screenshot, the YOLOv5 target detection algorithm is used to detect the window area in the image, and the text information in the window title bar is extracted through OCR text recognition technology, and the name of the window application is matched using regular expressions. At the same time, the desktop environment of the window screenshot is analyzed, other windows opened at the same time are identified, their titles and application information are extracted, and window context information is constructed. Then the window title, application name and context information are embedded into the watermark template according to the predefined grammatical rules to generate semantically rich window screenshot watermark content. If the screenshot type is determined to be a full-screen screenshot, the timestamp information of the screenshot is extracted from the EXIF ​​metadata of the image, and the timestamp is converted into a string in a standard format. At the same time, traditional image processing methods such as edge detection and Hough transform are used to accurately segment the taskbar area at the bottom of the image, and the application name list in the taskbar is extracted through icon recognition and text detection technology. In addition, OCR technology is used to perform text recognition on the full-screen screenshot content to extract key text information, such as document titles and important paragraphs. The screenshot time, application name list and key text information are combined according to the designed watermark template to obtain a full-screen screenshot watermark with rich content. If the screenshot method is determined to be a scrolling screenshot, the ratio of the image height to the screen resolution height is first calculated to obtain the number of pages of the scrolling screenshot. Then, a segmentation algorithm based on visual saliency, such as Graph-Based Visual Saliency (GBVS), is used to divide the scrolling screenshot into multiple semantically related regions. Local features are extracted and matched for each region, and the displacement between regions is estimated through SIFT feature point matching and RANSAC algorithm, and then the starting and ending position coordinates of the scrolling screenshot are calculated. Finally, the number of pages, starting position, and ending position are filled into the watermark template to generate a watermark content that reflects the scrolling process. If the user submits a screen recording, the key frames of the video are first extracted. The improved inter-frame difference method is used, combined with local neighborhood entropy and global motion compensation, to adaptively select frames with significant differences as key frames. Then the timestamps of the start and end frames of the video are extracted to calculate the duration of the video. At the same time, the total number of frames and the number of key frames in the video are counted to obtain the average frame rate of the video. In addition, the key frames are analyzed for content, and important events and operation information in the video are extracted through target detection, scene recognition and other technologies.The start time, end time, frame rate, event information, etc. of the video are embedded into the watermark template to generate a semantically rich screen video watermark. After determining the watermark content, the security level of the watermark is dynamically divided according to factors such as the confidentiality and importance of the watermark. For watermarks with low security levels, the LSB embedding method in the spatial domain is used to directly replace the lowest 1-2 bits of the image pixels with the watermark information. For watermarks with high security levels, the DCT transform domain watermark algorithm in the frequency domain is used, and combined with the visual saliency characteristics of the image, more watermark information is embedded in the low-saliency area to reduce the impact of the watermark on the image quality. At the same time, the watermark information is digitally summarized using an encrypted hash function, and the summary value is encrypted in combination with the public key encryption system to ensure the confidentiality and integrity of the watermark. Finally, the screenshot image or recorded video with the embedded watermark is returned to the user, and the metadata of the watermark embedding, including the watermark ID, user ID, embedding time, watermark security level, and image hash value, is recorded in the background database to establish a complete watermark management log. Through digital watermarking technology, semantic watermarks related to the features of different types of screenshots are embedded to achieve accurate traceability and copyright protection of the screenshot content. In practical applications, blockchain technology can also be combined to store watermark metadata on the chain, and the tamper-proof and traceable characteristics of blockchain can be used to further enhance the credibility and legal effect of the watermark. After obtaining the user's screenshot, the image's resolution, aspect ratio, and color histogram are first extracted to construct a feature vector. For example, if the resolution is 1920*1080 and the aspect ratio is 16:9, the mean and variance of the three RGB channels in the color histogram are (105, 98, 112) and (52, 61, 48), respectively. The feature vector is input into the pre-trained ResNet50 screenshot classification model. The classification accuracy of the model on the ImageNet dataset reaches 85%. After fine-tuning on a dataset of 100,000 screenshots, the accuracy is increased to more than 95%. The model outputs the probability that the screenshot belongs to the four types of window screenshot, full-screen screenshot, scrolling screenshot, and screen recording, and the type with the highest probability is taken as the discrimination result. If it is a window screenshot, the YOLOv5 target detection model is used to locate the window area, and the mAP on the COCO dataset reaches 90%. Extract the image of the window area and use PaddleOCR to recognize the text in the window title bar with an accuracy of 98%. Use the regular expression "[(.*?)]" to match the application name, such as "[Notepad]" to match the Notepad program. Then analyze the desktop environment of the window screenshot, find out other windows opened at the same time through icon recognition and text detection, extract their titles and application names, and generate window context information, such as "Notepad, [Word], [Excel], Desktop". Finally, according to the grammatical rules of "application name + window title + context information", generate the watermark content of the window screenshot: "Notepad|Notepad window|Word, Excel, Desktop".For full-screen screenshots, read the DateTimeOriginal tag from the EXIF ​​metadata, extract the screenshot timestamp, and convert it into a string in the format of "2023-05-2014:30:25". Use the Canny operator for edge detection and extract the 120-pixel-high area at the bottom of the image as the taskbar candidate area. Detect horizontal straight lines in the taskbar candidate area through Hough transform. If there is a straight line with a length greater than 80% of the image width, the area above it is determined as the taskbar area. Perform icon detection and text recognition on the taskbar area to obtain a list of application names, such as "Chrome, System, WPS". At the same time, perform OCR text recognition on the full-screen screenshot content to extract key text information, and select the three words with the highest TF-IDF weight as keywords, such as "annual summary, sales report, data analysis". The timestamp, application list, and keywords are formatted according to the watermark template of "Time|Application 1, Application 2, Application 3|Keyword 1, Keyword 2, Keyword 3" to obtain the full-screen screenshot watermark content: "2023-05-2014:30:25|Chrome, System, WPS|Annual Summary, Sales Report, Data Analysis". When it is identified as a scrolling screenshot, the ratio of the image height to the screen resolution height is calculated, such as 4800 / 1080=4.44, that is, the scrolling screenshot contains 4 pages of content. The GBVS saliency detection algorithm is used to extract the salient areas of the image, and the saliency threshold is set to 0.6 to obtain 8 salient areas. SIFT feature points are extracted for each area, and feature point matching is performed. The affine transformation matrix between regions is estimated by the RANSAC algorithm, and the displacement of each region relative to the first and last regions is calculated. For example, the displacements of region 1 and region 8 are (0,0) and (0,4320) respectively. According to the screen resolution, the starting position is (0,0) and the ending position is (1080,4800). Generate a scrolling screenshot watermark according to the template format of "Number of pages|Starting position|Ending position": "4|(0,0)|(1080,4800)". For screen recording, first extract the key frames of the video. Calculate the difference image between adjacent frames, calculate the local neighborhood entropy of the difference image, select the frames with entropy values ​​greater than 3.5 and more than 10% of the pixels as candidate key frames, and then obtain 5 key frames through global motion compensation and threshold filtering. Extract the start frame and end frame timestamps of the video, and calculate the duration to be 185 seconds. The total number of video frames is 5550, and the average frame rate is 30fps. Perform target detection and scene recognition on the key frames, and generate semantic descriptions based on the detected target categories and scene types, such as "office scene, documents, laptops, desks and other objects appear".The above information is integrated into a screen recording watermark in the format of "start time|end time|duration|frame rate|number of key frames|semantic description", "2023-05-2014:30:25|2023-05-2014:33:30|185 seconds|30fps|5|office scene, documents, laptops, desks and other objects appear". After generating the watermark content, the watermark is divided into three security levels: high, medium and low according to factors such as sensitivity and confidentiality. The low-security watermark uses the LSB algorithm with an embedding strength of 1-2 bits, the medium-security watermark uses the DCT transform domain embedding with an intensity of 3-4 bits, and the high-security watermark uses the DWT wavelet transform domain embedding with an intensity of 5-6 bits. For important images such as full-screen screenshots, the GBVS algorithm is used to extract the saliency map, and the watermark is embedded in the non-critical area with a saliency less than 0.4, and the embedding strength is reduced or not embedded in the critical area with a saliency greater than 0.6 to reduce the impact of the watermark on the image quality. The watermark information is digested by MD5 to generate a 128-bit digital fingerprint, which is then encrypted with an RSA 2048-bit key and embedded in the LSB of the image to verify the integrity and prevent tampering of the watermark. Finally, the metadata embedded in the watermark is recorded on the blockchain, including the watermark ID, user ID, embedding time, security level, and image hash value, etc. The tamper-proof and traceable characteristics of the blockchain are used to ensure the credibility of the watermark record and provide credible evidence for the judicial identification of the watermark.

[0032] S105. Formulate corresponding watermark embedding methods according to different screenshot methods. For full-screen screenshots, watermarks are evenly distributed in the entire screenshot area according to a grid. For window screenshots, watermarks are embedded in the four corners of the window border. For area screenshots, watermarks are embedded in the center of the captured area. For scrolling screenshots, the transparency of the embedded watermark gradually fades according to the scrolling direction of the screenshot. For screen recordings, continuous dynamic watermarks are embedded in different frames of the video.

[0033] If the screenshot mode is a full-screen screenshot, the size and number of the watermark grids are determined according to the size of the full-screen screenshot, and the watermark is embedded in a grid evenly distributed manner; if the screenshot mode is a window screenshot, the border outline of the window screenshot is extracted by an edge detection algorithm, the boundary coordinates of the window are obtained, and the watermark is embedded in the four corners of the window border; if the screenshot mode is a regional screenshot, the regional screenshot is divided into multiple sub-regions by a superpixel segmentation algorithm, the significance score of each sub-region is calculated by a significance detection model, and the watermark is embedded in a non-critical region whose significance score is lower than a preset threshold. For the evaluation of the watermark embedding effect, the image after watermark embedding is obtained, and the peak signal-to-noise ratio and structural similarity objective indicators are used to quantify the impact of the watermark on the image quality. At the same time, users are invited to score the subjective factors of the watermark's concealment and aesthetics. The comprehensive quality score of the watermark embedding is obtained by combining the objective indicators and the subjective scores. According to the comprehensive quality score, the intelligent optimization algorithm is used to search for the optimal combination of watermark embedding parameters to obtain the optimal watermark embedding strategy for different screenshot modes.

[0034] Specifically, if the screenshot mode is a full-screen screenshot, the watermark is embedded in a grid-uniformly distributed manner. According to the size of the full-screen screenshot, the size and number of the watermark grids are dynamically calculated to ensure that the watermark grid can divide the screenshot size. For example, for a 1920*1080 full-screen screenshot, it can be divided into 126 grids, each grid size is 160*180 pixels. The watermark pattern is embedded in the center of each grid, and the size of the watermark pattern is adaptively scaled according to the grid size, such as embedding a 40*40 pixel watermark pattern. Through the uniformly distributed grid watermark, the entire area of ​​the full-screen screenshot is effectively covered. For example, for each grid area, a 32-bit random watermark ID is generated, and its hash value is calculated by the MD5 algorithm as the watermark key of the grid. The watermark pattern is encrypted using the watermark key, and the encrypted watermark information is embedded in the frequency domain coefficient corresponding to the grid. The embedding strength is controlled within 5% of the frequency domain coefficient amplitude. After the embedding is completed, the IFFT inverse transform is performed to convert the image back to the spatial domain to obtain a full-screen screenshot containing a grid watermark. If the screenshot method is window screenshot, the watermark is embedded in the four corners of the window frame. The frame outline of the window screenshot is extracted through the Canny edge detection algorithm to obtain the boundary coordinates of the window. According to the window boundary size, the distance between the watermark pattern and the frame is dynamically calculated. Generally, 5% of the window width and height is taken as the distance. If the window width is 800 pixels and the height is 600 pixels, the distance between the watermark and the frame is 40 pixels. In the upper left, upper right, lower left, and lower right corners of the window boundary coordinates, embed a watermark pattern with a size of 80*80 pixels, and set the transparency to 50% to ensure that the watermark is clearly visible and does not affect the viewing of the window content. If the screenshot method is regional screenshot, the watermark is embedded in the non-critical content of the captured area. First, the SLIC superpixel segmentation algorithm is used to divide the regional screenshot into multiple semantically related sub-regions. Then, a saliency detection model, such as SalNet or BASNet, is used to calculate the saliency score of each sub-region to obtain the saliency heat map of the regional screenshot. According to the saliency score, a non-critical area, that is, an area with a saliency score lower than a threshold (such as 0.3), is selected and a watermark pattern is embedded in its center. The size of the watermark pattern is adaptively adjusted according to the size of the area, such as embedding a 64*64 pixel watermark. The transparency of the watermark is mapped to a range of 30% to 70% according to the saliency score of the area. The lower the saliency, the higher the transparency of the watermark, ensuring that the watermark does not affect the recognition of key content. If the user submits a scrolling screenshot, an adaptive transparency gradient watermark embedding method is used. First, the number of pages contained in the scrolling screenshot is estimated based on the height and width ratio of the scrolling screenshot, and then the scrolling screenshot is divided into several areas equal to the number of pages in the vertical direction. For each area, the embedding position and transparency of the watermark are dynamically adjusted according to the complexity and importance of its content. Through texture analysis and edge detection, key content in the area, such as text, graphics, etc., is identified to avoid embedding watermarks in these areas.In non-critical areas, the transparency change function of the S-curve is used to gradually reduce the transparency of the watermark from top to bottom to achieve a smooth gradient effect. At the same time, the size of the watermark is also dynamically adjusted with the change of transparency. The higher the transparency, the larger the watermark, and vice versa. At the top and bottom of each area, watermarks with maximum and minimum transparency are embedded respectively, and the transition is natural. For screen recording, a dynamic watermark embedding strategy based on content understanding is adopted. First, the video is segmented and the scene is recognized to obtain the semantic structure of the video. Then, for different scene types, such as characters, scenery, text, etc., the corresponding watermark styles and embedding methods are designed. For example, in the character scene, a semi-transparent watermark frame can be embedded around the face area to avoid blocking facial features; in the text scene, a watermark dot matrix with a color similar to the background can be embedded between the text lines to ensure that the readability of the text is not affected. On the key frames of the video, such as the lens conversion frame and the emotional climax frame, the embedding strength and density of the watermark are improved to enhance the relevance of the watermark. While embedding the watermark, the digital fingerprint technology can also be used to embed the unique identification, timestamp and device information of the video into the watermark carrier to achieve dynamic tracking and evidence collection of the video watermark. In order to evaluate and optimize the embedding effect of the watermark, a watermark quality evaluation system combining objective and subjective is introduced. Objective indicators such as PSNR, SSIM, and NQM are used to quantify the impact of watermark embedding on image quality from aspects such as signal distortion, structural similarity, and visual quality. Experts and users are invited to participate in subjective evaluations to score subjective factors such as the concealment, aesthetics, and interference of the watermark. The comprehensive quality score of the watermark embedding is obtained by combining objective indicators and subjective scores. On this basis, intelligent optimization methods such as particle swarm optimization and genetic algorithm are used to search for the optimal combination of watermark embedding parameters, such as watermark size, transparency, and embedding position, through repeated iterations and trial and error, to continuously improve the performance and quality of watermark embedding. Finally, the optimal watermark embedding strategy for different screenshot methods is obtained, which minimizes the impact of the watermark on the quality of the original image while ensuring the robustness and detectability of the watermark. When extracting the watermark, perform FFT transformation again, use the watermark key to decrypt the frequency domain watermark information of the corresponding grid, verify the similarity between the extracted watermark pattern and the original watermark, and if the similarity is greater than 90%, the watermark verification is considered to be passed. Through the grid watermark, different watermark information can be embedded in different areas of the screenshot to improve the capacity and security of the watermark. For the window screenshot, first use the Canny operator to detect the edge of the image and extract the border outline of the window. The Gaussian filter size of the Canny operator is set to 55, and the low threshold and high threshold are 30% and 90% of the pixel gradient amplitude respectively. The extracted border outline is morphologically processed to eliminate noise and breakpoints to obtain a complete window border. Then, according to the size of the circumscribed rectangle of the border, such as 800600, the positions of the four corner points of the watermark embedding are calculated. The horizontal and vertical distances between each corner point and the border are 5% of the side length, that is, 40 pixels.The watermark pattern is scaled to 80*80, the transparency is set to 50%, and it is superimposed on the four corner positions to obtain the window screenshot with embedded watermark. When extracting the watermark, the window border is first detected, the four corner positions are calculated according to the border size, the image of the corresponding area is extracted, and the similarity is compared with the original watermark pattern. If the similarity exceeds the threshold, it is determined to contain the watermark. By using the corner watermark method, the watermark can be quickly embedded and extracted without affecting the window content. When the screenshot type is a regional screenshot, the SLIC superpixel segmentation algorithm is used to divide the image into 100 semantically related sub-regions, and the number of pixels in each region is controlled at about 500. The SLIC algorithm first uniformly samples 100 initial seed points on the image, and then iteratively optimizes the region to which each pixel belongs according to the color and spatial distance of the pixel until the sub-region boundary is stable. Then the BASNet saliency detection model is used to calculate the saliency score of each sub-region. The BASNet model extracts multi-scale features of the image through a U-shaped encoder-decoder network, and uses the attention mechanism to adaptively fuse salient features, and finally generates a saliency heat map. The saliency score is normalized to between 0 and 1. According to the saliency score, the sub-region with a score less than 0.3 is selected as the non-critical region, and a 64*64 semi-transparent watermark pattern is superimposed at its geometric center. The transparency is linearly mapped to between 30% and 70% according to the saliency score. If the saliency score is 0.1, the transparency is 70%. The watermarking scheme based on region segmentation and saliency detection can adaptively select the watermark embedding position, avoid the key content in the image, reduce the visibility of the watermark, and ensure the robustness of the watermark. The watermark embedding of the scrolling screenshot adopts an adaptive transparency gradient strategy. First, the aspect ratio of the scrolling screenshot is calculated. For example, if the height is 9000, the width is 1800, and the aspect ratio is 5, it means that the scrolling screenshot contains 5 pages of content. The scrolling screenshot is evenly divided into 5 regions in the vertical direction, and the height of each region is 1800. For each region, extract its local histogram and gradient histogram features to evaluate the complexity of the region content. If the information entropy of the histogram is greater than 3.5 and the standard deviation of the gradient histogram is greater than 20, it is considered that the region is complex, contains a lot of text or texture information, and is not suitable for embedding watermarks; otherwise, it is considered that the region is simple and suitable for embedding watermarks. In complex regions, only two watermarks with high transparency (such as 80%) are embedded at the upper and lower edges of the region; in simple regions, the transparency of the watermark is modulated using an S-shaped curve, from top to bottom to 80%, 50%, 20%, 50%, 80%, and the size of the watermark also shows a trend of small in the middle and large on both sides with the transparency. When extracting watermarks, partition the scrolling screenshots, calculate the local histogram and gradient histogram features of each region, judge the complexity of the region based on the feature values, and then determine the embedding position and transparency change curve of the watermark, extract the watermark information of the corresponding region, and splice it into a complete watermark pattern.The scheme can adaptively adjust the watermark embedding strategy according to the complexity of the content, and realize dynamic hiding and reliable extraction of watermarks while effectively protecting the screenshot content. For the content adaptive watermark of screen recording, the ShotDetector algorithm is first used to segment the video and extract the shot boundary frame. The ShotDetector algorithm is based on the histogram difference between adjacent frames. If the difference exceeds the threshold (such as 0.3), it is marked as a shot switching point. Then the pre-trained InceptionV3 network is used to perform scene recognition on the key frames of each shot and output the category to which the scene belongs, such as people, scenery, text, etc. Different watermark styles are used according to the scene category, such as adding face contours to the watermark of the character scene, adding natural textures to the watermark of the scenery scene, and adding dot matrix or grid structure to the watermark of the text scene, so that the watermark is coordinated with the scene content. The first and last frames and the middle frames of the shot are selected to embed the watermark. The embedding positions are located at the four corners and the center of the frame respectively. The embedding intensity shows a gradual effect over time, and the duration is 1 / 10 of the shot length. Through content-adaptive watermarking, the correlation between watermark and video content can be enhanced, the concealment and aesthetics of watermark can be improved, and the extraction and authentication of watermark can be facilitated. To evaluate the comprehensive performance of watermarking schemes, a method combining objective evaluation indicators and subjective evaluation is adopted. First, different watermarking schemes are applied to embed watermarked images on 1000 test screenshots, and the three indicators of PSNR, SSIM and NQM are calculated. PSNR is used to measure the degree of distortion of image signal caused by watermark embedding, SSIM is used to measure the structural similarity between watermarked image and original image, and NQM is used to measure the impact of watermark embedding on image visual quality. The larger the value of the three indicators, the better the objective performance of the watermarking scheme. At the same time, 10 image processing experts and 50 ordinary users are invited to subjectively score the watermarked images generated by different schemes, with a score range of 1 to 5 points, to evaluate the concealment, aesthetics and interference of watermarks, and calculate the average subjective score MOS. The objective index and subjective score are weighted averaged to obtain the comprehensive quality score of the watermarking scheme, and the particle swarm optimization algorithm is used to search the watermark parameter space with this score as the optimization target. The particle swarm optimization algorithm quickly converges to the global optimal solution in the solution space by simulating the feeding behavior of bird flocks, and is suitable for solving multi-parameter optimization problems. The algorithm initializes 50 watermark parameter particles, each particle contains five parameters such as watermark intensity, size, transparency, and position, and the position and speed of the particle are randomly generated within the parameter range. In each round of iteration, the fitness function of each particle is calculated, that is, the comprehensive quality score of the generated watermarked image, and the speed and position of the particle are updated according to the fitness function until the algorithm converges or reaches the maximum number of iterations (such as 100 times). The global optimal particle obtained by the search is the best watermark parameter combination for the current screenshot, which is used to guide the watermark embedding process.Through mathematical modeling and intelligent optimization, the optimal watermark strategy under different screenshot methods can be found, achieving a balance between watermark performance and image quality.

[0035] S106. Record the total screenshot frequency, screenshot time interval, and usage frequency of different screenshot methods in the historical data of user screenshot events, develop a distribution curve of user screenshot events, analyze the screenshot frequency, time interval, screenshot method, distribution pattern, and curve volatility in the screenshot event distribution curve, and use a machine learning algorithm to divide the user group into people of different risk levels.

[0036] According to the historical data of the user's screenshot events, the timestamp, screenshot method, file size of the screenshot content, text sensitivity and image similarity information of each screenshot are obtained and stored in the screenshot event log database. The screenshot event data of the user within a period of time is extracted from the screenshot event log database, and the total number of screenshots and the total frequency of the user's screenshots are calculated by arranging them in chronological order. For continuous screenshot events, the timestamp difference is counted to obtain a series of screenshot time interval data. According to the screenshot event data, group statistics are performed according to the screenshot method to determine the number of times, frequency and content sensitivity of each screenshot method. A fixed time window is used to count the number of screenshot events in the window to obtain a series of frequency data. Feature engineering is performed on the screenshot event distribution curve to extract the peak, valley, slope and curvature morphological features of the curve, as well as the mean, variance and autocorrelation coefficient statistical features to construct a user screenshot behavior feature vector. The density-based DBSCAN clustering algorithm is introduced, and the user screenshot behavior feature vector is used as input. By setting the neighborhood radius and the minimum number of included points, the natural cluster structure of the screenshot behavior is automatically discovered, and users with similar behavior patterns are divided into the same group. A security risk scoring function for screenshot events is designed, and a multi-dimensional risk feature is constructed by combining the sensitivity of the screenshot method, the abnormal level of the screenshot frequency, the suddenness of the time distribution, and the content similarity factors.

[0037] Specifically, descriptive statistical analysis is performed on the time interval data, and indicators such as the minimum, maximum, mean, median, standard deviation and coefficient of variation are calculated to characterize the time characteristics of user screenshot behavior and evaluate the regularity and discreteness of screenshot frequency. Histograms and box-and-whisker plots of time interval data are drawn to analyze the central trend, discreteness and outliers of interval distribution, and to determine the periodicity and burstiness of user screenshot behavior. Group and count the user's screenshot event data, divide them according to the screenshot method, and calculate the number of times, frequency and content sensitivity of each screenshot method. The distribution of different screenshot methods in terms of usage frequency and risk level is displayed in the form of heat maps, radar maps, etc., to intuitively present the user's usage preferences for different screenshot functions and the potential risks they face. Combined with business scenarios and security requirements, the risk weights of each screenshot method are evaluated to generate a comprehensive risk index for user screenshot behavior. A fixed time window (such as every hour or every day) is selected, and the number of screenshot events in the window is counted to obtain a series of frequency data. The frequency data is plotted into a screenshot event distribution curve in chronological order, with time on the horizontal axis and screenshot frequency on the vertical axis. Using time series analysis methods such as moving average and exponential smoothing, we extract the trend, periodicity and randomness components of the curve, and characterize the long-term trend, periodicity and occasional fluctuations of user screenshot behavior. Combined with external information such as business calendar and system log, we analyze the key turning points and abnormal peaks in the curve to determine their relevance to specific events and operations. We perform feature engineering on the screenshot event distribution curve, extract the morphological features such as peak, valley, slope, curvature, and statistical features such as mean, variance, and autocorrelation coefficient, and construct the user screenshot behavior feature vector. Through dimensionality reduction algorithms such as principal component analysis (PCA) and t-SNE, we compress and visualize the high-dimensional feature vector, and explore the distribution pattern and clustering structure of user screenshot behavior in low-dimensional space. We introduce the density-based DBSCAN clustering algorithm, which takes the user screenshot behavior feature vector as input. By setting the neighborhood radius (Eps) and the minimum number of included points (MinPts) parameters, we automatically discover the natural cluster structure of screenshot behavior and divide users with similar behavior patterns into the same group. The clustering effect is evaluated by indicators such as Silhouette and DBCV, and the algorithm parameters are optimized. The differences in screenshot behavior among different user groups are analyzed to explore the typical behavior patterns and significant features of each group. A security risk scoring function for screenshot events is designed, and multi-dimensional risk features are constructed by comprehensively considering factors such as the sensitivity of the screenshot method, the abnormal level of the screenshot frequency, the suddenness of the time distribution, and the content similarity. A supervised learning algorithm such as logistic regression and support vector machine is used to train the screenshot risk prediction model with the user's risk characteristics as input and the user's historical risk events as labels. Cross-validation, grid search and other methods are used to optimize the model hyperparameters and improve the accuracy and recall rate of risk discrimination.Use interpretable algorithms such as SHAP and LIME to analyze the decision-making basis of the model and evaluate the importance of each risk dimension. Design differentiated security control strategies for users with different risk levels. Take strict screenshot restrictions and audit measures for high-risk users, monitor screenshot behavior in real time, implement dynamic access control and permission management based on content risks, and trigger abnormal behavior warnings. Take appropriate control and prompt measures for medium-risk users, conduct regular security scans, and launch intelligent recommendation guidance functions to improve user safety awareness. Implement routine compliance control for low-risk users, conduct random inspections, and focus on user behavior modeling and threat hunting. Establish user portraits and risk profile databases as the basis for control decisions. Continuously collect user screenshot feedback data and external environment change data, use machine learning paradigms such as incremental learning and continuous learning, and regularly update screenshot behavior clustering models and risk prediction models to improve the accuracy of user group segmentation and the timeliness of risk judgment. Use reinforcement learning algorithms to explore and optimize control strategies through Trial and Error methods to balance security and user experience. Build a closed loop of human-computer interaction and dynamically adjust strategies according to user behavior changes. Generate user portrait analysis reports regularly, characterize the characteristics of user screenshot behavior in multiple dimensions, evaluate the effectiveness of security management, and help continuously optimize security strategies. Each screenshot event of a user will generate about 100 bytes of log data, including timestamp (10 bytes), screenshot method (1 byte), file size (4 bytes), text sensitivity (2 bytes), image similarity (2 bytes) and other fields, which are stored in MongoDB. Within one month, the user generated a total of 1,000 screenshot operations, and the total screenshot frequency calculated by Map-Reduce was 33 times / day. For the screenshot interval time array.

[0038] [10,60,120,300,30,600,…], and calculated using the numpy library, the minimum interval is 10 seconds, the maximum interval is 600 seconds, the average interval is 120 seconds, the standard deviation is 150 seconds, and the coefficient of variation is 1.25, indicating that the screenshot interval time fluctuates greatly. Use matplotlib to draw the interval data histogram, plt.hist(intervals,bins=20), and observe that the distribution shows a long-tail feature, with most intervals concentrated within 60 seconds and a small number of intervals greater than 300 seconds, indicating that users have a small number of continuous and sudden screenshot behaviors. There are five screenshot modes: full screen (0x01), window (0x02), area (0x04), scroll (0x08), and screen recording (0x10). Through bit operations, statistics are performed and collections.Counter({'0x01′:200,'0x02':500,'0x04':100,'0x08':150,'0x10′:50}) is used to get the number of times each mode is used. Combined with the sensitivity of each mode (such as full screen 1.0, window 0.8, area 0.6, scroll 0.4, screen recording 0.2), the weighted average function of numpy is used to calculate the comprehensive risk index of 0.72, indicating that the overall risk of users' screenshot behavior is high. Use seaborn to draw a heat map sns.heatmap(data,annot=True) to intuitively display the distribution of usage frequency and risk level. Select a 1-hour time window and count the number of screenshots per hour to obtain the time series data [5, 10, 8, 20, 15, 11, ...]. Use the rolling function of pandas to calculate the 12-hour moving average and find that there is obvious periodicity, with screenshot peaks at 10 a.m. and 3 p.m. Use the seasonal_decompose function to extract the periodic component and determine whether users have periodic behavior of taking screenshots in batches every other day. Then use the find_peaks function of scipy to find the peak point, such as peaks,_=find_peaks(data,height=20,distance=24), and find that there is an abnormal screenshot peak before and after holidays, which is speculated to be related to business activities. 20 features were extracted from the screenshot curve, such as the number of peaks, the number of valleys, the maximum slope, the mean curvature, etc. PCA was used to reduce the 20-dimensional features to 2 dimensions. The screenshot behavior of 100 users after dimensionality reduction was visualized, and different colored scatter points were used to represent different screenshot methods. It was observed that there was an obvious cluster structure. Five user groups were divided by DBSCAN clustering, and the silhouette_score score was 0.8, with a good clustering effect. The analysis found that group A mainly took window screenshots and occasionally recorded screens, group B took full-screen screenshots frequently and for a long time, group C took fewer screenshots during the day and more at night, and their behavior was abnormal, and they were initially determined to be high-risk groups.A logistic regression classifier with 30 risk features was constructed, and group C was marked as high risk and the others were marked as low risk. Using 5-fold cross validation, the ROC-AUC score was 0.95 and the accuracy was 0.9, indicating that the model prediction effect was good. The SHAP value was used to analyze the main factors affecting the risk, and it was found that the burstiness of screenshot time, the proportion of screen recording use, and the frequency of file outbound transmission were the top three risk features. Strict control was taken for group C, and the screenshot volume was monitored in real time. The content security scanning coverage rate was 100%. When anomalies were found, the session was immediately interrupted, the permissions were reclaimed, and the alarm was triggered to effectively contain risk events. Subsequently, the screenshot logs of 1,000 new users were continuously collected, and the risk prediction model was fine-tuned every week, with an average accuracy rate of more than 0.85. For the newly emerged suspected leakage of training data within the organization, the control strategy was optimized through the exploration of reinforcement learning, and the leakage risk was reduced by 20%. PyEcharts was used to build a user portrait analysis page, which quantitatively portrayed users from 8 dimensions such as time pattern, usage preference, sensitive content, and risk level, and assisted managers in visual analysis. After one month of operation, based on feedback from business departments, the system handled more than 100 screenshot violation incidents and proactively issued warnings for more than 30 incidents, supporting business continuity within a controllable range and improving overall security and compliance levels.

[0039] S107. Add the user screenshot content factor to the screenshot event distribution curve of the user's historical data to determine the user's risk level, and update the risk level of the user group. When the user's screenshot frequency, time interval, screenshot method, distribution pattern and curve volatility are all normal, and the screenshot content only screenshots sensitive data, the risk level is increased.

[0040] Through the time series database and data visualization tools, the time distribution and frequency changes of the user's screenshot behavior are monitored in real time to obtain the time series data of the screenshot event. According to the time series data, smoothing and anomaly detection algorithms are used to determine whether the overall trend and fluctuation pattern of the curve are within the normal range. The periodic and mutation characteristics on different time scales are extracted from the curve through the wavelet transform time-frequency analysis method. According to the characteristics, the statistical process control method is used to dynamically set the upper and lower control limits of the screenshot frequency, interval, and duration indicators. If the frequency, interval, or duration of the screenshot behavior exceeds the set upper and lower control limits, the screenshot behavior warning is triggered and the user's abnormal risk score is updated. OCR text recognition and image classification AI are used to perform semantic understanding and risk analysis on the user's historical screenshot content to identify sensitive information. Through the sensitive information identification model, it is detected whether the screenshot contains sensitive content, including company confidential documents, source code, and personal privacy data. Combined with the user's access records and hunger operation log context information, the risk level of the screenshot behavior is comprehensively judged, so as to adjust the screenshot control strategy and permission configuration.

[0041] Specifically, the screenshot event data of users is continuously collected, including the timestamp, screenshot method, screenshot content and other information of the screenshot. After hashing the sensitive fields, the data is stored in the screenshot event log database. Through time series databases (such as InfluxDB) and data visualization tools (such as Grafana), the time distribution and frequency changes of user screenshot behaviors are monitored in real time, and a dynamically updated screenshot event distribution curve is drawn. The horizontal axis of the curve represents time, and the vertical axis represents the screenshot frequency. Through smoothing and anomaly detection algorithms, it is determined whether the overall trend and fluctuation pattern of the curve are within the normal range. Multi-scale analysis is performed on the screenshot event distribution curve, and time-frequency analysis methods such as wavelet transform are used to extract the periodicity and mutation characteristics of the curve at different time scales. Combined with business scenarios and user behavior baselines, the statistical process control (SPC) method is used to dynamically set the control upper and lower limits of indicators such as frequency, interval, and duration. When the screenshot frequency exceeds once per minute, the screenshot interval is less than 5 seconds, or the continuous screenshot duration exceeds 10 minutes, it is determined as a potential abnormal behavior, triggering a screenshot behavior warning, and updating the user's abnormal risk score. At the same time, through statistical indicators such as Mahalanobis distance and box plot, local abnormal patterns in the curve are identified in real time to improve the detection rate of abnormal behavior. AI technologies such as OCR text recognition and image classification are used to perform semantic understanding and risk analysis on the user's historical screenshot content. Through the sensitive information recognition model, it is detected whether the screenshot contains sensitive content such as company confidential documents, source code, personal privacy data, etc. The recognition model adopts the method of transfer learning, pre-trained on a large-scale general data set, and then fine-tuned using sensitive data annotated in business scenarios. The accuracy rate on the test set can reach more than 90%. If the screenshot content contains sensitive information, the risk level is automatically marked as high, and the risk level of the screenshot behavior is comprehensively judged in combination with contextual information such as the user's access records and operation logs. Image similarity algorithms such as perceptual hashing (pHash) and SIFT feature matching are introduced to compare the similarity of user screenshot content to identify whether there is a batch capture of the same original document. For multiple consecutive screenshots, extract their key content and calculate the content similarity matrix. If the average similarity is greater than the threshold (such as 0.9), and the screenshot content covers most of the key chapters of the original document, it is determined to be a suspected document leakage risk and automatically marked as a high risk level. At the same time, the screenshot audit process is triggered to manually review and desensitize the suspicious screenshot sequence. The user's historical screenshot content is clustered and keywords are extracted. The LDA topic model and TF-IDF keyword extraction algorithm are used to mine the hot topics and high-frequency words that users are concerned about from massive screenshot data. The LDA model uses Gibbs sampling to perform topic inference on the screenshot corpus, setting the number of topics K = 50, iterating 1000 times, and extracting 10 keywords under each topic. The TF-IDF algorithm selects the top 50 high-frequency keywords through word frequency-inverse document frequency.If the topic and keyword analysis finds that users often take screenshots of specific areas (such as competitor intelligence, business secrets) or specific content (such as internal code names, core technology names), they will be judged as risky behaviors such as insider trading and malicious theft of secrets, and the risk level will be automatically marked as high. Based on the historical screenshot behavior characteristics of users (frequency, method, curve pattern, etc.) and the current screenshot content risk, the weighted scoring method is used to quantitatively score the risks of each dimension, and the weights can be adjusted according to business needs and expert experience. On this basis, combined with the rule engine and risk matrix mechanism, the user's comprehensive risk level is dynamically evaluated and updated. The rule engine maps the risk score combination of different dimensions to the risk level by setting a series of IF-THEN rules. The risk matrix discretizes the continuous risk score into three levels: high, medium, and low by setting the dual-dimensional thresholds of risk probability and impact. The risk judgment rules and thresholds can be continuously optimized and adjusted according to business practices. According to the real-time risk level changes of users, the screenshot control strategy and permission configuration are dynamically adjusted. For low-risk users, regular control measures are adopted to allow them to perform compliant screenshot operations, but watermark prompts and access traces are set for sensitive content. For medium-risk users, moderate control is adopted to limit the number of screenshots per day (such as no more than 50 times) and the duration of a single continuous screenshot (such as no more than 5 minutes), pop up a secondary confirmation prompt for suspicious screenshots, and force the addition of user ID watermarks. For high-risk users, strict control is adopted to prohibit screenshot operations involving confidential documents, and other screenshot contents are desensitized in real time (such as blurring, mosaics, etc.) and forced to encrypt. Through adaptive control strategies, a balance is found between compliance and security.

[0042] Each time a user takes a screenshot, a screenshot event log is generated. The log contains fields such as screenshot time, screenshot method, image size, and image content hash value. The SHA256 algorithm is used to unidirectionally encrypt sensitive information such as image content hash value to ensure user privacy and security. Use the InfluxDB time series database to store screenshot logs, and configure the screenshot frequency monitoring panel through Grafana. When the screenshot frequency exceeds 10 times within 1 minute, the screenshot interval within 30 seconds is less than 2 seconds, or the continuous screenshot duration within 24 hours exceeds 30 minutes (the threshold can be adjusted according to business needs), an abnormal behavior alarm is triggered and the abnormal risk score of the user is increased by 20%. Use wavelet transform to perform time-frequency analysis on the screenshot event curve, extract the energy distribution characteristics of the curve at different time scales (such as 5 minutes, 30 minutes, and 1 hour), and use a series of IF-THEN rules to determine whether the energy of each frequency band exceeds the normal range, and automatically identify periodic anomalies and spike anomalies in the curve.

[0043] Scan the user's screenshots for sensitive information, use Baidu's paddleOCR framework to extract the text in the picture, and match it with the company's defined sensitive word library (including 500 sensitive words, such as "confidential", "source code", "ID number", etc.). If it contains more than 3 sensitive words, the risk level is determined to be high. The OCR model uses the network structure of ResNet+BiLSTM+CTC, and the accuracy rate on the ICDAR 2015 dataset reaches 92.1%. At the same time, the ResNet50 model pre-trained by ImageNet is used to classify the screenshot content to determine whether the screenshot belongs to sensitive categories such as contracts, codes, and certificates. If it belongs to sensitive categories, it will automatically mark the risk level as medium. Combined with the user's office scene behavior analysis, the number of screenshots taken by the user within 10 minutes before and after browsing sensitive documents is counted. If it is higher than 5 times, it is determined that the current screenshot behavior has a high risk.

[0044] The similarity of the content of continuous screenshots is calculated by the image pHash algorithm, and the sliding time window is set to 5 minutes. If the average pHash Hamming distance of 10 consecutive screenshots is less than 5 (i.e., the similarity is greater than 90%), and these screenshots cover more than 80% of the total number of pages of the original document, the user is suspected of leaking documents, and the risk level is set to high. The relevant screenshot content is automatically mosaiced and submitted for review. The LDA model in the gensim library is used to perform topic clustering on the user's screenshot content within a week, setting the number of topics to 20 and the number of iterations to 2000. The 15 keywords with the highest TF-IDF value are selected under each topic. If the KL divergence of the user's screenshot topic distribution and sensitive topics such as competitive product intelligence and commercial secrets is less than 0.5, and the number of screenshots of related topics accounts for more than 30%, the user is judged to have a risk of malicious theft, and the risk level is set to high.

[0045] The scores of different risk dimensions are weighted and summed. The weights can be determined by business experts and security personnel, such as content risk weight 0.4, behavior risk weight 0.3, and subject risk weight 0.3. The comprehensive risk score is normalized by Min-Max to obtain a risk score in the range of 0 to 100. Using a three-stage risk matrix, the vertical axis represents the probability of risk occurrence, and three levels of low, medium, and high are set, with probability thresholds of 10% and 30% respectively; the horizontal axis represents the degree of risk impact, which is also divided into three levels of low, medium, and high, and the impact thresholds are 20 and 60 respectively (the higher the score, the greater the impact). Map the normalized risk score to the risk matrix to obtain the user's comprehensive risk level.

[0046] For low-risk users, a digital watermark "Internal Use Only" is embedded. The watermark font size is 1 / 18 of the image height, with a transparency of 10%, and appears randomly in one of the upper left, upper right, lower left, and lower right positions. For medium-risk users, a maximum of 30 screenshots are allowed per day, and a single continuous screenshot cannot exceed 2 minutes. If the limit is exceeded, a prompt box will automatically pop up, and the screenshot content will be mosaiced in real time based on the image segmentation algorithm before providing a preview. For high-risk users, the Windows system API is called to disable its screenshot shortcut key, and only screenshots of non-confidential documents are allowed. A confirmation dialog box pops up before taking a screenshot, and the image is encrypted and uploaded to the audit server. It can only be viewed and used after being reviewed and approved by the security administrator. Minimize the risk of sensitive information leakage through dynamic permission management and control.

[0047] S108. Establish a screenshot audit and monitoring mechanism to record and track the user's screenshot behavior throughout the entire life cycle, and monitor the screenshot events, watermark embedding status and abnormal behavior information in the system in real time through visual dashboards and reports.

[0048] The communication data between the proxy and the main system is transmitted through the SSL encrypted channel. The screenshot data is encrypted using the AES symmetric encryption algorithm. The SHA-256 one-way hash function is used to process the sensitive information of the file name and user ID. The screenshot data is cached in the Kafka distributed message queue and then imported into the Elasticsearch cluster in batches. For the imported data, a multi-dimensional index is established to meet the needs of fast retrieval and aggregate analysis of the screenshot data. When the user submits a screenshot request, the watermark embedding microservice is called in real time. According to the risk level of the screenshot content, it is divided into four levels: public, internal, secret and confidential, and different watermark schemes are used for processing. The FlinkCEP engine is used to process the screenshot event stream in real time. By setting an abnormal behavior pattern library based on frequency, time and content characteristics, abnormal behavior alarms are triggered in real time, and security incident tickets are automatically created. The SparkMLlib distributed machine learning library is used offline to build common machine learning models such as LR, SVM, RF and XGBoost. Through parallel training and optimization of models, clustering, anomaly detection and risk score prediction are performed on historical screenshot behavior data. Build a screenshot event monitoring dashboard based on ELKStack. Through Kibana's Lens and Dashboard visualization tools, design a preset number of bar charts, pie charts, line charts, and heat maps, and layouts to intuitively display real-time and historical screenshot statistics in the system. Build an independent watermark detection and attack forensics system. Use SIFT and SURF local feature extraction algorithms to perform robust detection of digital watermarks on suspected leaked screenshots to restore key information about the leaker and the time of the leak. Set up differentiated audit processes and disposal strategies for abnormal events of different risk levels. By enabling the workflow engine and connecting with OA, HR, and access control office systems, reminders are automatically triggered for medium and low-risk events, and high-risk events require security administrators to intervene and investigate.

[0049] Specifically, a distributed screenshot audit and monitoring system is built, and the user's screenshot behavior data is collected in real time through the audit agent deployed on the user side and the server side. The agent and the main system communicate through an SSL encrypted channel, the screenshot data is encrypted using AES symmetric encryption, and sensitive information such as file names and user IDs are encrypted using SHA-256 one-way hashing to ensure transmission and storage security. The Kafka distributed message queue is used to cache and batch import data into the Elasticsearch cluster to establish a multi-dimensional index to meet the needs of fast retrieval and aggregate analysis. At the same time, the original screenshot file is asynchronously uploaded to the encrypted OSS object storage, and the storage period is set to a minimum of 6 months and a maximum of 2 years according to the data confidentiality level and industry compliance requirements. When the user submits a screenshot request, the watermark embedding microservice is called in real time, and different watermarking schemes are used according to the risk level of the screenshot content, including public, internal, secret, and confidential. For key content such as code and design drawings, frequency domain watermarks are used to embed digital fingerprints such as user IDs and timestamps; for general content such as text and charts, spatial domain watermarks are used to dynamically adjust the size, position, and transparency of the watermark, taking into account both tamper-proof and aesthetics. The watermarking scheme also considers factors such as the user's role, permissions, and recent behavior, and appropriately increases the watermark strength for suspicious persons. The watermark embedding and verification logs are stored in association with the screenshot behavior logs to facilitate post-audit. If the watermark embedding fails, the screenshot request is rejected and an alarm is reported. The FlinkCEP engine is used to process the screenshot event stream in real time, and an abnormal behavior pattern library based on frequency, time, and content is set up, such as taking screenshots more than 5 times in a minute, taking screenshots of confidential documents at 2 a.m., and screenshot content that is highly similar to major projects of competitors, etc., to trigger alarms in real time and automatically create security incident work orders. The SparkMLlib distributed machine learning library is used offline to build common models such as LR, SVM, RF, and XGBoost, and train and optimize the models in parallel to cluster, detect anomalies, and predict risk scores for historical screenshot behaviors. Business attributes such as user positions, projects, and social networks are introduced to build a multi-view behavior baseline library to improve the detection rate and accuracy of abnormal behaviors. Use ELKStack to build a screenshot event monitoring dashboard. Through Kibana's Lens, Dashboard and other visualization tools, design a variety of charts and layouts such as bar charts, pie charts, line charts, heat maps, etc., to intuitively display real-time and historical screenshot statistics in the system. For example, the proportion of different screenshot methods, the number of screenshots at each risk level, the top 10 screenshot users and file rankings, etc., support drilling down and filtering in multiple dimensions such as time range, department, and individual, so that managers can deeply analyze abnormal behavior trends. The system generates daily reports on a regular basis every day and weekly reports every week, summarizes the core indicators of screenshot audits, and pushes them to relevant persons in charge for review through email subscriptions. Build an independent watermark detection and attack forensics system to trace the source of suspected leaked screenshots.SIFT, SURF and other local feature extraction algorithms are used to robustly detect digital watermarks in screenshots and restore key information such as the leaker and time. Similarity hashing algorithms such as pHash are used to compare the differences between suspected screenshots and original documents, and analyze the proportion of leaked content, tampering methods, etc. Web crawlers and API interfaces are used to collect the exposure of the same or similar content on the Internet and evaluate the impact of the leak. Technical and situational evidence chains are summarized to respond to security incidents in a timely manner. Differentiated audit processes and disposal strategies are set for abnormal events of different risk levels. The workflow engine is enabled to connect to office systems such as OA, HR, and access control. For medium and low-risk events, email or SMS reminders are automatically triggered, and a 24-hour countdown is set to require the parties to provide reasonable explanations. If the parties fail to respond within the deadline or the explanations are unreasonable, they will be automatically recorded in the violation file, and the sensitive data access rights granted by the parties will be restricted. For high-risk events, the security incident response platform automatically creates an emergency plan, notifies the security administrator to intervene in the investigation, preserves the evidence chain for malicious leaks, conducts legal procedures, and implements strict punishment measures, and lists them as key monitoring targets. Continuously optimize the detection rules and model algorithms of the system. For samples with false positives and false negatives, business experts are organized to conduct manual review and annotation every month. The training set and validation set are divided into positive and negative samples in a ratio of 8:2. The model is retrained and evaluated every quarter, and the model parameters are optimized iteratively. Unsupervised anomaly detection technologies such as DGA and UEBA are introduced to mine unknown threat patterns. According to business scenarios and data characteristics, the audit event classification and manpower investment are reasonably evaluated and adjusted to achieve differentiated hierarchical response. Combined with business process changes, the audit system and system functions are revised synchronously to ensure that they keep pace with the times. When the user submits a screenshot request, the screenshot agent sends the screenshot metadata JSON to the audit system API gateway through an HTTP POST request. The metadata fields include user ID, device IP, timestamp, screenshot method, etc. The user ID is encrypted with SHA-256 hash and the device IP is encrypted with AES-128. The API gateway verifies the JWT token of the request, decrypts the metadata and parses it into the Kafka message value in a structured manner. The message key is a millisecond timestamp. The Kafka cluster consists of 3 broker nodes and adopts a 3-copy mechanism to ensure that messages are not lost. The Logstash consumer subscribes to Kafka messages and imports metadata into the Elasticsearch index audit-screenshot-yyyy-MM-dd, with 6 shards and 2 replicas.The watermark microservice first calculates the file fingerprint of the original screenshot file using MD5, and then calls TensorFlow to classify the screenshot content. According to the four confidentiality levels of confidential, secret, internal, and public, blind watermarks with strengths of a=0.8, 0.6, 0.4, and 0.2 are embedded respectively. The watermark payload carries a 16-byte MD5 fingerprint, a 10-bit Unix timestamp, and an 8-bit auto-increment ID, encrypted with a 2048-bit RSA private key. The FlinkCEP engine subscribes to the Kafka screenshot event stream, groups by user ID, sets the sliding window size to 60 seconds, and the step length to 10 seconds. If the number of screenshots of the same user within 1 minute is greater than 5, and the interval between the last two screenshots is less than 5 seconds, it is output to the alarm topic and triggers email and SMS notifications to the security administrator. SparkStreaming consumes Kafka in real time, performs full aggregation analysis every 5 minutes, and counts the total number of screenshots in the last hour, the proportion of each risk level, and the top 5 popular screenshot methods. The results are written to Redis for Kibana real-time large-screen display. SparkSQL offline analyzes 10 million screenshot logs in the past month, extracts 20 features such as personnel, time, method, content, etc., and uses the random forest algorithm to build a user abnormal behavior detection model, with hyperparameters n_estimators = 100, max_depth = 10, and a training set and test set ratio of 8:2. After 10-fold cross validation, precision = 0.85, recall = 0.92. The abnormal behavior records predicted by the model are exported to the abnormal event index of Elasticsearch for investigation and disposal. The Kibana dashboard is designed in combination with business scenarios. The total number of screenshots today panel uses line charts and digital charts to show the time series changes in the past 8 hours; the number of screenshots of each risk level is a circular chart, and you can drill down to view the statistics of popular personnel, methods, IP and other dimensions by clicking; the abnormal event list panel supports drilling down to expand event details, quickly create a JIRA work order and @ the security duty person, and connect to the threat intelligence platform to query IOC information with one click. LogstashPipeline incrementally imports the latest screenshot logs to the abnormal detection and watermark extraction process every 15 minutes. The detected abnormal screenshots are submitted to the idempotent API interface to call the OA system, and a rectification notice is automatically created for the parties involved, requiring online confirmation of the rectification within 2 hours. For sensitive operations of core business system administrators, a masking watermark is embedded with the text "For audit filing only, strictly prohibited from being disseminated", the font size is 12px, the transparency is 30%, and the position is 4 randomly appearing corners; when collecting evidence for leakage, the frequency domain watermark is extracted using the Fourier-Mellin filter, the bit error rate is less than 1 / 1000, and the extracted watermark fingerprint matches the original document more than 98%, which is considered a leak.

[0050] It should be noted that the above examples are only some specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments, and there are many variations. All variations that can be directly derived or associated with the content disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A multi-dimensional data authority management and privacy protection method for a power information network, characterized in that: The method comprises: Obtain and identify the user's screenshot method and the characteristics of different screenshots, including the full-screen screenshot image resolution and screen resolution, the window screenshot image size and position corresponding to a specific window, the area screenshot image shape manually selected by the user, the scrolling screenshot image height is greater than the screen height, the screen recording has a fixed time interval for each consecutive frame, and the screen recording screenshot content has a consistent interval on the timeline; Image recognition is used to extract screenshot content. The sensitivity of the content is identified based on keyword analysis of the screenshot content and customer personal information, electricity bills, power generation equipment operation and maintenance records, power load dispatching orders, power supplier contract documents, power company business plans, power system backend codes, and technical research reports. The sensitivity of the screenshot content is graded to determine the risk level of screenshot leakage. Dynamically select the watermark type based on the risk level of screenshot leakage. The watermark types include simple text watermark, text and image mixed watermark, invisible watermark and QR code watermark; Generate corresponding watermark content according to different characteristics of user screenshot methods. The window screenshot watermark content includes the window title and window application name, the full-screen screenshot watermark includes the screenshot time and taskbar application name, the scrolling screenshot watermark includes the scrolling start and end position information, and the screen recording watermark includes the image recording start and end time and the recording frame information; Formulate corresponding watermark embedding methods according to different screenshot methods. For full-screen screenshots, watermarks are evenly distributed in the entire screenshot area according to a grid. For window screenshots, watermarks are embedded in the four corners of the window border. For area screenshots, watermarks are embedded in the center of the captured area. For scrolling screenshots, the transparency of the embedded watermark gradually fades according to the scrolling direction of the screenshot. For screen recordings, continuous dynamic watermarks are embedded in different frames of the video. Record the total screenshot frequency, screenshot time interval, and usage frequency of different screenshot methods in the historical data of user screenshot events, develop a distribution curve of user screenshot events, analyze the screenshot frequency, time interval, screenshot method, distribution pattern, and curve volatility in the screenshot event distribution curve, and use machine learning algorithms to divide user groups into different risk levels; Add the user screenshot content factor to the screenshot event distribution curve of user historical data to determine the user risk level, and update the risk level of the user group. When the user's screenshot frequency, time interval, screenshot method, distribution pattern and curve volatility are all normal, and the screenshot content is only for sensitive data screenshots, the risk level is increased; Establish a screenshot audit and monitoring mechanism to record and track users' screenshot behavior throughout the entire life cycle, and monitor screenshot events, watermark embedding, and abnormal behavior information in the system in real time through visual dashboards and reports.

2. The method according to claim 1, wherein: The method of obtaining and identifying the user's screenshot method and the features of different screenshots, including the resolution of the full-screen screenshot image and the screen resolution, the size and position of the window screenshot image corresponding to a specific window, the shape of the area screenshot image manually selected by the user, the height of the scrolling screenshot image being greater than the height of the screen, the screen recording having a fixed time interval for each frame, and the screen recording screenshot content having a consistent interval on the time axis, includes: Obtaining a user screenshot image, and determining whether the user screenshot image is a full-screen screenshot by comparing the image resolution with the current system screen resolution; if the image resolution is the same as the current system screen resolution, determining that the user screenshot image is a full-screen screenshot; If the image resolution is smaller than the current system screen resolution, the position coordinates of the user screenshot image in the screen are obtained through a screen coordinate mapping algorithm. For non-full-screen and window screenshot images, an edge detection algorithm is used to extract the edge contour of the image. Polygonal approximation is performed based on the edge contour to obtain an approximated polygon. If the number of sides of the approximated polygon is less than a preset threshold and the shape is regular, the non-full-screen and window screenshot image is determined to be a rectangular or circular regular area screenshot; The feature information of image resolution, position coordinates and edge contour dimensions is comprehensively analyzed, and a screenshot classification model is constructed through decision tree and support vector machine machine learning algorithms. The screenshot classification model is trained based on different parameter combinations using a cross-validation method to obtain the optimal model hyperparameters with the highest classification accuracy, and the screenshot classification model is tuned.

3. The method according to claim 1, wherein: The screenshot content is extracted by image recognition, and the sensitivity of the content is identified based on the screenshot content and customer personal information, electricity bills, power generation equipment operation and maintenance records, power load dispatching commands, power supplier contract documents, power company business plans, power system background codes and technical research reports. Keyword analysis is used to classify the sensitivity of the screenshot content and determine the risk level of screenshot leakage, including: After obtaining the user's screenshot image, OCR optical character recognition is used to extract the text content in the image to obtain text information. For the text information, natural language processing algorithms are used to perform word segmentation, part-of-speech tagging and named entity recognition to obtain key information such as names of people, places and organizations. The target detection algorithm is used to analyze the image to identify key targets of power equipment and power lines, and obtain a structured representation of the image content. According to the pre-built sensitive word library of the power industry, key information is matched to determine whether there are keywords involving customer privacy, electricity bills, equipment operation and maintenance, power grid dispatching and commercial secrets. Structured representation of electricity bills and operation and maintenance records is performed. The data is analyzed using anomaly detection algorithms to identify anomalies and suspicious data items. If the screenshot image contains code snippets, program language recognition and code abstract syntax tree analysis are used to determine the programming language and functional module to which the code snippet belongs. The pre-trained knowledge graph of the power industry is used to perform concept extraction and entity linking on the key contents of the technical research report to obtain sensitive information on the key technologies, algorithms, and experimental data involved in the report. The frequency of the sensitive keywords, the distribution of sensitive targets, code functions, and technical importance factors are comprehensively considered, and the weighted summation and regularization methods are used to quantitatively evaluate the overall sensitivity of the screenshot content to obtain a comprehensive sensitivity score.

4. The method according to claim 1, wherein: The type of watermark is dynamically selected according to the risk level of the screenshot event leakage, and the watermark types include simple text watermark, text and image mixed watermark, invisible watermark and QR code watermark, including: According to the sensitive content analysis and leakage risk assessment results of the screenshot event, combined with the user authentication and access control mechanism, the watermark embedding strategy and algorithm selection are dynamically determined. If the screenshot event is high-risk, the invisible watermark technology is used. By selecting the DCT transform domain watermark algorithm, the DCT coefficient energy distribution of the screenshot image is analyzed, and the embedding strength parameters are adaptively set to embed more watermark information in the high-frequency area. For low-frequency areas, the embedding amount is reduced. In order to achieve full life cycle control of watermark images, digital rights management DRM technology is combined with the introduction of watermark synchronization code mechanism to embed synchronization positioning information into the watermark image, and the correlation peak detection method is used to achieve blind watermark extraction.

5. The method according to claim 1, wherein: The corresponding watermark content is generated according to different characteristics of the user's screenshot method. The window screenshot watermark content includes the window title and the window application name, the full-screen screenshot watermark includes the screenshot time and the taskbar application name, the scrolling screenshot watermark includes the scrolling start position and end position information, and the screen recording watermark includes the image recording start time and end time and the frame information of the recording, including: Obtain the screenshot image submitted by the user, extract the image resolution, aspect ratio and color histogram features, input them into the pre-trained screenshot classification model, and identify the type of the screenshot. If the screenshot type is a window screenshot, use the YOLOv5 target detection algorithm to detect the window area in the image, and use OCR text recognition to extract the text information in the window title bar to obtain the window application name; If the screenshot type is a full-screen screenshot, extract the screenshot timestamp from the EXIF ​​metadata of the image and convert the timestamp into a standard format string; If the screenshot type is a scrolling screenshot, the number of pages contained in the scrolling screenshot is obtained by calculating the ratio of the image height to the screen resolution height, and the watermark content is determined according to the screenshot type and the extracted key information. For the watermark content, the watermark security level is dynamically divided according to its confidentiality and importance factors. If the watermark security level is lower than a preset threshold, the watermark is embedded into the image using the spatial domain LSB embedding method; If the watermark security level is higher than a preset threshold, a frequency domain DCT transform domain watermark algorithm is selected and the watermark is embedded in combination with the visual saliency features of the image.

6. The method according to claim 1, wherein: The watermark embedding method is formulated according to different screenshot methods. For full-screen screenshots, the watermark is evenly distributed in the entire screenshot area according to a grid. For window screenshots, the watermark is embedded in the four corners of the window frame. For area screenshots, the watermark is embedded in the center of the captured area. For scrolling screenshots, the transparency of the embedded watermark gradually fades according to the scrolling direction of the screenshot. For screen recording, a continuous dynamic watermark is embedded in different frames of the video, including: If the screenshot mode is a full-screen screenshot, the size and number of watermark grids are determined according to the size of the full-screen screenshot, and the watermark is embedded in a grid evenly distributed manner; If the screenshot mode is a window screenshot, the frame outline of the window screenshot is extracted by an edge detection algorithm, the boundary coordinates of the window are obtained, and a watermark is embedded in the four corners of the window frame; If the screenshot method is a regional screenshot, the regional screenshot is divided into multiple sub-regions by a superpixel segmentation algorithm, and the significance score of each sub-region is calculated by a significance detection model. A watermark is embedded in a non-critical area whose significance score is lower than a preset threshold. The watermark embedding effect is evaluated, and the image after watermark embedding is obtained. The peak signal-to-noise ratio and structural similarity are used as objective indicators to quantify the impact of the watermark on the image quality. At the same time, users are invited to score the subjective factors of the concealment and aesthetics of the watermark. The comprehensive quality score of the watermark embedding is obtained by combining the objective indicators and the subjective scores. According to the comprehensive quality score, an intelligent optimization algorithm is used to search for the optimal combination of watermark embedding parameters to obtain the optimal watermark embedding strategy for different screenshot methods.

7. The method according to claim 1, wherein: The total screenshot frequency, screenshot time interval and usage frequency of different screenshot methods of the historical data of user screenshot events are recorded, a distribution curve of user screenshot events is formulated, the screenshot frequency, time interval, screenshot method, distribution pattern and curve volatility in the screenshot event distribution curve are analyzed, and the user group is divided into different risk level groups using a machine learning algorithm, including: According to the user screenshot event history data, obtain the timestamp, screenshot method, file size, text sensitivity and image similarity information of each screenshot, and store them in the screenshot event log database; Extracting the screenshot event data of the user within a period of time from the screenshot event log database, arranging them in chronological order, and calculating the total number of screenshots and the total frequency of screenshots of the user; For continuous screenshot events, count the timestamp differences and get a series of screenshot time interval data; Based on the screenshot event data, group and count the screenshot methods to determine the number of times each screenshot method is used, the frequency, and the sensitivity of the content; Use a fixed time window to count the number of screenshot events within the window and obtain a series of frequency data; Perform feature engineering on the screenshot event distribution curve to extract the peak, valley, slope, and curvature morphological features of the curve, as well as the mean, variance, and autocorrelation coefficient statistical features, and construct a user screenshot behavior feature vector; The density-based DBSCAN clustering algorithm is introduced, and the user screenshot behavior feature vector is used as input. By setting the neighborhood radius and the minimum number of included points parameters, the natural cluster structure of the screenshot behavior is automatically discovered, and users with similar behavior patterns are divided into the same group. A security risk scoring function for screenshot events is designed, and a multi-dimensional risk feature is constructed by combining the sensitivity of the screenshot method, the abnormal level of screenshot frequency, the suddenness of time distribution, and content similarity factors.

8. The method according to claim 1, wherein: The user screenshot content factor is added to the screenshot event distribution curve of the user's historical data to determine the user risk level, and the risk level of the user group is updated. When the user's screenshot frequency, time interval, screenshot method, distribution pattern and curve volatility are all normal, and the screenshot content is only for sensitive data screenshots, the risk level is increased, including: Through time series database and data visualization tools, the time distribution and frequency changes of users' screenshot behaviors are monitored in real time, and the time series data of screenshot events are obtained; Based on the time series data, smoothing and anomaly detection algorithms are used to determine whether the overall trend and fluctuation pattern of the curve are within a normal range; By using the wavelet transform time-frequency analysis method, the periodicity and mutation characteristics on different time scales are extracted from the curve; According to the characteristics, the statistical process control method is used to dynamically set the upper and lower limits of the screenshot frequency, interval and duration indicators; If the frequency, interval or duration of screenshots exceeds the set upper and lower limits, a screenshot behavior warning will be triggered and the user's abnormal risk score will be updated; Use OCR text recognition and image classification AI to perform semantic understanding and risk analysis on the user's historical screenshots and identify sensitive information; Through the sensitive information recognition model, detect whether the screenshot contains sensitive content, including company confidential documents, source code and personal privacy data; Combine the user's access records and the context information of the operation log to comprehensively judge the risk level of the screenshot behavior and adjust the screenshot management strategy and permission configuration accordingly.

9. The method according to claim 1, wherein: The screenshot audit and monitoring mechanism is established to record and track the user's screenshot behavior throughout the life cycle, and through visual dashboards and reports, real-time monitoring of screenshot events, watermark embedding and abnormal behavior information in the system, including: The communication data between the proxy and the main system is transmitted through the SSL encrypted channel, the AES symmetric encryption algorithm is used to encrypt the screenshot data, and the SHA-256 one-way hash function is used to process the file name and user ID sensitive information; Cache the screenshot data to the Kafka distributed message queue, and then import it into the Elasticsearch cluster in batches; For the imported data, a multi-dimensional index is established to meet the needs of fast retrieval and aggregate analysis of screenshot data; When a user submits a screenshot request, the watermark embedding microservice is called in real time; According to the risk level of the screenshot content, it is divided into four levels: public, internal, secret and confidential, and different watermark solutions are used for each level; Use the FlinkCEP engine to process the screenshot event stream in real time; By setting up an abnormal behavior pattern library based on frequency, time and content characteristics, abnormal behavior alarms are triggered in real time and security incident tickets are automatically created; SparkMLlib distributed machine learning library is used offline to build common machine learning models such as LR, SVM, RF and XGBoost; Through parallel training and optimization of models, historical screenshot behavior data is clustered, anomaly detected, and risk score predicted; Build a screenshot event monitoring dashboard based on ELKStack, and use Kibana's Lens and Dashboard visualization tools to design a preset number of bar charts, pie charts, line charts, and heat maps, and layouts to intuitively display real-time and historical screenshot statistics in the system; Build an independent watermark detection and attack forensics system; SIFT and SURF local feature extraction algorithms are used to perform robust detection of digital watermarks on suspected leaked screenshots, restoring key information such as the leaker and the time of the leak; Set up differentiated audit processes and disposal strategies for abnormal events of different risk levels; By enabling the workflow engine and connecting with the OA, HR and access control office systems, reminders are automatically triggered for medium and low-risk events, while high-risk events require the security administrator to intervene and investigate.

Images