Alarm information generation method and device, computer device, readable storage medium and program product

Abstract

The application relates to an alarm information generation method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a plurality of screenshot images in a preset time period; when a target abnormal behavior event is monitored, identifying a target behavior scene type corresponding to the target abnormal behavior event; acquiring a first screenshot image from the plurality of screenshot images based on a screenshot strategy corresponding to the target behavior scene type, and acquiring a second screenshot image when a completion prediction condition corresponding to the target abnormal behavior event is reached; and generating alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image. The method can improve the monitoring efficiency and timeliness of data leakage.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating alarm information. Background Technology

[0002] With the rapid development of internet technology, data security has become an increasingly important concern. In scenarios with high data security requirements, it is necessary to monitor and manage the outgoing operations of sensitive data (such as files, images, videos, drawings, etc.).

[0003] Traditional technologies can analyze log data from terminal devices to determine if there are any leaks of sensitive data, thus effectively monitoring for data breaches. However, the log data analysis process is cumbersome and complex, resulting in poor timeliness of data breach monitoring. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the monitoring efficiency and timeliness of data leakage alarm information in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for generating alarm information, including:

[0006] Get multiple screenshots within a preset time period;

[0007] When an abnormal behavior event is detected, the target behavior scenario type corresponding to the abnormal behavior event is identified;

[0008] Based on the screenshot strategy corresponding to the target behavior scenario type, a first screenshot image is obtained from multiple screenshot images, and a second screenshot image is obtained when the completion prediction condition corresponding to the target abnormal behavior event is reached.

[0009] Based on the first screenshot image and the second screenshot image, an alarm message corresponding to the abnormal behavior event of the target is generated.

[0010] In one embodiment, when a target abnormal behavior event is detected, identifying the target behavior scenario type corresponding to the target abnormal behavior event includes:

[0011] When an abnormal behavior event of a target is detected, the target instruction type of the triggering instruction of the abnormal behavior event is determined;

[0012] Based on the pre-stored mapping relationship between instruction types and behavior scenario types, the target behavior scenario type corresponding to the target instruction type is determined.

[0013] In one embodiment, obtaining the first screenshot image from a plurality of screenshot images based on the screenshot strategy corresponding to the target behavior scenario type includes:

[0014] Identify at least one key time point corresponding to the target behavior scenario type;

[0015] Based on the screenshot time of each screenshot image, among the multiple screenshot images, a screenshot image whose screenshot time matches at least one of the target key times is determined as the first screenshot image.

[0016] In one embodiment, generating alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image includes:

[0017] Extract image features from the first screenshot image and the second screenshot image, and identify whether the target abnormal behavior event meets the established event conditions based on the image features;

[0018] If the target abnormal behavior event meets the established event conditions, then an alarm message corresponding to the target abnormal behavior event is generated.

[0019] In one embodiment, the method further includes:

[0020] If the target abnormal behavior event does not meet the established event conditions, then the target abnormal behavior event is discarded.

[0021] In one embodiment, generating alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image includes:

[0022] Determine the abnormal event type corresponding to the target abnormal behavior event, and determine the alarm rule corresponding to the abnormal event type;

[0023] Based on the alarm rules, the first screenshot image, and the second screenshot image, alarm information corresponding to the abnormal behavior event of the target is generated.

[0024] Secondly, this application also provides an alarm information generation apparatus, the apparatus comprising:

[0025] The first acquisition module is used to acquire multiple screenshot images within a preset time period;

[0026] The identification module is used to identify the target behavior scenario type corresponding to the target abnormal behavior event when the target abnormal behavior event is detected;

[0027] The second acquisition module is used to acquire a first screenshot image from multiple screenshot images based on the screenshot strategy corresponding to the target behavior scene type, and acquire a second screenshot image when the completion prediction condition corresponding to the target abnormal behavior event is reached.

[0028] The generation module is used to generate alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image.

[0029] In one embodiment, the identification module is specifically used for:

[0030] When an abnormal behavior event of a target is detected, the target instruction type of the triggering instruction of the abnormal behavior event is determined;

[0031] Based on the pre-stored mapping relationship between instruction types and behavior scenario types, the target behavior scenario type corresponding to the target instruction type is determined.

[0032] In one embodiment, the second acquisition module is specifically used for:

[0033] Identify at least one key time point corresponding to the target behavior scenario type;

[0034] Based on the screenshot time of each screenshot image, among the multiple screenshot images, a screenshot image whose screenshot time matches at least one of the target key times is determined as the first screenshot image.

[0035] In one embodiment, the generation module is specifically used for:

[0036] Extract image features from the first screenshot image and the second screenshot image, and identify whether the target abnormal behavior event meets the established event conditions based on the image features;

[0037] If the target abnormal behavior event meets the established event conditions, then an alarm message corresponding to the target abnormal behavior event is generated.

[0038] In one embodiment, the device further includes:

[0039] The discard module is used to discard the target abnormal behavior event if the target abnormal behavior event does not meet the established event conditions.

[0040] In one embodiment, the generation module is specifically used for:

[0041] Determine the abnormal event type corresponding to the target abnormal behavior event, and determine the alarm rule corresponding to the abnormal event type;

[0042] Based on the alarm rules, the first screenshot image, and the second screenshot image, alarm information corresponding to the abnormal behavior event of the target is generated.

[0043] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps of the first aspect described above.

[0044] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps of the first aspect described above.

[0045] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method steps of the first aspect described above.

[0046] The aforementioned alarm information generation method, apparatus, computer equipment, computer-readable storage medium, and computer program product can acquire multiple screenshot images within a preset time period. When a target abnormal behavior event is detected, the target behavior scenario type corresponding to the target abnormal behavior event is identified. Based on the screenshot strategy corresponding to the target behavior scenario type, a first screenshot image is acquired from the multiple screenshot images. When the completion prediction condition corresponding to the target abnormal behavior event is met, a second screenshot image is acquired. Based on the first and second screenshot images, alarm information corresponding to the target abnormal behavior event is generated. In this solution, abnormal behavior events can be automatically monitored and relevant screenshot images of the abnormal behavior events can be acquired, thereby generating alarm information based on the relevant screenshot images. There is no need to analyze log data, which improves the monitoring efficiency and timeliness of data leakage. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating a method for generating alarm information in one embodiment;

[0049] Figure 2 This is a flowchart illustrating an example of a method for generating alarm information in one embodiment;

[0050] Figure 3 This is a structural block diagram of an alarm information generation device in another embodiment;

[0051] Figure 4 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0053] This application provides a method for generating alarm information. This embodiment illustrates the method using a terminal as an example. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. It is understood that this method can be applied to any terminal with data processing capabilities, and this application is not limited to any particular terminal.

[0054] The method for generating alarm information provided in this application will be explained in detail below, with specific implementation details. For example... Figure 1 As shown, the method includes the following steps:

[0055] Step 102: Obtain multiple screenshots within a preset time period.

[0056] In this embodiment, the terminal can be pre-configured with applications that need to be monitored. During the operation of these applications, the terminal can monitor in real time whether preset abnormal behavior events occur within the applications. The terminal can also perform real-time screenshot processing of the currently displayed image at a preset frequency. For example, the terminal can start screenshot processing of the currently displayed image after the application starts. Then, the terminal can cache the screenshot images. Specifically, the terminal can use a cache queue to cache the screenshot images. In this way, the terminal can cache screenshot images within a preset time period.

[0057] Step 104: When an abnormal behavior event of the target is detected, identify the target behavior scenario type corresponding to the abnormal behavior event of the target.

[0058] In this embodiment, the terminal can monitor in real time whether a preset abnormal behavior event has occurred. The preset abnormal behavior event is an outward behavior event that may cause data leakage, such as outward transmission through a communication application or through cloud storage synchronization; this embodiment does not limit the scope. When the terminal detects a target abnormal behavior event, it can identify the target behavior scenario type corresponding to the event. The target behavior scenario type reflects the outward transmission method of the event. For example, the scenario type could be a copy-and-paste scenario, a dialog box outward transmission scenario, a drag-and-drop outward transmission scenario, or a cloud storage synchronization scenario.

[0059] Step 106: Based on the screenshot strategy corresponding to the target behavior scenario type, obtain the first screenshot image from multiple screenshot images, and obtain the second screenshot image when the completion prediction condition corresponding to the target abnormal behavior event is reached.

[0060] In this embodiment, the terminal may pre-store screenshot strategies. After determining the target behavior scenario type, the terminal can query the screenshot strategy corresponding to the target behavior scenario type, and then, based on the screenshot strategy, filter the first screenshot image from multiple screenshot images. When the completion prediction condition corresponding to the target abnormal behavior event is met, the second screenshot image is obtained. Optionally, when the target abnormal behavior event is detected, the terminal can determine the current time point and use the screenshot image obtained at the current time point as the first screenshot image. The terminal can also use the screenshot images of the target duration before the current time point as the first image, based on the current time point and the target duration corresponding to the target behavior scenario type. For example, the screenshot image at the current time point and the screenshot image 3 seconds before the current time point can be used as the first screenshot image. Optionally, the number of first screenshot images can be two.

[0061] The terminal can also store completion prediction conditions corresponding to abnormal behavior events, such as the predicted completion time for the abnormal behavior event. A screenshot image that reaches the predicted completion time after the current time point is used as the second screenshot image. The completion prediction condition can also be a time period. For example, a screenshot image within 3 to 10 seconds after the current time point can be used as the second screenshot image. Optionally, the second screenshot image can be one or more. If the second screenshot image is one, the terminal can randomly select one image from the screenshot images within that time period (e.g., 3 to 10 seconds) as the second screenshot image; or, the terminal can use the screenshot image obtained when the predicted completion time is reached as the second screenshot image. It is understood that the completion prediction condition can also be triggered by user behavior commands, which can be specifically set by technicians according to requirements, and this application embodiment does not limit this.

[0062] Step 108: Based on the first and second screenshot images, generate alarm information corresponding to the abnormal behavior event of the target.

[0063] In this embodiment of the application, the terminal can generate alarm information containing the first screenshot image and the second screenshot image based on the first screenshot image and the second screenshot image, as alarm information corresponding to the target abnormal behavior event.

[0064] This solution can acquire multiple screenshots within a preset time period. When a target abnormal behavior event is detected, the target behavior scenario type corresponding to the abnormal behavior event is identified. Based on the screenshot strategy corresponding to the target behavior scenario type, a first screenshot is acquired from the multiple screenshots. When the completion prediction condition corresponding to the target abnormal behavior event is met, a second screenshot is acquired. Based on the first and second screenshots, alarm information corresponding to the target abnormal behavior event is generated. In this way, abnormal behavior events can be automatically detected and relevant screenshots can be acquired, thereby generating alarm information based on the relevant screenshots. There is no need to analyze log data, which improves the monitoring efficiency and timeliness of data leakage.

[0065] Optionally, when a target abnormal behavior event is detected, the target behavior scenario type corresponding to the target abnormal behavior event is identified, including: when a target abnormal behavior event is detected, determining the target instruction type of the triggering instruction of the target abnormal behavior event; and determining the target behavior scenario type corresponding to the target instruction type based on the pre-stored mapping relationship between instruction types and behavior scenario types.

[0066] In this embodiment, the terminal can monitor abnormal target behavior events through a HOOK API (Application Programming Interface). Specifically, it can monitor the triggering command of the abnormal target behavior event through the HOOK API, and then determine the target command type corresponding to the triggering command. Then, the terminal can determine the target behavior scenario type corresponding to the target command type based on the pre-stored mapping relationship between command types and behavior scenario types. For example, when a copy command and a paste command are detected, the behavior scenario type can be determined to be a copy-paste scenario; when a dialog box opening command and a target object selection command are detected, the behavior scenario type can be determined to be a dialog box outbound scenario; and when a drag-and-drop command is detected, the behavior scenario type can be determined to be a drag-and-drop outbound scenario.

[0067] This solution can identify the target behavior scenario type corresponding to the target abnormal behavior event, and then adopt different strategies to obtain screenshot images for different target behavior scenario types, which can improve the effectiveness and accuracy of obtaining screenshot images, thereby improving the accuracy of identifying data leakage.

[0068] Optionally, based on the screenshot strategy corresponding to the target behavior scenario type, a first screenshot image is obtained from multiple screenshot images, including: determining at least one target key time corresponding to the target behavior scenario type; and, based on the screenshot time of each screenshot image, determining the screenshot image whose screenshot time matches at least one target key time from among the multiple screenshot images, and using it as the first screenshot image.

[0069] In this embodiment, different target behavior scenario types correspond to different target key times, and one target behavior scenario type can correspond to multiple target key times. The target key time is associated with the trigger command corresponding to the abnormal behavior event. The terminal can cache the screenshot time of each screenshot image. Then, the terminal can determine, based on the screenshot time of each screenshot image, the screenshot image whose screenshot time matches at least one target key time from among multiple screenshot images, and use it as the first screenshot image. In one example, when the target behavior scenario type is a copy-paste scenario, the monitoring time of the copy command and the monitoring time of the paste command are obtained as the first screenshot image. When the target behavior scenario type is a dialog box outbound scenario, the first screenshot image with a preset duration before the dialog box opening command and the first screenshot image with the monitoring time of the target object selection command are obtained. When the target behavior scenario type is a drag-and-drop outbound scenario, the first screenshot image with a preset duration before the drag command and the first screenshot image with the end time of the drag command are obtained.

[0070] This solution can acquire screenshots of different nodes for different behavioral scenarios, which can improve the effectiveness and accuracy of acquiring screenshots, thereby improving the accuracy of identifying data leaks.

[0071] Optionally, based on the first screenshot image and the second screenshot image, an alarm message corresponding to the target abnormal behavior event is generated, including: extracting image features from the first screenshot image and the second screenshot image, and identifying whether the target abnormal behavior event meets the established event conditions based on the image features; if the target abnormal behavior event meets the established event conditions, an alarm message corresponding to the target abnormal behavior event is generated.

[0072] In this embodiment, the terminal can perform image analysis on the first and second screenshots to obtain image features of the first and second screenshots. These image features reflect the content information contained in the screenshots. Algorithms or artificial intelligence models with image analysis capabilities can be applied to this embodiment, and this embodiment is not limited to any particular type. The terminal can identify whether a target abnormal behavior event meets the established event conditions based on the image features. Specifically, the terminal can input the image features into a pre-trained recognition model to obtain the recognition result. This recognition result can characterize whether the target abnormal behavior event meets the established event conditions, such as whether the data in the screenshot has been sent. If the target abnormal behavior event meets the established event conditions, an alarm message corresponding to the target abnormal behavior event is generated. Optionally, the terminal can also compare the image features of the first and second screenshots to determine whether the established event conditions are met based on the comparison result. For example, if the target file is not present in the communication window in the image features of the first screenshot, but the target file is present in the communication window in the image features of the second screenshot, then the established event conditions are met.

[0073] Optionally, the method further includes: discarding the target abnormal behavior event if it does not meet the established event conditions. For example, if a user accidentally withdraws or cancels the sending, the target abnormal behavior event is discarded.

[0074] In this solution, content recognition can be performed on screenshot images to determine whether data has actually been sent out. If it has, an alarm message is generated; if it has not, the abnormal behavior event is discarded, thereby reducing false alarms.

[0075] Optionally, based on the first and second screenshots, alarm information corresponding to the target abnormal behavior event is generated, including: determining the abnormal event type corresponding to the target abnormal behavior event and determining the alarm rule corresponding to the abnormal event type; generating alarm information corresponding to the target abnormal behavior event according to the alarm rule, the first and second screenshots.

[0076] In this embodiment, the terminal can determine the abnormal event type corresponding to the target abnormal behavior event based on the analysis results of the outgoing behavior. The analysis results of the outgoing behavior are obtained through image analysis of the first and second screenshot images. Specifically, the analysis results of the outgoing behavior can include at least one of the following: the outgoing method, the quantity of outgoing data, and the outgoing object. For example, the outgoing method can include, but is not limited to, sending via instant messaging applications, sending via web pages, and sending via cloud storage; the quantity of outgoing data can be the number of outgoing files or the total amount of outgoing data; the outgoing object can be a user, domain name, or IP address. In one example, the abnormal event type can include a large number of file outgoing events, instant messaging outgoing events (i.e., sending files to external users via a messaging application), and web page outgoing events (i.e., sending files to external domain names or IP addresses via web pages or cloud storage).

[0077] The terminal can determine the corresponding alarm rule for the abnormal event type of the target abnormal behavior event based on the pre-stored correspondence between abnormal event types and alarm rules. Alarm rules may include, but are not limited to, alarm templates, alarm methods, and alarm levels. The terminal can generate alarm information corresponding to the target abnormal behavior event based on the alarm rules, the first screenshot image, and the second screenshot image. For example, the terminal can generate alarm information based on the alarm template, the first screenshot image, and the second screenshot image, and output the alarm information based on the determined alarm method.

[0078] In this solution, different levels of alarm information can be generated based on different types of abnormal events, and different alarm methods can be used to improve the effectiveness and timeliness of alarms.

[0079] like Figure 2 As shown in the figure, this application embodiment provides an example of a method for generating alarm information, including the following steps:

[0080] Step 201: Cache screenshot images in real time.

[0081] Step 202: When an abnormal behavior event of the target is detected, identify the target behavior scenario type corresponding to the abnormal behavior event of the target.

[0082] Step 203: When the target behavior scenario type is copy and paste scenario, obtain the monitoring time of the copy instruction and the first screenshot image corresponding to the monitoring time of the paste instruction.

[0083] Step 204: When the target behavior scenario type is a dialog box outgoing scenario, obtain the first screenshot image of the preset duration before the dialog box opening command, and the first screenshot image corresponding to the monitoring time of the target object selection command.

[0084] Step 205: When the target behavior scenario type is drag-and-drop outbound scenario, obtain the first screenshot image with a preset duration before the drag command and the first screenshot image corresponding to the end time of the drag command.

[0085] Step 206: When the completion prediction condition corresponding to the target abnormal behavior event is met, obtain the second screenshot image.

[0086] Step 207: Extract image features from the first screenshot image and the second screenshot image.

[0087] Step 208: Determine whether the abnormal behavior event of the target meets the established event conditions based on image features.

[0088] If the target abnormal behavior event meets the established event conditions, then proceed to step 209; if the target abnormal behavior event does not meet the established event conditions, then proceed to step 210.

[0089] Step 209: Generate alarm information corresponding to the abnormal behavior event of the target.

[0090] Step 210: Discard the target abnormal behavior event.

[0091] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0092] Based on the same inventive concept, this application also provides an alarm information generation apparatus for implementing the alarm information generation method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations of the one or more alarm information generation apparatus embodiments provided below can be found in the limitations of the alarm information generation method described above, and will not be repeated here.

[0093] In one exemplary embodiment, such as Figure 3 As shown, an alarm information generation device is provided, comprising:

[0094] The first acquisition module 310 is used to acquire multiple screenshot images within a preset time period;

[0095] The identification module 320 is used to identify the target behavior scene type corresponding to the target abnormal behavior event when the target abnormal behavior event is detected;

[0096] The second acquisition module 330 is used to acquire a first screenshot image from multiple screenshot images based on the screenshot strategy corresponding to the target behavior scene type, and acquire a second screenshot image when the completion prediction condition corresponding to the target abnormal behavior event is reached.

[0097] The generation module 340 is used to generate alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image.

[0098] In one embodiment, the identification module 320 is specifically used for:

[0099] When an abnormal behavior event of a target is detected, the target instruction type of the triggering instruction of the abnormal behavior event is determined;

[0100] Based on the pre-stored mapping relationship between instruction types and behavior scenario types, the target behavior scenario type corresponding to the target instruction type is determined.

[0101] In one embodiment, the second acquisition module 330 is specifically used for:

[0102] Identify at least one key time point corresponding to the target behavior scenario type;

[0103] Based on the screenshot time of each screenshot image, among the multiple screenshot images, a screenshot image whose screenshot time matches at least one of the target key times is determined as the first screenshot image.

[0104] In one embodiment, the generation module 340 is specifically used for:

[0105] Extract image features from the first screenshot image and the second screenshot image, and identify whether the target abnormal behavior event meets the established event conditions based on the image features;

[0106] If the target abnormal behavior event meets the established event conditions, then an alarm message corresponding to the target abnormal behavior event is generated.

[0107] In one embodiment, the device further includes:

[0108] The discard module is used to discard the target abnormal behavior event if the target abnormal behavior event does not meet the established event conditions.

[0109] In one embodiment, the generation module 340 is specifically used for:

[0110] Determine the abnormal event type corresponding to the target abnormal behavior event, and determine the alarm rule corresponding to the abnormal event type;

[0111] Based on the alarm rules, the first screenshot image, and the second screenshot image, alarm information corresponding to the abnormal behavior event of the target is generated.

[0112] Each module in the alarm information generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0113] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a method for generating alarm information. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0114] Those skilled in the art will understand that Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0115] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the alarm information generation method described above.

[0116] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described alarm information generation method.

[0117] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the alarm information generation method described above.

[0118] It should be noted that the user information (including but not limited to user device identifiers, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0119] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0120] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0121] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating alarm information, characterized in that, The method includes: Get multiple screenshots within a preset time period; When a target abnormal behavior event is detected, the target behavior scenario type corresponding to the target abnormal behavior event is identified; the target abnormal behavior event is used to indicate an outward behavior event that causes data leakage; the target behavior scenario type is used to indicate the outward method corresponding to the target abnormal behavior event; Based on the screenshot strategy corresponding to the target behavior scenario type, a first screenshot image is obtained from multiple screenshot images, and a second screenshot image is obtained when the completion prediction condition corresponding to the target abnormal behavior event is reached. Based on the first screenshot image and the second screenshot image, generate alarm information corresponding to the abnormal behavior event of the target; Wherein, when a target abnormal behavior event is detected, identifying the target behavior scenario type corresponding to the target abnormal behavior event includes: When an abnormal behavior event of a target is detected, the target instruction type of the triggering instruction of the abnormal behavior event is determined; Based on the pre-stored mapping relationship between instruction types and behavior scenario types, the target behavior scenario type corresponding to the target instruction type is determined; The screenshot strategy based on the target behavior scenario type, which obtains the first screenshot image from multiple screenshot images, includes: Identify at least one key time point corresponding to the target behavior scenario type; Based on the screenshot time of each screenshot image, among the multiple screenshot images, a screenshot image whose screenshot time matches at least one of the target key times is determined as the first screenshot image.

2. The method according to claim 1, characterized in that, The step of generating alarm information corresponding to the abnormal behavior event of the target based on the first screenshot image and the second screenshot image includes: Extract image features from the first screenshot image and the second screenshot image, and identify whether the target abnormal behavior event meets the established event conditions based on the image features; If the target abnormal behavior event meets the established event conditions, then an alarm message corresponding to the target abnormal behavior event is generated.

3. The method according to claim 2, characterized in that, The method further includes: If the target abnormal behavior event does not meet the established event conditions, then the target abnormal behavior event is discarded.

4. The method according to claim 1, characterized in that, The step of generating alarm information corresponding to the abnormal behavior event of the target based on the first screenshot image and the second screenshot image includes: Determine the abnormal event type corresponding to the target abnormal behavior event, and determine the alarm rule corresponding to the abnormal event type; Based on the alarm rules, the first screenshot image, and the second screenshot image, alarm information corresponding to the abnormal behavior event of the target is generated.

5. An alarm information generation device, characterized in that, The device includes: The first acquisition module is used to acquire multiple screenshot images within a preset time period; The identification module is used to identify the target behavior scenario type corresponding to the detected target abnormal behavior event; the target abnormal behavior event is used to indicate an outward behavior event that causes data leakage; the target behavior scenario type is used to indicate the outward method corresponding to the target abnormal behavior event; wherein, identifying the target behavior scenario type corresponding to the detected target abnormal behavior event includes: when the target abnormal behavior event is detected, determining the target instruction type of the triggering instruction of the target abnormal behavior event; and determining the target behavior scenario type corresponding to the target instruction type according to a pre-stored mapping relationship between instruction types and behavior scenario types. The second acquisition module is used to acquire a first screenshot image from multiple screenshot images based on a screenshot strategy corresponding to the target behavior scene type, and to acquire a second screenshot image when the completion prediction condition corresponding to the target abnormal behavior event is met; wherein, acquiring the first screenshot image from multiple screenshot images based on the screenshot strategy corresponding to the target behavior scene type includes: determining at least one target key time corresponding to the target behavior scene type; and determining, based on the screenshot time of each screenshot image, a screenshot image whose screenshot time matches at least one target key time from multiple screenshot images, as the first screenshot image; The generation module is used to generate alarm information corresponding to the target abnormal behavior event based on the first screenshot image and the second screenshot image.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images