External event information processing method and device, computer device, storage medium and computer program product

Abstract

The application relates to an external event information processing method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: periodically determining whether a client device is in a working state and updating a working state duration; in the case that an external event is triggered, caching current running information, and generating a working state timestamp of the running information according to the current working state duration; generating to-be-processed information based on the running information, and processing the to-be-processed information; periodically traversing all the running information cached locally, and in the case that it is determined that the to-be-processed information corresponding to the current running information is successfully processed, determining whether to clean up the current running information based on the difference between the current working state duration and the working state timestamp. The method can reduce the probability that the running information cached locally is cleaned up by mistake.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a sending event information processing method and device, computer equipment, storage medium and computer program product. BACKGROUND

[0002] With the continuous improvement of informatization, enterprises and organizations are facing increasingly severe data leakage risks. Terminal equipment, as the main way of data sending, its security protection is particularly important. In related technologies, a data leakage prevention system with screenshot forensics function is usually used to record data sending behavior to provide basis for subsequent tracing and auditing.

[0003] In related technologies, in order to save local storage space, an expiration time is usually set for the locally saved forensic data, and the locally saved forensic data is cleaned up after the system time exceeds the expiration time. However, when the user intentionally powers off or disconnects the network connection after the data sending event occurs and the forensic data has not been reported, the system time may have exceeded the expiration time when the device is powered on or connected to the network again, resulting in that the forensic data is cleaned up before being reported, and the problem of forensic data loss exists. SUMMARY

[0004] Therefore, it is necessary to provide a sending event information processing method and device, computer equipment, storage medium and computer program product to solve the above technical problems.

[0005] In a first aspect, the present application provides a sending event information processing method. The method comprises:

[0006] periodically determining whether the client device is in a working state, and updating a working state duration based on whether the client device is in the working state;

[0007] in the case of triggering a sending event, caching current running information, and generating a working state timestamp of the running information according to the current working state duration;

[0008] generating to-be-processed information based on the running information, and processing the to-be-processed information;

[0009] periodically traversing all the running information cached locally, and in the case of determining that processing of to-be-processed information corresponding to current running information is successful, determining whether to clean up the current running information based on a difference between the current working state duration and the working state timestamp of the current running information.

[0010] In one of the embodiments, the method further comprises:

[0011] In a case where the client device is currently in an active state, the screenshot processing is performed to obtain a running screen image, and the running screen image is taken as the running information.

[0012] In one of the embodiments, the screenshot processing is performed to obtain a running screen image, and the running screen image is taken as the running information, including:

[0013] A preset screenshot mode and an alternative screenshot mode are determined based on device information of the client device.

[0014] In a case where the preset screenshot mode conflicts with an application currently running on the client device, a first target screenshot mode is determined from the alternative screenshot mode, and the running screen image is obtained by performing the screenshot processing in the first target screenshot mode.

[0015] In one of the embodiments, the method further includes:

[0016] In a case where the preset screenshot mode does not conflict with the application currently running on the client device, the screenshot processing is performed in the preset screenshot mode.

[0017] In a case where an error occurs in the screenshot processing in the preset screenshot mode, a second target screenshot mode is determined from the alternative screenshot mode, the running screen image is obtained by performing the screenshot processing in the second target screenshot mode, and the second target screenshot mode is set as the preset screenshot mode.

[0018] In a case where an active state of the client device changes, the preset screenshot mode is restored to an initial preset screenshot mode.

[0019] In one of the embodiments, the periodic determination of whether the client device is in an active state includes:

[0020] A first callback function and a second callback function are registered; the first callback function is used to be called when a screen power state changes, and outputs the current screen power state; the second callback function is used to be called when a login state changes, and outputs the current login state.

[0021] The periodic determination of whether the client device is in an active state is based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screensaver program is running.

[0022] In one of the embodiments, the determining whether the client device is in the working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screen saver process is running comprises:

[0023] In a case where the login state represents that the client device is in a remote login and screen-unlocked state, it is determined that the client device is in the working state.

[0024] In a case where the login state represents that the client device is in a local login and screen-unlocked state, if the screen power state represents that the screen of the client device is woken up, it is determined that the client device is in the working state.

[0025] In one of the embodiments, the processing the to-be-processed information comprises:

[0026] storing the to-be-processed information into a first database;

[0027] periodically traversing the to-be-processed information in the first database, and in a case where it is determined that the current to-be-processed information corresponds to a leakage event, moving the current to-be-processed information to a second database, or in a case where it is determined that the current to-be-processed information does not correspond to the leakage event, deleting the current to-be-processed information;

[0028] periodically traversing the to-be-processed information in the second database, and performing reporting processing on the traversed to-be-processed information.

[0029] In one of the embodiments, the method further comprises:

[0030] in a case where the to-be-processed information is successfully reported, deleting the to-be-processed information from the second database;

[0031] in a case where there is no to-be-processed information corresponding to the current running information in the first database and the second database, determining that the to-be-processed information corresponding to the current running information is successfully processed.

[0032] In a second aspect, the application further provides an external event information processing device. The device comprises:

[0033] a first determining module configured to periodically determine whether the client device is in the working state, and update a working state duration based on whether the client device is in the working state;

[0034] The generating module is configured to cache current running information in the case of triggering an outgoing event, and generate a working state timestamp of the running information according to a current working state duration;

[0035] The processing module is configured to generate to-be-processed information based on the running information, and process the to-be-processed information;

[0036] The cleaning module is configured to periodically traverse all the running information cached locally, and determine whether to clean current running information based on a difference between a current working state duration and the working state timestamp of the current running information in the case that the to-be-processed information corresponding to the current running information is processed successfully.

[0037] In one of the embodiments, the apparatus further includes:

[0038] The first screenshot module is configured to perform screenshot processing to obtain a running screenshot image in the case that the client device is currently in a working state, and take the running screenshot image as the running information.

[0039] In one of the embodiments, the screenshot module is further configured to:

[0040] determine a preset screenshot mode and an alternative screenshot mode based on device information of the client device;

[0041] In the case that the preset screenshot mode conflicts with an application currently running on the client device, determine a first target screenshot mode from the alternative screenshot mode, and perform screenshot processing by using the first target screenshot mode to obtain the running screenshot image.

[0042] In one of the embodiments, the apparatus further includes:

[0043] The second screenshot module is configured to perform screenshot processing by using the preset screenshot mode in the case that the preset screenshot mode does not conflict with the application currently running on the client device.

[0044] The third screenshot module is configured to determine a second target screenshot mode from the alternative screenshot mode in the case that an error occurs in the process of performing screenshot processing by using the preset screenshot mode, perform screenshot processing by using the second target screenshot mode to obtain the running screenshot image, and set the second target screenshot mode as the preset screenshot mode.

[0045] The restoring module is configured to restore the preset screenshot mode to an initial preset screenshot mode in the case that the working state of the client device changes.

[0046] In one of the embodiments, the first determining module is further configured to:

[0047] register a first callback function and a second callback function; the first callback function is configured to be called when a screen power state changes and output the current screen power state; the second callback function is configured to be called when a login state changes and output the current login state;

[0048] periodically determine whether the client device is in the working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screensaver program is running.

[0049] In one of the embodiments, the first determining module is further configured to:

[0050] determine that the client device is in the working state when the login state indicates that the client device is in a remote login and screen-unlocked state;

[0051] determine that the client device is in the working state when the login state indicates that the client device is in a local login and screen-unlocked state and the screen power state indicates that the screen of the client device is on.

[0052] In one of the embodiments, the processing module is further configured to:

[0053] store the to-be-processed information into a first database;

[0054] periodically traverse the to-be-processed information in the first database, and for the current to-be-processed information traversed, move the current to-be-processed information to a second database when it is determined that the external event corresponding to the current to-be-processed information is a leakage event, or delete the current to-be-processed information when it is determined that the external event corresponding to the current to-be-processed information is not the leakage event;

[0055] periodically traverse the to-be-processed information in the second database, and perform reporting processing on the to-be-processed information traversed.

[0056] In one of the embodiments, the apparatus further comprises:

[0057] a deleting module configured to delete the to-be-processed information from the second database when the to-be-processed information is successfully reported;

[0058] a second determining module configured to determine that the to-be-processed information corresponding to the current running information is successfully processed when the to-be-processed information corresponding to the current running information does not exist in the first database and the second database.

[0059] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements any of the above methods when executing the computer program.

[0060] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program implements any of the above methods when executed by a processor.

[0061] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program implements any of the above methods when executed by a processor.

[0062] The above-mentioned external event information processing method, device, computer device, storage medium and computer program product determine a working state duration for indicating a total duration of the client device in a working state, and set a working state timestamp for the running information as evidence collection according to the working state duration when triggering the external event. When the client device determines whether to clean up the locally cached running information, the working state duration and the working state timestamp of the running information are used to determine whether the running information is expired, and the running information is cleaned up when it is determined that the running information is expired and the to-be-processed information corresponding to the running information has been successfully processed. Since the actual time of the client device in the working state is used to determine whether the running information is expired, the present application embodiment can correctly calculate whether the running information is expired for the scenario that the user turns off the machine immediately after triggering the external event, thereby avoiding the case that the client device automatically cleans up the local running information to cause the evidence to be lost when the user turns on the machine after a long interval. Moreover, the present application embodiment determines whether the to-be-processed information corresponding to the running information has been successfully processed when cleaning up the expired running information, so that the present application embodiment can also preserve the running information when it is verified that the to-be-processed information has not been successfully processed due to network reasons for the scenario that the user disconnects the network connection immediately after triggering the external event. The probability of losing the evidence when the data is not successfully reported in the data external scenario can be reduced. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 A flowchart of an external event information processing method in an embodiment is shown;

[0064] Figure 2 A flowchart of acquiring running information in an embodiment is shown;

[0065] Figure 3 A flowchart of determining a preset screenshot mode in an embodiment is shown;

[0066] Figure 4A flowchart of a method for determining a processing manner according to an error returned according to a screenshot in an embodiment;

[0067] Figure 5 A flowchart of a method for determining whether a client device is in an active state according to a registration function in an embodiment;

[0068] Figure 6 A flowchart of a method for determining whether a client device is in an active state according to different information returned by a function in an embodiment;

[0069] Figure 7 A flowchart of a method for processing pending information in an embodiment;

[0070] Figure 8 A flowchart of a method for determining whether to clean local cache running information in an embodiment;

[0071] Figure 9 A schematic diagram of an event information processing system in an embodiment;

[0072] Figure 10 A block diagram of an event information processing apparatus in an embodiment;

[0073] Figure 11 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0074] To make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0075] In an embodiment, as shown in Figure 1 , an event information processing method is provided. In this embodiment, the method is applied to a client device that involves privacy and needs to monitor whether a user is performing an outgoing operation on the device. The client device can be a server or a terminal. In this embodiment, the method includes the following steps:

[0076] In step 102, it is periodically determined whether the client device is in an active state, and the duration of the active state is updated based on whether the client device is in the active state.

[0077] In the embodiments of the present application, the client device can determine whether it is in an active state according to its own screen information, whether it has received an input from an external device, etc. The screen information is used to represent the current state of the display device of the client device, such as being turned off, being woken up, being locked, etc.

[0078] The embodiments of the present application do not limit what information the screen information includes, and how the client device determines whether it is in the working state according to the screen information. For example, the client device can take a screenshot, take the screenshot image as the screen information, and perform image recognition on the screen information. When it is identified that the screenshot image is a screen saver program or a login interface, it is determined that the client device is in the non-working state. Or when it is identified that the screenshot image is an application interface, it is determined that the client device is in the working state. Alternatively, the client device can also register a callback function, and use the callback function to receive a notification message when the screen state changes. Then the notification message can be taken as the screen information, and whether the client device is in the working state can be determined based on the content of the notification message.

[0079] The client device can further update the working state duration recorded at present based on whether it is in the working state. The working state duration refers to the total length of time during which the client device is in the working state from an initial time to the present time. The initial time can be the time when the client device starts or the time when the client device starts to monitor the external events.

[0080] If the client device is in the working state, the client device can add the length of a period to the current working state duration to obtain an updated working state duration. If the client device is in the non-working state, it means that the client device may have entered the non-working state at some time during the last period and the present period. In order to make the working state duration as much as possible not to include the time when the client device is actually in the non-working state, the current working state duration can not be changed in this case.

[0081] When updating the working state duration, whether the client device was in the working state in the last period can also be referred to. If the client device is in the non-working state in the present period, the client device does not change the current working state duration regardless of the state of the client device in the last period. If the client device is in the working state in the present period and was also in the working state in the last period, it can be considered that the client device may have entered the non-working state between the two periods, and the time when the client device entered the non-working state can be relatively short. Therefore, in this case, the client device can add the length of a period to the current working state duration to obtain an updated working state duration. If the client device is in the working state in the present period and was in the non-working state in the last period, it means that the client device may have entered the working state at some time during the last period and the present period. Similarly to the reason why the client device is in the non-working state in the present period, the current working state duration can not be changed in this case.

[0082] In step 104, the running information of the cache client device is cached in the case of triggering the external event, and a working state timestamp of the running information is generated according to the current working state duration.

[0083] In the embodiment of the application, the external event can be any event representing that the user may have the intention to externally leak the confidential data, for example: the user performs the operation of copying, printing, sending through the network and the like on the file with the confidential mark in the client device; the user performs the operation of screen capture or screen recording on the client device when the application currently running in the client device includes the application for displaying the file with the confidential mark; the confidential data is identified in the data sent by the user through the network by means of keyword matching, data classification and the like. The specific events included in the external event can be set by the person skilled in the art according to the actual demand, and the embodiment of the application does not make a specific limitation.

[0084] In the case of triggering the external event, the client device caches the current running information of itself. The running information can include the application currently running in the client device, the data transmitted by the client device on the network, the content currently displayed on the screen of the client device and the like, and the embodiment of the application does not make a limitation.

[0085] The client device can further generate the working state timestamp of the cached running information according to the current recorded working state duration, and the working state timestamp can be used for judging whether the cached running information is expired or not.

[0086] In step 106, the running information is used to generate the to-be-processed information, and the to-be-processed information is processed.

[0087] In the embodiment of the application, the to-be-processed information is the information generated by further processing such as screening, integrating, marking and the like on the running information, and the client device or the server can judge whether the external event is the leakage event causing the substantial leakage based on the to-be-processed information. The embodiment of the application does not make a limitation on how to judge whether the external event is the leakage event based on the to-be-processed information, for example, the classification model capable of classifying the to-be-processed information can be trained, and whether the external event is the leakage event can be judged according to the output of the classification model, or whether the external event is the leakage event can also be judged according to the rule matching and the like.

[0088] In one embodiment, the client device can determine whether to provide the screenshot of the client device in the to-be-processed information based on the working state, and the determination specifically includes:

[0089] In the case that the client device is currently in the working state, the running screen image is obtained by performing the screen capture processing, and the running screen image is taken as the running information.

[0090] In the embodiments of the present application, after triggering the outgoing event, the client device acquires its own state. If the client device is in the non-working state, the screen capture cannot acquire valid information, and instead, can affect the judgment of whether the outgoing event is a leakage event, and also can occupy the local cache of the client device. Therefore, in the case that the client device is in the non-working state, the running information can not include the running screen image. If the client device is in the working state, the client device can perform screen capture to acquire the running screen image, and include the running screen image as one of the contents of the running information.

[0091] If the client device can locally judge whether the outgoing event is a leakage event, processing the to-be-processed information means that the client device judges whether the outgoing event is a leakage event based on the to-be-processed information, sends the to-be-processed information to the server or the database for storage when the outgoing event is a leakage event, or deletes the to-be-processed information when the outgoing event is not a leakage event. If the client device needs to send the to-be-processed information to the server, and then judges whether the outgoing event is a leakage event, processing the to-be-processed information means that the client device sends the to-be-processed information to the server.

[0092] In step 108, all the running information in the local cache is periodically traversed, and for the current running information traversed, it is determined whether to clean up the current running information based on the difference between the current working state duration and the working state timestamp of the current running information, in the case that the to-be-processed information corresponding to the current running information is processed successfully.

[0093] In the embodiments of the present application, the client device periodically traverses the running information in the local cache. If the client device determines that the to-be-processed information corresponding to the current running information (hereinafter referred to as current running information) traversed currently is processed successfully, the client device further judges whether the running information is expired, and cleans up the running information when the running information is expired, or preserves the running information when the running information is not expired. If the client device judges that the to-be-processed information corresponding to the running information is not processed successfully, the client device can re-execute step 106 to re-process the to-be-processed information.

[0094] The embodiments of the present application do not limit how the client device determines whether the to-be-processed information is successfully processed. For example, the client device can add a processing success identifier to the running information after the to-be-processed information is successfully processed, and determine whether the to-be-processed information is successfully processed by checking whether the current running information has the processing success identifier. Wherein, when the client device processes the to-be-processed information locally, the to-be-processed information being successfully processed means that the client device successfully identifies whether the outgoing event is a leakage event, and receives the response message from the server for the received leakage event when it is identified that the outgoing event is a leakage event; when the server processes the to-be-processed information, the to-be-processed information being successfully processed means that the client device receives the response message from the server for the received to-be-processed information.

[0095] Alternatively, the client device can also communicate with the server regularly to determine which to-be-processed information or leakage event reported by the client device is received by the server, and compare these information with the to-be-processed information or leakage event sent by the client device to the server to determine which to-be-processed information or leakage event sent by the client device successfully reaches the server (i.e., successfully processed) and which to-be-processed information or leakage event sent by the client device does not reach the server (i.e., unsuccessfully processed).

[0096] If the client device determines that the to-be-processed information is successfully processed, the client device clears the running information after the running information cached locally expires to save storage space. Whether the running information expires is determined according to the difference between the current working state duration and the working state timestamp of the current running information, for example, when the difference between the current working state duration and the current running information is greater than a certain preset threshold, it is determined that the running information expires.

[0097] If the client device determines that the to-be-processed information is not successfully processed, the client device can generate the to-be-processed information based on the running information again, and update the working state timestamp of the running information according to the current working state duration to prolong the expiration time of the running information.

[0098] The method for processing external event information provided in the embodiments of the present application determines a working state duration for indicating a total duration of the client device in a working state, and sets a working state timestamp for the running information collected as evidence according to the working state duration when the external event is triggered. When the client device determines whether to clean up the locally cached running information, the working state duration and the working state timestamp of the running information are used to determine whether the running information is expired, and the running information is cleaned up when it is determined that the running information is expired and the to-be-processed information corresponding to the running information has been successfully processed. Since the time when the client device is actually in the working state is used to determine whether the running information is expired in the embodiments of the present application, the embodiments of the present application can correctly determine whether the running information is expired for the scenario that the user turns off the machine immediately after triggering the external event, thereby avoiding the situation that the client device automatically cleans up the local running information to cause the loss of evidence when the user turns on the machine after a long interval. Moreover, the embodiments of the present application also determine whether the to-be-processed information corresponding to the running information has been successfully processed when the expired running information is cleaned up, so that the embodiments of the present application can also retain the running information when it is verified that the to-be-processed information has not been successfully processed due to network reasons for the scenario that the user disconnects the network connection immediately after triggering the external event. The probability of losing the evidence when the data is not successfully reported in the data external scenario can be reduced.

[0099] In one embodiment, as shown in FIG. 2, the method for processing external event information comprises the following steps. Figure 2 As shown in FIG. 2, the method for processing external event information comprises the following steps.

[0100] In step 202, the preset screenshot mode and the alternative screenshot mode are determined based on the device information of the client device.

[0101] In step 204, the first target screenshot mode is determined from the alternative screenshot mode in the case that the preset screenshot mode conflicts with the currently running application of the client device, and the running screen image is obtained by performing the screenshot processing by using the first target screenshot mode.

[0102] In the embodiments of the present application, the client device can determine the screenshot mode matched with the client device according to the device information. The preset screenshot mode is the screenshot mode with the highest matching degree with the client device, and the alternative screenshot mode is the screenshot mode available in the client device. The device information can include but is not limited to the operating system version of the client device, the graphics card model used, the graphics card driver version, etc.

[0103] In one embodiment, as shown in FIG. 2, the preset screenshot mode is determined based on the device information of the client device, comprising the following steps. Figure 3

[0104] ​In the case that the graphics card model of the client device is not NVIDIA, or the operating system version of the client device is not a version later than Windows 8.1, the GDI (Graphics Device Interface) screenshot is taken as the preset screenshot mode;

[0105] In the case that the graphics card model of the client device is NVIDIA, and the operating system version of the client device is a version later than Windows 8.1, the DXGI (DirectX Graphics Infrastructure) screenshot is taken as the preset screenshot mode.

[0106] Among them, the GDI has strong compatibility and supports the client device with a lower operating system version. The image quality of the DXGI screenshot is better, so the DXGI screenshot can be preferentially used in the case that the operating system and the graphics card support the DXGI screenshot. In addition to the GDI and the DXGI, the running screen image can also be obtained through other third-party tools or other interfaces of the operating system, and the embodiments of the present application do not limit which screenshot modes are included in the preset screenshot mode.

[0107] The client device can determine whether the preset screenshot mode may conflict with the application currently running in the client device based on the conflict relationship between the preconfigured application and the screenshot mode. If the preset screenshot mode conflicts with the currently running application, the client device can replace the preset screenshot mode with a first target screenshot mode in the alternative screenshot mode, which is explicitly recorded as not conflicting with each application or at least is recorded as having a conflict relationship with each application, and take a running screen image by using the first target screenshot mode.

[0108] If no error is generated when the first target screenshot mode is used to take a screenshot, the client device can record that the first target screenshot mode does not explicitly have a conflict relationship with each application currently running, that is, the conflict application white list is updated. If an error is generated when the first target screenshot mode is used to take a screenshot, the client device correspondingly records that the first target screenshot mode may have a conflict relationship with each application currently running, that is, the conflict application black list is updated.

[0109] If the preset screenshot mode does not conflict with the currently running application, the method further includes: performing the screenshot processing by using the preset screenshot mode; in a case where an error occurs during the screenshot processing by using the preset screenshot mode, determining a second target screenshot mode from the alternative screenshot modes, performing the screenshot processing by using the second target screenshot mode to obtain the running screen image, and setting the second target screenshot mode as the preset screenshot mode; and in a case where a working state of the client device changes, restoring the preset screenshot mode to the initial preset screenshot mode.

[0110] In the embodiments of the present application, as shown in FIG. 1, when the screenshot processing is performed by using the preset screenshot mode, the client device monitors whether an error occurs. If an error occurs, the client device can determine a second target screenshot mode from the alternative screenshot modes according to the foregoing manner of selecting the first target screenshot mode from the alternative screenshot modes. Moreover, the client device can set the second target screenshot mode as the preset screenshot mode of the client device to avoid the error from occurring again during the subsequent screenshot processing. Figure 4

[0111] In one embodiment, the client device can determine whether the preset screenshot mode needs to be replaced or other processing manners need to be used according to an error code when the error occurs, including:

[0112] In a case where the error code represents that the error is an expected error, the component performing the screenshot is reinitialized and initialized;

[0113] In a case where the error code represents that the error is an unexpected error, a second target screenshot mode is determined from the alternative screenshot modes.

[0114] If the error is an expected error, the error of the screenshot may not be caused by the conflict between the screenshot mode and the currently running application, and the client device can preferentially attempt to restart the screenshot component to solve the problem of the error of the screenshot. If the error is an unexpected error, the preset screenshot mode can be replaced.

[0115] The client device can also restore the preset screenshot mode to the initially determined preset screenshot mode (i.e., the initial preset screenshot mode) at an appropriate time. The time can be a change in the working state of the client device, where the change in the working state can include that the user restarts the client device, the user logs in to the operating system again, the user restarts the application for performing the external event information processing method, and the like.

[0116] ​The external event information processing method provided in the embodiments of the present application automatically selects a suitable preset screenshot mode for screenshot according to the device information of the client device, maintains the conflict relationship between the screenshot mode and the application, automatically switches to another screenshot mode to complete the screenshot when the preset screenshot mode and the application conflict, and switches the preset screenshot mode when the preset screenshot mode screenshot fails, which can realize the adaptation to various operation environments and improve the stability of the screenshot.

[0117] In one embodiment, as shown in Figure 5 The method comprises periodically determining whether the client device is in a working state, comprising:

[0118] In step 502, the first callback function and the second callback function are registered. The first callback function is used to be called when the screen power state changes and output the current screen power state. The second callback function is used to be called when the login state changes and output the current login state.

[0119] In step 504, the client device is periodically determined to be in a working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether the screensaver program is running.

[0120] In the embodiments of the present application, the client device can register the first callback function and the second callback function in the operating system to receive notifications of screen power state changes and login state changes. When the client device executes the external event information processing method, it can create an invisible window in the operating system for receiving notification messages. The first callback function will send a notification message to the invisible window when the screen triggers wake-up and triggers extinguishing, and the second callback function will send a notification message to the invisible window when the operating system triggers login, logout, remote login, remote logout, lock screen, and unlock screen of the user session.

[0121] The client device can also obtain the name of the screensaver process and determine whether the screensaver program is running by checking whether the screensaver process exists in the process list. In the Windows system, if the screensaver process exists in the process list, it is further determined that the parent process of the screensaver process is winlogon (a process responsible for user login and logout operations) to determine that the screensaver program is running. For other operating systems, those skilled in the art can also set the conditions for determining whether the screensaver program is running according to actual needs.

[0122] The client device can determine that the client device is in a working state when the screen triggers wake-up, the screen triggers unlocking, and the operating system triggers login or remote login of the user session. When the screen triggers extinguishing, the screen triggers locking, the screensaver program is running, and the operating system triggers logout or remote logout of the user session, it is determined that the client device is in a non-working state.

[0123] Alternatively, the client device can also make finer distinctions and determinations for the login and remote login states, including the following:

[0124] In the case that the login state represents that the client device is in remote login and screen unlocked state, it is determined that the client device is in working state;

[0125] In the case that the login state represents that the client device is in local login and screen unlocked state, if the screen power state represents that the screen of the client device is on, it is determined that the client device is in working state.

[0126] In the embodiments of the present application, if the client device is in remote login state, the client device does not need to pay attention to the screen on and off, and can determine that the client device is in working state in the case that the screen is unlocked and the user is logged in. If the client device is in local login state, the client device needs to determine that the client device is in working state only when the combination of screen on, screen unlocked and user logged in is met.

[0127] The flow chart for determining whether the client device is in working state can be seen in FIG. 1, and the standards for determining whether the client device is in working state or non-working state for different login states are as follows: Figure 6

[0128] For the client device in local login state:

[0129] (1) screen off or locked represents non-working state;

[0130] (2) screen on and unlocked represents working state;

[0131] (3) remote login triggered, and screen unlocked represents working state, and there is no need to pay attention to screen on and off messages.

[0132] (4) screen saver running represents non-working state.

[0133] For the client device with RDP session (Remote Desktop Protocol):

[0134] (1) ignore screen on and off messages;

[0135] (2) screen unlocked represents working state;

[0136] (3) screen locked represents non-working state;

[0137] (4) remote login triggered, and screen unlocked represents working state;

[0138] ​(5) the screen saver program running indicates a non-working state.

[0139] The method for processing outgoing event information provided in the embodiments of the present application determines whether the client device is in a working state based on the screen power state and the login state, and can distinguish between local login and remote login scenarios, thereby improving the accuracy of working state determination.

[0140] In one embodiment, as shown in FIG. 7, the to-be-processed information is processed, including: Figure 7

[0141] At step 702, the to-be-processed information is stored in the first database.

[0142] At step 704, the to-be-processed information in the first database is periodically traversed, and for the current to-be-processed information traversed, the current to-be-processed information is moved to the second database in a case where it is determined that the outgoing event corresponding to the current to-be-processed information is a leakage event, or the current to-be-processed information is deleted in a case where it is determined that the outgoing event corresponding to the current to-be-processed information is not a leakage event.

[0143] At step 706, the to-be-processed information in the second database is periodically traversed, and the to-be-processed information traversed is reported.

[0144] In the embodiments of the present application, when the client device processes the to-be-processed information, the to-be-processed information can be first stored in the first database disposed outside the client device. The client device can periodically traverse the first database and determine whether the outgoing event is a leakage event based on the to-be-processed information.

[0145] If the client device determines that the outgoing event is a leakage event, the client device moves the to-be-processed information to the second database. If the client device determines that the outgoing event is not a leakage event, the client device deletes the to-be-processed information from the first database.

[0146] The client device can further periodically traverse the second database and report the to-be-processed information still existing in the second database. After the client device receives the reporting success message returned by the server, the corresponding to-be-processed information in the second database is deleted.

[0147] In one embodiment, the above method further includes: deleting the to-be-processed information from the second database in a case where the to-be-processed information is reported successfully; and determining that the to-be-processed information corresponding to the current running information is processed successfully in a case where the to-be-processed information corresponding to the current running information does not exist in the first database and the second database.

[0148] ​In this embodiment, when the client device periodically checks whether the local running information has expired, it can determine whether the pending information has been successfully processed based on whether there is pending information corresponding to the running information in the first database and the second database. Since the client device removes the pending information from the first database after determining whether the outgoing event is a leakage event based on the pending information, and removes the pending information from the second database after reporting the leakage event, the client device can determine that the pending information has been successfully processed when there is no pending information in either the first or second database.

[0149] like Figure 8 The diagram illustrates a flowchart of a client device determining whether to clear cached runtime information. When traversing runtime information, the client device first obtains the current working state duration. Then, based on the difference between the working state duration and the working state timestamp, it determines the cache duration of the runtime information. The client device can obtain a cache duration threshold from the server. If the cache duration of the runtime information is lower than the threshold, the client device does not clear the runtime information. Otherwise, the client device further determines whether the pending information corresponding to the runtime information is in the first or second database. If the pending information corresponding to the runtime information is in either database, the client device does not clear the runtime information; otherwise, the client device clears the runtime information and records the clearing operation in the runtime log.

[0150] In one embodiment, such as Figure 9 As shown, an external event information processing system is provided, including a work status perception module, a management module, and a screenshot module, wherein...

[0151] The working status awareness module is used to periodically determine whether the client device is in a working state, and update the working status duration based on whether the client device is in a working state.

[0152] The management module is used to send a screenshot request to the screenshot module when an external event is triggered.

[0153] The screenshot module is used to obtain whether the client device is in a working state from the working state perception module, and when the client device is currently in a working state, it performs screenshot processing to obtain the running screen image and sends the running screen image to the management module, or when the client device is currently in a non-working state, it does not perform screenshot processing and sends a notification message to the management module.

[0154] The management module is used to generate current running information based on the running screen image and / or the running status of the client device, encrypt and cache the running information, obtain the current working status duration from the working status perception module, and generate a working status timestamp of the running information based on the current working status duration.

[0155] The management module is further configured to generate to-be-processed information based on the running information, and store the to-be-processed information to the first database, periodically traverse the first database to determine whether the external event corresponding to the to-be-processed information is a leakage event, move the to-be-processed information corresponding to the leakage event to the second database, and periodically traverse the second database to perform reporting processing on the to-be-processed information in the second database.

[0156] The management module is further configured to periodically traverse the locally cached running information, and in a case where the to-be-processed information corresponding to the current running information does not exist in the first database and the second database, determine that the to-be-processed information corresponding to the current running information is successfully processed, and determine whether to clean up the current running information based on a difference between a current working state duration and a working state time stamp of the current running information.

[0157] The working state awareness module determines the working state duration in the following manner: in a case where the client device is in a non-working state, the working state duration is paused from being updated; in a case where the client device is in a working state, an incremental time between a current time and a last time of counting is calculated, and the incremental time is added to the last working state duration; if the client device is in a non-working state at the last time of counting and is in a working state at the current time, a switching time is recorded as a new last time of counting.

[0158] By the above technical solutions, the problems of evidence saving reliability, system adaptability, device state recognition, network connection instability and local cache evidence timeliness management in the prior art can be solved, and specifically:

[0159] (1) solving the problem of evidence saving reliability

[0160] The present application maintains a special database to track the processing status of each external event in real time, ensuring that the integrity of the evidence is maintained even in the case of system restart or shutdown.

[0161] Specifically, when the user suddenly shuts down or restarts while the external event occurs and the forensic data has not been completed, the client device can persistently store the to-be-processed information that has not been completed in the database, and automatically continue to process these unfinished tasks after the client device is restored. This mechanism ensures that even in the case of a system restart after a batch of sensitive files are externally sent by email by enterprise users in a short period of time, complete forensic data can still be retained, effectively tracing the entire process of the leakage behavior.

[0162] (2) improving system adaptability

[0163] The screenshot module significantly improves the adaptability of the system through the conflict application adaptation sub-module, the graphics card adaptation sub-module, and the graphics exception tolerance sub-module.

[0164] The conflict application adaptation sub-module maintains a feature library of known conflict applications, monitors the running processes in the system in real time, and automatically switches to a non-conflict screenshot mode when a conflict application is detected. This solves the problem of desktop operation lag and screen flashing caused by conflicts between specific graphics processing software or video players and the screenshot mechanism, greatly improving the user experience.

[0165] The graphics card adaptation sub-module can automatically identify the type, model, and architecture characteristics of the graphics card in the system, and match the optimal screenshot mode according to the graphics card driver version. This enables the system to adapt to the differences in graphics cards of different terminal devices, ensuring stable operation in various hardware environments.

[0166] The graphics exception tolerance sub-module classifies and automatically switches to the optimal alternative screenshot mode by accurately parsing the error code returned by the screenshot API, further enhancing the stability of the system in complex environments.

[0167] (3) Recognize client device state

[0168] The work behavior perception module can intelligently recognize special states such as shutdown, restart, hibernate, sleep, screen saver, lock screen, screen off, and logout by registering callback functions. The system intelligently decides whether to perform a screenshot operation based on these state information, avoiding a large number of meaningless black screen, blue screen, or green screen screenshots.

[0169] Especially for RDP session scenarios, the system can distinguish between personal local login and devices with RDP sessions, and use different state judgment logic to ensure accurate judgment of user work state in various complex use scenarios, avoiding screenshot abnormalities caused by state recognition errors.

[0170] (4) Solve network connection instability problem

[0171] The reporting stage management function of the management module specially designs a network exception handling mechanism. When a node of the network device is unstable or disconnected, the system saves the event information to be reported in the database and continuously monitors the data reporting process to handle possible network exceptions.

[0172] Even if the user intentionally disconnects the network connection during the data transmission process and reconnects the network after a long time, the system can maintain the integrity of the forensic data, ensuring that the reporting process continues after the network is restored, avoiding the loss of key evidence.

[0173] (5) Improve local cache time effectiveness management

[0174] The application obtains the current working state duration of the user through a working behavior perception module instead of simply relying on system time. The system calculates the difference between the working state duration and the working state timestamp to obtain the storage duration of the cached data in the working state. This calculation method based on actual working time instead of system time can solve the cache management defects of traditional systems.

[0175] The traditional system only relies on system time to set a fixed cache expiration period. When the user triggers an outgoing event and then puts the device to sleep for a period of time (which can be a day or even a week) and then opens the machine again, the system time has passed a day or a week, causing the screenshot data to be cleaned up because it exceeds the preset cache retention time. The application accurately identifies that the actual working time is not long even if the device is put to sleep for a week and then restarted, thereby avoiding the false cleaning based on system time.

[0176] In addition, the system will confirm whether the to-be-processed information still exists in the database before performing the cleaning. Only when the cache duration exceeds the threshold and the to-be-processed information is not in the database, the system performs the safe cleaning process. This double-checking mechanism effectively avoids the competition between the cleaning logic and the reporting logic, ensures that important forensic data will not be automatically cleaned up by the system before reporting, thereby ensuring the integrity and effectiveness of the forensics.

[0177] It should be understood that, although each step in the flowchart involved in the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0178] Based on the same inventive concept, the application also provides an outgoing event information processing device for implementing the above-mentioned outgoing event information processing method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more outgoing event information processing device embodiments provided below can refer to the limitations of the outgoing event information processing method in the above text, which will not be repeated here.

[0179] In one embodiment, as Figure 10As shown, an outgoing event information processing apparatus 1000 is provided, comprising a first determination module 1002, a generation module 1004, a processing module 1006, and a cleaning module 1008, wherein:

[0180] The first determination module 1002 is configured to periodically determine whether the client device is in an active state, and update an active state duration based on whether the client device is in the active state;

[0181] The generation module 1004 is configured to, in the case of triggering an outgoing event, cache current running information, and generate an active state timestamp of the running information according to the current active state duration;

[0182] The processing module 1006 is configured to generate to-be-processed information based on the running information, and process the to-be-processed information;

[0183] The cleaning module 1008 is configured to periodically traverse all the running information cached locally, and in the case of determining that processing of to-be-processed information corresponding to current running information is successful, determine whether to clean up the current running information based on a difference between the current active state duration and the active state timestamp of the current running information.

[0184] In one of the embodiments, the apparatus further comprises:

[0185] A first screenshot module is configured to, in the case of the client device being currently in an active state, perform screenshot processing to obtain a running screenshot image, and take the running screenshot image as the running information.

[0186] In one of the embodiments, the screenshot module is further configured to:

[0187] Determine a preset screenshot mode and an alternative screenshot mode based on device information of the client device;

[0188] In the case of the preset screenshot mode and an application currently running on the client device being in conflict, determine a first target screenshot mode from the alternative screenshot mode, and perform screenshot processing by using the first target screenshot mode to obtain the running screenshot image.

[0189] In one of the embodiments, the apparatus further comprises:

[0190] A second screenshot module is configured to, in the case of the preset screenshot mode and the application currently running on the client device not being in conflict, perform screenshot processing by using the preset screenshot mode.

[0191] The third screenshot module is configured to determine a second target screenshot mode from the alternative screenshot modes in a case where an error occurs in the process of performing the screenshot operation in the preset screenshot mode, perform the screenshot operation in the second target screenshot mode to obtain the running screen image, and set the second target screenshot mode as the preset screenshot mode.

[0192] The recovery module is configured to restore the preset screenshot mode to an initial preset screenshot mode in a case where a working state of the client device changes.

[0193] In one of the embodiments, the first determination module 1002 is further configured to:

[0194] register a first callback function and a second callback function; the first callback function is configured to be called when a screen power state changes and output the current screen power state; the second callback function is configured to be called when a login state changes and output the current login state;

[0195] periodically determine whether the client device is in the working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screensaver program is running.

[0196] In one of the embodiments, the first determination module 1002 is further configured to:

[0197] determine that the client device is in the working state in a case where the login state indicates that the client device is in a remote login and screen-unlocked state;

[0198] determine that the client device is in the working state in a case where the login state indicates that the client device is in a local login and screen-unlocked state and the screen power state indicates that a screen of the client device is awake.

[0199] In one of the embodiments, the processing module 1006 is further configured to:

[0200] store the to-be-processed information into a first database;

[0201] periodically traverse the to-be-processed information in the first database, and in a case where it is determined that a corresponding outgoing event of current to-be-processed information traversed is a leakage event, move the current to-be-processed information to a second database, or in a case where it is determined that the corresponding outgoing event of the current to-be-processed information is not the leakage event, delete the current to-be-processed information;

[0202] periodically traverse the to-be-processed information in the second database, and perform reporting processing on the to-be-processed information traversed.

[0203] In one of the embodiments, the apparatus further includes:

[0204] a deleting module, configured to delete the to-be-processed information from the second database in a case that the reporting of the to-be-processed information is successful;

[0205] a second determining module, configured to determine that the to-be-processed information corresponding to the current running information is processed successfully in a case that the to-be-processed information corresponding to the current running information does not exist in the first database and the second database.

[0206] The modules in the apparatus can be all or partially implemented by software, hardware or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in a hardware form, or stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform the operations corresponding to the modules.

[0207] In one of the embodiments, a computer device is provided, which can be a server. An internal structure diagram of the computer device can be as shown in Figure 11 The computer device includes a processor, a memory and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement an outgoing event information processing method.

[0208] Those skilled in the art can understand that Figure 11 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0209] In one of the embodiments, a computer device is provided, which includes a memory and a processor. The memory stores a computer program. The processor executes the computer program to implement the steps in the above method embodiments.

[0210] In one of the embodiments, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0211] In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of any of the above method embodiments.

[0212] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0213] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0214] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, as long as the combinations of technical features do not have contradictions, they shall be considered within the scope of the present disclosure.

[0215] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it shall not be understood as a limitation on the patent scope of the present application. It shall be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these shall be within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. An external event information processing method characterized by comprising: The method is applied to a client device, and comprises: periodically determining whether the client device is in an active state, and updating an active state duration based on whether the client device is in the active state; in the case of triggering an outgoing event, caching current running information, and generating an active state timestamp of the running information according to the current active state duration; the outgoing event is an event representing a user's intention to leak confidential data; generating to-be-processed information based on the running information, and processing the to-be-processed information; periodically traversing all the running information cached locally, and in the case of determining that processing of to-be-processed information corresponding to current running information is successful, determining whether to clean up the current running information based on a difference between the current active state duration and the active state timestamp of the current running information; the method further comprises: in the case of determining that the outgoing event is not the leakage event, sending the to-be-processed information to a server or a database for storage; in the case of determining that the outgoing event is not the leakage event, deleting the to-be-processed information. The method further comprises:

2. The method of claim 1, wherein, in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises:

3. The method of claim 2, wherein, in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information.

4. The method of claim 3, wherein, The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information.

5. The method of claim 1, wherein, The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises: in the case of the client device being currently in the active state, performing screenshot processing to obtain a running screenshot image, and taking the running screenshot image as the running information. The method further comprises: registering a first callback function and a second callback function; the first callback function is used to be called when a screen power state changes, and outputs a current screen power state; the second callback function is used to be called when a login state changes, and outputs a current login state. periodically determine whether the client device is in the working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screensaver program is running.

6. The method of claim 5, wherein, The method of determining whether the client device is in the working state based on at least one of the screen power state output by the first callback function, the login state output by the second callback function, and whether a screensaver program is running comprises: determining that the client device is in the working state when the login state indicates that the client device is in a remote login and screen-unlocked state; determining that the client device is in the working state when the login state indicates that the client device is in a local login and screen-unlocked state and the screen power state indicates that the screen of the client device is on.

7. The method of claim 1, wherein, The method of processing the to-be-processed information comprises: storing the to-be-processed information in a first database; periodically traversing the to-be-processed information in the first database, and for a current to-be-processed information traversed, moving the current to-be-processed information to a second database when it is determined that the outgoing event corresponding to the current to-be-processed information is a leakage event, or deleting the current to-be-processed information when it is determined that the outgoing event corresponding to the current to-be-processed information is not the leakage event; periodically traversing the to-be-processed information in the second database, and performing reporting processing on the to-be-processed information traversed.

8. The method of claim 7, wherein, The method further comprises: deleting the to-be-processed information from the second database when the to-be-processed information is successfully reported; determining that the to-be-processed information corresponding to the current running information is successfully processed when there is no to-be-processed information corresponding to the current running information in both the first database and the second database.

9. An outgoing event information processing apparatus characterized by comprising: The apparatus applied to a client device comprises: a first determination module configured to periodically determine whether the client device is in a working state, and update a working state duration based on whether the client device is in the working state; a generation module configured to, when an outgoing event is triggered, cache a current running information, and generate a working state timestamp of the running information according to the current working state duration; the outgoing event is an event indicating that a user has an intention to externally leak confidential data; a processing module configured to generate to-be-processed information based on the running information, and process the to-be-processed information; a cleaning module configured to periodically traverse all the running information cached locally, and for a current running information traversed, determine whether to clean the current running information based on a difference between the current working state duration and the working state timestamp of the current running information when it is determined that the to-be-processed information corresponding to the current running information is successfully processed. The processing module is specifically configured to: determine whether the outgoing event is a leakage event based on the to-be-processed information; send the to-be-processed information to a server or a database for storage when the outgoing event is not the leakage event; and delete the to-be-processed information when the outgoing event is not the leakage event. 10.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-9. The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 8.

11. A computer readable storage medium having stored thereon a computer program, characterized in that The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 8.

12. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 8.

Images