User network behavior tracking method and system

Abstract

According to the user network behavior tracking method and system, a network client, a network cloud server and a remote public security system cloud server are included, the network client obtains a user screen image through a screenshot method, transfers the image into characters through an image recognition method, extracts keywords, and sends the keywords to the remote public security system cloud server; the method comprises the following steps: identifying and recording names, time and information interaction behaviors of websites visited by users and sending the names, time and information interaction behaviors to a network cloud server, and the network cloud server obtains detailed network use data of the users, analyzes website types, durations, operation behaviors and sensitive keywords, issues a user network analysis report and sends the user network analysis report to the user. The network risk level is judged from three aspects of network indulging, network behaviors and network security, popup prompt is performed on high-risk network behaviors, and meanwhile, storage and verification related evidence is provided for a remote public security system cloud server, so that the health, security and traceability of the network behaviors are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network tracking technology, and in particular to a method and system for tracking user network behavior. Background Art

[0002] While Internet technology has brought people convenient and fast production and life services, network behavior and network security awareness have not changed fundamentally. Therefore, how to effectively regulate user network behavior and guide netizens to use the network in a healthy and safe manner is a technical problem that urgently needs to be solved. Summary of the invention

[0003] In view of this, the present invention proposes a user network behavior tracking method and system to solve the existing problems such as regulating user network behavior security, and promote the health, safety and traceability of user network behavior.

[0004] The technical solution of the present invention is implemented as follows: On the one hand, the present invention provides a user network behavior tracking system, which includes a network client, a network cloud server and a remote public security system cloud server; The network client includes a login request module, a screenshot module, an image recognition module, a keyword extraction module and an information processing module; the function of the login request module is that the user sends personal information verification to the network cloud server to confirm the legal identity; the function of the screenshot module is to obtain the user's screen image by screenshot; the function of the image recognition module is to convert the screen image into text; the function of the keyword extraction module is to extract keywords from the text; the information processing module identifies and records the name, time, and information interaction behavior of the user's visit to the website based on the keyword and sends it to the network cloud server, receives the network analysis report and network risk level provided by the network cloud server, and displays pop-up window prompts for high-risk network behaviors; The network cloud server includes an identity authentication module, a network analysis module, a risk determination module and a security warning module; the function of the identity authentication module is to receive the personal information sent by the network client for verification and compare it with the information stored in the network cloud server, uniquely identify the identity, generate an access token and authorize the network client; the function of the network analysis module is to receive detailed data of the user's use of the network sent by the network client, generate a network analysis report within a recent period of time and send it to the network client; the function of the risk determination module is to determine the network risk according to the network risk determination standard and send it to the network client; the function of the security warning module is to send warning information to the network client and the remote public security system cloud server respectively when the risk is determined to be high; The function of the remote public security system cloud server is to receive warning information sent by the network cloud server and store and verify relevant evidence.

[0005] Preferably, the personal information verification includes one or more combinations of password verification, question and answer verification, SMS verification, fingerprint feature verification, voiceprint feature verification, and video feature verification.

[0006] On the other hand, the present invention provides a method and system for tracking user network behavior, comprising the following steps: S1. The user uses the client to send a login request to the network cloud server; S2. The network cloud server verifies and confirms the user's unique client login request and authorizes the network client to take a screenshot in the background using the screenshot method; S3. The network client uses the image recognition method to identify the text in the image, uses the keyword extraction method to extract the keywords, identifies and records the name, time, and information interaction behavior of the visited website and sends them to the network cloud server; S4. The network cloud server receives network usage information of the user using different network clients at different times; S5. The network cloud server analyzes the category, duration, operation behavior, and sensitive keywords of the visited websites based on the user's network usage information records, and issues a network analysis report for the user in the recent period; S6. The network cloud server quantifies the user's recent network analysis report and determines the network addiction risk, network behavior risk and network security risk level respectively; S7. The network cloud server pushes reasonable network usage suggestions to the client used by the user according to the risk level; S8. When the risk level is high, the network cloud server will pop up a window to the user through the network client and send a warning message to the remote public security system cloud server; S9. The remote public security system cloud server stores and verifies relevant evidence.

[0007] Compared with the prior art, the user network behavior tracking method and system of the present invention have the following beneficial effects: (1) Directly obtain screen images through screenshots, convert images into text, extract keywords, identify and record the name, time, and information interaction behavior data of users visiting websites, replacing traditional cookie tracking, IP address tracking, ETag tracking, and log tracking methods; (2) Analyze the categories of visited websites, duration, operation behaviors and sensitive keywords, and issue user network analysis reports to achieve traceability of network behaviors; (3) Quantify online behavior and evaluate it from three aspects: online addiction, online behavior, and online security. Pop-up prompts will be displayed when high-risk online behavior occurs, and relevant evidence will be provided to the public security system for storage and verification to ensure the health and safety of online use. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0009] Figure 1 It is a structural diagram of the user network behavior tracking system of the present invention; Figure 2 The following is a flowchart of the user network behavior tracking method and system of the present invention. DETAILED DESCRIPTION

[0010] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Embodiment 1

[0011] like Figure 1 As shown, the user network behavior tracking system of the present invention includes a network client, a network cloud server and a remote public security system cloud server; The network client includes a login request module, a screenshot module, an image recognition module, a keyword extraction module and an information processing module; the function of the login request module is that the user sends personal information verification to the network cloud server to confirm the legal identity; the function of the screenshot module is to obtain the user's screen image by screenshot; the function of the image recognition module is to convert the screen image into text; the function of the keyword extraction module is to extract keywords from the text; the information processing module identifies and records the name, time, and information interaction behavior of the user's visit to the website based on the keyword and sends it to the network cloud server, receives the network analysis report and network risk level provided by the network cloud server, and displays pop-up window prompts for high-risk network behaviors; The network cloud server includes an identity authentication module, a network analysis module, a risk determination module and a security warning module; the function of the identity authentication module is to receive the personal information sent by the network client for verification and compare it with the information stored in the network cloud server, uniquely identify the identity, generate an access token and authorize the network client; the function of the network analysis module is to receive detailed data of the user's use of the network sent by the network client, generate a network analysis report within a recent period of time and send it to the network client; the function of the risk determination module is to determine the network risk according to the network risk determination standard and send it to the network client; the function of the security warning module is to send warning information to the network client and the remote public security system cloud server respectively when the risk is determined to be high; The function of the remote public security system cloud server is to receive warning information sent by the network cloud server and store and verify relevant evidence.

[0012] This system uses a network client, a network cloud server and a remote public security system cloud server to implement a user network behavior tracking system. The system network client uses screenshots to obtain user screen images, uses image recognition to convert images into text, extracts keywords, identifies and records information data of users visiting websites, and the network cloud server analyzes detailed data on users' network usage, issues a user network analysis report, and determines the network risk level from three aspects: network addiction, network behavior and network security. It pops up prompts for high-risk network behaviors and provides storage and verification of relevant evidence to the remote public security system cloud server to ensure the health, security and traceability of user network behavior. Through design, simulation and verification, modular products are formed, which can achieve rapid transplantation between different platforms and accelerate the product development process.

[0013] The personal information verification includes one or more combinations of password verification, question and answer verification, SMS verification, fingerprint feature verification, voiceprint feature verification, and video feature verification; The user network behavior tracking system in this embodiment adopts a network client, a network cloud server and a remote public security system cloud server to implement the user network behavior tracking system. The network client of the system adopts screenshots to obtain user screen images, uses image recognition to convert images into text, extracts keywords, identifies and records information data of users visiting websites, and the network cloud server analyzes detailed data of users' network usage, issues a user network analysis report, and determines the network risk level from three aspects: network addiction, network behavior and network security. It pops up prompts for high-risk network behaviors, and provides storage and verification of relevant evidence to the remote public security system cloud server to ensure the health, security and traceability of user network behavior. Through design, simulation and verification, modular products are formed, which can achieve rapid transplantation between different platforms and accelerate the product development process. Embodiment 2

[0014] A method for tracking user network behavior is provided, which uses the user network behavior tracking system as described in the first embodiment, and includes the following steps: S1. The user uses the client to send a login request to the network cloud server; S2. The network cloud server verifies and confirms the user's unique client login request and authorizes the network client to take a screenshot in the background using the screenshot method; S3. The network client uses the image recognition method to identify the text in the image, uses the keyword extraction method to extract the keywords, identifies and records the name, time, and information interaction behavior of the visited website and sends them to the network cloud server; S4. The network cloud server receives network usage information of the user using different network clients at different times; S5. The network cloud server analyzes the category, duration, operation behavior, and sensitive keywords of the visited websites based on the user's network usage information records, and issues a network analysis report for the user in the recent period; S6. The network cloud server quantifies the user's recent network analysis report and determines the network addiction risk, network behavior risk and network security risk level respectively; S7. The network cloud server pushes reasonable network usage suggestions to the client used by the user according to the risk level; S8. When the risk level is high, the network cloud server will pop up a window to the user through the network client and send a warning message to the remote public security system cloud server; S9. The remote public security system cloud server stores and verifies relevant evidence.

[0015] The screenshot method is to use the Screencap command after obtaining the root permission of the Android system or to use the GDI function, HOOK API function or DirectX of the Windows system to capture the current screen image; The image recognition method is a method for obtaining text in an image by using any combination of PSENet, PAN, MSR, DB text detection algorithms of OCR technology and CRNN, CTPN, Densenet-OCR, MORAN, PARSeq text recognition algorithms; The keyword extraction method is a method for obtaining keywords in text using a TF-IDF algorithm, a TextRank algorithm, an LDA algorithm, a Word2Vec method, or a deep learning method such as CNN, RNN, or BERT; The categories of the websites include comprehensive portal websites, business and financial websites, enterprise service websites, government agency websites, industry information websites, leisure and entertainment websites, education and scientific research websites, functional websites, communication websites and personal websites; The operations include posting messages, pictures, voice, video, liking, rewarding, sending red envelopes, paying fees and transferring money; The sensitive keywords include words and phrases that are frequently used in connection with illegal network behaviors; The network analysis report includes a list, statistics and analysis of the categories, duration, operation behaviors and sensitive keywords of users' website visits, and obtains the proportion of visit duration of each category of website, the frequency of each operation behavior and the frequency of each category of sensitive keywords.

[0016] The Internet addiction risk is calculated by calculating the proportion of the time spent on visiting leisure and entertainment websites to the total time spent on the Internet. If it exceeds 70%, it is considered high risk, if it is less than 30%, it is considered low risk, and the rest are medium risk; The network behavior risk is calculated based on the network behavior risk index formula Calculated, where N1 to N9 represent the frequency of 9 behaviors within 1 hour, namely, leaving messages, pictures, voice, video, likes, rewards, sending red envelopes, payment and transfer, and q1 to q9 represent the weights of 9 behaviors, namely, leaving messages, pictures, voice, video, likes, rewards, sending red envelopes, payment and transfer. If the network behavior risk index is in the range Judged as high risk, risk index is in the range The risk is determined as medium, and the rest of the intervals are determined as low risk; The network security risk level is calculated by summing the frequencies of sensitive keywords. If it exceeds 50 times / h, it is judged as high risk; if it is less than 10 times / h, it is judged as low risk; the rest are medium risk.

[0017] Furthermore, the comprehensive portal website is a website that provides various comprehensive Internet information resources, contains information in multiple fields, and has a high number of visits; The commercial and financial website is one of a B2B, B2C, C2C commodity transaction model or financial transaction model website; The leisure and entertainment website includes a website of movies, music, games, novels, short videos, dating and forums; The functional websites include search, navigation, translation and office websites; The communication exchange website includes a website such as email, instant messaging, and chat.

[0018] Among them, the Screencap command call is compiled using Java, the GDI function, HOOK API function or DirectX is compiled using C++, the PSENet, PAN, MSR, DB text detection algorithm, CRNN, CTPN, Densenet-OCR, MORAN, PARSeq text recognition algorithm, TF-IDF algorithm, TextRank algorithm, LDA algorithm, Word2Vec method or deep learning method CNN, RNN, BERT are compiled through Java and C++ at the same time and applied in the Android operating system or Windows operating system network client.

[0019] like Figure 2 As shown, the user uses the client to send a login request to the network cloud server. The network cloud server verifies and confirms the authorization of the network client background screenshot. The network client recognizes the text in the image, extracts keywords, recognizes and records the name and time of the visited website, and the information interaction behavior and sends it to the network cloud server. The network cloud server analyzes the user's network usage information records, issues a network analysis report, determines the network addiction risk, network behavior risk and network security risk level, and pops up a prompt to the user when the risk level is high. At the same time, it sends a warning message to the remote public security system cloud server to facilitate the remote public security system cloud server to store and verify relevant evidence.

[0020] The user network behavior tracking method and system in this embodiment are compiled using Java under the Android operating system and C++ under the Windows operating system. A modular design method is adopted, and a user network behavior tracking system is implemented using a network client, a network cloud server, and a remote public security system cloud server. The system network client uses a screenshot method to obtain a user screen image, uses an image recognition method to convert the image into text, extracts keywords, identifies and records information data of users visiting websites, and the network cloud server analyzes detailed data on users' network usage, issues a user network analysis report, and determines the network risk level from three aspects: network addiction, network behavior, and network security. A pop-up window prompts high-risk network behavior, and provides storage and verification of relevant evidence to the remote public security system cloud server to ensure the health, security, and traceability of user network behavior.

[0021] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for tracking user network behavior, characterized in that: The steps include: S1. The user uses the client to send a login request to the network cloud server; S2. The network cloud server verifies and confirms the user's unique client login request and authorizes the network client to take a screenshot in the background using the screenshot method; S3. The network client uses the image recognition method to identify the text in the image, uses the keyword extraction method to extract the keywords, identifies and records the name, time, and information interaction behavior of the visited website and sends them to the network cloud server; S4. The network cloud server receives network usage information of the user using different network clients at different times; S5. The network cloud server analyzes the category, duration, operation behavior, and sensitive keywords of the visited websites based on the user's network usage information records, and issues a network analysis report for the user in the recent period; S6. The network cloud server quantifies the user's recent network analysis report and determines the network addiction risk, network behavior risk and network security risk level respectively; S7. The network cloud server pushes reasonable network usage suggestions to the client used by the user according to the risk level; S8. When the risk level is high, the network cloud server will pop up a window to the user through the network client and send a warning message to the remote public security system cloud server; S9. The remote public security system cloud server stores and verifies relevant evidence.

2. The user network behavior tracking method according to claim 1, characterized in that: The step S2 specifically includes: The screenshot method is a method of using the Screencap command after obtaining root authority in the Android system or using the GDI function, HOOK API function or DirectX in the Windows system to capture the current screen image.

3. The user network behavior tracking method according to claim 1, characterized in that: The step S3 specifically includes: The image recognition method is a method for obtaining text in an image by using any combination of PSENet, PAN, MSR, DB text detection algorithms of OCR technology and CRNN, CTPN, Densenet-OCR, MORAN, PARSeq text recognition algorithms; The keyword extraction method is a method for obtaining keywords in text using a TF-IDF algorithm, a TextRank algorithm, an LDA algorithm, a Word2Vec method, or a deep learning method such as CNN, RNN, or BERT.

4. The user network behavior tracking method according to claim 1, characterized in that: The step S5 specifically includes: The categories of the websites include comprehensive portal websites, business and financial websites, enterprise service websites, government agency websites, industry information websites, leisure and entertainment websites, education and scientific research websites, functional websites, communication websites and personal websites; The operations include posting messages, pictures, voice, video, liking, rewarding, sending red envelopes, paying fees and transferring money; The sensitive keywords include words and phrases that are frequently used in connection with illegal network behaviors; The network analysis report includes a list, statistics and analysis of the categories, duration, operation behaviors and sensitive keywords of users' website visits, and obtains the proportion of visit duration of each category of website, the frequency of each operation behavior and the frequency of each category of sensitive keywords.

5. The user network behavior tracking method according to claim 1, characterized in that: The step S6 specifically includes: The Internet addiction risk is calculated by calculating the proportion of the time spent on visiting leisure and entertainment websites to the total time spent on the Internet. If it exceeds 70%, it is considered high risk, if it is less than 30%, it is considered low risk, and the rest are medium risk; The network behavior risk is calculated based on the network behavior risk index formula Calculated, where N1 to N9 represent the frequency of 9 behaviors within 1 hour, namely, leaving messages, pictures, voice, video, likes, rewards, sending red envelopes, payment and transfer, and q1 to q9 represent the weights of 9 behaviors, namely, leaving messages, pictures, voice, video, likes, rewards, sending red envelopes, payment and transfer. If the network behavior risk index is in the range Judged as high risk, risk index is in the range The risk is determined as medium, and the rest of the intervals are determined as low risk; The network security risk level is calculated by summing the frequencies of sensitive keywords. If it exceeds 50 times / h, it is judged as high risk; if it is less than 10 times / h, it is judged as low risk; the rest are medium risk.

6. The method for tracking user network behavior according to claim 4, characterized in that: The comprehensive portal website is a website that provides various comprehensive Internet information resources, contains information in multiple fields, and has a high number of visits; The commercial and financial website is one of a B2B, B2C, C2C commodity transaction model or financial transaction model website; The leisure and entertainment website includes a website of movies, music, games, novels, short videos, dating and forums; The functional websites include search, navigation, translation and office websites; The communication exchange website includes a website such as email, instant messaging, and chat.

7. A system for tracking user network behavior, which adopts the method according to any one of claims 1 to 6; characterized in that: Mainly includes network client, network cloud server and remote public security system cloud server; The network client includes a login request module, a screenshot module, a picture recognition module, a keyword extraction module and an information processing module; The function of the login request module is for users to send personal information verification to the network cloud server to confirm their legal identity; The function of the screenshot module is to obtain the user's screen image by taking a screenshot; the function of the image recognition module is to convert the screen image into text; the function of the keyword extraction module is to extract keywords from the text; The information processing module identifies and records the name, time, and information interaction behavior of the user's visited website based on keywords and sends them to the network cloud server, receives the network analysis report and network risk level provided by the network cloud server, and displays pop-up prompts for high-risk network behaviors; The network cloud server includes an identity authentication module, a network analysis module, a risk determination module and a security warning module; The function of the identity authentication module is to receive the personal information sent by the network client, compare it with the information stored in the network cloud server, uniquely authenticate the identity, generate an access token and authorize the network client; the function of the network analysis module is to receive the detailed data of the user's network usage sent by the network client, generate a network analysis report for the recent period of time and send it to the network client; The function of the risk determination module is to determine network risks according to the network risk determination criteria and send them to the network client; The function of the security warning module is to send warning information to the network client and the remote public security system cloud server respectively when the risk is judged to be high; The function of the remote public security system cloud server is to receive warning information sent by the network cloud server and store and verify relevant evidence.

8. The system for tracking user network behavior as claimed in claim 7, characterized in that: The personal information verification includes one or more combinations of password verification, question and answer verification, SMS verification, fingerprint feature verification, voiceprint feature verification, and video feature verification.

Images