A cloud platform-based abnormal login behavior monitoring method and system

Abstract

The application relates to an abnormal login behavior monitoring method and system based on a cloud platform, and relates to the technical field of cloud platforms, which comprises the following steps: collecting account information; obtaining a login address in response to the account information; calling a login display screen in response to the account information and the login address; collecting image detection information and sound detection information; defining the account information in the login display screen as marked account information; identifying a reference detection type in response to the marked account information, the image detection information and the sound detection information; obtaining an automatic operation instruction set through the marked account information and the reference detection type, and outputting a sharing instruction; collecting actual operation instructions; when the actual operation instructions are consistent with the sharing instruction, updating the actual operation instructions and outputting the automatic operation instruction set; and when the actual operation instructions are inconsistent with the automatic operation instruction set, outputting abnormal information. The application has the effect of improving the accuracy of cloud platform identification of abnormal login of an account.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud platform, and particularly relates to an abnormal login behavior monitoring method and system based on a cloud platform. BACKGROUND

[0002] The cloud platform refers to a comprehensive service platform based on cloud computing technology, which provides various computing resources and services through the Internet.

[0003] When a user uses the cloud platform for operation, it is usually necessary to log in to the user's own account for use, and the cloud platform will call out the address logged in by the user account from the system, and analyze and output the abnormal login of the user account by identifying the case that the user account is logged in from multiple different addresses in a short time or logged in at a time period other than the user's usual login time.

[0004] When the user uses the cloud platform for operation, when there are multiple screens connected to one address for operation, and there is one screen for multiple account login operation, it is not easy to identify whether the account exists abnormal login, which reduces the accuracy of the cloud platform in identifying abnormal login of the account. SUMMARY

[0005] In order to improve the accuracy of the cloud platform in identifying abnormal login of the account, the present application provides an abnormal login behavior monitoring method and system based on a cloud platform.

[0006] In the first aspect, the present application provides an abnormal login behavior monitoring method based on a cloud platform, which adopts the following technical scheme:

[0007] An abnormal login behavior monitoring method based on a cloud platform, comprising:

[0008] S1: collecting account information;

[0009] S2: responding to the account information to obtain a login address;

[0010] S3: responding to the account information and the login address to call a login display screen;

[0011] S4: when one login display screen exists multiple account information, collecting image detection information and sound detection information corresponding to the login display screen;

[0012] S5: defining the account information in the login display screen as marked account information;

[0013] S6: responding to the marked account information, the image detection information and the sound detection information to identify a reference detection type;

[0014] S7: obtaining an automatic operation instruction set by the marked account information and the reference detection type, and outputting a preset sharing instruction;

[0015] S8: collecting an actual operation instruction after the sharing instruction is outputted;

[0016] S9: when the actual operation instruction is consistent with the sharing instruction, updating the actual operation instruction and outputting the automatic operation instruction set;

[0017] S10: when the actual operation instruction is inconsistent with the automatic operation instruction set, outputting a preset abnormal information.

[0018] By adopting the above technical solution, the multiple accounts in one screen are analyzed to obtain the marked account information, the automatic operation instruction set is obtained by the image detection information and the sound detection information and the marked account information, and the actual operation instruction, the sharing instruction and the automatic operation instruction set are analyzed to output the abnormal information, so as to identify whether the user uses multiple accounts to perform teaching operation or help other users to perform account operation, and when the user switches the account to perform the same operation, the cloud platform can perform auxiliary indication operation, which facilitates the user to perform operation and identifies whether the user uses the account of other users to perform abnormal operation, thereby improving the accuracy of the cloud platform to identify the abnormal login of the account.

[0019] Optionally, the method for obtaining the automatic operation instruction set comprises:

[0020] S701: in response to the marked account information and the reference detection type, calling an account operation picture from the login display picture;

[0021] S702: in response to the continuous account operation picture, generating a continuous coincidence degree;

[0022] S703: taking the account operation picture with the continuous coincidence degree exceeding a preset reference coincidence degree as a continuous picture set;

[0023] S704: in response to the continuous picture set, obtaining a picture change feature and an instruction switching picture;

[0024] S705: in response to the picture change feature, generating an automatic operation instruction;

[0025] S706: in response to the continuous picture set, the instruction switching picture and the automatic operation instruction, obtaining an automatic operation instruction set.

[0026] Optionally, the method after obtaining the automatic operation instruction set further comprises:

[0027] S711: collecting an actual account screen when the actual operation instruction is consistent with the sharing instruction;

[0028] S712: outputting the automatic operation instruction set in response to the actual account screen;

[0029] S713: calling an instruction generation position in response to the automatic operation instruction set;

[0030] S714: obtaining a detection instruction position in response to the actual account screen, the marked account screen and the instruction generation position;

[0031] S715: obtaining an instruction deviation position in response to the actual account screen and the detection instruction position;

[0032] S716: obtaining an offset distance in response to the actual account screen, the marked account screen and the instruction deviation position;

[0033] S717: generating a drag instruction and a reset instruction through the offset distance and the actual account screen, and updating the automatic operation instruction set according to the drag instruction and the reset instruction.

[0034] Optionally, the method for obtaining the detection instruction position comprises:

[0035] S7141: calling a reference page parameter in response to the marked account information;

[0036] S7142: obtaining an actual page parameter through the actual account screen;

[0037] S7143: obtaining a deviation coefficient ratio in response to the reference page parameter and the actual page parameter;

[0038] S7144: obtaining a detection instruction position in response to the deviation coefficient ratio and the instruction generation position.

[0039] Optionally, the method after outputting the automatic operation instruction set comprises:

[0040] S721: generating an actual detection instruction in response to the actual operation instruction;

[0041] S722: obtaining an actual detection order in response to the actual detection instruction and a preset adjustment instruction category when the actual detection instruction contains the adjustment instruction category;

[0042] S723: calling an actual adjustment instruction of the adjustment instruction category from the actual detection order;

[0043] S724: retrieving an automatic instruction sequence from the automatic operation instruction set in response to the actual detection sequence;

[0044] S725: obtaining an actual change instruction in response to the actual detection sequence and the actual adjustment instruction;

[0045] S726: outputting preset abnormal information in response to the actual change instruction and the automatic instruction sequence.

[0046] Optionally, the method for outputting preset abnormal information comprises:

[0047] S7261: obtaining an automatic change instruction in response to the automatic instruction sequence and the actual change instruction;

[0048] S7262: obtaining a restoration instruction in response to the automatic change instruction and the continuous picture group;

[0049] S7263: updating the detection instruction position in response to the restoration instruction, the actual change instruction and the actual page parameter;

[0050] S7264: retrieving an actual instruction position from the actual detection instruction;

[0051] S7265: outputting preset abnormal information when the actual instruction position is inconsistent with the detection instruction position.

[0052] By using the above technical solution, the automatic change instruction and the restoration instruction are obtained by analyzing the instruction actually operated by the user and the sequence of instruction execution, and the new detection instruction position is obtained by the restoration instruction, the actual change instruction and the actual page parameter, and the abnormal information is output according to the consistency of the detection instruction position and the actual instruction position, so that the same operation when the user disturbs part of the instruction can be identified, and the accuracy of the cloud platform to identify abnormal login of the account is improved.

[0053] Optionally, the method further comprises:

[0054] S731: retrieving an operation instruction consistent with a preset text filling type from the automatic instruction type and defining the operation instruction as a text filling instruction;

[0055] S732: retrieving a text filling range in response to the text filling instruction and the continuous picture group;

[0056] S733: obtaining an interval query instruction in response to the text filling instruction and the text filling range;

[0057] S734: obtaining a mark query instruction in response to the text filling range and the interval query instruction;

[0058] S735: retrieving a mark query position from the mark query instruction;

[0059] S736: obtaining an actual text instruction in response to the actual detection instruction and the text filling range;

[0060] S737: outputting preset abnormal information when the actual text instruction is inconsistent with the mark query instruction.

[0061] Optionally, the method for obtaining the mark query instruction comprises:

[0062] S7341: obtaining filled text in response to the text filling range;

[0063] S7342: obtaining an actual filling range in response to the text filling range and the actual page parameter;

[0064] S7343: obtaining a reference query text in response to the filled text;

[0065] S7344: retrieving an actual query text in response to the actual filling range;

[0066] S7345: generating the mark query instruction in response to the actual query text and the interval query instruction when the actual query text is inconsistent with the reference query text.

[0067] By using the above technical solution, the text filling range and the query picture and the reference query text are obtained by analyzing the filled text and the continuous picture group, the actual query text is obtained by analyzing the text filling range and the actual page parameter, and the mark query instruction is generated according to the consistency of the actual query text and the reference query text, so that the content filled by the user for query can be obtained, and the mark query instruction is generated by analyzing the query instruction, so as to further identify the abnormal operation of the user existing other instructions.

[0068] Optionally, the method for identifying the reference detection type comprises:

[0069] S61: obtaining a reference person image and an account operation picture in response to the mark account information;

[0070] S62: obtaining an actual person image in response to the image detection information and a preset person feature;

[0071] S63: identifying a pointing direction in response to the image detection information when the actual person image is consistent with the reference person image.

[0072] S64: in response to the sound detection information and the actual person image to obtain a detection sound text;

[0073] S65: in response to the detection sound text and the account operation picture to obtain a coincidence text;

[0074] S66: in response to the pointing direction and the coincidence text to obtain a command generation time point and a pointing position;

[0075] S67: in response to the marked account information and the command generation time point to call the pointing position;

[0076] S68: when the pointing position and the command position are consistent, the marked account information is defined as the reference detection type.

[0077] In a second aspect, the application provides an abnormal login behavior monitoring system based on a cloud platform, which adopts the following technical scheme:

[0078] An abnormal login behavior monitoring system based on a cloud platform, comprising:

[0079] An acquisition module for acquiring account information;

[0080] A memory for storing a program of an abnormal login behavior monitoring method based on a cloud platform;

[0081] A processor for loading and executing and realizing the program stored in the memory.

[0082] In summary, the application includes at least one of the following beneficial technical effects:

[0083] 1. By analyzing the actual operation instruction, the sharing instruction and the automatic operation instruction group to output abnormal information, the cloud platform can assist in indicating operation when the user switches the account to perform the same operation, which facilitates the user to operate and identifies whether the user uses the account of other users to perform abnormal operation, thereby improving the accuracy of the cloud platform in identifying abnormal login of the account;

[0084] 2. By analyzing the restoration instruction, the actual change instruction and the actual page parameter to output abnormal information, the cloud platform can identify when the user disturbs part of the instruction to perform the same operation, thereby improving the accuracy of the cloud platform in identifying abnormal login of the account;

[0085] 3. By analyzing the filled text, the continuous picture group and the actual page parameter to obtain an actual query text, generating a marked query instruction according to the consistency of the actual query text and the reference query text, the content that the user must query can be obtained, and the query instruction is analyzed to generate a marked query instruction, thereby further identifying that the user exists abnormal operation of other instructions. BRIEF DESCRIPTION OF DRAWINGS

[0086] Figure 1 is a method flow chart of an abnormal login behavior monitoring method based on a cloud platform according to an embodiment of the present application;

[0087] Figure 2 is a method flow chart of a method for outputting preset abnormal information according to an embodiment of the present application;

[0088] Figure 3 is a method flow chart of a method after outputting the automatic operation instruction set according to an embodiment of the present application;

[0089] Figure 4 is a method flow chart of a method for obtaining the mark query instruction according to an embodiment of the present application. DETAILED DESCRIPTION

[0090] The present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0091] Referring to Figure 1 , the present application discloses an abnormal login behavior monitoring method based on a cloud platform, comprising the following steps:

[0092] S1: collecting account information.

[0093] The account information refers to the account information of a user logging into a cloud platform, which can be called from a system of the cloud platform.

[0094] S2: obtaining a login address in response to the account information.

[0095] The login address refers to an Internet protocol address for logging into the cloud platform account of the user, and the Internet protocol address corresponding to the account information is called from the system of the cloud platform as the login address.

[0096] S3: calling a login display screen in response to the account information and the login address.

[0097] The login display screen refers to the display screen of the screen used by the user to log into the cloud platform account, and the display screen of the screen is called from the system of the cloud platform with the account information and the login address.

[0098] In this embodiment, there are multiple screens for operation using one Internet protocol address, and the screen of each screen is used as the login display screen.

[0099] S4: when there are multiple account information for one login display screen, collecting image detection information and sound detection information corresponding to the login display screen.

[0100] The image detection information refers to the image of the user captured by the screen of the login display screen with multiple account information. The sound detection information refers to the sound collected by the screen corresponding to the image detection information.

[0101] When there are multiple account information in a login display screen, it indicates that there is a user using other user's account abnormally. The image detection information is the picture of the user captured by the camera on the screen, and the sound detection information is collected by the microphone on the screen.

[0102] S5: Defining the account information in the login display screen as the marked account information.

[0103] The marked account information refers to the account information in the login display screen.

[0104] S6: Identifying the reference detection type in response to the marked account information, the image detection information and the sound detection information.

[0105] The reference detection type refers to the type of teaching demonstration or user helping other users to operate the account, such as using other user's account to demonstrate the operation of file submission and file filling, or a user logging into other user's account to perform the operation of file submission and file filling.

[0106] The reference detection type is obtained by analyzing the marked account information, the image detection information and the sound detection information.

[0107] S7: Obtaining the automatic operation instruction set by the marked account information and the reference detection type, and outputting the preset sharing instruction.

[0108] The automatic operation instruction set refers to the instruction set assisted by the cloud platform to operate. The automatic operation instruction set is obtained by analyzing the marked account information and the reference detection type. In this embodiment, the automatic operation instruction set is a cursor point indicating the user to operate. The cursor point is marked with different functions corresponding to different instructions. The automatic operation instruction set is only the instruction set recorded when the operation is performed on one account.

[0109] The automatic operation instruction set contains different instructions, including copying and pasting by keyboard, searching by pressing enter key, mouse clicking, mouse clicking page dragging, etc. The instructions in the automatic operation instruction set exist in different categories. For example, when the page is dragged by mouse clicking, the position of the page on the screen or the size of the page changes, and the instruction of dragging the page by mouse clicking is the adjustment of the page category.

[0110] The instruction of clicking the dialog box to facilitate the user to input text is the text filling category.

[0111] The sharing instruction is an instruction set by a technician to allow automatic operation instruction output. For example, the mouse cursor stops for 3 seconds.

[0112] S8: Collect the actual operation instruction after the sharing instruction is output.

[0113] The actual operation instruction refers to the instruction output by the user after the sharing instruction is output. The instruction output by the user after the sharing instruction is output from the system of the cloud platform is taken as the actual operation instruction.

[0114] S9: When the actual operation instruction is consistent with the sharing instruction, update the actual operation instruction and output the automatic operation instruction set.

[0115] The abnormal information is information set by a technician in the art to prompt the operator that there is an abnormal login behavior of the account. When the actual operation instruction is inconsistent with the sharing instruction, it means that there is an abnormal behavior using the account of other users, and the abnormal information is output.

[0116] When the actual operation instruction is consistent with the sharing instruction, there is still a probability of abnormal behavior using the account of other users, so the actual operation instruction is collected again and the automatic operation instruction set is output.

[0117] S10: When the actual operation instruction is inconsistent with the automatic operation instruction set, output the preset abnormal information.

[0118] When the actual operation instruction collected again is inconsistent with the automatic operation instruction set, it means that there is an abnormal behavior using the account of other users, and the abnormal information is output.

[0119] The method for obtaining the automatic operation instruction set comprises:

[0120] S701: In response to the marked account information and the reference detection type, the account operation picture is called from the login display picture.

[0121] The account operation picture is a display picture for operating the marked account information of the reference detection type. The operation picture of the marked account information of the reference detection type is called from the login display picture as the account operation picture.

[0122] S702: In response to the continuous account operation picture to generate the continuous coincidence degree.

[0123] The continuous coincidence degree refers to the percentage of the coincidence of adjacent account operation pictures. The continuous coincidence degree is obtained by analyzing adjacent account operation pictures. The method for image analysis coincidence is well known to those skilled in the art, and will not be described here.

[0124] S703: The account operation picture with the continuous coincidence degree exceeding the preset reference coincidence degree is taken as the continuous picture set.

[0125] The reference coincidence degree is the minimum coincidence degree of the screen appearance picture change set by the technician. The continuous picture group refers to the picture combination of the screen without picture switching when the user outputs the instruction. The adjacent account operation pictures with the continuous coincidence degree exceeding the reference coincidence degree are integrated into the continuous picture group.

[0126] S704: obtaining the picture change feature in response to the continuous picture group and the instruction switching picture.

[0127] The picture change feature refers to the feature of the picture change in the continuous picture group. The picture change feature is obtained by analyzing the image at the position without coincidence in the continuous picture group. The picture change feature is the mouse cursor change, the text color change, or the image adding text feature.

[0128] The instruction switching picture refers to the two pictures of the picture switching when the user uses the marked account information and outputs the instruction. For example, one continuous picture group is selected as the marked picture group, and the adjacent picture group adjacent to the marked picture group is selected. If the adjacent picture group is arranged before the marked picture group, the last picture of the adjacent picture group and the first picture of the marked picture group are the instruction switching pictures.

[0129] S705: generating the automatic operation instruction in response to the picture change feature.

[0130] The automatic operation instruction refers to the instruction output by the user when the picture change occurs in the continuous picture group. The automatic operation instruction is obtained by analyzing the picture change feature. For example, when the mouse clicks the selected dialog box, the picture starts to add text, and then the position of the mouse click to select the dialog box and the instruction of the mouse click are taken as an automatic operation instruction. The instruction of the user using the keyboard to add text is not the automatic operation instruction.

[0131] S708: obtaining the automatic operation instruction group in response to the continuous picture group, the instruction switching picture, and the automatic operation instruction.

[0132] The switching instruction that makes the screen switch is obtained by analyzing the instruction switching picture, and the automatic operation instruction group is obtained by sorting the switching instruction and the automatic operation instruction. The output of the instruction by the change of the image is well known to the person skilled in the art, and is not described here. For example, when the user completes the text input in the search dialog box and clicks the enter key or the control mouse to search the picture change, the instruction of clicking the enter key or the control mouse to search is taken as the switching instruction.

[0133] In this embodiment, the automatic operation instruction group is only displayed when the picture displayed in the cloud platform, and the automatic operation instruction group is not displayed when the page is loaded or closed.

[0134] The method after obtaining the automatic operation instruction set further comprises:

[0135] S711: collecting an actual account screen when the actual operation instruction is consistent with the sharing instruction.

[0136] The actual account screen refers to a screen presented on the screen when the user outputs the automatic operation instruction set to assist operation. When the actual operation instruction is consistent with the sharing instruction, it indicates that the user needs to output the automatic operation instruction set to assist operation, and the actual account screen is retrieved from the system of the cloud platform.

[0137] S712: outputting the automatic operation instruction set in response to the actual account screen.

[0138] Referring to S9, the screen for recording the instruction by retrieving the marked account information from the automatic operation instruction set, and the cursor is output from the screen in the automatic operation instruction set whose coincidence degree with the actual account screen exceeds the reference coincidence degree. For example, the input interface of the account password exists in the screen for recording the instruction by the user, and the account has completed login when the user switches other accounts, and the page of the account that has completed login is retrieved from the automatic operation instruction set to output the cursor.

[0139] S713: retrieving the instruction generation position in response to the automatic operation instruction set.

[0140] The instruction generation position refers to the position coordinates of the output instruction of the automatic operation instruction set, and the coordinate position of the instruction output retrieved from the automatic operation instruction set is taken as the instruction generation position.

[0141] S714: obtaining the detection instruction position in response to the actual account screen, the marked account screen, and the instruction generation position.

[0142] The detection instruction position refers to the position of the automatic operation instruction set output in the actual account screen, and the detection instruction position is obtained by analyzing the actual account screen, the marked account screen, and the instruction generation position. In this embodiment, the actual account screen and the marked account screen refer to the display screen of the cloud platform on the screen.

[0143] S715: obtaining the instruction deviation position in response to the actual account screen and the detection instruction position.

[0144] The instruction deviation position refers to the detection instruction position that does not fall into the actual account screen, and the instruction deviation position is obtained by analyzing the falling condition of the detection instruction position in the actual account screen.

[0145] In the embodiment, the detection instruction position refers to the instruction position after the actual account picture appears the page size change, and the proportion change parameter of the page text in the actual account picture causes the detection instruction position to be unable to be located at the position points such as the dialog box and the search key of the search box. Therefore, the detection instruction position which is unable to be located at the dialog box and the search key of the search box is taken as the instruction deviation position.

[0146] S716: obtaining the offset distance in response to the actual account picture, the marked account picture and the instruction deviation position.

[0147] The offset distance refers to the distance of the text drag on the page of the actual account picture. The offset distance of the instruction deviation position is obtained by analyzing the positions of the overlapped texts in the actual account picture and the marked account picture.

[0148] In the embodiment, the positions of the dialog box and the search key of the search box are unchanged for the distance between the texts in the page when the cloud platform logs in using different accounts. The analysis method of the offset distance is well known to those skilled in the art, and is not described here.

[0149] S717: generating the drag instruction and the reset instruction by the offset distance and the actual account picture, and updating the automatic operation instruction group according to the drag instruction and the reset instruction.

[0150] The drag instruction refers to the instruction for controlling the text drag on the page of the actual account picture. The reset instruction refers to the instruction for resetting the actual account picture after the drag. The drag instruction and the reset instruction are obtained by analyzing the offset distance and the actual account picture, and are added to the automatic operation instruction group to obtain a new automatic operation instruction group.

[0151] In the embodiment, when the page is reduced and the text proportion is unchanged, the page hides part of the picture and a scroll bar appears on the page. The operation of long pressing and dragging the scroll bar to slide is the drag instruction or the reset instruction. The generation method of the drag instruction and the reset instruction is well known to those skilled in the art, and is not described here.

[0152] The method for obtaining the detection instruction position comprises:

[0153] S7141: calling the reference page parameter in response to the marked account information.

[0154] The reference page parameter refers to the page size of the cloud platform, the position of the page on the screen and the text size in the page in the marked account information. The reference page parameter is obtained by analyzing the picture of the marked account information. The picture analysis method of the reference page parameter is well known to those skilled in the art, and is not described here.

[0155] S7142: obtaining actual page parameters through the actual account page.

[0156] The actual page parameters refer to the page size of the cloud platform, the position of the page on the screen, and the size of the text in the page in the actual account page. Refer to S7141 to obtain the actual page parameters through the actual account page, which is not described herein.

[0157] S7143: obtaining a deviation coefficient ratio in response to the reference page parameters and the actual page parameters.

[0158] The deviation coefficient ratio refers to the position change ratio of the instructions in the reference page parameters in the actual page parameters. The deviation coefficient ratio is obtained by analyzing the reference page parameters and the actual page parameters. The analysis method of the deviation coefficient ratio is known to those skilled in the art, which is not described herein.

[0159] S7144: obtaining a detected instruction position in response to the deviation coefficient ratio and the instruction generation position.

[0160] The instruction position obtained by adjusting the instruction generation position by the deviation coefficient ratio is the detected instruction position.

[0161] The method after outputting the automatic operation instruction set includes:

[0162] S721: generating an actual detected instruction in response to the actual operation instruction.

[0163] The actual detected instruction refers to the actual operation instruction that does not cause the cloud platform page to appear screen switching. The actual operation instruction that does not cause the cloud platform page to appear screen switching is obtained from the actual operation instruction as the actual detected instruction by analyzing the screen continuity of the cloud platform page.

[0164] S722: obtaining an actual detection order in response to the actual detected instruction and the adjustment instruction category when the adjustment instruction category appears in the actual detected instruction.

[0165] The adjustment instruction category is the instruction for adjusting the page set by the user.

[0166] The actual detection order refers to the order of outputting the actual detected instruction containing the adjustment instruction category. When the adjustment instruction category appears in the actual detected instruction, it means that the user adjusts the page size of the cloud platform after the cloud platform outputs the automatic operation instruction set. Therefore, the order of outputting the actual detected instruction containing the adjustment instruction category is taken as the actual detection order. In this embodiment, the cloud platform page does not appear screen switching when the actual detection order is output.

[0167] S723: obtaining an actual adjustment instruction of the adjustment instruction category from the actual detection order.

[0168] The actual adjustment instruction refers to an actual detection instruction for adjusting a page in the actual detection sequence.

[0169] S724: In response to the actual detection sequence, an automatic instruction sequence is called from the automatic operation instruction group.

[0170] The automatic instruction sequence refers to an execution sequence of the automatic operation instruction consistent with the screen executed by the actual detection sequence, and the execution sequence of the automatic operation instruction called from the automatic operation instruction group in response to the actual detection sequence is taken as the automatic instruction sequence.

[0171] S725: In response to the actual detection sequence and the actual adjustment instruction, an actual change instruction is obtained.

[0172] The actual change instruction refers to an actual detection instruction required to adjust the page size after the actual adjustment instruction, and the actual detection instruction after the actual adjustment instruction in the actual detection sequence is taken as the actual change instruction.

[0173] S726: In response to the actual change instruction and the automatic instruction sequence, preset abnormal information is output.

[0174] The abnormal information is output by analyzing the actual change instruction and the automatic instruction sequence.

[0175] Referring to Figure 2 , the method for outputting preset abnormal information comprises:

[0176] S7261: In response to the automatic instruction sequence and the actual change instruction, an automatic change instruction is obtained.

[0177] The automatic change instruction refers to an automatic operation instruction for assisting the output of the actual change instruction in the automatic instruction sequence, and the automatic operation instruction for assisting the output of the actual change instruction is taken from the automatic instruction sequence as the automatic change instruction.

[0178] S7262: In response to the automatic change instruction and the continuous screen group, a restoration instruction is obtained.

[0179] The reference page refers to a page set by a technician consistent with the screen size. The restoration instruction refers to an automatic operation instruction for restoring the cursor display on the reference page, and the change parameter of the page corresponding to the automatic change instruction is called from the continuous screen group, and then the instruction position of the automatic change instruction is updated by the change parameter to form the restoration instruction.

[0180] S7263: In response to the restoration instruction, the actual change instruction, and the actual page parameter, the detection instruction position is updated.

[0181] The actual proportion is obtained by analyzing the page parameters of the actual page and the reference page, and then the new detection instruction position is obtained by analyzing the instruction parameters of the actual proportion, the restoration instruction and the actual change instruction. The analysis method of page and instruction position is well known to those skilled in the art, and will not be repeated here.

[0182] Referring to the examples of S7261, S7262 and S7263, the automatic instruction sequence is 1, 2, 3 and 4. 2 is the instruction of page change, and 3 and 4 are automatic change instructions. The actual detection sequence is 1, 3, 21 and 4, and 4 is the actual change instruction.

[0183] 3 and 4 in the automatic instruction sequence pass through the page parameters of 2 to obtain the restoration instructions 31 and 41. Then the actual detection sequence should be 1, 31, 21 and 4, and since 4 is changed by the page parameters of 21, the page change parameters of 2 and 21 are inconsistent, then 41 passes through 21 again to obtain 42, and the actual detection sequence in the new detection instruction position is 1, 31, 21 and 42.

[0184] S7264: The actual instruction position is retrieved from the actual detection instruction.

[0185] The actual instruction position refers to the instruction position of the actual detection instruction, and the actual instruction position is retrieved from the actual detection instruction.

[0186] S7265: When the actual instruction position is inconsistent with the detection instruction position, output the preset abnormal information.

[0187] When the actual instruction position is inconsistent with the detection instruction position, it indicates that there is a situation of logging in the account of other users to perform abnormal operations, and then the abnormal information is output.

[0188] Referring to Figure 3 , the method of outputting the automatic operation instruction group further comprises:

[0189] S731: The operation instruction consistent with the preset text filling category is retrieved from the automatic instruction category and defined as the text filling instruction.

[0190] The text filling category is the category of operation instructions for the user to input text set by the technical personnel. The text filling instruction refers to the automatic instruction category of the user to input text, and the operation instruction consistent with the text filling category is retrieved from the automatic instruction category and defined as the text filling instruction.

[0191] S732: The text filling range is retrieved in response to the text filling instruction and the continuous picture group.

[0192] The text filling range refers to a range in which a text filling instruction in the cloud platform outputs text. The text filling range is obtained by analyzing a continuous picture group to obtain a frame selection range in which text changes, and a frame selection range in which a position of the text filling instruction is located is called as the text filling range.

[0193] S733: obtaining an interval query instruction in response to the text filling instruction and the text filling range.

[0194] The interval query instruction refers to an instruction for content query when a user fills in text. The interval query instruction is obtained by analyzing the text filling instruction and the text filling range. For example, when a user fills in text in the text filling range, instructions such as opening other pages, scrolling pages, selecting pages, and copying and pasting to the text filling range are all interval query instructions.

[0195] S734: obtaining a mark query instruction in response to the text filling range and the interval query instruction.

[0196] The mark query instruction refers to an instruction for which a user needs to query. The mark query instruction is obtained by analyzing the text filling range and the interval query instruction. For example, when a device name and a device model need to be filled in the text filling range, the user fills in the device name and then queries the device model corresponding to the device name in a device data table. The device data table is a table type preset by a technical personnel.

[0197] S735: calling a mark query position from the mark query instruction.

[0198] The mark query position refers to a position of the mark query instruction. The mark query position is called from the mark query instruction.

[0199] S736: obtaining an actual text instruction in response to the actual detection instruction and the text filling range.

[0200] The actual text instruction refers to an instruction output by a user when filling in text in the text filling range. The actual text instruction is obtained by calling an instruction output by the user when filling in text in the text filling range from the actual detection instruction.

[0201] S737: outputting a preset abnormal information when the actual text instruction is inconsistent with the mark query instruction.

[0202] When the actual text instruction is inconsistent with the mark query instruction, it indicates that there is an abnormal operation of logging in an account of another user, and the abnormal information is output.

[0203] Referring to Figure 4 , the method for obtaining the mark query instruction comprises:

[0204] S7341: obtaining the filled-in text in response to the text filling range.

[0205] The filled-in text refers to the text filled in by the user in the text filling range. The filled-in text is obtained by analyzing the screen of the text filling range. In this embodiment, the filled-in text is the text filled in by the user in the text filling range.

[0206] S7342: obtaining the actual filling range in response to the text filling range and the actual page parameter.

[0207] The actual filling range refers to the range of the filled-in text in the actual page parameter. The actual filling range is obtained by analyzing the screen of the actual page parameter and taking the text filling range in the screen as the actual filling range.

[0208] S7343: obtaining the reference query text in response to the filled-in text.

[0209] The reference query text refers to the text that needs to be queried. The reference query text is obtained by performing text matching analysis on the filled-in text. For example, the name of the device or the name of the company is taken as the reference query text.

[0210] S7344: obtaining the actual query text in response to the actual filling range.

[0211] The actual query text refers to the text filled in by the user in the actual filling range. The actual query text is obtained by analyzing the screen of the actual filling range.

[0212] S7345: generating the marked query instruction in response to the actual query text and the interval query instruction when the actual query text is inconsistent with the reference query text.

[0213] When the actual query text is inconsistent with the reference query text, it means that the name of the device or the name of the enterprise is inconsistent, and it is necessary to re-perform table lookup. Therefore, the instruction for finding the actual query text in the table from the interval query instruction is taken as the marked query instruction. In this embodiment, when the table is queried by the marked query instruction, if the table needs to be scrolled, the marked query instruction needs to be scrolled until the actual query text appears in the table.

[0214] The method for identifying the reference detection type comprises:

[0215] S61: obtaining the reference figure image and the account operation screen in response to the marked account information.

[0216] The reference figure image refers to the figure image bound by the marked account information. The figure image bound by the marked account information is obtained from the system of the cloud platform as the reference figure image.

[0217] S62: obtaining an actual person image in response to the image detection information and the preset person feature.

[0218] The person feature is a shape and color feature of a person set by a technician. The actual person image refers to a person image in the image detection information, which is obtained by framing the image corresponding to the person feature in the image detection information as the actual person image.

[0219] S63: identifying a pointing direction in response to the image detection information when the actual person image is consistent with the reference person image.

[0220] When the actual person image is inconsistent with the reference person image, it indicates that the user logs in the account of the other user and the other user is not beside the user, and then abnormal information is output.

[0221] The pointing direction refers to a direction of a hand of the person pointing to the screen. When the actual person image is consistent with the reference person image, it indicates that the user logs in the account of the other user and the other user is not beside the user, and then the hand in the image detection information is identified to obtain a direction of the hand facing the screen. The method of identifying the pointing direction by the image is well known to those skilled in the art, and is not described here.

[0222] S64: obtaining a detected sound text in response to the sound detection information and the actual person image.

[0223] The detected sound text refers to a sound text of the person in the actual person image, which is obtained by calling the sound at the position of the person in the actual person image from the sound detection information and converting the sound into a text to obtain the detected sound text. The positioning of the sound, the identification of the position of the person in the image, and the conversion of the sound text are well known to those skilled in the art, and are not described here.

[0224] S65: obtaining a coincident text in response to the detected sound text and the account operation screen.

[0225] The coincident text refers to a text that appears in the content of the detected sound text and the account operation screen. The time point output by the detected sound text is identified, and the operation text of the screen corresponding to the time point of the account operation screen is called to obtain the coincident text.

[0226] S66: obtaining a command generation time point and a pointing position in response to the pointing direction and the coincident text.

[0227] The instruction generation time point refers to a time point of the instruction direction to the overlapped text, and the instruction position refers to a position of the instruction direction to the overlapped text in the account operation screen. The instruction generation time point is generated by analyzing the image of the instruction direction, and the time point of the image and the time point of the overlapped text in S65 are used as the instruction generation time point. The position of the finger pointing to the screen is obtained by analyzing the instruction direction, and the position of the overlapped text is obtained from the account operation screen, and the two position points are used as the instruction position.

[0228] S67: The instruction position is obtained by calling the instruction of the marked account information and the instruction generation time point from the system of the cloud platform.

[0229] The instruction position refers to the instruction position of the marked account information generated at the instruction generation time point, and the position of the instruction of the marked account information and the instruction generation time point is obtained from the system of the cloud platform as the instruction position. The reference deviation time is a maximum deviation time length value set by the technician for the generation of the instruction position. In this embodiment, there is a time deviation when the finger points to the screen and then the mouse cursor is moved to the position point of the finger pointing to the screen, so the instruction generation time point is expanded by the preset reference deviation time, and the instruction position within the reference deviation time is the instruction position.

[0230] S68: When the instruction position and the instruction position are consistent, the marked account information is defined as the reference detection type.

[0231] When the instruction position and the instruction position are consistent, it means that the user is instructed by other users to operate the cloud platform, and the marked account information is defined as the reference detection type.

[0232] Based on the same inventive concept, the embodiment of the present application provides an abnormal login behavior monitoring system based on a cloud platform, comprising:

[0233] The acquisition module is used to acquire account information, account information, image detection information, sound detection information, actual operation instruction and actual account screen.

[0234] The memory is used to store the program of the abnormal login behavior monitoring method based on the cloud platform.

[0235] The processor is used to load and execute and realize the program stored in the memory.

[0236] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is exemplified, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0237] The above is only the preferred embodiment of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical solutions falling within the concept of the present application shall fall within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application shall also be considered as the protection scope of the present application.

Claims

1. A cloud platform-based abnormal login behavior monitoring method, characterized in that, The method comprises the following steps: S1: collecting account information; S2: obtaining a login address in response to the account information; S3: calling a login display screen in response to the account information and the login address; S4: when there are multiple pieces of account information in one login display screen, collecting image detection information and sound detection information corresponding to the login display screen; S5: defining the account information in the login display screen as marked account information; S6: identifying a reference detection type in response to the marked account information, the image detection information, and the sound detection information; S7: obtaining an automatic operation instruction set through the marked account information and the reference detection type, and outputting a preset sharing instruction; S8: collecting an actual operation instruction after the sharing instruction is outputted; S9: when the actual operation instruction is consistent with the sharing instruction, re-collecting the actual operation instruction and outputting the automatic operation instruction set; S10: when the re-collected actual operation instruction is inconsistent with the automatic operation instruction set, outputting a preset abnormal information. 2.The cloud platform-based abnormal login behavior monitoring method of claim 1, wherein, The method for obtaining the automatic operation instruction set comprises the following steps: S701: calling an account operation screen from the login display screen in response to the marked account information and the reference detection type; S702: generating a continuous coincidence degree in response to continuous account operation screens; S703: taking the account operation screen with a continuous coincidence degree exceeding a preset reference coincidence degree as a continuous screen set; S704: obtaining a screen change feature and an instruction switching screen in response to the continuous screen set; S705: generating an automatic operation instruction in response to the screen change feature; S706: obtaining an automatic operation instruction set in response to the continuous screen set, the instruction switching screen, and the automatic operation instruction. 3.The cloud platform-based abnormal login behavior monitoring method of claim 2, wherein, The method after obtaining the automatic operation instruction set further comprises the following steps: S711: collecting an actual account screen when the actual operation instruction is consistent with the sharing instruction; S712: outputting the automatic operation instruction set in response to the actual account screen; S713: calling an instruction generation position in response to the automatic operation instruction set; S714: obtaining a detection instruction position in response to the actual account screen, the marked account information, and the instruction generation position; S715: obtaining an instruction deviation position in response to the actual account screen and the detection instruction position; S716: obtaining an offset distance in response to the actual account screen, the marked account information, and the instruction deviation position; S717: generating a drag instruction and a reset instruction through the offset distance and the actual account screen, and updating the automatic operation instruction set according to the drag instruction and the reset instruction. 4.The cloud platform-based abnormal login behavior monitoring method of claim 3, wherein, The method for obtaining the detection instruction position comprises the following steps: S7141: calling a reference page parameter in response to the marked account information; S7142: obtaining an actual page parameter through the actual account screen; S7143: obtaining a deviation coefficient ratio in response to the reference page parameter and the actual page parameter; S7144: in response to the deviation coefficient ratio and the instruction generation position to obtain a detection instruction position.

5. The method of claim 4, wherein the method further comprises: The method for outputting the automatic operation instruction set comprises: S721: in response to the actual operation instruction to generate an actual detection instruction; S722: when a preset adjustment instruction category appears in the actual detection instruction, in response to the actual detection instruction and the adjustment instruction category to obtain an actual detection sequence; S723: from the actual detection sequence, an actual adjustment instruction of the adjustment instruction category is called out; S724: in response to the actual detection sequence, an automatic instruction sequence is called out from the automatic operation instruction set; S725: in response to the actual detection sequence and the actual adjustment instruction to obtain an actual change instruction; S726: in response to the actual change instruction and the automatic instruction sequence to output preset abnormal information.

6. The method of claim 5, wherein the method further comprises: The method for outputting the preset abnormal information comprises: S7261: in response to the automatic instruction sequence and the actual change instruction to obtain an automatic change instruction; S7262: in response to the automatic change instruction and the continuous picture group to obtain a restoration instruction; S7263: in response to the restoration instruction, the actual change instruction and the actual page parameter to update the detection instruction position; S7264: from the actual detection instruction, an actual instruction position is called out; S7265: when the actual instruction position is inconsistent with the detection instruction position, preset abnormal information is outputted.

7. The method of claim 6, wherein the method further comprises: Further comprising: S731: from the automatic instruction category, an operation instruction consistent with a preset text filling category is called out and defined as a text filling instruction; S732: in response to the text filling instruction and the continuous picture group to call out a text filling range; S733: in response to the text filling instruction and the text filling range to obtain an interval query instruction; S734: in response to the text filling range and the interval query instruction to obtain a mark query instruction; S735: from the mark query instruction, a mark query position is called out; S736: in response to the actual detection instruction and the text filling range to obtain an actual text instruction; S737: when the actual text instruction is inconsistent with the mark query instruction, preset abnormal information is outputted. 8.The cloud platform-based abnormal login behavior monitoring method of claim 7, wherein, The method for obtaining the mark query instruction comprises: S7341: in response to the text filling range to obtain a filling text; S7342: in response to the text filling range and the actual page parameter to obtain an actual filling range; S7343: in response to the filling text to obtain a reference query text; S7344: in response to the actual filling range to call out an actual query text; S7345: when the actual query text is inconsistent with the reference query text, in response to the actual query text and the interval query instruction to generate the mark query instruction. 9.The method of claim 1, wherein, The method for identifying the reference detection type comprises: S61: in response to the mark account information to obtain a reference figure image and an account operation picture; S62: in response to the image detection information and a preset figure feature to obtain an actual figure image; S63: when the actual person image is consistent with the reference person image, responding to the image detection information to identify a pointing direction; S64: responding to the sound detection information and the actual person image to obtain a detected sound text; S65: responding to the detected sound text and the account operation screen to obtain a coincident text; S66: responding to the pointing direction and the coincident text to obtain an instruction generation time point and a pointing position; S67: responding to the marked account information and the instruction generation time point to call an instruction position; S68: when the pointing position is consistent with the instruction position, defining the marked account information as the reference detection type. 10.A cloud platform-based abnormal login behavior monitoring system, characterized in that, Comprise: an acquisition module, configured to acquire account information; a memory, configured to store a program of the abnormal login behavior monitoring method based on a cloud platform according to any one of claims 1 to 9; a processor, configured to load and execute the program stored in the memory.

Images