Intelligent anti-photographing monitoring, blocking and terminal security sensing system

Abstract

The invention discloses an intelligent anti-photographing monitoring, blocking and terminal security sensing system, which comprises the following modules: a camera authorization and watermark control module, which is used for configuring a camera use authorization mode and desktop watermark prompt information display according to a security policy; the environment image acquisition and mode selection module is used for acquiring image data of the surrounding environment of the display screen of the terminal and selecting an identification mode; the AI behavior recognition engine module is used for extracting visual features, positioning shooting related equipment and generating shooting behavior judgment data and abnormal behavior confirmation data; the abnormal behavior handling module is used for executing handling operation when an abnormal behavior is detected; and the unlocking control and security audit module is used for unlocking the terminal after the exception is eliminated and generating an audit log and alarm information. According to the invention, an integrated processing flow of intelligent sensing, active blocking and safety auditing for preventing the photographing risk of the terminal is realized.

Description

Technical Field

[0001] This invention relates to the fields of terminal information security and computer vision technology, and in particular to an intelligent anti-photography monitoring, blocking, and terminal security perception system. Background Technology

[0002] With the widespread use of information-based office environments, classified terminals, and remote collaboration devices, terminal display content faces security risks such as unauthorized photography, screen information leakage, and abnormal terminal operation. Monitoring, blocking, and terminal security awareness technologies for photographing are increasingly important. Existing terminal security protection solutions typically manage photographing behavior through camera access control, fixed rule restrictions, or simple image recognition. Some solutions incorporate target detection algorithms to analyze the surrounding environment of the terminal.

[0003] However, in practical applications, the following shortcomings still exist: Existing technologies often rely on single rules, making it difficult to accurately identify shooting devices in complex environments, resulting in a high false negative rate; the determination of continuous shooting behavior lacks joint analysis of the temporal change characteristics of the device and the spatial relationship of the terminal display screen, making it difficult to distinguish between normal holding behavior and actual shooting behavior; in reasonable usage scenarios such as QR code login, existing solutions lack effective scenario exclusion mechanisms, which can easily lead to misjudgments as abnormal photography behavior; at the same time, there is a lack of a unified data loop between abnormal behavior identification, handling execution, unlocking, and security auditing, resulting in unclear unlocking conditions and incomplete audit information, making it difficult to meet the usage requirements of high-security terminals.

[0004] Therefore, how to provide an intelligent anti-photography monitoring, blocking, and terminal security sensing system is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose an intelligent anti-photography monitoring, blocking, and terminal security perception system. This invention constructs an AI behavior recognition engine to intelligently identify and judge shooting-related devices and shooting behaviors in the surrounding environment of the terminal. When abnormal behavior is detected, it will trigger actions such as screen locking, peripheral device restriction, and security auditing. At the same time, it will effectively exclude reasonable usage scenarios such as QR code login, and realize closed-loop management of abnormal removal and unlocking control. It has the advantages of high accuracy of photo-taking behavior recognition, low false judgment rate, timely response, and strong terminal security auditability.

[0006] An intelligent anti-photography monitoring, blocking, and terminal security sensing system according to an embodiment of the present invention includes the following modules: The camera authorization and watermark control module is used to configure the camera usage authorization method according to the security policy when the terminal device starts up, restarts or logs off, and to display a watermark prompt message on the terminal desktop while the camera is on. The environmental image acquisition and mode selection module is used to acquire environmental image data of the environment around the terminal display screen after the camera is enabled, and to determine the recognition mode based on the terminal's computing resource status and network status. The AI ​​behavior recognition engine module is used to process environmental image data, extract visual features, locate shooting-related devices, and combine continuous environmental image data to generate shooting behavior judgment data and abnormal behavior confirmation data. The abnormal behavior handling module is used to perform handling operations according to the security policy when abnormal behavior confirmation data indicates the presence of abnormal shooting behavior, abnormal camera activation failure behavior, abnormal camera obstruction behavior, or abnormal external display screen behavior. The unlock control and security audit module is used to unlock the terminal after abnormal behavior is handled, generate log audit data when abnormal behavior occurs, and perform sensitive word detection on desktop screenshots to generate alarm information.

[0007] An intelligent method for preventing camera-based detection, blocking, and terminal security sensing according to an embodiment of the present invention includes the following steps: Step 1: When the terminal device starts up, restarts, or logs off, configure the camera usage authorization method according to the security policy, and display a watermark prompt message on the terminal desktop while the camera is on; Step 2: After the camera is enabled, collect environmental image data of the environment around the terminal display screen, and determine whether to process the environmental image data using client recognition mode, server recognition mode or AI camera recognition mode based on the terminal's computing resource status and network status. Step 3: Input the environmental image data into the AI ​​behavior recognition engine for processing. The AI ​​behavior recognition engine includes a visual feature extraction unit, a shooting behavior recognition unit, and an abnormal behavior judgment unit. The visual feature extraction unit performs multi-scale visual feature recognition and extraction on the environmental image data, generates visual feature data, and locates the shooting-related equipment. Step 4: The shooting behavior recognition unit analyzes the posture changes of shooting-related devices and their spatial relationship with the terminal display screen in continuous environmental image data based on visual feature data, and generates shooting behavior judgment data. Step 5: The abnormal behavior determination unit calculates the mobile phone recognition confidence based on the shooting behavior determination data, and combines the semantic recognition results of the display interface and the camera occlusion rate threshold to generate abnormal behavior confirmation data for shooting behavior, QR code login scenario and camera occlusion behavior. Step Six: When the abnormal behavior confirmation data indicates abnormal shooting behavior, camera activation failure, camera obstruction, or external display screen behavior, perform the corresponding handling operation according to the security policy. Step 7: After handling the abnormal behavior, continuously monitor the terminal status, unlock the terminal when the abnormal behavior confirmation data indicates that the abnormal behavior has been eliminated, generate log audit data when the abnormal behavior occurs, and perform sensitive word detection on the desktop screenshot to generate alarm information.

[0008] Optionally, step one specifically includes: When the terminal device starts up, restarts, or the user logs out, the current running status of the terminal is obtained and the camera initialization process is triggered; The camera usage authorization method is determined according to a preset security policy. The security policy is used to indicate whether user authorization is required to enable the camera. When the security policy indicates that user authorization is not required, the camera is controlled to enter the enabled state and start the subsequent image acquisition process. When the security policy indicates that user authorization is required, an authorization confirmation interface pops up on the terminal display interface. The authorization confirmation interface contains a prompt title and prompt content configured by the security policy. The camera is enabled after receiving user confirmation. The camera is kept in the off state when receiving user rejection. While the camera is enabled, a watermark message is overlaid on a designated display area on the terminal desktop. If the camera fails to enable, the camera's enabling status information is recorded.

[0009] Optionally, step two specifically includes: When the camera is enabled, it continuously captures images of the environment around the terminal display screen at a preset acquisition frequency, generates corresponding environmental image data, and marks the acquisition time information for each frame of environmental image data. Obtain the current computing resource status information and network connection status information of the terminal; Based on computing resource status information and network connection status information, and matched with preset recognition mode selection rules, it is determined whether to use client recognition mode, server recognition mode or AI camera recognition mode for the environmental image data. The client-side recognition mode retains environmental image data locally on the terminal and provides it to the AI ​​behavior recognition engine for processing; The server-side recognition mode sends environmental image data to the model server according to preset transmission rules, and after receiving the recognition processing instruction, provides the environmental image data to the AI ​​behavior recognition engine for processing; The AI ​​camera recognition mode uses an AI behavior recognition engine to process environmental image data on the camera side.

[0010] Optionally, the visual feature extraction unit performs multi-scale visual feature extraction on the environmental image data based on the YOLO model to generate visual feature data.

[0011] Optionally, step four specifically includes: Based on visual feature data, obtain the feature data sequence corresponding to the shooting equipment in continuous environmental image data; Perform time-series correlation processing on the feature data sequence to obtain a time-series feature representation; Based on temporal feature representation, the pose changes of shooting-related equipment in continuous environmental image data are calculated; The spatial relationship between the shooting equipment and the terminal display screen is determined based on visual feature data; After normalizing the posture changes and spatial relationships respectively, a weighted summation process is performed according to a preset weight ratio to form the joint behavioral characteristics of the shooting-related equipment. The stability of the joint behavioral features is judged within a continuous time window. When the joint behavioral features continue to increase or remain above the preset judgment level within the time window, shooting behavior judgment data is generated.

[0012] Optionally, step five specifically includes: Based on the shooting behavior determination data, the behavior determination results used to characterize the possibility of shooting related equipment constituting shooting behavior are extracted, and the behavior determination results are converted into corresponding initial determination weights. Based on visual feature data, the feature response intensity of the shooting device in the environmental image data is obtained, and the initial judgment weight is adjusted according to the stability of the feature response intensity in continuous environmental image data to generate the mobile phone recognition confidence score. The confidence level of mobile phone recognition is compared with a preset confidence threshold. When the confidence level of mobile phone recognition reaches or exceeds the confidence threshold, a candidate result of shooting anomaly is generated. Execute the exclusion scanning procedure and generate the corresponding allowed scenario identifier; Based on the pixel distribution of the camera's visible area in the environmental image data, the pixel set corresponding to the occluded area is extracted, and the proportion of the number of pixels in the occluded area to the total number of pixels in the camera's visible area is calculated to obtain the camera occlusion rate. The camera occlusion rate is compared with a preset occlusion rate threshold. When the camera occlusion rate reaches or exceeds the occlusion rate threshold, a camera occlusion abnormality flag is generated. Based on the candidate results of abnormal shooting, the allowed scene identifier, and the abnormal camera occlusion identifier, the shooting behavior, the QR code login scene, and the camera occlusion behavior are comprehensively judged to generate abnormal behavior confirmation data.

[0013] Optionally, step six specifically includes: Based on the abnormal behavior confirmation data, abnormal behavior type identifiers are identified, including abnormal shooting behavior identifiers, abnormal camera activation failure behavior identifiers, abnormal camera obstruction behavior identifiers, and abnormal external display screen behavior identifiers. Based on the abnormal behavior type identifier, the corresponding abnormal handling strategy is matched from the preset security policy; When the abnormal behavior type is identified as an abnormal shooting behavior identifier, a screen lock control command is generated and sent to the terminal display control module to control the terminal display screen to enter the locked state. When the abnormal behavior type is identified as camera activation failure abnormal behavior, an abnormal status prompt instruction is generated, and the corresponding abnormal prompt information is output on the terminal display interface, while the camera activation status information is recorded. When the abnormal behavior type is identified as camera occlusion abnormal behavior, a screen lock control command is generated, and the corresponding occlusion abnormality indicator and environmental image data are recorded. When the abnormal behavior type is identified as an abnormal behavior identifier for an external display screen, an external display screen control command is generated and executed through the terminal peripheral management to prohibit or restrict the display output of the external display device. While executing the exception handling strategy, process record information is generated, and the process record information is associated and stored with the corresponding exception behavior confirmation data.

[0014] Optionally, step seven specifically includes: After handling abnormal behavior, the abnormal behavior confirmation data is updated based on continuously collected environmental image data and terminal operating status information; When the updated abnormal behavior confirmation data indicates that the abnormal shooting behavior, camera activation failure behavior, camera obstruction behavior, or external display screen behavior has been eliminated, an abnormality removal flag is generated. Based on the abnormal unlocking flag, determine whether the automatic unlocking conditions are met. When the preset automatic unlocking conditions are met, unlock the terminal display screen. When the automatic unlocking conditions are not met, the terminal receives an unlock command from the user or a remote unlock command from the management terminal to unlock the terminal display screen. When abnormal behavior occurs, generate security audit data including information about the abnormal behavior and desktop screenshots; Sensitive word detection is performed on screenshots of the terminal desktop. When text information that matches the preset sensitive word rules is detected, a corresponding alarm message is generated and the alarm message is associated with and stored with security audit data.

[0015] Optionally, the security audit data includes user information, abnormal behavior type, abnormal trigger time, handling method, unlocking method, environmental image data, and terminal desktop screenshots.

[0016] The beneficial effects of this invention are: This invention adopts a modular system architecture design, dividing the terminal anti-photography process into a camera authorization and watermark control module, an environmental image acquisition and mode selection module, an AI behavior recognition engine module, an abnormal behavior handling module, and an unlock control and security audit module, forming a complete terminal security perception closed loop. The AI ​​behavior recognition engine module uses the YOLO model, improving the accuracy and stability of recognizing shooting-related devices and shooting behaviors. Simultaneously, modularization enables temporal analysis of continuous environmental image data, exclusion of QR code login scenarios, and recognition of camera occlusion behaviors, effectively reducing the impact of misjudgments on normal terminal use. Furthermore, the interconnected design of abnormal handling, unlock control, and log auditing among the modules achieves controllable abnormal behavior, traceable handling processes, and complete audit information for terminal security protection, thereby significantly improving the overall security protection capability of the terminal's displayed content while ensuring system real-time performance and scalability. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0018] Figure 1 The flowchart below shows an intelligent anti-photography monitoring, blocking, and terminal security sensing system proposed in this invention. Figure 2 This is a schematic diagram of an intelligent anti-photography monitoring, blocking, and terminal security sensing method proposed in this invention. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0020] refer to Figure 1 An intelligent anti-photography monitoring, blocking, and terminal security sensing system includes the following modules: The camera authorization and watermark control module is used to configure the camera usage authorization method according to the security policy when the terminal device starts up, restarts or logs off, and to display a watermark prompt message on the terminal desktop while the camera is on. The environmental image acquisition and mode selection module is used to acquire environmental image data of the environment around the terminal display screen after the camera is enabled, and to determine the recognition mode based on the terminal's computing resource status and network status. The AI ​​behavior recognition engine module is used to process environmental image data, extract visual features, locate shooting-related devices, and combine continuous environmental image data to generate shooting behavior judgment data and abnormal behavior confirmation data. The abnormal behavior handling module is used to perform handling operations according to the security policy when abnormal behavior confirmation data indicates the presence of abnormal shooting behavior, abnormal camera activation failure behavior, abnormal camera obstruction behavior, or abnormal external display screen behavior. The unlock control and security audit module is used to unlock the terminal after abnormal behavior is handled, generate log audit data when abnormal behavior occurs, and perform sensitive word detection on desktop screenshots to generate alarm information.

[0021] refer to Figure 2 An intelligent method for preventing camera-based monitoring, blocking, and terminal security sensing includes the following steps: Step 1: When the terminal device starts up, restarts, or logs off, configure the camera usage authorization method according to the security policy, and display a watermark prompt message on the terminal desktop while the camera is on; Step 2: After the camera is enabled, collect environmental image data of the environment around the terminal display screen, and determine whether to process the environmental image data using client recognition mode, server recognition mode or AI camera recognition mode based on the terminal's computing resource status and network status. Step 3: Input the environmental image data into the AI ​​behavior recognition engine for processing. The AI ​​behavior recognition engine includes a visual feature extraction unit, a shooting behavior recognition unit, and an abnormal behavior judgment unit. The visual feature extraction unit performs multi-scale visual feature recognition and extraction on the environmental image data, generates visual feature data, and locates the shooting-related equipment. Step 4: The shooting behavior recognition unit analyzes the posture changes of shooting-related devices and their spatial relationship with the terminal display screen in continuous environmental image data based on visual feature data, and generates shooting behavior judgment data. Step 5: The abnormal behavior determination unit calculates the mobile phone recognition confidence based on the shooting behavior determination data, and combines the semantic recognition results of the display interface and the camera occlusion rate threshold to generate abnormal behavior confirmation data for shooting behavior, QR code login scenario and camera occlusion behavior. Step Six: When the abnormal behavior confirmation data indicates abnormal shooting behavior, camera activation failure, camera obstruction, or external display screen behavior, perform the corresponding handling operation according to the security policy. Step 7: After handling the abnormal behavior, continuously monitor the terminal status, unlock the terminal when the abnormal behavior confirmation data indicates that the abnormal behavior has been eliminated, generate log audit data when the abnormal behavior occurs, and perform sensitive word detection on the desktop screenshot to generate alarm information.

[0022] In this embodiment, step one specifically includes: When the terminal device starts up, restarts, or the user logs out, the current running status of the terminal is obtained and the camera initialization process is triggered; The camera usage authorization method is determined according to a preset security policy. The security policy is used to indicate whether user authorization is required to enable the camera. When the security policy indicates that user authorization is not required, the camera is controlled to enter the enabled state and start the subsequent image acquisition process. When the security policy indicates that user authorization is required, an authorization confirmation interface pops up on the terminal display interface. The authorization confirmation interface contains a prompt title and prompt content configured by the security policy. The camera is enabled after receiving user confirmation. The camera is kept in the off state when receiving user rejection. While the camera is enabled, a watermark message is overlaid on a designated display area on the terminal desktop. The watermark message includes text indicating that the camera is enabled, and the corresponding display transparency and display style are configured according to the security policy. If the camera fails to enable, the camera enable status information is recorded.

[0023] In this embodiment, step two specifically includes: When the camera is enabled, it continuously captures images of the environment around the terminal display screen at a preset acquisition frequency, generates corresponding environmental image data, and marks the acquisition time information for each frame of environmental image data. Obtain the current computing resource status information and network connection status information of the terminal. The computing resource status information includes the available load of the terminal processor, and the network connection status information includes the network connectivity status. Based on computing resource status information and network connection status information, and matched with preset recognition mode selection rules, it is determined whether to use client recognition mode, server recognition mode or AI camera recognition mode for the environmental image data. The client-side recognition mode retains environmental image data locally on the terminal and provides it to the AI ​​behavior recognition engine for processing; The server-side recognition mode sends environmental image data to the model server according to preset transmission rules, and after receiving the recognition processing instruction, provides the environmental image data to the AI ​​behavior recognition engine for processing; The AI ​​camera recognition mode uses an AI behavior recognition engine to process environmental image data on the camera side.

[0024] In this embodiment, the visual feature extraction unit performs multi-scale visual feature extraction on environmental image data based on the YOLO model to generate visual feature data.

[0025] In this embodiment, step four specifically includes: Based on visual feature data, a feature data sequence corresponding to the shooting device is obtained from continuous environmental image data, and the feature data sequence is arranged according to the acquisition time order of the environmental image data; Temporal correlation processing is performed on the feature data sequence. By aligning and correlating the visual feature data at adjacent time points, a temporal feature representation is obtained to characterize the continuously changing state of the shooting-related equipment. Based on temporal feature representation, the attitude change of the shooting-related device in continuous environmental image data is calculated. The attitude change includes the orientation change and relative displacement change of the shooting-related device in the image coordinate system. The spatial relationship between the shooting-related equipment and the terminal display screen is determined based on visual feature data. The spatial relationship includes the positional relationship of the shooting-related equipment relative to the terminal display area in the environmental image data. After normalizing the posture changes and spatial relationships respectively, a multiplication and accumulation process is performed according to a preset weight ratio to form the joint behavioral features of the shooting-related devices. The preset weight ratio is used to limit the contribution of posture changes and spatial relationships to the joint behavioral features. The stability of the joint behavioral features is judged within a continuous time window. When the joint behavioral features continue to increase or remain above the preset judgment level within the time window, shooting behavior judgment data is generated.

[0026] In this embodiment, step five specifically includes: Based on the shooting behavior determination data, the behavior determination results used to characterize the possibility of shooting related equipment constituting shooting behavior are extracted, and the behavior determination results are converted into corresponding initial determination weights. Based on visual feature data, the feature response intensity of the shooting-related device in the environmental image data is obtained, and the initial judgment weight is weighted and corrected according to the stability of the feature response intensity in continuous environmental image data to generate a mobile phone recognition confidence score that characterizes the credibility of the shooting-related device in constituting the shooting behavior. The confidence level of mobile phone recognition is compared with a preset confidence threshold. When the confidence level of mobile phone recognition reaches or exceeds the confidence threshold, a candidate result of shooting anomaly is generated. The process of excluding QR code scanning is executed. Based on the image data of the current display interface of the terminal, the interface features are extracted and matched with the pre-configured QR code login interface feature template. When the matching result meets the preset similarity condition, the abnormal candidate result of the shooting is marked as a QR code login scene and the corresponding allowed scene identifier is generated. Based on the pixel distribution of the camera's visible area in the environmental image data, the pixel set corresponding to the occluded area is extracted, and the proportion of the number of pixels in the occluded area to the total number of pixels in the camera's visible area is calculated to obtain the camera occlusion rate. The camera occlusion rate is compared with a preset occlusion rate threshold. When the camera occlusion rate reaches or exceeds the occlusion rate threshold, a camera occlusion abnormality flag is generated. Based on the candidate results of abnormal shooting, the allowed scene identifier, and the abnormal camera occlusion identifier, the shooting behavior, the QR code login scene, and the camera occlusion behavior are comprehensively judged to generate abnormal behavior confirmation data.

[0027] In this embodiment, step six specifically includes: Based on the abnormal behavior confirmation data, abnormal behavior type identifiers are identified, including abnormal shooting behavior identifiers, abnormal camera activation failure behavior identifiers, abnormal camera obstruction behavior identifiers, and abnormal external display screen behavior identifiers. Based on the abnormal behavior type identifier, the corresponding abnormal handling strategy is matched from the preset security policy. The abnormal handling strategy is used to indicate the combination of handling actions to be performed for different abnormal behavior types. When the abnormal behavior type is identified as an abnormal shooting behavior identifier, a screen lock control command is generated and sent to the terminal display control module to control the terminal display screen to enter the locked state. When the abnormal behavior type is identified as camera activation failure abnormal behavior, an abnormal status prompt instruction is generated, and the corresponding abnormal prompt information is output on the terminal display interface, while the camera activation status information is recorded. When the abnormal behavior type is identified as camera occlusion abnormal behavior, a screen lock control command is generated, and the corresponding occlusion abnormality indicator and environmental image data are recorded. When the abnormal behavior type is identified as an abnormal behavior identifier for an external display screen, an external display screen control command is generated and executed through the terminal peripheral management to prohibit or restrict the display output of the external display device. While executing the exception handling strategy, process record information is generated, and the process record information is associated and stored with the corresponding exception behavior confirmation data.

[0028] In this embodiment, step seven specifically includes: After handling abnormal behavior, the abnormal behavior confirmation data is updated based on continuously collected environmental image data and terminal operating status information to determine whether the abnormal behavior persists. When the updated abnormal behavior confirmation data indicates that the abnormal shooting behavior, camera activation failure behavior, camera obstruction behavior, or external display screen behavior has been eliminated, an abnormality removal flag is generated. Based on the abnormal unlocking flag, determine whether the automatic unlocking conditions are met. When the preset automatic unlocking conditions are met, unlock the terminal display screen. When the automatic unlocking conditions are not met, the terminal receives an unlock command from the user or a remote unlock command from the management terminal to unlock the terminal display screen. When abnormal behavior occurs, generate security audit data including information about the abnormal behavior and desktop screenshots; Sensitive word detection is performed on screenshots of the terminal desktop. When text information that matches the preset sensitive word rules is detected, a corresponding alarm message is generated and the alarm message is associated with and stored with security audit data.

[0029] In this embodiment, the security audit data includes user information, abnormal behavior type, abnormal trigger time, handling method, unlocking method, environmental image data, and terminal desktop screenshot.

[0030] Example 1: To verify the feasibility of this invention in practice, it was applied to a terminal information security protection scenario in an office area. This office area is primarily used for R&D data processing, internal system maintenance, and confidential business operations. With a large number of office terminals and frequent personnel movement, the terminal screen content is at risk of being illegally photographed, leaked, or exhibiting abnormal terminal usage behavior during daily use. To enhance the security of terminal display content without affecting employees' normal work experience, the company deployed the intelligent anti-photography monitoring, blocking, and terminal security sensing system described in this invention on the office terminals.

[0031] In this implementation scenario, each office terminal is equipped with a front-facing camera, which is deeply integrated with the terminal's operating system. The system of this invention automatically runs upon terminal startup or user login, and manages the cameras uniformly according to the enterprise security policy through a camera authorization and watermark control module. Once the terminal enters normal office mode, the system automatically displays a camera-enabled watermark prompt on the terminal desktop to inform the user that the terminal is currently under security monitoring. Subsequently, the environmental image acquisition and mode selection module begins operation, continuously acquiring environmental image data of the environment surrounding the terminal display screen at a fixed frame rate, and obtaining the terminal's computing resource status and network status in real time. Based on the current status, it dynamically selects the client recognition mode, server recognition mode, or AI camera recognition mode, thereby ensuring stable system operation under different network and load conditions.

[0032] The collected environmental image data is fed into the AI ​​behavior recognition engine module for processing. This module uses a YOLO model to extract multi-scale visual features from the environmental image data. For continuously collected environmental image data, the system further analyzes the posture changes of the shooting device and its spatial relationship with the terminal display screen to generate shooting behavior judgment data. Based on this, the system combines the phone's recognition confidence level, the semantic recognition results of the display interface, and the camera occlusion rate threshold to comprehensively judge shooting behavior, QR code login scenarios, and camera occlusion behavior, ultimately generating abnormal behavior confirmation data.

[0033] After confirming abnormal behavior, the abnormal behavior handling module executes corresponding handling operations according to the enterprise security policy, including automatically locking the terminal display screen, restricting the output of external display devices, notifying the user of the abnormal status, and recording audit information in the logs. When the system continuously detects that the abnormal behavior has been eliminated, the unlock control and security audit module unlocks the terminal based on automatic unlock conditions or user unlock commands, and generates complete security audit data for subsequent security analysis and compliance auditing.

[0034] To evaluate the effectiveness of this invention in practical applications, 50 terminals were selected as test samples in the office area. The system was run continuously for 30 working days, and the system operation data was statistically analyzed. During the test, various scenarios were simulated, including illegal photography, normal QR code login, normal mobile phone holding, and camera obstruction, to evaluate the system's recognition accuracy, false negative rate, and response time.

[0035] Table 1 shows some of the key data collected during the testing process: Table 1. Statistical table of system recognition performance in different application scenarios

[0036] As shown in Table 1, in the illegal photography test, the system of this invention can accurately identify most photography behaviors, with a correct recognition rate of 94.4% and a low number of false negatives. In normal QR code login scenarios, the introduction of a QR code login scenario exclusion mechanism effectively avoids interference with normal login operations. In camera obstruction scenarios, the system can promptly identify obstruction anomalies and trigger corresponding actions, with a response time of less than 200 milliseconds, meeting the real-time requirements of actual office scenarios. Further comparison of security event statistics before and after deploying the system of this invention is shown in Table 2.

[0037] Table 2. Comparison of Security Incidents Before and After System Deployment

[0038] As shown in Table 2, after deploying the system of this invention, the number of alarms related to terminal photography decreased significantly, and incidents of leakage of confidential information were effectively curbed. Simultaneously, through the coordinated design of the unlocking control and security audit modules, the integrity rate of terminal security audit data was significantly improved, meeting the enterprise's requirements for security compliance and post-incident traceability.

[0039] In summary, the above embodiments demonstrate that this invention employs a modular system architecture, organically combining camera authorization management, environmental image acquisition, AI behavior recognition, abnormal behavior handling, unlocking control, and security auditing. This achieves high-precision recognition and stable judgment of photo-taking behavior. Simultaneously, by excluding QR code login scenarios and identifying camera occlusion, the impact on normal terminal use is effectively reduced. Furthermore, the closed-loop design of abnormal handling and auditing ensures the controllability and traceability of terminal security status. These embodiments fully demonstrate the feasibility, effectiveness, and application value of this invention in practical terminal security protection scenarios.

[0040] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An intelligent anti-photography monitoring, blocking, and terminal security sensing system, characterized in that, Includes the following modules: The camera authorization and watermark control module is used to configure the camera usage authorization method according to the security policy when the terminal device starts up, restarts or logs off, and to display a watermark prompt message on the terminal desktop while the camera is on. The environmental image acquisition and mode selection module is used to acquire environmental image data of the environment around the terminal display screen after the camera is enabled, and to determine the recognition mode based on the terminal's computing resource status and network status. The AI ​​behavior recognition engine module is used to process environmental image data, extract visual features, locate shooting-related devices, and combine continuous environmental image data to generate shooting behavior judgment data and abnormal behavior confirmation data. The abnormal behavior handling module is used to perform handling operations according to the security policy when abnormal behavior confirmation data indicates the presence of abnormal shooting behavior, abnormal camera activation failure behavior, abnormal camera obstruction behavior, or abnormal external display screen behavior. The unlock control and security audit module is used to unlock the terminal after abnormal behavior is handled, generate log audit data when abnormal behavior occurs, and perform sensitive word detection on desktop screenshots to generate alarm information.

2. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 1, characterized in that, The modules are connected in the following way: Step 1: When the terminal device starts up, restarts, or logs off, configure the camera usage authorization method according to the security policy, and display a watermark prompt message on the terminal desktop while the camera is on; Step 2: After the camera is enabled, collect environmental image data of the environment around the terminal display screen, and determine whether to process the environmental image data using client recognition mode, server recognition mode or AI camera recognition mode based on the terminal's computing resource status and network status. Step 3: Input the environmental image data into the AI ​​behavior recognition engine for processing. The AI ​​behavior recognition engine includes a visual feature extraction unit, a shooting behavior recognition unit, and an abnormal behavior judgment unit. The visual feature extraction unit performs multi-scale visual feature recognition and extraction on the environmental image data, generates visual feature data, and locates the shooting-related equipment. Step 4: The shooting behavior recognition unit analyzes the posture changes of shooting-related devices and their spatial relationship with the terminal display screen in continuous environmental image data based on visual feature data, and generates shooting behavior judgment data. Step 5: The abnormal behavior determination unit calculates the mobile phone recognition confidence based on the shooting behavior determination data, and combines the semantic recognition results of the display interface and the camera occlusion rate threshold to generate abnormal behavior confirmation data for shooting behavior, QR code login scenario and camera occlusion behavior. Step Six: When the abnormal behavior confirmation data indicates abnormal shooting behavior, camera activation failure, camera obstruction, or external display screen behavior, perform the corresponding handling operation according to the security policy. Step 7: After handling the abnormal behavior, continuously monitor the terminal status, unlock the terminal when the abnormal behavior confirmation data indicates that the abnormal behavior has been eliminated, generate log audit data when the abnormal behavior occurs, and perform sensitive word detection on the desktop screenshot to generate alarm information.

3. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step one specifically includes: When the terminal device starts up, restarts, or the user logs out, the current running status of the terminal is obtained and the camera initialization process is triggered; The camera usage authorization method is determined according to a preset security policy. The security policy is used to indicate whether user authorization is required to enable the camera. When the security policy indicates that user authorization is not required, the camera is controlled to enter the enabled state and start the subsequent image acquisition process. When the security policy indicates that user authorization is required, an authorization confirmation interface pops up on the terminal display interface. The authorization confirmation interface contains a prompt title and prompt content configured by the security policy. The camera is enabled after receiving user confirmation. The camera is kept in the off state when receiving user rejection. While the camera is enabled, a watermark message is overlaid on a designated display area on the terminal desktop. If the camera fails to enable, the camera's enabling status information is recorded.

4. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step two specifically includes: When the camera is enabled, it continuously captures images of the environment around the terminal display screen at a preset acquisition frequency, generates corresponding environmental image data, and marks the acquisition time information for each frame of environmental image data. Obtain the current computing resource status information and network connection status information of the terminal; Based on computing resource status information and network connection status information, and matched with preset recognition mode selection rules, it is determined whether to use client recognition mode, server recognition mode or AI camera recognition mode for the environmental image data. The client-side recognition mode retains environmental image data locally on the terminal and provides it to the AI ​​behavior recognition engine for processing; The server-side recognition mode sends environmental image data to the model server according to preset transmission rules, and after receiving the recognition processing instruction, provides the environmental image data to the AI ​​behavior recognition engine for processing; The AI ​​camera recognition mode uses an AI behavior recognition engine to process environmental image data on the camera side.

5. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, The visual feature extraction unit performs multi-scale visual feature extraction on environmental image data based on the YOLO model to generate visual feature data.

6. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step four specifically includes: Based on visual feature data, obtain the feature data sequence corresponding to the shooting equipment in continuous environmental image data; Perform time-series correlation processing on the feature data sequence to obtain a time-series feature representation; Based on temporal feature representation, the pose changes of shooting-related equipment in continuous environmental image data are calculated; The spatial relationship between the shooting equipment and the terminal display screen is determined based on visual feature data; After normalizing the posture changes and spatial relationships respectively, a weighted summation process is performed according to a preset weight ratio to form the joint behavioral characteristics of the shooting-related equipment. The stability of the joint behavioral features is judged within a continuous time window. When the joint behavioral features continue to increase or remain above the preset judgment level within the time window, shooting behavior judgment data is generated.

7. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step five specifically includes: Based on the shooting behavior determination data, the behavior determination results used to characterize the possibility of shooting related equipment constituting shooting behavior are extracted, and the behavior determination results are converted into corresponding initial determination weights. Based on visual feature data, the feature response intensity of the shooting device in the environmental image data is obtained, and the initial judgment weight is adjusted according to the stability of the feature response intensity in continuous environmental image data to generate the mobile phone recognition confidence score. The confidence level of mobile phone recognition is compared with a preset confidence threshold. When the confidence level of mobile phone recognition reaches or exceeds the confidence threshold, a candidate result of shooting anomaly is generated. Execute the exclusion scanning procedure and generate the corresponding allowed scenario identifier; Based on the pixel distribution of the camera's visible area in the environmental image data, the pixel set corresponding to the occluded area is extracted, and the proportion of the number of pixels in the occluded area to the total number of pixels in the camera's visible area is calculated to obtain the camera occlusion rate. The camera occlusion rate is compared with a preset occlusion rate threshold. When the camera occlusion rate reaches or exceeds the occlusion rate threshold, a camera occlusion abnormality flag is generated. Based on the candidate results of abnormal shooting, the allowed scene identifier, and the abnormal camera occlusion identifier, the shooting behavior, the QR code login scene, and the camera occlusion behavior are comprehensively judged to generate abnormal behavior confirmation data.

8. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step six specifically includes: Based on the abnormal behavior confirmation data, abnormal behavior type identifiers are identified, including abnormal shooting behavior identifiers, abnormal camera activation failure behavior identifiers, abnormal camera obstruction behavior identifiers, and abnormal external display screen behavior identifiers. Based on the abnormal behavior type identifier, the corresponding abnormal handling strategy is matched from the preset security policy; When the abnormal behavior type is identified as an abnormal shooting behavior identifier, a screen lock control command is generated and sent to the terminal display control module to control the terminal display screen to enter the locked state. When the abnormal behavior type is identified as camera activation failure abnormal behavior, an abnormal status prompt instruction is generated, and the corresponding abnormal prompt information is output on the terminal display interface, while the camera activation status information is recorded. When the abnormal behavior type is identified as camera occlusion abnormal behavior, a screen lock control command is generated, and the corresponding occlusion abnormality indicator and environmental image data are recorded. When the abnormal behavior type is identified as an abnormal behavior identifier for an external display screen, an external display screen control command is generated and executed through the terminal peripheral management to prohibit or restrict the display output of the external display device. While executing the exception handling strategy, process record information is generated, and the process record information is associated and stored with the corresponding exception behavior confirmation data.

9. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 2, characterized in that, Step seven specifically includes: After handling abnormal behavior, the abnormal behavior confirmation data is updated based on continuously collected environmental image data and terminal operating status information; When the updated abnormal behavior confirmation data indicates that the abnormal shooting behavior, camera activation failure behavior, camera obstruction behavior, or external display screen behavior has been eliminated, an abnormality removal flag is generated. Based on the abnormal unlocking flag, determine whether the automatic unlocking conditions are met. When the preset automatic unlocking conditions are met, unlock the terminal display screen. When the automatic unlocking conditions are not met, the terminal receives an unlock command from the user or a remote unlock command from the management terminal to unlock the terminal display screen. When abnormal behavior occurs, generate security audit data including information about the abnormal behavior and desktop screenshots; Sensitive word detection is performed on screenshots of the terminal desktop. When text information that matches the preset sensitive word rules is detected, a corresponding alarm message is generated and the alarm message is associated with and stored with security audit data.

10. The intelligent anti-photography monitoring, blocking, and terminal security sensing system according to claim 9, characterized in that, The security audit data includes user information, abnormal behavior types, abnormal trigger times, handling methods, unlocking methods, environmental image data, and terminal desktop screenshots.

Images