Software development method and device for desktop behavior analysis, equipment, medium and product

Abstract

The invention provides a software development method and device for desktop behavior analysis, equipment, a medium and a product.The method comprises the steps that behavior monitoring data, collected by a software terminal, of business personnel are obtained, and the behavior monitoring data comprise multi-dimensional desktop behavior data of a user and / or multi-dimensional desktop behavior data of the user; the business process data of the business handled by the user through a browser, and the software terminal is an application program pre-installed in a desktop operating system of the terminal equipment; based on the behavior monitoring data, business analysis is carried out on business operated by business personnel to obtain a business analysis result, and sensitive behavior analysis is carried out on the behavior monitoring data according to a behavior configuration rule formulated by a behavior analysis service platform to obtain a sensitive behavior analysis result; and based on the service analysis result and the sensitive behavior analysis result, carrying out sensitive behavior analysis on the user.

Description

Technical Field

[0001] This disclosure relates to the field of security technology, and more specifically, to a software development method, apparatus, device, medium, and product for desktop behavior analysis. Background Technology

[0002] Currently, desktop system security strategies rely more on third-party security software and depend more on the judgment of independent behaviors. Related technologies can identify some common threats and take limited restrictive measures, such as stopping the current behavior.

[0003] Currently, most behavioral analytics software for various industries focuses primarily on business data. However, these technologies employ a single strategy, which cannot comprehensively assess complex business scenarios, and the limiting measures they take are limited. Furthermore, existing technologies analyze data at the business level rather than providing mature, universal solutions that analyze behavioral actions. Summary of the Invention

[0004] This disclosure provides at least one software development method, apparatus, device, medium, and product for desktop behavior analysis.

[0005] In a first aspect, embodiments of this disclosure provide a software development method for desktop behavior analysis, the method comprising: Acquire behavioral monitoring data of business personnel collected by software terminal, wherein the behavioral monitoring data includes multi-dimensional desktop behavior data of users, and / or business process data of business handled by users through browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device; Based on the behavior monitoring data, business analysis is performed on the business operations performed by business personnel to obtain business analysis results. In addition, sensitive behavior analysis is performed on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results. Based on the business analysis results and the sensitive behavior analysis results, sensitive behavior analysis is performed on the user.

[0006] In one optional implementation, the step of performing sensitive behavior analysis on the user based on the business analysis results and the sensitive behavior analysis results includes: When the sensitive behavior analysis results determine that a target sensitive behavior exists in the behavior monitoring data, and the business analysis results determine that the occurrence time of the target sensitive behavior is a non-business processing stage, an alarm message is generated, and the desktop operating system is controlled.

[0007] In one optional implementation, generating alarm information includes: The alarm information is generated according to at least one alarm mode, wherein the alarm mode includes at least one of the following: SMS alarm, email alarm, third-party interface alarm, and terminal management alarm.

[0008] In one optional implementation, the step of performing sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results includes: Once a connection is established with the behavior analysis service platform, a first behavior configuration rule is downloaded from the behavior analysis service platform, and the behavior monitoring data is matched with the first behavior configuration rule to obtain the sensitive behavior analysis result; Without establishing a connection with the behavior analysis service platform, the system retrieves the second behavior configuration rule previously downloaded from the behavior analysis service platform, and matches the behavior monitoring data with the second behavior configuration rule to obtain the sensitive behavior analysis result.

[0009] In one optional implementation, the step of acquiring user behavior monitoring data collected by the software terminal includes: The desktop operation behavior of the business personnel is collected from multiple operational dimensions to obtain the multi-dimensional desktop behavior data; wherein, the multi-dimensional desktop behavior data includes at least one of the following: keyboard input operation, mouse click operation, movement operation, window opening operation, window closing operation, clipboard copy operation, clipboard paste operation, disk file creation, deletion, modification and query operation.

[0010] In one optional implementation, the step of acquiring the behavior monitoring data of business personnel collected by the software terminal includes: Read the page rendering content of the browser; When the browser is identified as being in a business processing state based on the rendered page content, OCR recognition is performed on the rendered page content to obtain key business information; The business process data is determined based on the aforementioned key business information, wherein the key business information includes at least one of the following: page text content, form filling information, position information of operation buttons, and operation status of the operation buttons.

[0011] In one optional implementation, determining the business process data based on the key business information includes: The business type is determined by comparing the key business information with a business feature database. Based on the business type results and business process template, determine the business processing steps corresponding to the browser's corresponding page; The business processing steps are combined to obtain the business processing flow; The business process data is determined based on the business process flow and the key information of the business process flow, and the business process data is stored; wherein, the key information of the flow flow includes at least one of the following: the name of the business process flow, the start time and end time of each business process step, and the core operation record within each business process step.

[0012] In one optional implementation, the method further includes: Based on the stored business process data, business reports are generated, wherein the business reports include at least one of the following: the average time spent on each business processing step, the error rate of different business processing steps, and the overall business processing success rate.

[0013] In one optional implementation, the software terminal is installed in a terminal device according to preset requirements, the preset requirements including at least one of the following: concealment requirements, stability requirements, and performance usage requirements.

[0014] Secondly, embodiments of this disclosure provide a software development apparatus for desktop behavior analysis, the apparatus comprising: The acquisition unit is used to acquire the behavior monitoring data of business personnel collected by the software terminal, wherein the behavior monitoring data includes multi-dimensional desktop behavior data of the user, and / or business process data of the business handled by the user through the browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device; The business analysis unit is used to perform business analysis on the business operations performed by business personnel based on the behavior monitoring data, and to obtain business analysis results; and to perform sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform, and to obtain sensitive behavior analysis results. The behavior analysis unit is used to perform sensitive behavior analysis on the user based on the business analysis results and the sensitive behavior analysis results.

[0015] Thirdly, embodiments of this disclosure also provide an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps of the first aspect above, or any possible implementation of the first aspect, are performed.

[0016] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the first aspect or any possible implementation of the first aspect.

[0017] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the first aspect described above, or any possible implementation of the first aspect.

[0018] This disclosure provides a software development method, apparatus, device, medium, and product for desktop behavior analysis. In this embodiment, firstly, behavior monitoring data of business personnel collected by a software terminal is acquired. This behavior monitoring data includes multi-dimensional desktop behavior data of the user and / or business process data of the business transactions conducted by the user through a browser. The software terminal is an application pre-installed in the desktop operating system of the terminal device. Next, business analysis is performed on the business transactions performed by the business personnel based on the behavior monitoring data to obtain business analysis results. Then, sensitive behavior analysis is performed on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results. Finally, sensitive behavior analysis is performed on the user based on the business analysis results and the sensitive behavior analysis results.

[0019] In the above embodiments, by monitoring multi-dimensional desktop behavior data of users and / or business process data of transactions conducted by users through browsers, a security audit system can detect personnel physical behavior and monitor internal IT system information, thereby forming a comprehensive protection chain. Within a single system, it can intelligently detect personnel physical behavior and intelligently monitor events within the information system. This approach provides a higher level of security for the overall system, preventing sensitive daily operations; it offers more efficient business processing guidance for branch staff, and also provides customers with a better access experience and service quality.

[0020] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a software development method for desktop behavior analysis provided in an embodiment of this disclosure is shown; Figure 2 A schematic diagram of a software development apparatus for desktop behavior analysis provided in an embodiment of this disclosure is shown; Figure 3 A schematic diagram of an electronic device provided in an embodiment of the present disclosure is shown. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0024] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0025] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0026] Research has found that current desktop system security strategies rely more on third-party security software and on the determination of independent behaviors. Related technologies can identify some common threats and take limited restrictive measures, such as stopping the current behavior.

[0027] Currently, most behavioral analytics software for various industries focuses primarily on business data. However, these technologies employ a single strategy, which cannot comprehensively assess complex business scenarios, and the limiting measures they take are limited. Furthermore, existing technologies analyze data at the business level rather than providing mature, universal solutions that analyze behavioral actions.

[0028] Based on the above research, this disclosure provides a software development method, apparatus, device, medium, and product for desktop behavior analysis. In this embodiment, firstly, behavior monitoring data of business personnel collected by a software terminal is acquired. This behavior monitoring data includes multi-dimensional desktop behavior data of the user, and / or business process data of the business transactions conducted by the user through a browser. The software terminal is an application pre-installed in the desktop operating system of the terminal device. Next, business analysis is performed on the business transactions performed by the business personnel based on the behavior monitoring data to obtain business analysis results. Then, sensitive behavior analysis is performed on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results. Finally, sensitive behavior analysis is performed on the user based on the business analysis results and the sensitive behavior analysis results.

[0029] In the above embodiments, by monitoring multi-dimensional desktop behavior data of users and / or business process data of transactions conducted by users through browsers, a security audit system can detect personnel physical behavior and monitor internal IT system information, thereby forming a comprehensive protection chain. Within a single system, it can intelligently detect personnel physical behavior and intelligently monitor events within the information system. This approach provides a higher level of security for the overall system, preventing sensitive daily operations; it offers more efficient business processing guidance for branch staff, and also provides customers with a better access experience and service quality.

[0030] To facilitate understanding of this embodiment, a detailed description of a desktop behavior analysis software development method disclosed in this disclosure will be provided first. The execution entity of the desktop behavior analysis software development method provided in this disclosure is generally an electronic device with a certain computing capability. In some possible implementations, this desktop behavior analysis software development method can be implemented by a processor calling computer-readable instructions stored in memory.

[0031] See Figure 1The diagram shows a flowchart of a software development method for desktop behavior analysis provided in this embodiment of the present disclosure. The method includes steps S101 to S103, wherein: S101: Acquire the behavior monitoring data of business personnel collected by the software terminal, wherein the behavior monitoring data includes multi-dimensional desktop behavior data of the user, and / or business process data of the business handled by the user through the browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device.

[0032] Here, the software terminal is installed in the terminal device according to preset requirements, which include at least one of the following: concealment requirements, stability requirements, and performance usage requirements.

[0033] Stealth refers to the fact that the software terminal cannot be directly uninstalled by the system and cannot be seen directly through the process manager. The stealth of the software terminal is achieved through a combination of technical solutions: process hiding, uninstallation control, interface concealment, lightweight resources, and seamless auto-start. At the process level, terminal processes are disguised as regular system processes (such as "svchost.exe") by calling the underlying system interfaces, or removed from the visible list of the process manager using driver-level technology. In conjunction with daemon processes, the process can be restarted and hidden again immediately after being unexpectedly detected. In some scenarios, core modules are also embedded in the system resident process (such as explorer.exe) to avoid the exposure of independent processes. In terms of uninstallation control, an uninstallation password verification mechanism is set up so that only administrators can obtain permissions through the background to trigger uninstallation. At the same time, critical registry information of the terminal is written into the protected branch of the system and access is restricted for ordinary users to prevent it from being directly deleted or uninstalled. In terms of interface presentation, no desktop icon, Start Menu entry, or system tray icon is generated during installation. It runs silently by default without pop-ups during daily operation, and only pops up a minimal message disguised as a "business system prompt" when a sensitive behavior alarm is triggered. In terms of resource consumption, an "on-demand wake-up" mechanism is adopted, which sleeps when idle and starts collecting data when operating, keeping CPU usage below 5% and memory usage below 100MB. At the same time, data compression and batch uploading reduce network traffic anomalies. In the auto-start phase, the system automatically runs at startup by modifying the registry startup item. Its startup priority is lower than that of business software and there is no loading prompt. This ensures that the terminal is integrated into the desktop environment like a system component, and users cannot detect its existence through normal operations, while not affecting the normal operation of business.

[0034] Stability refers to the ability of a software terminal to start up with the system and automatically restart the process if an abnormality is detected.

[0035] Performance usage refers to the process of avoiding excessive system resource consumption by software terminals due to the diversity of computer configurations, so as to ensure that other system services can operate normally.

[0036] S102: Based on the behavior monitoring data, perform business analysis on the business operations performed by business personnel to obtain business analysis results, and perform sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules formulated by the behavior analysis service platform to obtain sensitive behavior analysis results.

[0037] After identifying the behavioral monitoring data, business analysis can be performed on the user's multi-dimensional desktop behavior data, and / or on the business process data of the transactions the user completes through the browser, thereby obtaining business analysis results. Simultaneously, sensitive behavior analysis needs to be performed on the behavioral monitoring data according to the behavior configuration rules defined by the behavioral analysis service platform, thereby obtaining sensitive behavior analysis results.

[0038] S103: Based on the results of business analysis and sensitive behavior analysis, conduct sensitive behavior analysis on users.

[0039] Finally, based on the results of business analysis and sensitive behavior analysis, sensitive behavior analysis can be performed on users. This approach enables precise tracking of violation scenarios and narrowing of the scope of security control, thereby improving the accuracy of behavior analysis.

[0040] In this embodiment of the application, step S101, which involves acquiring user behavior monitoring data collected by the software terminal, specifically includes the following steps: The desktop operation behavior of the business personnel is collected from multiple operational dimensions to obtain the multi-dimensional desktop behavior data; wherein, the multi-dimensional desktop behavior data includes at least one of the following: keyboard input operation, mouse click operation, movement operation, window opening operation, window closing operation, clipboard copy operation, clipboard paste operation, disk file creation, deletion, modification and query operation.

[0041] Here, the software terminal mainly completes the data collection of multi-dimensional desktop operation behavior, specifically including real-time recording of business personnel's keyboard input operations, mouse click / move operations, window open / close / activation status, clipboard copy / paste content and corresponding window association information, and disk file (including external USB flash drive) add, delete, modify and query operations.

[0042] Specifically, keyboard input refers to obtaining the operator's keyboard operations through the system interface on the terminal operating system; mouse click operations refer to obtaining the operator's mouse operations through the system interface on the terminal operating system; window operations refer to opening and closing windows: obtaining information about all currently open / closed windows through the system interface on the terminal operating system, and recording the opening / closing and activation information of windows; clipboard operations refer to copying and pasting clipboard operations: obtaining current copy and paste information through the system interface on the terminal operating system, and simultaneously recording the window information corresponding to the current copy and paste information; disk file CRUD operations refer to obtaining CRUD operations on disk files through the system interface on the terminal operating system, and specifically recording operation records for USB drives.

[0043] After obtaining the aforementioned multi-dimensional desktop behavior data, sensitive behavior analysis is performed on the multi-dimensional desktop behavior data according to the behavior configuration rules defined by the behavior analysis service platform to obtain the sensitive behavior analysis results.

[0044] When a terminal device identifies a sensitive operation (such as unauthorized copying of sensitive data or unauthorized access to sensitive files) through behavior configuration rules, it needs to trigger differentiated control feedback. Specifically, this can be done by informing business personnel of the violation risk through pop-up prompts, temporarily restricting mouse / keyboard operations to block the current sensitive behavior, or performing a system logout operation to terminate the violation scenario, ensuring timely intervention in sensitive behaviors and preventing data leakage and unauthorized operations.

[0045] In this embodiment of the application, step S101, which involves acquiring the behavior monitoring data of business personnel collected by the software terminal, specifically includes the following steps: S11: Reads the page rendering content from the browser; S12: When the browser is identified as being in a business processing state based on the page rendering content, perform OCR recognition on the page rendering content to obtain key business information; S13: Determine business process data based on key business information, wherein the key business information includes at least one of the following: page text content, form filling information, position information of operation buttons, and operation status of the operation buttons.

[0046] Here, the browser page rendering content can be directly read through the system interface, and OCR recognition is triggered when the browser is detected to be in a business processing state to obtain key business information. Specifically, the identified key business information includes text content on the synchronized page, form entry information, the location information of operation buttons, and the operation status of the operation buttons, such as whether the operation status is active or inactive (e.g., whether the "Submit" button has been clicked), ensuring the acquisition of the basic data required for business analysis.

[0047] After identifying the key business information, it can be analyzed to determine the business process data; among which, business process data refers to the data involved in the user's business process.

[0048] In this application's embodiment set, the above steps for determining the business process data based on the key business information specifically include the following steps: First, the business type is determined by comparing key business information with a business feature database. Secondly, by combining the business type results and the business process template, the corresponding business processing steps for the browser's corresponding page are determined; Next, the business processing steps are combined to obtain the business processing flow; Finally, business process data is determined based on the business process flow and its key information, and the business process data is stored. The key information includes at least one of the following: the name of the business process flow, the start and end times of each business process step, and the core operation records within each business process step.

[0049] After acquiring key business information, the software terminal packages this information into a business feature data package and uploads it to the behavior analysis service platform. The "Business Module" of the behavior analysis service platform pre-stores all supported business types and their corresponding features. For example, the features of "5G package account opening" include "page containing the keyword '5G package' + URL containing '5g_open' + presence of an 'ID card upload' button"; the features of "phone bill recharge" include "includes a 'recharge amount' input box + URL containing 'recharge'". The business module compares the "business feature data package" uploaded by the software terminal with features in the database one by one, finding the business type with the highest matching degree (e.g., matching "5G package account opening"), thereby determining the business type result corresponding to the key business information.

[0050] After obtaining the "business feature data package", the behavior analysis service platform compares the key business information in the "business feature data package" with the business feature database to determine the business type result. Then, the behavior analysis service platform returns the business type result to the software terminal (such as "Current business: 5G package account opening, business ID: BUS_001"). The software terminal records the business type result and associates it with the current operation time (such as "2024-XX-XX 10:15:30, business type: 5G package account opening"), providing a basis for "progress positioning" in subsequent steps.

[0051] After determining the business type, the business process model can be used to locate the progress of the business, thereby pinpointing the specific step the business is currently in. The specific processing procedure is described below: The "Business Module" of the behavior analysis service platform has a preset "standard business process template" for each business type (for example, the template for "5G package account opening" is: Step 1 [Fill in personal information] → Step 2 [Select package level] → Step 3 [Upload ID card photo] → Step 4 [Confirm order]). When the business type result is confirmed as "5G package account opening", the behavior analysis service platform will automatically call the "business process template" for that business.

[0052] The behavior analysis service platform compares key business information with the characteristics of each step in the "business process template" (e.g., "click 'Personal Information Next Step'" corresponds to "Step 1 completed, proceed to Step 2" in the template; "Select Package and Save" corresponds to "Step 2 completed, proceed to Step 3"). Based on the matching results, it determines the current stage of the business, i.e. the business processing step, such as "5G Package Account Opening - Step 2: Select Package Tier"), and returns this "process node" to the software terminal.

[0053] The software terminal will associate and record "service type + current step + operation time" (e.g., "2024-XX-XX 10:18:20, service: 5G package account opening, current step: step 2 (select package level)"). If the user continues to operate (e.g., click "next" to upload ID card), the terminal will repeat the process described above and update the "process node" until the service is completed.

[0054] Next, multiple business processing steps that are continuously determined in chronological order (such as "customer information entry → package selection → cost calculation → order submission") are linked together to form complete business process data. Finally, for the determined complete business process data, key information is stored in a standardized format, specifically including the business process name, the start / end time of each step, and the core operation records within each step (such as form filling content and button click time), providing data support for subsequent business traceability and compliance auditing.

[0055] In this embodiment of the application, the method further includes: Based on the stored business process data, business reports are generated, wherein the business reports include at least one of the following: the average time spent on each business processing step, the error rate of different business processing steps, and the overall business processing success rate.

[0056] Here, based on the stored business process data, business reports are automatically generated. The reports need to highlight the average time spent on each business step, the error rate of different steps (such as the "missed information entry rate"), and the overall business success rate. By analyzing the indicators, process bottlenecks can be identified, providing data support for optimizing business operation processes and improving staff efficiency.

[0057] In this embodiment of the application, step S102, based on the business analysis results and the sensitive behavior analysis results, performs sensitive behavior analysis on the user, specifically including the following steps: When the results of sensitive behavior analysis determine that there is a target sensitive behavior in the behavior monitoring data, if the results of business analysis determine that the occurrence time of the target sensitive behavior is a non-business processing stage, an alarm message will be generated and the desktop operating system will be controlled.

[0058] After obtaining the results of the sensitive behavior analysis, the behavior analysis service platform can compare the results with predefined rules to determine whether there is sensitive information in the behavior monitoring data.

[0059] Here, for four types of risk objects—'individual operation, sensitive words, combined behavior, and sensitive images'—judgment rules covering 'behavioral actions + information content' are formulated in advance. The purpose is to achieve accurate identification of sensitive behaviors through more comprehensive rule design, directly serving the core objective of 'preventing data leakage and controlling illegal operations'.

[0060] When sensitive target behaviors are identified in the behavioral monitoring data, the business analysis results can be used to determine whether the current moment falls within a business processing stage. If the sensitive target behaviors are determined to occur outside of a business processing stage, an alarm message needs to be generated, and the desktop operating system needs to be monitored.

[0061] For example, regarding the sensitive behavior analysis result "copying customer ID number", if the business analysis result determines that the current process is "compliant business processing" (such as entering information to open a mobile phone number for a customer), no alarm will be triggered; if the process is "non-business processing" (such as copying to a local document when idle), an alarm will be triggered immediately to prevent the normal business from being blocked.

[0062] In this embodiment of the application, the above steps for generating alarm information specifically include the following steps: An alarm message is generated according to at least one alarm mode, wherein the alarm mode includes at least one of the following: SMS alarm, email alarm, third-party interface alarm, and terminal management alarm.

[0063] Among them, SMS alarms refer to SMS push notifications via SMS interface; email alarms refer to email push notifications via email interface; third-party interface alarms refer to HTTP push notifications of corresponding alarms via third-party interfaces in our self-defined format; and terminal control alarms refer to related control of users' computers via terminal software.

[0064] In this embodiment of the application, the above steps, in accordance with the behavior configuration rules formulated by the behavior analysis service platform, perform sensitive behavior analysis on the behavior monitoring data to obtain sensitive behavior analysis results, specifically including the following steps: First, after establishing a connection with the behavior analysis service platform, a first behavior configuration rule is downloaded from the behavior analysis service platform, and the behavior monitoring data is matched with the first behavior configuration rule to obtain the sensitive behavior analysis result; Secondly, without establishing a connection with the behavior analysis service platform, the second behavior configuration rule downloaded from the behavior analysis service platform last time is obtained, and the behavior monitoring data and the second behavior configuration rule are matched to obtain the sensitive behavior analysis result.

[0065] Here, if the software terminal is a newly installed application on the terminal device, the corresponding behavior configuration rules must be downloaded online after the software terminal is installed; otherwise, the system cannot be used.

[0066] If the software terminal is not a newly installed application on the terminal device, the system can continue to detect whether a connection has been established between the software terminal and the behavior analysis service platform. If it is determined that no connection has been established, the system retrieves the behavior configuration rules previously downloaded from the behavior analysis service platform, i.e., the second behavior configuration rules. When the software terminal re-establishes a connection with the behavior analysis service platform, it retrieves the behavior configuration rules again and matches them with the behavior monitoring data to obtain the sensitive behavior analysis results.

[0067] If the software terminal is not a newly installed application on the terminal device, the system can continue to detect whether a connection has been established between the software terminal and the behavior analysis service platform. If a connection is established between the software terminal and the behavior analysis service platform, the system will re-obtain the behavior configuration rules from the behavior analysis service platform and match them with the behavior monitoring data to obtain the sensitive behavior analysis results.

[0068] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0069] Based on the same inventive concept, this disclosure also provides a software development device for desktop behavior analysis corresponding to the software development method for desktop behavior analysis. Since the principle of the device in this disclosure for solving the problem is similar to the software development method for desktop behavior analysis described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0070] Reference Figure 2 The diagram shown is a schematic of a desktop behavior analysis software development device provided in an embodiment of this disclosure. The device includes: an acquisition unit 10, a business analysis unit 20, and a behavior analysis unit 30; wherein, The acquisition unit 10 is used to acquire the behavior monitoring data of business personnel collected by the software terminal, wherein the behavior monitoring data includes multi-dimensional desktop behavior data of the user, and / or business process data of the business handled by the user through the browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device. The business analysis unit 20 is used to perform business analysis on the business operations performed by business personnel based on the behavior monitoring data, and to obtain business analysis results; and to perform sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules formulated by the behavior analysis service platform, and to obtain sensitive behavior analysis results. The behavior analysis unit 30 is used to perform sensitive behavior analysis on the user based on the business analysis results and the sensitive behavior analysis results.

[0071] In one possible implementation, the behavior analysis unit 30 is further configured to: When the sensitive behavior analysis results determine that a target sensitive behavior exists in the behavior monitoring data, and the business analysis results determine that the occurrence time of the target sensitive behavior is a non-business processing stage, an alarm message is generated, and the desktop operating system is controlled.

[0072] In one possible implementation, the behavior analysis unit 30 is further configured to: The alarm information is generated according to at least one alarm mode, wherein the alarm mode includes at least one of the following: SMS alarm, email alarm, third-party interface alarm, and terminal management alarm.

[0073] In one possible implementation, the business analysis unit 20 is further configured to: Once a connection is established with the behavior analysis service platform, a first behavior configuration rule is downloaded from the behavior analysis service platform, and the behavior monitoring data is matched with the first behavior configuration rule to obtain the sensitive behavior analysis result; Without establishing a connection with the behavior analysis service platform, the system retrieves the second behavior configuration rule previously downloaded from the behavior analysis service platform, and matches the behavior monitoring data with the second behavior configuration rule to obtain the sensitive behavior analysis result.

[0074] In one possible implementation, the acquiring unit 10 is further configured to: The desktop operation behavior of the business personnel is collected from multiple operational dimensions to obtain the multi-dimensional desktop behavior data; wherein, the multi-dimensional desktop behavior data includes at least one of the following: keyboard input operation, mouse click operation, movement operation, window opening operation, window closing operation, clipboard copy operation, clipboard paste operation, disk file creation, deletion, modification and query operation.

[0075] In one possible implementation, the acquisition unit 10 is further configured to: Read the page rendering content of the browser; When the browser is identified as being in a business processing state based on the rendered page content, OCR recognition is performed on the rendered page content to obtain key business information; The business process data is determined based on the aforementioned key business information, wherein the key business information includes at least one of the following: page text content, form filling information, position information of operation buttons, and operation status of the operation buttons.

[0076] In one possible implementation, the acquisition unit 10 is further configured to: The business type is determined by comparing the key business information with a business feature database. Based on the business type results and business process template, determine the business processing steps corresponding to the browser's corresponding page; The business processing steps are combined to obtain the business processing flow; The business process data is determined based on the business process flow and the key information of the business process flow, and the business process data is stored; wherein, the key information of the flow flow includes at least one of the following: the name of the business process flow, the start time and end time of each business process step, and the core operation record within each business process step.

[0077] In one possible implementation, the device is further used for: Based on the stored business process data, business reports are generated, wherein the business reports include at least one of the following: the average time spent on each business processing step, the error rate of different business processing steps, and the overall business processing success rate.

[0078] In one possible implementation, the software terminal is installed in a terminal device according to preset requirements, which include at least one of the following: concealment requirements, stability requirements, and performance usage requirements.

[0079] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0080] Corresponding to Figure 1 The software development method for desktop behavior analysis in this disclosure also provides an electronic device 300, such as... Figure 3 The diagram shown is a structural schematic of an electronic device 300 provided in an embodiment of this disclosure, including: The system includes a processor 31, a memory 32, and a bus 33. The memory 32 stores execution instructions and includes main memory 321 and external memory 322. The main memory 321, also called internal memory, temporarily stores the computational data in the processor 31, as well as data exchanged with external memory such as a hard disk. The processor 31 exchanges data with the external memory 322 through the main memory 321. When the electronic device 300 is running, the processor 31 communicates with the memory 32 through the bus 33, causing the processor 31 to execute the following instructions: Acquire behavioral monitoring data of business personnel collected by software terminal, wherein the behavioral monitoring data includes multi-dimensional desktop behavior data of users, and / or business process data of business handled by users through browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device; Based on the behavior monitoring data, business analysis is performed on the business operations performed by business personnel to obtain business analysis results. In addition, sensitive behavior analysis is performed on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results. Based on the business analysis results and the sensitive behavior analysis results, sensitive behavior analysis is performed on the user.

[0081] This disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the software development method for desktop behavior analysis described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0082] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the software development method for desktop behavior analysis described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0083] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0084] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0085] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0086] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0087] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0088] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A software development method for desktop behavior analysis, characterized in that, The method includes: Acquire behavioral monitoring data of business personnel collected by software terminal, wherein the behavioral monitoring data includes multi-dimensional desktop behavior data of users, and / or business process data of business handled by users through browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device; Based on the behavior monitoring data, business analysis is performed on the business operations performed by business personnel to obtain business analysis results. In addition, sensitive behavior analysis is performed on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform to obtain sensitive behavior analysis results. Based on the business analysis results and the sensitive behavior analysis results, sensitive behavior analysis is performed on the user.

2. The method according to claim 1, characterized in that, The process of performing sensitive behavior analysis on the user based on the business analysis results and the sensitive behavior analysis results includes: When the sensitive behavior analysis results determine that a target sensitive behavior exists in the behavior monitoring data, and the business analysis results determine that the occurrence time of the target sensitive behavior is a non-business processing stage, an alarm message is generated, and the desktop operating system is controlled.

3. The method according to claim 2, characterized in that, The generated alarm information includes: The alarm information is generated according to at least one alarm mode, wherein the alarm mode includes at least one of the following: SMS alarm, email alarm, third-party interface alarm, and terminal management alarm.

4. The method according to claim 1, characterized in that, The process of performing sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform, and obtaining sensitive behavior analysis results, includes: Once a connection is established with the behavior analysis service platform, a first behavior configuration rule is downloaded from the behavior analysis service platform, and the behavior monitoring data is matched with the first behavior configuration rule to obtain the sensitive behavior analysis result; Without establishing a connection with the behavior analysis service platform, the system retrieves the second behavior configuration rule previously downloaded from the behavior analysis service platform, and matches the behavior monitoring data with the second behavior configuration rule to obtain the sensitive behavior analysis result.

5. The method according to claim 1, characterized in that, The acquisition of user behavior monitoring data collected by the software terminal includes: The desktop operation behavior of the business personnel is collected from multiple operational dimensions to obtain the multi-dimensional desktop behavior data; wherein, the multi-dimensional desktop behavior data includes at least one of the following: keyboard input operation, mouse click operation, movement operation, window opening operation, window closing operation, clipboard copy operation, clipboard paste operation, disk file creation, deletion, modification and query operation.

6. The method according to claim 1, characterized in that, The acquisition of behavioral monitoring data of business personnel collected by the software terminal includes: Read the page rendering content of the browser; When the browser is identified as being in a business processing state based on the rendered page content, OCR recognition is performed on the rendered page content to obtain key business information; The business process data is determined based on the key business information, wherein the key business information includes at least one of the following: page text content, form filling information, position information of operation buttons, and operation status of the operation buttons.

7. The method according to claim 6, characterized in that, Determining the business process data based on the key business information includes: The business type is determined by comparing the key business information with a business feature database. Based on the business type results and business process template, determine the business processing steps corresponding to the corresponding page in the browser; The business processing steps are combined to obtain the business processing flow; The business process data is determined based on the business process flow and the key information of the business process flow, and the business process data is stored; wherein, the key information of the flow flow includes at least one of the following: the name of the business process flow, the start time and end time of each business process step, and the core operation record within each business process step.

8. The method according to claim 7, characterized in that, The method further includes: Based on the stored business process data, business reports are generated, wherein the business reports include at least one of the following: the average time spent on each business processing step, the error rate of different business processing steps, and the overall business processing success rate.

9. The method according to claim 1, characterized in that, The software terminal is installed in the terminal device according to preset requirements, which include at least one of the following: concealment requirements, stability requirements, and performance usage requirements.

10. A software development device for desktop behavior analysis, characterized in that, The device includes: The acquisition unit is used to acquire the behavior monitoring data of business personnel collected by the software terminal, wherein the behavior monitoring data includes multi-dimensional desktop behavior data of the user, and / or business process data of the business handled by the user through the browser, and the software terminal is an application pre-installed in the desktop operating system of the terminal device; The business analysis unit is used to perform business analysis on the business operations performed by business personnel based on the behavior monitoring data, and to obtain business analysis results; and to perform sensitive behavior analysis on the behavior monitoring data according to the behavior configuration rules defined by the behavior analysis service platform, and to obtain sensitive behavior analysis results. The behavior analysis unit is used to perform sensitive behavior analysis on the user based on the business analysis results and the sensitive behavior analysis results.

11. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the software development method for desktop behavior analysis as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the software development method for desktop behavior analysis as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the software development method for desktop behavior analysis as described in any one of claims 1 to 9.

Images