Driver theory examination anti-cheating detection system and working process

Abstract

The invention relates to the field of examination, in particular to a driver theory examination anti-cheating detection system and workflow, and the driver theory examination anti-cheating detection system comprises a server, an information collection module, a behavior analysis module, an early warning display and processing module, a business query module, a statistics module and a system setting module. The server is electrically connected with the information acquisition module, the behavior analysis module, the early warning display and processing module, the business query module, the statistics module and the system setting module, and the information acquisition module is deployed on an examination computer. According to the product, omnibearing and dead-corner-free three-dimensional monitoring is realized through multi-dimensional information acquisition. Compared with the traditional video monitoring, the improved system extends the monitoring range from the examination room environment to the inside of the examination computer, deeply fuses bottom data such as hardware interface, network communication, process service, keyboard and mouse operation and the like, greatly improves the capability of finding cheating behaviors, and compresses the cheating space from the source.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of examination, in particular to a driver theory examination anti-cheating detection system and working process. BACKGROUND

[0002] At present, the anti-cheating schemes for online and paperless examinations such as motor vehicle driver theory examination mainly include the following: 1. Video analysis of examination process: the eye, hand and body movements are extracted from the video of the examination process to determine whether there is any suspicion of cheating; 2. Screen recording analysis: the screen information of the examinee's answers during the examination process is recorded to analyze whether there is any suspicion of cheating; 3. Examination equipment monitoring: the examination equipment processes, ports and network states are monitored to analyze whether there are any programs, devices and network messages that are not required for the examination, so as to determine whether there is any suspicion of cheating.

[0003] However, the method of video analysis of examination process is based on image processing or deep learning algorithm, which requires high computing power of hardware devices and high cost of devices, and is not conducive to rapid deployment and large-scale promotion; the screen recording analysis belongs to a post-processing scheme and cannot meet the requirements of real-time early warning in the examination site; the method of examination equipment monitoring only analyzes the examination equipment and does not analyze the early warning of the examination behavior process, which lacks the integrity of early warning. SUMMARY

[0004] To achieve the above-mentioned purpose, the present application provides a driver theory examination anti-cheating detection system which can solve the above-mentioned problems. The present application provides the following technical scheme: A driver theory examination anti-cheating detection system, comprising a server, an information collection module, a behavior analysis module, an early warning display and processing module, a business query module, a statistical module and a system setting module, the server is electrically connected with the information collection module, the behavior analysis module, the early warning display and processing module, the business query module, the statistical module and the system setting module, the information collection module is deployed on an examination computer and is used to collect various types of information of the examination computer generated during the examination process, the behavior analysis module is based on the data collected by the information collection module to analyze whether there is any cheating behavior during the examination, the early warning display and processing module is used to display the early warning information sent by the behavior analysis module and to display the early warning information in the interface, the early warning information is confirmed by the staff and appropriate processing is made, the business query module is used to retrieve and view the historical early warning information and related data, the statistical module is used to statistically analyze all historical early warning information and corresponding processing flow and state according to different dimensions such as time and early warning type, and the system setting module is used to set the parameters such as white list and threshold value involved in the system.

[0005] As a further aspect of the present invention: the information acquisition module includes a video surveillance information acquisition unit, a hardware interface information acquisition unit, a network port communication information acquisition unit, a computer process information acquisition unit, a computer service information acquisition unit, and a network traffic information acquisition unit. The video surveillance information acquisition unit acquires examination room surveillance video, candidate face surveillance video, etc. The hardware interface information acquisition unit acquires usage information of all examination computer interfaces, including USB interface, PCI interface, SATA interface, display interface, network port, etc. The network port communication information acquisition unit acquires outbound and inbound information of all network ports of the examination computer. The computer process information acquisition unit acquires information of all processes running in the examination computer. The computer service information acquisition unit acquires information of all services running in the examination computer. The network traffic information acquisition unit monitors all network ports of the examination computer and acquires data input and output information of all network ports.

[0006] As a further aspect of the present invention, the information acquisition module also includes a real-time information acquisition unit for computer keyboard and mouse, which monitors the input status of input devices such as keyboards, mice, and touch screens connected to the examination computer in real time.

[0007] As a further aspect of this invention: the behavior analysis module includes a video surveillance analysis unit, a hardware interface access analysis unit, a network port communication analysis unit, a computer process legality analysis unit, a computer service legality analysis unit, and a network traffic analysis unit. The video surveillance analysis unit analyzes the behavior of examinees and other personnel. Examinee behavior analysis: if an examinee is looking around for an extended period or their attention is not on the screen, a warning message is issued. Other personnel behavior analysis: if other personnel are standing near the examination desk for an extended period, a warning message is issued. The hardware interface access analysis unit detects hardware access outside the whitelist of the examination computer and issues a warning message. The network port communication analysis unit detects network ports outside the whitelist of the examination computer and issues a warning message. The computer process legality analysis unit detects processes outside the whitelist of the examination computer running and issues a warning message. The computer service legality analysis unit detects services outside the whitelist of the examination computer running and issues a warning message. The network traffic analysis unit detects abnormal situations such as increased or terminated network traffic and issues a warning message.

[0008] As a further aspect of the present invention, the behavior analysis module also includes a real-time computer keyboard and mouse behavior analysis unit, which can perform the following analyses: 1. Abnormal keyboard input analysis: Since the driver's theory test only requires mouse clicks, a warning message is issued when prolonged input is detected on the computer keyboard during the test; 2. Answering too fast analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the examinee's answering speed is detected to be faster than the warning value; 3. Exam time too short analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the exam completion time is detected to be shorter than the warning value; 4. Abnormal answering process analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the examinee's answering interruption time exceeds the warning value during the answering process; 5. Abnormal mouse input jitter warning: The mouse or touchscreen click status is judged, and a warning message is issued when abnormal mouse trajectory jitter is detected during the exam.

[0009] As a further aspect of the present invention: the behavior analysis module, the early warning display and processing module, the business query module, the statistics module, and the system settings module are all located on the server.

[0010] The workflow of a driver's theory test anti-cheating detection system includes the following steps: S01: Driver's Theory Test Anti-Cheating Detection System Server Powers On. The server is powered on before the test begins; the system starts running automatically after power-on. S02: Modify and load the whitelists and system parameters of each exam computer's hardware, ports, processes, services, etc. Upon initial run, the system loads the default whitelist and system parameters. These can be modified according to the exam room and the needs of the day's exams; the system then loads the modified whitelist and parameters. S03: Power on the examination computer. The examination computer can only be powered on after the server of the driver's theory test anti-cheating detection system is running normally; otherwise, the information collection module will not function properly. S04: The driver's theory test anti-cheating detection system information collection module is activated, and begins monitoring hardware, ports, processes, services, etc. After the examination computer is powered on, the information collection module automatically starts, loads the whitelist and system parameters from the server through the interface, and begins monitoring hardware, ports, processes, services, etc., and sends the information to the server; S05: Enable real-time keyboard and mouse information collection for the examination computer. After the information collection module starts automatically, it will also enable real-time collection of keyboard and mouse information from the examination computer and send the information to the server. S06: Waiting for the exam to begin. After the server and exam computers have finished booting up and all project listeners have started, the system enters the waiting state for the exam to begin; S07: Real-time Analysis and Early Warning. The information collection module receives the exam start command and sends the information to the server. The server then begins real-time analysis of the data from the information collection module based on the whitelist and parameter configuration. When the data triggers an early warning, the warning information is sent to the early warning display and processing module. S08: Warning information is manually confirmed and processed accordingly. After receiving the warning information, the warning display and processing module displays a warning prompt on the interface. Staff members check the warning monitoring and data to comprehensively judge whether there is any cheating behavior. If cheating behavior is indeed found after manual judgment, the original data is recorded and saved in the system. If no cheating behavior is found, it is recorded as a false judgment in the system. S09: Exam over. Waiting for the next candidate. After the exam, save all listening data for this exam for later retrieval, and wait for the next candidate to begin their exam.

[0011] Compared with the prior art, the beneficial effects of the present invention are: This product achieves comprehensive, all-around, three-dimensional monitoring through multi-dimensional information collection. Compared with traditional systems that rely solely on video surveillance, the improved system extends the monitoring scope from the examination room environment to the internal workings of the examination computer. It deeply integrates underlying data such as hardware interfaces, network communication, process services, and keyboard and mouse operations, greatly enhancing the ability to detect cheating and reducing the space for cheating at its source. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the driver's theory test anti-cheating detection system in Embodiment 1 of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] This product integrates multi-dimensional data analysis, including video surveillance, hardware interfaces, network ports, processes, services, network traffic, and real-time keyboard and mouse behavior, to comprehensively ensure the fairness and impartiality of the examination. In particular, the innovative introduction of a real-time computer keyboard and mouse behavior analysis module monitors and analyzes the input devices such as keyboards, mice, and touchscreens used by examinees during the exam, thus improving the system's monitoring and analysis capabilities.

[0015] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0016] Example 1, see Figure 1 A driver's theory test anti-cheating detection system includes a server, an information collection module, a behavior analysis module, an early warning display and processing module, a business query module, a statistics module, and a system settings module. The server is electrically connected to the information collection module, behavior analysis module, early warning display and processing module, business query module, statistics module, and system settings module. The information collection module is deployed on the test computer and is used to collect various types of information generated by the test computer during the test. The behavior analysis module analyzes whether cheating behavior exists in the test based on the data collected by the information collection module. The early warning display and processing module is used to display the early warning information issued by the behavior analysis module and display it on the interface. Staff members confirm the early warning information and take appropriate actions. The business query module is used to retrieve and view historical early warning information and related data. The statistics module is used to statistically analyze all historical early warning information and corresponding processing procedures and statuses according to different dimensions such as time and early warning type. The system settings module is used to set parameters such as whitelists and thresholds involved in the system.

[0017] In one embodiment of the present invention, the information acquisition module includes a video surveillance information acquisition unit, a hardware interface information acquisition unit, a network port communication information acquisition unit, a computer process information acquisition unit, a computer service information acquisition unit, and a network traffic information acquisition unit. The video surveillance information acquisition unit acquires examination room surveillance video, candidate face surveillance video, etc. The hardware interface information acquisition unit acquires usage information of all examination computer interfaces, including USB interface, PCI interface, SATA interface, display interface, network port, etc. The network port communication information acquisition unit acquires outbound and inbound information of all network ports of the examination computer. The computer process information acquisition unit acquires information of all processes running in the examination computer. The computer service information acquisition unit acquires information of all services running in the examination computer. The network traffic information acquisition unit monitors all network ports of the examination computer and acquires data inbound and outbound information of all network ports. The behavior analysis module, early warning display and processing module, business query module, statistics module, and system settings module are all located on the server.

[0018] The workflow of a driver's theory test anti-cheating detection system includes the following steps: S01: First, power on the server; S02: Upon initial run, the default whitelist and system parameters are loaded. The whitelist and system parameters of items requiring warnings can be modified according to the examination room and the examination requirements of the day, and the modified whitelist and parameters are loaded. S03: After the server is running normally, power on the examination computer; S04: After the examination computer is powered on, the information collection module starts automatically and loads the whitelist and system parameters from the server through the interface. It then starts listening to information about hardware, ports, processes and services and sends the information to the server. S05: The information collection module enables real-time collection of keyboard and mouse information from the examination computer and sends the information to the server; S06: The server and examination computer have finished booting up. After all project listeners have started, the system enters the waiting state for the exam to begin. S07: The information collection module receives the exam start command and sends the information to the server. The server then begins to analyze the data from the information collection module in real time based on the whitelist and parameter configuration. When the data triggers an alert, the alert information is sent to the alert display and processing module. S08: After receiving the warning information, the warning display and processing module will display a warning prompt on the interface. Staff will check the warning monitoring and data to make a comprehensive judgment on whether there is cheating behavior. If cheating behavior is found to exist after manual judgment, the original data will be recorded and saved. If no cheating behavior is found, it will be recorded as a false judgment. S09: After the exam, save all the listening data of the examinee for this exam for later query, and wait for the next examinee to start the exam.

[0019] Example 2, see Figure 1 A driver's theory test anti-cheating detection system includes a server, an information collection module, a behavior analysis module, an early warning display and processing module, a business query module, a statistics module, and a system settings module. The server is electrically connected to the information collection module, behavior analysis module, early warning display and processing module, business query module, statistics module, and system settings module. The information collection module is deployed on the test computer and is used to collect various types of information generated by the test computer during the test. The behavior analysis module analyzes whether cheating behavior exists in the test based on the data collected by the information collection module. The early warning display and processing module is used to display the early warning information issued by the behavior analysis module and display it on the interface. Staff members confirm the early warning information and take appropriate actions. The business query module is used to retrieve and view historical early warning information and related data. The statistics module is used to statistically analyze all historical early warning information and corresponding processing procedures and statuses according to different dimensions such as time and early warning type. The system settings module is used to set parameters such as whitelists and thresholds involved in the system.

[0020] In one embodiment of the present invention, the information acquisition module includes a video surveillance information acquisition unit, a hardware interface information acquisition unit, a network port communication information acquisition unit, a computer process information acquisition unit, a computer service information acquisition unit, and a network traffic information acquisition unit. The video surveillance information acquisition unit acquires examination room surveillance video, candidate face surveillance video, etc. The hardware interface information acquisition unit acquires usage information of all examination computer interfaces, including USB interface, PCI interface, SATA interface, display interface, network port, etc. The network port communication information acquisition unit acquires outbound and inbound information of all network ports of the examination computer. The computer process information acquisition unit acquires information of all processes running in the examination computer. The computer service information acquisition unit acquires information of all services running in the examination computer. The network traffic information acquisition unit monitors all network ports of the examination computer and acquires data input and output information of all network ports.

[0021] In one embodiment of the present invention, the information acquisition module further includes a real-time information acquisition unit for computer keyboard and mouse, which monitors the input status of input devices such as keyboards, mice, and touch screens connected to the examination computer in real time. In one embodiment of the present invention, the information acquisition module further includes a computer keyboard and mouse real-time information acquisition unit to monitor the input status of input devices such as keyboards, mice and touch screens connected to the examination computer in real time.

[0022] In one embodiment of the present invention, the behavior analysis module includes a video surveillance analysis unit, a hardware interface access analysis unit, a network port communication analysis unit, a computer process legality analysis unit, a computer service legality analysis unit, and a network traffic analysis unit. The video surveillance analysis unit performs candidate behavior analysis and other personnel behavior analysis. For example, if a candidate is looking around for an extended period or their attention is not on the screen, a warning message is issued. For other personnel behavior analysis, if someone stands near the examination desk for an extended period, a warning message is issued. The hardware interface access analysis unit detects hardware access outside the whitelist of the examination computer and issues a warning message. The network port communication analysis unit detects network ports outside the whitelist of the examination computer and issues a warning message. The computer process legality analysis unit detects processes outside the whitelist of the examination computer running and issues a warning message. The computer service legality analysis unit detects services outside the whitelist of the examination computer running and issues a warning message. The network traffic analysis unit detects abnormal situations such as increased or terminated network traffic and issues a warning message.

[0023] In one embodiment of the present invention, the behavior analysis module further includes a real-time computer keyboard and mouse behavior analysis unit, which can perform the following analyses: 1. Abnormal keyboard input analysis: Since the driver's theory test only requires mouse clicks, a warning message is issued when prolonged input is detected on the computer keyboard during the test; 2. Answering too fast analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the examinee's answering speed is detected to be faster than the warning value; 3. Exam time too short analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the exam completion time is detected to be shorter than the warning value; 4. Abnormal answering process analysis: The mouse or touchscreen click status is judged, and a warning message is issued when the examinee's answering interruption time exceeds the warning value during the answering process; 5. Abnormal mouse input jitter warning: The mouse or touchscreen click status is judged, and a warning message is issued when abnormal mouse trajectory jitter is detected during the exam.

[0024] The workflow of a driver's theory test anti-cheating detection system includes the following steps: S01: Driver's Theory Test Anti-Cheating Detection System Server Powers On. The server is powered on before the test begins; the system starts running automatically after power-on. S02: Modify and load the whitelists and system parameters of each exam computer's hardware, ports, processes, services, etc. Upon initial run, the system loads the default whitelist and system parameters. These can be modified according to the exam room and the needs of the day's exams; the system then loads the modified whitelist and parameters. S03: Power on the examination computer. The examination computer can only be powered on after the server of the driver's theory test anti-cheating detection system is running normally; otherwise, the information collection module will not function properly. S04: The driver's theory test anti-cheating detection system information collection module is activated, and begins monitoring hardware, ports, processes, services, etc. After the examination computer is powered on, the information collection module automatically starts, loads the whitelist and system parameters from the server through the interface, and begins monitoring hardware, ports, processes, services, etc., and sends the information to the server; S05: Enable real-time keyboard and mouse information collection for the examination computer. After the information collection module starts automatically, it will also enable real-time collection of keyboard and mouse information from the examination computer and send the information to the server. S06: Waiting for the exam to begin. After the server and exam computers have finished booting up and all project listeners have started, the system enters the waiting state for the exam to begin; S07: Real-time Analysis and Early Warning. The information collection module receives the exam start command and sends the information to the server. The server then begins real-time analysis of the data from the information collection module based on the whitelist and parameter configuration. When the data triggers an early warning, the warning information is sent to the early warning display and processing module. S08: Warning information is manually confirmed and processed accordingly. After receiving the warning information, the warning display and processing module displays a warning prompt on the interface. Staff members check the warning monitoring and data to comprehensively judge whether there is any cheating behavior. If cheating behavior is indeed found after manual judgment, the original data is recorded and saved in the system. If no cheating behavior is found, it is recorded as a false judgment in the system. S09: Exam over. Waiting for the next candidate. After the exam, save all listening data for this exam for later retrieval, and wait for the next candidate to begin their exam.

[0025] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A driver theory test anti-cheating detection system, characterized by, It comprises a server, an information collection module, a behavior analysis module, an early warning display and processing module, a business query module, a statistics module and a system setting module, the server is electrically connected with the information collection module, the behavior analysis module, the early warning display and processing module, the business query module, the statistics module and the system setting module respectively, and the information collection module is arranged on an examination computer.

2. The driver theory test anti-cheating detection system according to claim 1, characterized in that, The information collection module comprises a video monitoring information collection unit, a hardware interface information collection unit, a network port communication information collection unit, a computer process information collection unit, a computer service information collection unit and a network traffic information collection unit.

3. The driver theory test anti-cheating detection system according to claim 2, characterized in that, The information collection module further comprises a computer keyboard and mouse real-time information collection unit.

4. The driver theory test anti-cheating detection system according to claim 1, characterized in that, The behavior analysis module comprises a video monitoring analysis unit, a hardware interface access analysis unit, a network port communication analysis unit, a computer process legality analysis unit, a computer service legality analysis unit and a network traffic analysis unit.

5. The driver theory test anti-cheating detection system according to claim 4, characterized in that, The behavior analysis module further comprises a computer keyboard and mouse real-time behavior analysis unit.

6. The driver's license theory test anti-cheating detection system according to claim 1 or 2, characterized in that, The behavior analysis module, the early warning display and processing module, the business query module, the statistics module and the system setting module are arranged on the server.

7. A workflow of a driver theory test anti-cheating detection system, characterized in that, It comprises the following steps: S01: first, start the server; S02: when initially running, load the default white list and system parameters, and the white list and the parameters after modification can be loaded according to the examination room and the examination requirements of the day, and the items needing early warning and the system parameters are modified; S03: after the server normally runs, start the examination computer; S04: after the examination computer starts, the information collection module automatically starts, loads the white list and the system parameters from the server through the interface, starts to listen to the information of the hardware, the port, the process and the service, and sends the information to the server; S05: the information collection module starts the real-time information collection of the keyboard and mouse of the examination computer, and sends the information to the server; S06: after the server and the examination computer start and all the items start to listen, enter the waiting state for the start of the examination; S07: the information collection module obtains the start command of the examination, sends the information to the server, and the server starts to analyze the data of the information collection module according to the white list and the parameters; when the data triggers the early warning, the early warning information is sent to the early warning display and processing module; S08: after receiving the early warning information, the early warning display and processing module makes a warning prompt in the interface, and the staff judges whether there is cheating behavior by checking the early warning monitoring and data; If it is determined that there is cheating behavior, record and save the original data; If it is determined that there is no cheating behavior, record it as a false judgment; S09: after the examination ends, save all the listening data of the examinee in this examination for later query, and wait for the next examinee to start the examination.

Images