Instruction monitoring method and device, equipment, storage medium and program product

Abstract

The invention discloses an instruction monitoring method and device, equipment, a storage medium and a program product. The method comprises the steps of obtaining a user instruction in response to an instruction input operation of a user, and collecting biological characteristics of the user; identifying an emotional state of the user based on the biological characteristics, and determining a first risk level corresponding to the user instruction according to the emotional state and a preset risk mapping relationship; according to the reversibility of the system operation indicated by the user instruction, the influence range of the system operation indicated by the user instruction, the authority of the user and the instruction blacklist, performing security assessment on the user instruction, and determining a second risk level corresponding to the user instruction; and determining a risk level of the user instruction according to the first risk level and the second risk level, and executing a system operation corresponding to the risk level. By adopting the method, the risk level of the instruction can be determined from the two aspects of the instruction and the user emotion, and the accuracy of an instruction risk level judgment result is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to an instruction monitoring method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] In server operation and maintenance, core software development and other scenarios, users can use the Linux system command line interactive function to input command lines to instruct the operating system to execute various instructions. The Linux system command line interactive function provides users with highly accurate, efficient and automated system operation capabilities.

[0003] However, some user instructions have certain risks, and the operating system running under the instruction of a risk instruction can easily cause data loss, system failure and other problems. At present, risk instruction monitoring and interception is usually achieved by relying on static rules (instruction blacklists, etc.), manual confirmation and other methods, and there is a problem of low risk instruction processing efficiency and accuracy. SUMMARY

[0004] In view of the above-mentioned defects or shortcomings in the prior art, it is desirable to provide an instruction monitoring method, device, equipment, storage medium and program product, which can determine the risk level of an instruction from both the instruction itself and the user's emotions, thereby effectively improving the accuracy of the instruction risk level determination result.

[0005] In a first aspect, the present application provides an instruction monitoring method. The method comprises: In response to a user's instruction input operation, obtaining a user instruction and collecting a user's biological characteristics; Recognizing the emotional state of the user based on the biological characteristics, and determining the first risk level corresponding to the user instruction according to the emotional state and a preset risk mapping relationship; the risk mapping relationship includes the corresponding relationship between different emotional states and risk levels; Performing a security assessment on the user instruction according to the reversibility of the system operation indicated by the user instruction, the influence range of the system operation indicated by the user instruction, the user's authority and the instruction blacklist, to determine the second risk level corresponding to the user instruction; the risk level corresponding to the user instruction with irreversible system operation represents a higher risk degree than the risk level corresponding to the user instruction with reversible system operation; the influence range size is positively correlated with the high and low of the risk degree represented by the risk level, and the user authority size is positively correlated with the high and low of the risk degree represented by the risk level; Determining the risk level of the user instruction according to the first risk level and the second risk level, and executing the system operation corresponding to the risk level In a possible implementation manner of the first aspect, the biological feature is a facial feature, and the collecting the biological feature of the user includes: collecting a video containing a face of the user, performing micro-expression recognition on the video, and intercepting video continuous frames in which micro-expressions exist in the video; and performing feature extraction on each video continuous frame to obtain the facial feature of the user.

[0006] In a possible implementation manner of the first aspect, the emotional state includes an emotional type and an intensity value, the risk mapping relationship includes a corresponding relationship between different emotional types, different intensity value ranges, and risk levels, the emotional state of the user is identified based on the biological feature, and the first risk level corresponding to the user instruction is determined according to the emotional state and the preset risk mapping relationship, including: inputting the biological feature into a pre-trained emotion recognition model to determine the emotional type and the intensity value of the user; and searching in the risk mapping relationship according to the emotional type and the intensity value to determine the risk level corresponding to the intensity value range in which the emotional type and the intensity value of the user are located, and obtain the first risk level.

[0007] In a possible implementation manner of the first aspect, the risk level of the user instruction is determined according to the first risk level and the second risk level, including: if the second risk level is higher than a preset risk level, the risk level of the user instruction is determined based on the first risk level; and if the second risk level is lower than or equal to the preset risk level, the risk level of the user instruction is determined based on the second risk level.

[0008] In a possible implementation manner of the first aspect, the system operation corresponding to the risk level is executed, including: if the risk level is greater than or equal to a first level, the process corresponding to the user instruction is terminated; if the risk level is greater than a second level and less than the first level, the process corresponding to the user instruction is stopped, and the user instruction is subjected to security verification, in a case where a security verification result of the user instruction is not received within a preset time period or the security verification result indicates that the user instruction has a risk, the process corresponding to the user instruction is terminated; the risk degree indicated by the first level is higher than the risk degree indicated by the second level; and if the risk level is less than or equal to the second level, the user instruction is executed.

[0009] In a possible implementation manner of the first aspect, the instruction monitoring method further includes: recording at least one of the first risk level, the second risk level, the risk level of each user instruction, the emotional state of the user, and the security verification result, forming an audit log, and storing the audit log to the local.

[0010] The second aspect, the present application also provides an instruction monitoring device. The device includes: The collecting module is configured to, in response to an instruction input operation of a user, acquire a user instruction and collect a biological feature of the user. The first risk determination module is configured to determine an emotional state of the user based on the biological characteristics, and determine a first risk level corresponding to the user instruction according to the emotional state and a preset risk mapping relationship. The risk mapping relationship includes a corresponding relationship between different emotional states and risk levels. The second risk determination module is configured to perform security evaluation on the user instruction according to reversibility of a system operation indicated by the user instruction, an influence range of the system operation indicated by the user instruction, a permission of the user and an instruction blacklist, and determine a second risk level corresponding to the user instruction. The risk level corresponding to the user instruction with the irreversible system operation represents a higher risk degree than the risk level corresponding to the user instruction with the reversible system operation. The influence range is positively correlated with the high and low of the risk degree represented by the risk level, and the permission of the user is positively correlated with the high and low of the risk degree represented by the risk level. The risk level determination module is configured to determine a risk level of the user instruction according to the first risk level and the second risk level, and perform a system operation corresponding to the risk level.

[0011] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor. The memory stores a computer program. The processor implements the method in the first aspect when executing the computer program.

[0012] In a fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the method in the first aspect.

[0013] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program. The computer program is executed by a processor to implement the method in the first aspect.

[0014] The embodiment of the present application provides an instruction monitoring method, device, equipment, storage medium and program product, can acquire a user instruction and collect a biological feature of the user in response to a user instruction input operation. The emotional state of the user is identified based on the biological feature, and a first risk level corresponding to the user instruction is determined according to the emotional state and a preset risk mapping relationship. The user instruction and an instruction blacklist are subjected to security evaluation according to the reversibility of a system operation indicated by the user instruction, the influence range of the system operation indicated by the user instruction and the permission of the user, and a second risk level corresponding to the user instruction is determined. The risk level of the user instruction is determined according to the first risk level and the second risk level, and a system operation corresponding to the risk level is executed. When judging the security risk of the user instruction, the embodiment of the present application judges the security risk of the instruction itself based on multiple evaluation indexes, and the accuracy of the instruction security risk judgment can be improved. Further, the security risk of the user instruction is judged by referring to the emotional state of the user when inputting the instruction, that is, the risk level of the instruction is determined from the instruction itself and the emotion of the user, and the accuracy of the instruction risk level judgment result is effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0015] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments thereof as read in conjunction with the accompanying drawings: Figure 1 An application environment diagram of an instruction monitoring method in an embodiment; Figure 2 A flowchart of an instruction monitoring method in an embodiment; Figure 3 Another flowchart of an instruction monitoring method in an embodiment; Figure 4 Another flowchart of an instruction monitoring method in an embodiment; Figure 5 A structure block diagram of an instruction monitoring device in an embodiment; Figure 6 An internal structure diagram of a computer equipment in an embodiment. DETAILED DESCRIPTION

[0016] The present application will be further described in conjunction with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the convenience of description, only the parts related to the application are shown in the drawings.

[0017] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments. In addition, the term "and / or" in this paper is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. The terms "first" and "second" in the specification and claims of the embodiments of the present application are used to distinguish different objects, not to describe a specific order of the objects.

[0018] In the scenarios of server operation and maintenance, core software development, etc., users can use the Linux system command line interactive function to input command lines to instruct the operating system to execute various instructions. The Linux system command line interactive function provides users with highly accurate, efficient and automated system operation capabilities.

[0019] However, some user instructions (such as rm -rf / , dd, fdisk, etc.) have certain risks, and the operating system running under the instruction of the risk instruction is easy to cause data loss, system failure and other problems. At present, for user instructions with certain risks, static rules (instruction blacklists, etc.) are often used for judgment, but it is difficult to judge against transformed risk instructions (such as find / -name “*.log” -exec rm {}\). At present, there are also manual confirmation, risk instruction confirmation methods relying on audit logs. However, the above methods have the problem of low efficiency and accuracy of risk instruction processing.

[0020] Based on this, the embodiments of the present application provide an instruction monitoring method, device, equipment, storage medium and program product, which can determine the risk level of the instruction from the instruction itself and the user emotion, effectively improving the accuracy of the instruction risk level judgment result.

[0021] The instruction monitoring method provided by the embodiments of the present application can be applied in an application environment as shown in Figure 1 The terminal 10 communicates with the server 20 through a network. The terminal 10 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, etc. The terminal 10 can provide an instruction input interface for the user to input instructions; the server 20 can judge the risk level of the user instruction in response to the user instruction, and the operating system controls the operating system.

[0022] The server 20 can be implemented by an independent server or a server cluster composed of multiple servers.

[0023] In one embodiment, as Figure 2As shown, an instruction monitoring method is provided, and the method is applied to Figure 1 The server 20 in the method is taken as an example for illustration, and the method comprises the following steps. In step 101, in response to a user's instruction input operation, a user instruction is acquired, and a user's biological feature is collected.

[0024] In the embodiment, the terminal 10 can be a device with a display screen to provide a user with an instruction input interface. After the terminal 10 detects a user's instruction input operation in the instruction input interface, the terminal 10 can directly acquire the user's input instruction and send the user instruction to the server 20.

[0025] Further, considering that the user's emotional state is often abnormal when the user inputs an instruction with a security risk, the server 20 can instruct the terminal 10 to collect the user's biological information after receiving the user instruction sent by the terminal 10, so as to determine the user's emotional state based on the biological information. In a possible implementation, to improve the effectiveness of the biological feature, the terminal 10 can also start to collect the user's biological information when detecting the user's instruction input operation, so that the biological feature can effectively reflect the user's emotional state when inputting the instruction.

[0026] In a possible implementation, the server 20 can be a server supporting a Linux operating system. The user can input an instruction through a Linux system command line interactive function, and the server 20 can call a readline() function through a kernel hook technology to capture the command line input, i.e., the user instruction.

[0027] The terminal 10 can be integrated with a sensor for collecting the user's biological information. For example, an image sensor (which can be a Doppler camera) for collecting the user's facial information, a radar sensor for collecting the user's breathing information, a laser sensor for collecting the user's heartbeat information, and the like. After acquiring the user instruction, the terminal 10 starts the sensor to collect the user's biological information and sends the biological information to the server 20.

[0028] After receiving the biological information, the server 20 performs feature analysis on the biological information to obtain the user's biological feature. For example, the user's facial information can be analyzed to determine the user's expression feature; the user's heartbeat information can be analyzed to determine the user's heartbeat frequency; and the user's breathing information can be analyzed to determine the user's breathing frequency.

[0029] In step 102, the user's emotional state is identified based on the biological feature, and a first risk level corresponding to the user instruction is determined according to the emotional state and a preset risk mapping relationship.

[0030] In the embodiments of the present application, an initial emotion recognition model can be constructed in advance based on a convolutional neural network (CNN) or the like. Then, biological features of multiple different users are collected, and emotional states are labeled. The biological features labeled with emotional states are used as a training set to train the initial emotion recognition model until the model accuracy reaches a preset accuracy, to obtain an emotion recognition model. The emotion recognition model is integrated in the server 20.

[0031] After the server 20 analyzes the biological information of the user to obtain the biological features, the server 20 can input the biological features into the pre-trained emotion recognition model to obtain the emotional state of the user. The emotional state can include an emotional type, such as nervousness, fear, happiness, and the like.

[0032] In the embodiments of the present application, a corresponding relationship between different emotional states and risk levels can also be constructed according to experience according to the principle that the nervousness degree of the emotional state representation is positively correlated with the risk degree of the risk level representation, and the corresponding relationship is stored in the server 20 as a risk mapping relationship. After the server 20 determines the emotional state of the user when inputting the instruction, the server 20 searches in the risk mapping relationship based on the emotional state of the user to determine the risk level corresponding to the emotional state of the user, to obtain a first risk level. The risk level in the risk mapping relationship can be in the form of a textual description such as safe, low risk, medium risk, and high risk; or in the form of a risk score of 1-10, wherein the higher the risk score, the higher the risk degree.

[0033] Step 103: According to the reversibility of the system operation indicated by the user instruction, the influence range of the system operation indicated by the user instruction, and the permission of the user, the security of the user instruction and the instruction blacklist is evaluated, to determine a second risk level corresponding to the user instruction.

[0034] The risk levels corresponding to the user instructions with irreversible system operations are higher than the risk levels corresponding to the user instructions with reversible system operations. For example, the instruction rm for permanently deleting files and directories in the Linux system causes the files and directories to be unrecoverable, and thus, the risk level is relatively high. The instruction cp for copying files in the Linux system is not irreversible, and thus, the risk level is relatively low. The size of the influence range is positively correlated with the risk level. For example, the instruction based on the root directory / starts has a larger influence range than the instruction based on the user directory~ / tmp, and thus, the risk level is relatively high. The size of the user permission is positively correlated with the risk level. For example, the instruction of the user with the administrator permission (root user) has a relatively high risk level than the instruction of the user without the administrator permission.

[0035] In the embodiments of the present application, the server 20 can analyze the user instruction based on the evaluation indexes such as the reversibility of the system operation, the influence range, and the user permission, to obtain a first candidate risk level. Specifically, different evaluation indexes correspond to different risk scores. The server 20 can determine at least one evaluation index (for example, irreversible operation and administrator permission) matched with the user index, determine the risk score corresponding to the at least one evaluation index, and fuse (for example, add) the at least one risk score to obtain the first candidate risk level.

[0036] The embodiments of the present application can also pre-construct a plurality of user instructions with risks, different user instruction intentions, and the corresponding relationship of the risk levels, and store them in the server 20 locally as a blacklist. After obtaining the user instruction, the server 20 can analyze the user instruction (for example, which can include analyzing the position of the pipeline in the instruction) by using a language processing model (for example, BERT), determine the natural language meaning and execution intention of the user instruction, and the like. Then, the server 20 can query the blacklist based on the user instruction and the analysis result of the user instruction, and determine the second candidate risk level corresponding to the user instruction.

[0037] Finally, the server 20 fuses the first candidate risk level and the second candidate risk level to determine the second risk level corresponding to the user instruction. For example, the first candidate risk level and the second candidate risk level can be weighted and summed to obtain the second risk level. For example, the candidate risk level with a relatively high risk level can also be taken as the second candidate risk level. Step 104, determining the risk level of the user instruction according to the first risk level and the second risk level, and performing a system operation corresponding to the risk level.

[0038] In the embodiments of the present application, the second risk level represents the risk level of the user instruction itself, and the first risk level is the risk level of the user instruction determined based on the user emotion. Therefore, when the second risk level represents that the user instruction is relatively low in risk (or safe), the first risk level does not need to be referred to determine the risk level of the user instruction, and the risk level of the user instruction is directly determined based on the second risk level. For example, the second risk level can be directly determined as the risk level of the user instruction. When the second risk level represents that the user instruction has a certain risk, the first risk level can be referred to determine the risk level of the user instruction. That is, if the second risk level is higher than a preset risk level, the risk level of the user instruction is determined based on the first risk level; if the second risk level is lower than or equal to the preset risk level, the risk level of the user instruction is determined based on the second risk level.

[0039] In the embodiments of the present application, the second risk level represents the risk level of the user instruction itself, and the first risk level is the risk level of the user instruction determined based on the user emotion. Therefore, when the second risk level represents that the user instruction is relatively low in risk (or safe), the first risk level does not need to be referred to determine the risk level of the user instruction, and the risk level of the user instruction is directly determined based on the second risk level. For example, the second risk level can be directly determined as the risk level of the user instruction. When the second risk level represents that the user instruction has a certain risk, the first risk level can be referred to determine the risk level of the user instruction. That is, if the second risk level is higher than a preset risk level, the risk level of the user instruction is determined based on the first risk level; if the second risk level is lower than or equal to the preset risk level, the risk level of the user instruction is determined based on the second risk level.

[0040] If the second risk level is lower than or equal to the preset risk level, it indicates that the user instruction is relatively safe, and therefore the second risk level can be directly determined as the risk level of the user instruction, or the risk level of the user instruction can be determined by taking the risk level representing a higher risk degree in the first risk level and the second risk level, so as to improve the sensitivity of the risk judgment of the user instruction.

[0041] In the embodiments of the present application, the correspondence between different risk levels and different system operations can be pre-configured and stored locally. After determining the risk level of the user instruction, the server 20 can search in the correspondence to determine the system operation matched with the risk level corresponding to the user instruction. Specifically, if the risk level is greater than or equal to the first level, the process corresponding to the user instruction is terminated; if the risk level is greater than the second level and less than the first level, the process corresponding to the user instruction is stopped, and the user instruction is subjected to security verification; if the security verification result of the user instruction is not received within a preset time period, or the security verification result indicates that the user instruction has a risk, the process corresponding to the user instruction is terminated; if the risk level is less than or equal to the second level, the user instruction is executed.

[0042] The risk degree represented by the first level is higher than the risk degree represented by the second level. Taking a risk score with a risk level of 1-10 as an example, the greater the risk score, the higher the risk degree, and the risk score corresponding to the first level is higher than the risk score corresponding to the second level, for example, the first level can be 8 and the second level can be 3. In this case, the risk level is divided into three risk degree intervals, i.e., level 1 to level 3, level 4 to level 7, and level 8 to level 10, based on the first level and the second level.

[0043] In this implementation, if the risk level is greater than or equal to the first level (i.e., level 8-10), it indicates that the user instruction has a high risk, and the server 20 can use the kernel hook technology to call sys_execve to replace the process corresponding to the user instruction, so as to terminate the process corresponding to the user instruction; or directly terminate the process corresponding to the user instruction by using the SIGTOP instruction. For the user instruction with a high security risk, the server 20 can also perform alarm processing.

[0044] If the risk level is greater than the second level and less than the first level (i.e., level 4-7), it indicates that the user instruction has a certain security risk, and therefore, the process corresponding to the user instruction can be suspended first, and then the security verification of the user instruction is performed again (which can use the security verification manner of the above embodiment, or use other manners). If the security verification result of the user instruction is not received within a preset time period, or the security verification result still indicates that the user instruction has a risk (the risk level is greater than the second level), the process corresponding to the user instruction is terminated; if the verification result indicating that the user instruction is safe is received within the preset time period, the process corresponding to the user instruction is continued to execute.

[0045] If the risk level is less than or equal to the second level (i.e., level 1-3), it indicates that the user instruction has no security risk, and therefore, the process corresponding to the user instruction is continued to execute.

[0046] Taking three levels of high-risk, suspicious, and safe as an example, the risk degree represented by the high-risk is the highest, and the risk degree represented by the safe is the lowest, and therefore, the first level can be set as “high-risk” and the second level can be set as “safe”. When the risk level is greater than or equal to the first level (i.e., high-risk), the process corresponding to the user instruction is terminated; when the risk level is greater than the second level and less than the first level (i.e., suspicious), the process corresponding to the user instruction is stopped, and the security verification of the user instruction is performed, and in the case that the security verification result of the user instruction is not received within a preset time period or the security verification result indicates that the user instruction has a risk, the process corresponding to the user instruction is terminated. When the risk level is less than or equal to the second level (i.e., safe), the user instruction is executed.

[0047] In a possible implementation, the server 20 can construct an audit log based on the relevant information generated in the monitoring process of the user instruction for each user instruction after completing the security monitoring and processing of the user instruction, so as to perform subsequent accuracy analysis and the like on the monitoring process of the user instruction. That is, at least one of the first risk level, the second risk level, the risk level, the emotional state of the user, and the security verification result of each user instruction is recorded to form an audit log and stored locally.

[0048] For example, the audit log can be in the form of "root user executes instruction ls / etc", "root user instruction rm -rf ~ / tmp / test is executed through secondary security verification", "root user instruction rm -rf / etc is intercepted due to failure of re-security verification", "root user instruction rm -rf / etc is intercepted due to the risk level being higher than the first level", and the like.

[0049] The method provided by the embodiment of the application can acquire a user instruction in response to a user instruction input operation, and collect a biological feature of the user. The emotional state of the user is identified based on the biological feature, and a first risk level corresponding to the user instruction is determined according to the emotional state and a preset risk mapping relationship. The second risk level corresponding to the user instruction is determined by performing security evaluation on the user instruction and an instruction blacklist according to the reversibility of a system operation indicated by the user instruction, the influence range of the system operation indicated by the user instruction, and the permission of the user. The risk level of the user instruction is determined according to the first risk level and the second risk level, and a system operation corresponding to the risk level is performed. When judging the security risk of the user instruction, the embodiment of the application judges the security risk of the instruction itself based on multiple evaluation indexes, which can improve the accuracy of the security risk judgment of the instruction. Furthermore, the embodiment of the application also refers to the emotional state of the user when inputting the instruction to judge the security risk of the instruction, that is, the risk level of the instruction is determined from the instruction itself and the emotional state of the user, which effectively improves the accuracy of the judgment result of the risk level of the instruction.

[0050] The foregoing embodiments introduce a scheme of collecting biological features such as expressions, heartbeats, and breaths of the user. In another embodiment of the application, the biological feature can be a facial feature, which can be collected and analyzed by an image sensor. The embodiment includes the steps shown in Figure 3 Step 201: Collect a video containing a face of the user, perform micro-expression recognition on the video, and intercept video continuous frames in which micro-expressions exist.

[0051] ​In the embodiments of the present application, the terminal 10 can be integrated with an image sensor, and the lens of the image sensor faces the user's face. When detecting the user's instruction input operation, the server 20 starts the image sensor on the terminal 10 to start shooting a video, and acquires the video shot by the image sensor in real time.

[0052] After acquiring the video, the server 20 can perform face detection and tracking based on a target detection algorithm (for example, a YOLO algorithm), determine and intercept a video frame with the user's face in the video. Then, micro-expression analysis is performed on the intercepted video frame, and a video continuous frame with micro-expression is determined and intercepted. Specifically, considering that a micro-expression is a facial expression with extremely short duration (usually 1 / 25 second to 1 / 5 second). Therefore, by excluding video frames with expressions and duration exceeding the duration range corresponding to micro-expression, and non-continuous video frames (single), a video continuous frame with expression and duration within the duration range corresponding to micro-expression can be obtained.

[0053] In a possible implementation, before performing micro-expression analysis on the video frame, the proportion of video frames with the user's face in the video collected by the image sensor can be determined. If the proportion is less than a preset proportion, it indicates that the user's face is blocked. In this case, the process corresponding to the user instruction can be stopped first, and the user instruction can be subjected to security verification. If no security verification result of the user instruction is received within a preset time period, or the security verification result indicates that the user instruction is risky, the process corresponding to the user instruction is terminated.

[0054] In step 202, for each video continuous frame, feature extraction is performed on the video continuous frame to obtain facial features of the user.

[0055] In the embodiments of the present application, the server 20 can use a feature extraction algorithm to process the video continuous frame with micro-expression to obtain facial features of the user. Considering that the video continuous frame is a two-dimensional object, and the expression is a three-dimensional feature, the LBP-TOP algorithm can be used to process the video continuous frame to obtain dynamic facial features of the user.

[0056] The method provided in the embodiments of the present application can collect facial features of the user as biological features, and the facial features have rich expression information, so that the emotional state of the user can be accurately analyzed. Specifically, the embodiments of the present application collect a video containing the user's face, perform micro-expression recognition on the video, and intercept a video continuous frame with micro-expression in the video. Then, feature extraction is performed on each video continuous frame to obtain facial features of the user. That is, the embodiments of the present application perform feature analysis after performing interception processing on the video based on micro-expression, which effectively reduces the data processing amount and improves the feature analysis efficiency.

[0057] The foregoing embodiments introduce a scheme of judging the security risk of a user instruction based on a user biological feature. In another embodiment of the present application, for a biological feature, the instruction risk can be judged based on a pre-constructed model and a corresponding relationship. The embodiment includes the steps shown in Figure 4 Step 301: input the biological feature into a pre-trained emotion recognition model to determine the emotion type and intensity value of the user.

[0058] The emotion state includes the emotion type and the intensity value.

[0059] In the embodiment of the present application, the server 20 can be integrated with an emotion recognition model, which can be specifically an initial emotion recognition model constructed in advance based on CNN, etc. Then, a plurality of facial features are collected, and the emotion type and intensity value represented by each facial feature are labeled. The labeled facial features are used as a training set to train the initial emotion recognition model until the model accuracy reaches a preset accuracy, and an emotion recognition model is obtained. The emotion recognition model is integrated in the server 20.

[0060] After the server 20 analyzes the facial features of the user in the continuous frames of the video with micro-expressions, the facial features are directly input into the pre-trained emotion recognition model to obtain the emotion type and intensity value of the user when inputting the instruction.

[0061] Step 302: according to the emotion type and intensity value, find in the risk mapping relationship to determine the risk level corresponding to the intensity value range where the emotion type and intensity value of the user are located, and obtain the first risk level.

[0062] The risk mapping relationship includes the corresponding relationship between different emotion types, different intensity value ranges, and risk levels.

[0063] In the embodiment of the present application, according to experience, the corresponding relationship between different emotion types, intensity value ranges, and risk levels can be constructed according to the principle that the nervousness degree represented by the emotion type, the intensity value size, and the risk degree represented by the risk level are positively correlated, and stored in the server 20 as a risk mapping relationship. After the server 20 determines the emotion type and intensity value of the user based on the facial features of the user, the server 20 finds in the risk mapping relationship to determine the risk level corresponding to the intensity value range that matches the emotion type of the user and covers the corresponding intensity value of the user, and the first risk level.

[0064] The risk mapping relationship is described by some examples: expression type: "regret", intensity value > 0.6, risk level: high risk; expression type: "nervousness", intensity value > 0.7, risk level: medium risk; expression type: "smile", intensity value > 0.6, risk level: safe. ​

[0065] The method provided by the embodiments of the present application can determine the emotion type and intensity value of a user based on a pre-trained emotion recognition model, and determine the risk level of a user instruction through a pre-constructed risk mapping relationship, so that efficient and automated instruction risk determination can be achieved.

[0066] It should be noted that although the operations of the method of the present application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in this specific order, or that all of the shown operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be broken down into multiple steps.

[0067] In one embodiment, as shown in Figure 4 An instruction monitoring device is provided, comprising: an acquisition module 401, a first risk determination module 402, a second risk determination module 403, and a risk level determination module 404, wherein: The acquisition module 401 is configured to acquire a user instruction in response to a user's instruction input operation, and to collect a biological feature of the user.

[0068] The first risk determination module 402 is configured to identify the emotional state of the user based on the biological feature, and to determine a first risk level corresponding to the user instruction according to the emotional state and a pre-set risk mapping relationship; the risk mapping relationship includes a corresponding relationship between different emotional states and risk levels.

[0069] The second risk determination module 403 is configured to perform a security assessment on the user instruction according to the reversibility of a system operation indicated by the user instruction, the impact range of the system operation indicated by the user instruction, the user's authority, and an instruction blacklist, and to determine a second risk level corresponding to the user instruction; the risk level corresponding to the user instruction with an irreversible system operation represents a higher risk degree than the risk level corresponding to the user instruction with a reversible system operation; the impact range size is positively correlated with the high and low of the risk degree represented by the risk level, and the user authority size is positively correlated with the high and low of the risk degree represented by the risk level.

[0070] The risk level determination module 404 is configured to determine the risk level of the user instruction according to the first risk level and the second risk level, and to perform a system operation corresponding to the risk level.

[0071] In one embodiment, the biological feature is a facial feature, and the acquisition module 401 is specifically configured to collect a video containing the user's face, perform micro-expression recognition on the video, and intercept video consecutive frames in which micro-expressions exist; for each video consecutive frame, the video consecutive frame is subjected to feature extraction to obtain the facial feature of the user.

[0072] In an embodiment, the emotional state includes an emotional type and an intensity value, the risk mapping relationship includes a corresponding relationship between different emotional types, different intensity value ranges and risk levels, and the first risk determination module 402 is specifically configured to determine the emotional type and the intensity value of the user by inputting the biological features into the pre-trained emotional recognition model; determine the risk level corresponding to the intensity value range where the emotional type and the intensity value of the user are located in the risk mapping relationship, and obtain the first risk level.

[0073] In an embodiment, the risk level determination module 404 is specifically configured to determine the risk level of the user instruction based on the first risk level if the second risk level is higher than the preset risk level, and determine the risk level of the user instruction based on the second risk level if the second risk level is lower than or equal to the preset risk level.

[0074] In an embodiment, the risk level determination module 404 is further configured to terminate the process corresponding to the user instruction if the risk level is greater than or equal to the first level, stop the process corresponding to the user instruction and perform security verification on the user instruction if the risk level is greater than the second level and less than the first level, and terminate the process corresponding to the user instruction in the case that the security verification result of the user instruction is not received within a preset time period or the security verification result indicates that the user instruction has risks; the risk degree represented by the first level is higher than the risk degree represented by the second level; and execute the user instruction if the risk level is less than or equal to the second level.

[0075] In an embodiment, the instruction monitoring apparatus further includes an audit module configured to record at least one of the first risk level, the second risk level, the risk level of each user instruction, the emotional state of the user, and the security verification result, form an audit log and store it locally.

[0076] It should be understood that the units or modules recorded in the instruction monitoring apparatus correspond to each step in the method described with reference to Figure 2 The operations and features described above with respect to the method also apply to the instruction monitoring apparatus and the units contained therein, and will not be described here. The instruction monitoring apparatus can be pre- implemented in the browser or other security application of the electronic device, or can be loaded into the browser or security application thereof of the electronic device by downloading or the like. The corresponding units in the instruction monitoring apparatus can cooperate with the units in the electronic device to realize the schemes of the embodiments of the present application.

[0077] Reference is made below to Figure 5 which shows a structural schematic diagram of a computer system 500 suitable for realizing the terminal device or server of the embodiments of the present application.

[0078] As Figure 5As shown, the computer system 500 includes a central processing unit (CPU) 501 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 502 or loaded into a random access memory (RAM) 503 from a storage section 508. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0079] Connected to the I / O interface 505 are an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a display device such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable recording medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read therefrom is installed into the storage section 508 as necessary.

[0080] In particular, the processes described above with reference to the Figure 2 application can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product which includes a computer program tangibly embodied on a machine readable medium, the computer program including program code for executing the methods of Figure 2 In such embodiments, the computer program can be downloaded and installed from a network via the communication section 509 and / or installed from the removable recording medium 511.

[0081] It should be noted that the computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer-readable storage medium can include, but are not limited to, the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer-readable storage medium can be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium can include a computer-readable storage medium and can also include a computer-readable transmission medium carrying a computer-readable program code. Such a computer-readable transmission medium can be any computer-readable medium that can carry a computer-readable program code for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable medium carrying the computer-readable program code can be a computer-readable storage medium or a computer-readable signal medium transmitting the computer-readable program code. The computer-readable medium, including the computer-readable storage medium and the computer-readable transmission medium, can be any medium that can be accessed by a computer. The computer-readable storage medium can be a tangible medium that can retain, store, or maintain the computer-readable program code for use by or in connection with the computer. The computer-readable transmission medium can carry the computer-readable program code on the computer-readable storage medium or can carry the computer-readable program code independently.

[0082] The computer program product can include a computer readable medium (media) having instructions stored thereon / in which can be executed by a processing unit, such as a processor in a mobile device or other electronic device. The computer readable medium can be a machine-readable storage medium having stored thereon / in instructions which, when executed by the computer, can cause the computer to carry out a process of the present application. The computer readable medium can also be, for example, a machine-readable storage medium, a machine-readable transmission medium, or a combination of both, where appropriate. The computer readable medium can be, for example, but not limited to, tangible computer readable storage media or computer readable communication media. Examples of a computer readable storage medium can include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information in a computer readable form. Note that the computer readable medium can be paper, where appropriate. Examples of computer readable communication media can include, but are not limited to, wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, Bluetooth, and other wireless media. The computer readable medium can also be, where appropriate, a computer readable medium that can be accessed by a processor of a mobile device or other electronic device. The present application can also include a computer program product which can be stored / distributed on such a computer readable medium. The computer program product can also include instructions which can be executed by a processing unit, such as a processor in a mobile device or other electronic device, to cause the processing unit to carry out a process of the present application.

[0083] The units or modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. The described units or modules can also be arranged in a processor. In some cases, the names of the units or modules do not constitute a limitation on the units or modules themselves.

[0084] As another aspect, the present application also provides a computer readable storage medium, which can be included in the computer device described in the above embodiments, or can exist separately and not be assembled into the computer device. The computer readable storage medium stores one or more programs, when the programs are used by one or more processors to execute the methods described in the present application. For example, the computer readable storage medium can store the programs for executing Figure 2 each step of the method shown.

[0085] The embodiments of the present application provide a computer program product, which includes instructions that, when executed, cause the method described in the embodiments of the present application to be performed. For example, the computer program product can store the programs for executing Figure 2 each step of the method shown.

[0086] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0087] The above description is merely preferred embodiments of the present application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and also covers other technical solutions formed by any combination of the above technical features or equivalent features without departing from the inventive concept. For example, the above features can be replaced with technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A method for monitoring instructions, characterized in that, The method includes: In response to user input, the system acquires user commands and collects the user's biometric features. The user's emotional state is identified based on the biometrics, and a first risk level corresponding to the user's instruction is determined according to the emotional state and a preset risk mapping relationship; the risk mapping relationship includes the correspondence between different emotional states and risk levels. The user instruction is assessed for security based on the reversibility of the system operation indicated by the user instruction, the scope of its impact, the user's permissions, and the instruction blacklist, to determine a second risk level corresponding to the user instruction. The risk level corresponding to a user instruction whose system operation is irreversible represents a higher level of risk than that of a user instruction whose system operation is reversible. The scope of impact is positively correlated with the level of risk represented by the risk level, and the user's permissions are positively correlated with the level of risk represented by the risk level. The risk level of the user instruction is determined based on the first risk level and the second risk level, and the system operation corresponding to the risk level is executed.

2. The method according to claim 1, characterized in that, The biometric feature is a facial feature, and the collection of the user's biometric features includes: The system acquires videos containing user faces, performs micro-expression recognition on the videos, and extracts consecutive video frames containing micro-expressions. For each of the aforementioned consecutive video frames, feature extraction is performed on the consecutive video frames to obtain the user's facial features.

3. The method according to claim 1, characterized in that, The emotional state includes emotional type and intensity value; the risk mapping relationship includes the correspondence between different emotional types, different intensity value ranges, and risk levels; the step of identifying the user's emotional state based on the biometrics and determining the first risk level corresponding to the user's instruction according to the emotional state and the preset risk mapping relationship includes: The biometric features are input into a pre-trained emotion recognition model to determine the user's emotion type and intensity value; Based on the emotion type and intensity value, the risk mapping relationship is searched to determine the risk level corresponding to the range of intensity values ​​in which the user's emotion type and intensity value fall, thus obtaining the first risk level.

4. The method according to claim 1, characterized in that, Determining the risk level of the user instruction based on the first risk level and the second risk level includes: If the second risk level is higher than the preset risk level, then the risk level of the user instruction is determined based on the first risk level; If the second risk level is lower than or equal to the preset risk level, then the risk level of the user instruction is determined based on the second risk level.

5. The method according to claim 1, characterized in that, The system operation corresponding to the risk level includes: If the risk level is greater than or equal to the first level, then the process corresponding to the user instruction is terminated; If the risk level is greater than the second level and less than the first level, the process corresponding to the user instruction is stopped, and the user instruction is subjected to security verification. If no security verification result is received for the user instruction within a preset time period, or if the security verification result indicates that the user instruction is risky, the process corresponding to the user instruction is terminated; the risk level represented by the first level is higher than the risk level represented by the second level. If the risk level is less than or equal to the second level, then the user instruction is executed.

6. The method according to claim 1, characterized in that, The method further includes: Record at least one of the following for each user instruction: first risk level, second risk level, risk level, user's emotional state, and security verification result, and form an audit log and store it locally.

7. A command monitoring device, characterized in that, The device includes: The acquisition module is used to respond to user input operations, acquire user commands, and collect the user's biometric features; The first risk determination module is used to identify the user's emotional state based on the biometrics, and determine the first risk level corresponding to the user's instruction according to the emotional state and a preset risk mapping relationship; the risk mapping relationship includes the correspondence between different emotional states and risk levels; The second risk determination module is used to perform a security assessment on the user instruction based on the reversibility of the system operation indicated by the user instruction, the scope of influence of the system operation indicated by the user instruction, the user's permissions, and an instruction blacklist, and determine the second risk level corresponding to the user instruction; the risk level corresponding to the user instruction with irreversible system operation represents a higher level of risk than the risk level corresponding to the user instruction with reversible system operation; the scope of influence is positively correlated with the level of risk represented by the risk level, and the user's permissions are positively correlated with the level of risk represented by the risk level; The risk level determination module is used to determine the risk level of the user instruction based on the first risk level and the second risk level, and to execute the system operation corresponding to the risk level.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images