A high-risk operation instruction identification method and device and a storage medium

Abstract

The application relates to the technical field of network security, in particular to a high-risk operation instruction identification method and device and a storage medium, which comprises the following steps: acquiring keystroke coordinate records. According to the effective coordinates and the time information of the keystroke operation, the column distribution dispersion degree used for representing the horizontal direction distribution width of the keystroke operation on a monitoring target row is calculated, and the active point filling rate used for representing the horizontal direction continuity degree of the keystroke operation on the monitoring target row is calculated. Whether a command input intention exists on the monitoring target row is judged according to the column distribution dispersion degree and the active point filling rate. In response to the judgment result that the command input intention exists, the instruction sequence executed by the user final intention is reconstructed according to the keystroke character, the effective coordinates and the time information of the keystroke operation. The application provides a method for identifying the real command construction intention in a full-screen program.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method, device, and storage medium for identifying high-risk operation commands. Background Technology

[0002] In the operation and maintenance of enterprise information technology infrastructure, Secure Shell (SSH) is the standard means for administrators to remotely manage servers. In order to ensure the security of operation and maintenance, enterprises usually deploy SSH proxy gateways as intermediate audit nodes.

[0003] However, with the widespread use of full-screen interactive programs, traditional auditing techniques face severe challenges. Existing technologies primarily rely on regular expression matching of strings in the data stream. While effective for linear command-line interface operations, in full-screen interactive scenarios, user keystrokes are no longer a simple linear sequence of time but are accompanied by random cursor jumps in the two-dimensional space of the screen. The SSH protocol separates user keystroke input from terminal cursor movement commands during transmission, preventing gateways from directly sensing the absolute coordinates of the cursor. This mechanism creates a serious security blind spot, allowing attackers to exploit the characteristics of full-screen programs to escape, such as constructing malicious shell commands in the Vim editor. Traditional auditing gateways struggle to distinguish whether users are entering harmless content in the document body or constructing malicious commands at the bottom of lines. Therefore, a method to identify the true intent behind command construction within full-screen programs is urgently needed. Summary of the Invention

[0004] In order to identify the true command construction intent within a full-screen program, the purpose of this application is to provide a method, device, and storage medium for identifying high-risk operation commands. The specific technical solution adopted is as follows: Firstly, a method for identifying high-risk operation commands is provided, comprising: acquiring keystroke coordinate records. The keystroke coordinate records include the keystroke character corresponding to the user's keystroke operation on the terminal screen, the effective coordinates of the keystroke character on the terminal screen, and the time information of the keystroke operation. Based on the effective coordinates and the time information of the keystroke operation, a column distribution dispersion characterizing the horizontal distribution width of keystroke operations on the target row is calculated, as well as an active point fill rate characterizing the horizontal continuity of keystroke operations on the target row. Based on the column distribution dispersion and the active point fill rate, it is determined whether a command input intent exists on the target row. In response to the determination that a command input intent exists, the command sequence to be executed by the user's final intent is reconstructed based on the keystroke character, effective coordinates, and time information of the keystroke operation.

[0005] In one possible design, the process of determining the column distribution dispersion and active point fill rate includes: updating the screen activity matrix based on the effective coordinates and keystroke timing information. The screen activity matrix is ​​used to characterize the frequency of operation at each location on the terminal screen. The column distribution dispersion and active point fill rate are calculated based on the matrix elements corresponding to the monitored target rows in the screen activity matrix.

[0006] In one possible design, the column distribution dispersion is calculated based on the matrix elements corresponding to the target row in the screen activity matrix. This includes: extracting matrix elements with values ​​greater than zero from the target row of the screen activity matrix as active points; calculating the weighted average column coordinates of all active points in the target row based on the values ​​and column coordinates of each active point, and using the weighted average column coordinates as the operation centroid coordinates; and calculating the weighted dispersion of all active points in the target row relative to the operation centroid coordinates based on the operation centroid coordinates, the values, and column coordinates of each active point, and using the calculated weighted dispersion as the column distribution dispersion.

[0007] In one possible design, the active point fill rate is calculated based on the matrix elements corresponding to the target row in the screen activity matrix. This includes: extracting matrix elements with values ​​greater than zero from the target row in the screen activity matrix as active points; mapping each active point to a binary state; and using the binary state to indicate whether a keystroke operation occurred at the corresponding position within a preset time period. The horizontal span covered by all active points in the target row is determined based on the column coordinates of each active point. The density of binary states filling the horizontal span is calculated based on the horizontal span and the total number of binary states with operation status. This calculated density is used as the active point fill rate, where the operation status characterizes that a keystroke operation occurred at the corresponding position within the preset time period.

[0008] In one possible design, the process of determining the keystroke coordinate record includes: parsing the uplink data stream in the Secure Shell Protocol session to obtain the keystroke character and its arrival time. If a cursor positioning instruction is matched within a preset time window, the coordinates indicated by the cursor positioning instruction are determined as the effective coordinates of the keystroke character. The start time of the preset time window is the keystroke time. If no cursor positioning instruction is matched within the preset time window, the effective coordinates of the keystroke character are determined based on the current cursor position and the type of keystroke character. A keystroke coordinate record is generated based on the keystroke character, its effective coordinates, and the keystroke time.

[0009] In one possible design, the sequence of instructions to be reconstructed based on the user's final intention includes: In response to the determination that a command input intention exists, extracting keystroke coordinate records from the history cache within the triggering time period. Initializing a temporary storage space corresponding to the width of the terminal screen. Traversing the extracted keystroke coordinate records in chronological order, updating the content in the temporary storage space based on the character and effective coordinates of the currently traversed keystroke coordinate record. Specifically, if the currently traversed character is a printable character, it is written to the position in the temporary storage space corresponding to the effective coordinates of that character, overwriting the original content at that position. After the traversal is complete, extracting non-empty characters sequentially from the temporary storage space and concatenating them to form the instruction sequence.

[0010] In one possible design, updating the content in the temporary storage space also includes: if the currently traversed character is a backspace character, then based on the effective coordinates of the backspace character, clearing the content in the temporary storage space corresponding to the previous coordinate position.

[0011] One possible design also includes: during the process of determining whether a command input intention exists, upon the first determination of a command input intention, entering an instruction collection state. In the instruction collection state, if no command input intention is determined, a timer is started; if a command input intention is determined again before the timer expires, the instruction collection state is maintained. When a newline character is detected, or the timer expires, the current instruction input process is determined to have ended, and the step of reconstructing the instruction sequence that represents the user's final intention to execute is triggered.

[0012] Secondly, a high-risk operation command recognition device is provided, comprising: a keystroke information unit for acquiring keystroke coordinate records. The keystroke coordinate records include the keystroke character corresponding to the user's keystroke operation on the terminal screen, the effective coordinates of the keystroke character on the terminal screen, and the time information of the keystroke operation. A feature calculation unit for calculating the column distribution dispersion, which characterizes the horizontal distribution width of keystroke operations on the target row, and the active point fill rate, which characterizes the horizontal continuity of keystroke operations on the target row. An intent recognition unit for determining whether a command input intent exists on the target row based on the column distribution dispersion and the active point fill rate. An intent reconstruction unit for reconstructing the command sequence to be executed by the user's final intent based on the keystroke character, effective coordinates, and time information of the keystroke operation, in response to the determination that a command input intent exists.

[0013] Thirdly, a storage medium is provided, the storage medium including stored instructions, wherein, when the instructions are executed, the device where the storage medium is located executes the high-risk operation instruction identification method of the first aspect.

[0014] This application offers the following advantages: By acquiring keystroke coordinate records containing keystroke characters, effective coordinates, and time information, a complete data foundation is provided for user intent analysis. Furthermore, based on the effective coordinates and time information, the column distribution dispersion (characterizing the horizontal distribution width of keystrokes on the monitored target row) and the active point fill rate (characterizing horizontal continuity) are directly calculated. The command input intent is identified through a comprehensive judgment of these two statistical features. When a command input intent is determined, the final instruction sequence executed by the user is reconstructed based on the complete keystroke information. This method effectively distinguishes linear continuous command input, dotted accidental touch operations, and discrete, jumping scrolling noise from the perspective of operation morphology through the statistical features of column distribution dispersion and active point fill rate, avoiding the misjudgment and omission problems caused by traditional techniques that rely solely on cursor position or keyword matching. Simultaneously, by reconstructing the instruction, the final user intent is restored, eliminating confusion caused by backspace, modification, and other editing operations during input. This achieves accurate identification of high-risk operation instructions in full-screen interactive programs, significantly improving the security and accuracy of operation and maintenance auditing. Attached Figure Description

[0015] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A flowchart illustrating a high-risk operation command identification method provided in one embodiment of this application; Figure 2 This is a schematic diagram of a high-risk operation command identification device provided in one embodiment of this application. Detailed Implementation

[0017] To further illustrate the technical means and effects adopted by this application to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a high-risk operation instruction identification method proposed in this application. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0019] The specific scheme of the high-risk operation command identification method provided in this application is described in detail below with reference to the accompanying drawings.

[0020] Please see Figure 1 The diagram illustrates a flowchart of a high-risk operation command identification method according to an embodiment of this application. Figure 1 As shown, the method includes the following steps S101-S104.

[0021] S101. Obtain keystroke coordinate records.

[0022] The keystroke coordinate record includes the keystroke character corresponding to the user's keystroke operation on the terminal screen, the effective coordinates of the keystroke character on the terminal screen, and the time information of the keystroke operation.

[0023] One possible approach is to parse the uplink data stream in the Secure Shell protocol session to obtain the keystroke character and its arrival time. If a cursor positioning instruction is matched within a preset time window, the coordinates indicated by the cursor positioning instruction are determined as the effective coordinates of the keystroke character. The start time of the preset time window is the keystroke time. If no cursor positioning instruction is matched within the preset time window, the effective coordinates of the keystroke character are determined based on the current cursor position and the type of keystroke character. A keystroke coordinate record is generated based on the keystroke character, its effective coordinates, and the keystroke time.

[0024] The aforementioned preset time window is a pre-configured time window. For example, the preset time window can be 200ms or 230ms; this embodiment does not specifically limit it. The aforementioned preset time window is greater than the network round-trip time for transmitting information from the terminal device to the security device to ensure successful matching of keystroke operations and keystroke characters.

[0025] In some embodiments, during the session establishment phase, the security device parses the pseudo-terminal request message sent by the terminal device to extract the maximum number of rows and columns, and uses these two values ​​as the initial number of rows and columns of the terminal screen. During the session, the security device continuously monitors the window size change signal of the terminal screen and updates the maintained number of rows and columns of the terminal window in real time according to the monitored window size change signal. For cases where data transmission begins before the window size is determined at the beginning of session establishment, the security device generates a pending data queue in its own memory and temporarily stores the data parsed during the window size determination phase into this pending data queue. After the window size parameters are determined, the data is then retrieved sequentially from this pending data queue for playback processing to prevent data loss due to coordinate out-of-bounds errors.

[0026] Furthermore, the security device can process the decrypted uplink and downlink data streams in parallel. For the uplink data stream, the security device extracts keystroke characters and the keystroke time of the data packet arriving at the security device from the data packets sent by the terminal device. For the downlink data stream, the security device can scan the data stream returned by the server to identify the cursor positioning instructions used to control cursor movement, and parse out the target row coordinates, target column coordinates, and the cursor time of the instruction arriving at the security device.

[0027] Subsequently, the security device performs timing alignment and coordinate deduction operations. For example, the security device maintains a keystroke matching queue to push the parsed keystroke characters and their keystroke times into the queue in sequence. Further, the security device uses the keystroke time as the start time of a preset time window and continuously monitors cursor update events in the downlink data stream. If a new cursor positioning instruction is matched within the preset time window, the target row coordinates and target column coordinates indicated by the instruction are determined as the effective coordinates of the keystroke character. If no cursor positioning instruction is matched within the preset time window, the effective coordinates of the keystroke character are deduced based on the currently maintained virtual cursor position and the type of the keystroke character. When a real cursor positioning instruction is received subsequently, the coordinates indicated by the real instruction are used to correct the currently maintained virtual cursor position. After completing coordinate matching or deduction, a keystroke coordinate record is generated based on the keystroke character, its effective row coordinates, its effective column coordinates, and the corresponding keystroke time.

[0028] In some embodiments, when generating keystroke coordinate records, the security device may also write the keystroke coordinate records to a history circular cache in chronological order.

[0029] In this embodiment, the security device can be an SSH proxy gateway with protocol termination capabilities, a network traffic analysis device, or other devices; this embodiment does not specifically limit its capabilities. The security device acts as an intermediate endpoint for the Secure Shell protocol session, establishing encrypted connections with both the terminal device and the server, and holding the session key.

[0030] The aforementioned upstream data stream can be a data stream that includes keystroke character information, and the aforementioned downstream data stream can be a data stream that includes cursor position information.

[0031] The aforementioned pseudo-terminal request message can be a message that includes the window size parameters of the terminal device.

[0032] S102. Based on the effective coordinates and keystroke time information, calculate the column distribution dispersion, which characterizes the horizontal distribution width of keystrokes on the target row, and the active point fill rate, which characterizes the horizontal continuity of keystrokes on the target row.

[0033] One possible approach is to update the screen activity matrix based on the effective coordinates and keystroke timing information. The screen activity matrix characterizes the frequency of operations at various locations on the terminal screen. Based on the matrix elements corresponding to the target row in the screen activity matrix, the column distribution dispersion (characterizing the horizontal width of keystrokes on the target row) and the active point fill rate (characterizing the horizontal continuity of keystrokes on the target row) are calculated. Based on the column distribution dispersion and the active point fill rate, it is determined whether a command input intent exists on the target row. This step is detailed in the following embodiments and will not be repeated here.

[0034] S103. Based on the column distribution dispersion and active point fill rate, determine whether there is a command input intention on the monitored target row.

[0035] As one possible approach, three threshold parameters for comprehensive judgment are pre-configured: activity threshold, dispersion threshold, and fill rate threshold.

[0036] The activity threshold mentioned above is a value much larger than the preset minimum activity value to ensure that sporadic operations can be filtered out. For example, the activity threshold is set to 5.0.

[0037] The aforementioned dispersion threshold is greater than 1.0 to filter single-point operations, but it should not be too large to avoid missing short commands. For example, the dispersion threshold can be set to 5.0.

[0038] The fill rate threshold mentioned above should be greater than 0.5 to effectively filter scrolling noise, but it should not be too high to avoid missing commands containing normal modifications. For example, the fill rate threshold can be set to 0.8.

[0039] Within each analysis cycle, three key quantitative indicators for the monitored target row have been obtained through the aforementioned steps: total activity, column distribution dispersion, and active point fill rate. Total activity represents the sum of the matrix values ​​of all active points on the monitored target row, reflecting the overall activity level of that row; column distribution dispersion represents the horizontal distribution width of active points, reflecting whether the operation trajectory exhibits a linear extension; and active point fill rate represents the continuous fill density of active points within the horizontal span, reflecting whether the operation has a continuous, character-by-character input characteristic.

[0040] The three quantitative indicators mentioned above are compared with their corresponding preset thresholds, and the following judgment logic is executed: Determine if the total activity level is greater than the preset activity level threshold. Determine if the column distribution dispersion is greater than the preset dispersion threshold. Determine if the active point fill rate is greater than the preset fill rate threshold.

[0041] If all three conditions above are met simultaneously—that is, the total activity exceeds a preset activity threshold, the column distribution dispersion exceeds a preset dispersion threshold, and the active point fill rate exceeds a preset fill rate threshold—then it is determined that there is a command input intent on the current monitoring target row, and the command input status flag is set to a valid status flag (e.g., a value of 1). This flag indicates that the system confirms with a high degree of confidence that the user is consciously constructing commands on the monitoring target row.

[0042] If any of the above conditions are not met—namely, the total activity level does not exceed a preset activity threshold, the column distribution dispersion does not exceed a preset dispersion threshold, or the active point fill rate does not exceed a preset fill rate threshold—then it is determined that there is no command input intent on the current monitoring target row, and the command input status flag is set to an invalid status flag (e.g., a value of 0). This flag indicates that the current operation may be a mis-touch, scrolling noise, or other non-command input behavior.

[0043] When the command input status flag changes from invalid to valid, the command history backtracking module starts the command collection window; when the command input status flag remains invalid and times out, or when a newline character is detected, the collection terminates and command reconstruction is performed. This determination mechanism enables accurate identification of command input intent based on statistical morphological features.

[0044] S104. In response to the judgment result that there is a command input intention, the instruction sequence to be executed by the user's final intention is reconstructed based on the keystroke character, effective coordinates and keystroke operation time information.

[0045] One possible approach is to retrieve keystroke coordinate records from the history cache within the triggering time period in response to a determination that a command input intent exists. Further, a temporary storage space corresponding to the width of the terminal screen is initialized, and the retrieved keystroke coordinate records are traversed in chronological order. Based on the character and effective coordinates of the currently traversed keystroke coordinate record, the content in the temporary storage space is updated. Specifically, if the currently traversed character is a printable character, it is written to the position in the temporary storage space corresponding to the effective coordinates of that character, overwriting the original content at that position; if the currently traversed character is a backspace character, the content in the temporary storage space corresponding to the previous coordinate position is cleared based on the effective coordinates of the backspace character. After the traversal is complete, non-empty characters are extracted sequentially from the temporary storage space and concatenated to form an instruction sequence.

[0046] Specifically, multiple keystroke coordinate records are stored in the history circular cache. Each keystroke coordinate record contains at least the keystroke character, the effective row coordinate, the effective column coordinate, and the time information of the keystroke operation. For the data in the history circular cache, a first-in, first-out (FIFO) strategy is adopted, and keystroke coordinate records within the most recent preset time (e.g., 25s or 20s) are retained to ensure that when user intent reconstruction is triggered, the starting moment of command input can be traced back.

[0047] The aforementioned most recent preset duration is the duration closest to the current time, which is greater than the total duration of a typical command input process (including input time and intermediate pause time). The total duration of a typical command input process can be determined by the duration required for the input processes of multiple commands.

[0048] When the command input status flag first changes from invalid to valid, it is determined that a command input action has begun on the current monitoring target line. The system then enters the command collection state and marks the current time as the collection start time. During the command collection state, even if the command input status flag briefly changes from valid to invalid, command collection does not immediately terminate; instead, a debounce timer is started. If the command input status flag becomes valid again before the debounce timer expires, the command collection state remains unchanged, and the debounce timer is reset. If no valid status flag is received again before the debounce timer expires, or if the user presses the Enter key, the current command input process is considered complete, and the collection end time is determined.

[0049] When the instruction input process is confirmed to be complete, all keystroke coordinate records within the trigger time period from the start to the end of the collection are retrieved from the historical circular buffer as the raw data to be reconstructed. Further, the current maximum number of columns on the terminal screen is obtained, and a temporary character array with a length corresponding to the current maximum number of columns is initialized in memory. Subsequently, all elements of this temporary character array are initialized to null values. This temporary character array is used to simulate the final rendering state of a line of characters on the terminal screen.

[0050] Following the chronological order of extraction times, iterate through all keystroke coordinate records within the trigger time period from the start to the end of the collection. For each keystroke coordinate record currently being traversed, update the temporary character array based on the type of the keystroke character and the effective column coordinates in that record: if the currently traversed keystroke character is a normal print character, and the effective column coordinates in that record are... If the keystroke character is entered, the system writes it to the position at index c in the temporary character array. This write operation utilizes the uniqueness of array indices to implement the overwrite logic; for multiple inputs at the same screen position, only the last character encountered is retained in the array.

[0051] If the currently encountered keystroke is a backspace character, and the coordinate of the effective column in that record is... Then, a simulated deletion operation is performed, that is, the temporary character array at index is cleared. The content at position -1 is set to an empty value to simulate the effect of the cursor moving back and deleting the previous character.

[0052] After the traversal is complete, the temporary character array is scanned in ascending order of column coordinates. All non-empty characters in the array are extracted sequentially and then concatenated to form the final instruction sequence. This instruction sequence is the sequence of instructions that the user intends to execute on the target line on the terminal screen, eliminating intermediate traces caused by backspace, modification, or other editing operations during the input process.

[0053] Finally, the reconstructed instruction sequence is sent to the subsequent security policy execution module for matching and responding to high-risk instructions.

[0054] The above-mentioned ordinary printable characters can be characters other than control characters, such as letters or numbers.

[0055] In some embodiments, when a reconstructed instruction sequence is determined, the instruction sequence is matched sequentially against each rule in the blocking rule set. If the reconstructed instruction sequence matches any of the rules, the current operation is determined to be abnormal behavior, and the following response action is immediately executed: Traffic blocking: Identify the execution confirmation data packet corresponding to the current command, that is, the data packet to be forwarded containing a carriage return, and discard it, thereby preventing the command from being sent to the target server for execution and blocking the occurrence of malicious behavior from the source.

[0056] Alarm echo: Construct downlink data packets in the Secure Shell Protocol format and send alarm information to the terminal device to display a blocking prompt on the terminal device's screen, thereby informing the user that their operation has been blocked.

[0057] Audit Log: Generate a complete high-risk operation log, recording the session's identifier information, the user's Internet Protocol address, the time the operation occurred, the original keystroke recording, and the matching rule identifier, for subsequent security auditing and tracing purposes.

[0058] If the reconstruction fails to match all rules in the block rule set, the current operation is deemed a safe action. The temporary lock on the current data stream is released, allowing the data packet containing the instruction to be forwarded normally to the target server, and the session continues normally.

[0059] For example, taking the reconstructed instruction sequence as ":!bash" and the blocking rule set as containing the rule ".!.*bash", the process involves confirming that the reconstructed instruction sequence matches a rule in the blocking rule set, thereby triggering traffic blocking, alarm echoing, and audit logging actions, thus forming a complete closed loop for intercepting high-risk operations.

[0060] The aforementioned blocking rule set can be pre-built and stored. This blocking rule set can include a preset set of high-risk operation command features that need to be blocked. For example, the blocking rule set can contain a set of regular expressions for various high-risk operation command keywords, command combinations, and feature strings, covering, but not limited to, file system destructive operation commands, commands with excessively open permissions, remote shell creation commands, and commands that modify system core configurations.

[0061] In one design, the above S102 includes: S1021-S1022.

[0062] S1021. Update the screen activity matrix based on the effective coordinates and keystroke time information.

[0063] The screen activity matrix is ​​used to characterize the frequency of operation at each location on the terminal screen.

[0064] As one possible implementation, a two-dimensional floating-point matrix is ​​maintained in memory as the screen activity matrix, denoted as... This matrix is ​​used to transform discrete keystroke operations into a state field suitable for spatial analysis. It has the same number of rows and columns as the current maximum number of rows in the terminal window, and all elements are initialized to zero. Additionally, the effective row coordinates in each keystroke coordinate record are marked as... This indicates the target row position of the keystroke on the terminal screen; the effective column coordinates are... , indicates the target column position of the keystroke on the terminal screen.

[0065] Whenever a new keystroke coordinate record is received, it is located in the screen activity matrix. The grid cell corresponding to the effective row and column coordinates of the new keystroke coordinate record is selected, and an accumulation operation is performed on that grid cell, which increases the current value of that grid cell by one unit. This accumulation operation is represented as... +1. This accumulation operation converts discrete keystroke events into heat accumulation at the corresponding screen location. The larger the value of the grid cell, the more frequently that location has been accessed recently.

[0066] In some embodiments, timeliness control is implemented on the screen activity matrix to ensure that it dynamically reflects the real-time distribution of user attention. Specifically, an independent timer is started with a fixed decay period (e.g., 100ms), denoted as τ. Each time the timer expires, all elements in the screen activity matrix are iterated, and a multiplicative decay operation is performed on each grid cell. The decay period is less than the total duration of a typical command input but greater than the average interval between keystrokes.

[0067] For example, for the first line, number The grid cells of a column, whose multiplicative decay operation is represented as = ×α. Where α is the preset heat decay coefficient, a real number greater than zero and less than 1, for example, a value of 0.9. The heat decay coefficient α is used to control the decay rate of historical operation information; the closer its value is to one, the slower the decay rate; the closer its value is to zero, the faster the decay rate. The above heat decay coefficient is set between 0.8 and 0.98. If it is lower than 0.8, the decay will be too fast, resulting in severe matrix "memory loss"; if it is higher than 0.98, the decay will be too slow, resulting in long-term retention of historical noise.

[0068] Through this multiplicative decay operation, the values ​​of grid cells not updated by new keystrokes gradually decrease over time, approaching zero after several decay cycles. Meanwhile, locations with recent keystrokes maintain relatively high values ​​due to continuous accumulation and updates. This dynamic update mechanism ensures that the screen activity matrix always focuses on the spatial distribution of keystrokes near the current moment, providing an accurate data foundation for morphological statistical analysis.

[0069] S1022. Based on the matrix elements in the screen activity matrix corresponding to the target row, calculate the column distribution dispersion, which characterizes the horizontal distribution width of keystrokes on the target row, and the active point fill rate, which characterizes the horizontal continuity of keystrokes on the target row.

[0070] As one possible approach, determining the column distribution dispersion involves: extracting matrix elements with values ​​greater than zero from the target row of the screen activity matrix, designating them as active points. Based on the values ​​and column coordinates of each active point, calculating the weighted average column coordinates of all active points in the target row, and using these weighted average column coordinates as the operation centroid coordinates. Based on the operation centroid coordinates and the values ​​and column coordinates of each active point, calculating the weighted dispersion of all active points in the target row relative to the operation centroid coordinates, and using this calculated weighted dispersion as the column distribution dispersion.

[0071] The process of determining the active point fill rate includes: extracting matrix elements with values ​​greater than zero from the monitoring target row from the screen activity matrix, which are then used as active points. Each active point is mapped to a binary state. The binary state indicates whether a keystroke operation occurred at the corresponding location within a preset time period. Based on the column coordinates of each active point, the horizontal span covered by all active points on the monitoring target row is determined. Based on the horizontal span and the total number of binary states with operation activity, the density of binary states filling the horizontal span is calculated. This calculated density is used as the active point fill rate. The presence of operation activity indicates that a keystroke operation occurred at the corresponding location within the preset time period.

[0072] Specifically, the screen activity matrix is ​​analyzed at fixed analysis cycles. Within each analysis cycle, a preset monitoring target row index is first identified. This monitoring target row is a specific row number pre-configured based on program characteristics, such as the last row of the terminal screen in a full-screen editor scenario, used to focus on analyzing high-frequency areas of command input.

[0073] The aforementioned fixed analysis period is longer than the average interval of a single keystroke to ensure the stability of the statistical features, and shorter than the total duration of a typical command input to ensure that the determination can be completed before the command is executed. The fixed analysis period can be set to 300ms or 200ms; this embodiment does not impose a specific limitation.

[0074] The aforementioned target line for monitoring can be a special screen line dedicated to receiving and executing commands, such as the last line of the terminal screen. The target line can also be a configurable parameter that can be dynamically adjusted based on different applications, thereby achieving accurate and efficient intent recognition.

[0075] Extract all matrix elements with values ​​greater than zero from the target row of the screen activity matrix. These elements are designated as active points, and a set of active points is constructed. This set contains N active points. For the m-th active point, its column index is recorded as follows: Its matrix value is Column index This indicates the horizontal position of the active point on the target row being monitored; the matrix value... This indicates the current cumulative activity level at this location.

[0076] Before performing feature calculations, a zero-protection check can be performed. Specifically, the total activity of the target row is calculated and denoted as... Total activity It equals the sum of the matrix values ​​of all active points in that row, and is calculated as follows: If total activity Less than the preset minimum activity value (e.g.) This indicates that there are almost no effective operations on the current monitoring target row. The column distribution dispersion, which is used to characterize the width of the operation distribution, and the active point fill rate, which is used to characterize the continuity of the operation, are both set to zero, and the analysis of the current period ends.

[0077] If total activity If the value is greater than or equal to the preset minimum activity value, begin calculating the column distribution dispersion. First, calculate the column coordinates of the operation centroid, denoted as . Column coordinates of the operation centroid The formula can be determined using column coordinates.

[0078] For example, the formula for determining column coordinates can be as follows: in, To manipulate the column coordinates of the centroid, The column index for the m-th active point. Let m be the matrix value of the m-th active point. This represents the total activity level. The column coordinates of the operation center reflect the horizontal center position of keystrokes on the monitored target row.

[0079] The aforementioned minimum activity value is used to determine whether there is a valid operation on the target row being monitored. Its setting needs to balance the stability of numerical calculation with the sensitivity of retaining weak operations.

[0080] For example, the minimum activity value can be This value is determined based on the precision limit of single-precision floating-point arithmetic and can reliably filter out errors caused by floating-point calculations. The precision noise is on the order of magnitude, and is far lower than the residual value after dozens of decay cycles of a single keystroke, ensuring that subtle operation traces are not mistakenly eliminated.

[0081] In practical applications, the minimum activity value can also be adjusted based on floating-point precision: if double-precision floating-point numbers are used for matrix operations, the minimum activity value can be reduced to [value missing]. To improve sensitivity to extremely weak signals; if operating in a low-precision embedded environment, the sensitivity can be appropriately increased to [value missing]. This is to avoid frequent triggering of the zero-reset protection. Of course, those skilled in the art can adaptively modify the above-mentioned minimum activity value according to the actual floating-point precision used and the system noise level.

[0082] Subsequently, the column distribution dispersion was calculated. The column distribution dispersion is used to characterize the horizontal distribution width of keystrokes on the monitored target row. It is calculated as follows: for each active point, calculate its column coordinates. Column coordinates of the operation center The square of the difference, multiplied by the matrix value at that point. Sum the products of all active points and divide by the total activity of that row. ,Right now: The larger the column distribution dispersion value, the wider the distribution of active points in the horizontal direction, and the operation trajectory shows a linear extension characteristic, which is consistent with the shape of long command input; the smaller the column distribution dispersion value, the more concentrated the operation is near the operation center, showing a point distribution, which is consistent with the shape of single-point modification or accidental touch operation.

[0083] And, calculate the active point fill rate. The active point fill rate is used to characterize the degree of continuity of keystrokes in the horizontal direction on the monitored target row. When calculating the active point fill rate, the active points are first binarized: for each active point on the monitored target row, regardless of its matrix value... The size of each variable is mapped to an operational state. The value is 1, indicating that a keystroke operation has occurred at this location within a preset time period; for other locations on the target row that do not belong to the active point set, the binary state is no operation state, with a value of zero.

[0084] Determine the horizontal span covered by all active points on the target row, denoted as Span. Specifically, find the largest column coordinate among all active points. and minimum column coordinates The horizontal span, Span, is equal to the maximum column coordinate minus the minimum column coordinate, plus one, i.e., Span = - +1. Understandably, the horizontal span reflects the length of the continuous column interval occupied by the active point.

[0085] Then the active point fill rate was calculated. This refers to the density of the area filled with binary states within a horizontal span. The specific calculation method is as follows: The above active point fill rate The value ranges from 0 to 1. When the active point fill rate is close to 1, it indicates that most column positions within the horizontal span have been operated on, which is consistent with the continuous filling characteristics of manual character input; when the active point fill rate is small, it indicates that there are many gaps between operation points, which is consistent with the discrete jump characteristics of scrolling or page turning.

[0086] Through the above calculation process, the column distribution dispersion and active point fill rate on the monitored target row are obtained in each analysis cycle. These two statistical characteristics together describe the spatiotemporal distribution of keystroke operations on the monitored target row, providing a quantitative basis for subsequent command input intent determination.

[0087] In one design, the process of determining the keystroke coordinate record includes: S1011-S1012.

[0088] S1011. Parse the uplink data stream in the Secure Shell Protocol session to obtain the keystroke characters and the keystroke times when the keystroke characters arrive.

[0089] In this embodiment, the security device can be an SSH proxy gateway with protocol termination capabilities. This SSH proxy gateway acts as an intermediate endpoint for the Secure Shell protocol session, establishing independent encrypted connections with both the terminal device and the server. Based on the session key of the current session, the SSH proxy gateway can decrypt passing encrypted data packets in real time, thereby obtaining the uplink and downlink data streams in plaintext form.

[0090] An SSH proxy gateway can process decrypted bidirectional data streams in parallel or sequentially. For the upstream data stream, i.e., the data sent from the client to the server, data parsing operations are performed. The upstream data stream carries the raw keystroke data generated by the user's keyboard input on the terminal device.

[0091] Specifically, two core pieces of information can be extracted from each upstream data stream: keystroke characters and keystroke time. The keystroke characters are denoted as... The keystroke character is the actual input generated by the user pressing a key on the keyboard. It can be ordinary printable characters, such as letters, numbers, and punctuation marks, or control characters, such as backspace and carriage return. These characters are extracted one byte at a time from the upstream data stream payload to form a continuous keystroke sequence. The keystroke time is denoted as... This time can be the moment the current uplink data stream arrives at the gateway. For example, when the SSH proxy gateway detects the arrival of the current uplink data stream, it retrieves the current timestamp from the operating system kernel as the arrival time of the keystroke. Keystroke Time It is used for subsequent timing alignment operations and is the key basis for correctly associating keystroke characters with cursor positions.

[0092] Furthermore, the extracted keystroke characters and their corresponding keystroke times are stored sequentially into a keystroke matching queue. This keystroke matching queue uses a first-in, first-out data structure to cache keystroke records that have not yet completed coordinate matching, waiting for subsequent timing alignment with cursor positioning instructions in the downlink stream.

[0093] Through the above parsing process, the user's actual keystroke input sequence and its precise arrival time are restored from the encrypted SSH session, providing basic raw data for subsequent coordinate deduction, spatiotemporal distribution analysis, and instruction reconstruction.

[0094] S1012. If a cursor positioning instruction is matched within the preset time window, the coordinates indicated by the cursor positioning instruction will be determined as the effective coordinates of the keystroke character.

[0095] The starting time of the preset time window is the keystroke time.

[0096] As one possible approach, whenever a new keystroke character and its keystroke time are parsed from an upstream data packet, this set of information is treated as a record to be matched and pushed into the tail of the keystroke matching queue in chronological order.

[0097] Simultaneously, cursor update events in the downlink data stream can be monitored in parallel: when a new cursor positioning instruction is parsed from the downlink data stream, the target row coordinates indicated by the instruction are extracted from the instruction. and target column coordinates And the cursor time at which the instruction reaches the gateway. .

[0098] For the record currently at the head of the keystroke matching queue, a preset time window is opened, denoted as . The preset time window can be a pre-defined time length used to define the maximum allowed time interval between a keystroke and the cursor movement it causes. The start time of the preset time window is the keystroke time of the first keystroke in that sequence.

[0099] Determine within the time interval [ , + [Whether a new cursor positioning command has been received within the specified time frame. Specifically, the second time frame of the currently received cursor positioning command.] Keystroke time of the first keystroke character Compare. If If it falls within the above time interval, then it satisfies ≤ ≤ + If the cursor positioning command is successfully matched within the preset time window, it is determined that the cursor positioning command was successfully matched.

[0100] After a successful match, the target row and column coordinates indicated by the cursor positioning command are determined as the effective row and column coordinates of the first keystroke character. Subsequently, the first keystroke character is removed from the keystroke matching queue, and the keystroke time, keystroke character 'k', and the determined effective row coordinates are recorded. and the effective column coordinates Generate a complete keystroke coordinate record.

[0101] In some embodiments, the keystroke character k and the determined effective line coordinates are... Effective column coordinates This, along with the normalized time information, generates a complete keystroke coordinate record. The normalized time information is the keystroke time... or cursor time Standardized timestamps, processed uniformly and accurate to milliseconds or microseconds, provide a unified timeline, enabling accurate identification of the time and location of keystrokes. This is crucial for subsequent statistical analysis and instruction reconstruction.

[0102] Through the above matching mechanism, the keystrokes transmitted discretely can be accurately associated with the cursor position information returned by the server, and each keystroke can be assigned accurate screen space coordinates. This solves the technical problem that the gateway cannot directly perceive the absolute coordinates of the cursor due to the dual-stream separation transmission of the SSH protocol.

[0103] S1013. If no cursor positioning instruction is matched within the preset time window, the effective coordinates of the keystroke character are determined based on the current position of the cursor and the type of the keystroke character.

[0104] One possible approach is to continuously maintain a virtual cursor position for the terminal device during operation. This virtual cursor position simulates the row and column coordinates of the current cursor on the terminal screen, serving as a spatial reference for coordinate derivation. The initial value of the virtual cursor position can be set according to the terminal window size and the current session state, and can be corrected in real time during subsequent processing using received real cursor positioning commands.

[0105] For the record currently at the head of the keystroke matching queue, a preset time window has been opened, starting from its keystroke time. If no new cursor positioning instruction is received within this preset time window, a timeout calculation process is triggered to determine the effective coordinates for the keystroke character at the head of the queue.

[0106] Specifically, first, read the currently maintained virtual cursor position and record it as the current row coordinate. and current column coordinates Subsequently, based on the type of the first keystroke character, the corresponding coordinate deduction operation is performed, specifically in the following cases: Scenario 1: If the keystroke is a regular printed character, such as a letter, number, punctuation mark, or space, the line coordinates of its effective position will remain the same as the current line coordinates. The effective column coordinates remain unchanged, while the effective column coordinates are the current column coordinates. Add a preset unit. This preset unit is usually 1, which means that the cursor moves one column to the right after a printable character is entered, i.e., the effective column coordinate. +1.

[0107] Scenario 2: If the keystroke is a backspace character, i.e., a control character used to delete the previous character, then the line coordinates of its effective position will remain the current line coordinates. The effective column coordinates remain unchanged, while the effective column coordinates are the current column coordinates. Reduce by one preset unit, while ensuring that the column coordinate is not less than the minimum effective value of one, i.e., the effective column coordinate. =max(1, -1), where max() is used to take the larger of two values. This operation simulates the physical effect of the backspace key moving the cursor one space to the left.

[0108] Scenario 3: If the keystroke character is a carriage return, i.e., a control character used to execute commands or add a newline, then the coordinates of the line in which it takes effect are the coordinates of the current line. Adding a preset unit resets the effective column coordinates to one, which is the effective row coordinates. = +1, effective column coordinates =1. This operation simulates the physical effect of the Enter key moving the cursor to the beginning of the next line.

[0109] After completing the coordinate position deduction, the effective row coordinates and effective column coordinates obtained from the deduction are used as the effective coordinates of the first keystroke character in the queue, and the keystroke character is removed from the keystroke matching queue. At the same time, the currently maintained virtual cursor position is updated according to the deduction results, and it is set to the new coordinates after deduction, so that it can be used for the deduction of subsequent keystroke characters.

[0110] In addition, the downlink data stream is continuously monitored during subsequent processing. When a real cursor positioning command is received at a later time, the target row coordinates and target column coordinates indicated by the real command are used to correct the currently maintained virtual cursor position and update it to the real coordinate values. This correction operation can eliminate the cumulative errors that may occur due to continuous simulation, thereby ensuring that the virtual cursor position always remains consistent with the actual cursor state on the terminal screen.

[0111] Through the aforementioned timeout extrapolation mechanism, in scenarios where it is impossible to obtain the actual cursor positioning command in a timely manner, accurate effective coordinates can be determined for each keystroke character based on the keystroke character type and the current virtual cursor position, thereby ensuring the continuity and integrity of keystroke coordinate records and providing a complete data foundation for subsequent morphological statistical analysis.

[0112] S1014. Generate a keystroke coordinate record based on the keystroke character, the effective coordinates of the keystroke character, and the keystroke time.

[0113] One possible approach is to obtain complete spatiotemporal attribute information for the keystroke character after completing coordinate matching or deduction, including the keystroke character, its effective position on the terminal screen, and the time of the keystroke. To provide this spatiotemporal attribute information to subsequent modules in a standardized format, a keystroke coordinate record generation operation can be performed.

[0114] For example, create a standardized data structure, denoted as keystroke coordinate record. This keystroke coordinate record is a four-tuple containing four core fields: the keystroke character, the effective row coordinates, the effective column coordinates, and the time information. Specifically, it is represented as follows: Among them: keystroke characters These are the raw characters parsed from the upstream data stream; they can be ordinary print characters or control characters, used for subsequent instruction reconstruction and content analysis. Effective line coordinates. This refers to the target row position of the keystroke character on the terminal screen, determined through coordinate matching or coordinate deduction. The value ranges from one to the maximum number of rows in the terminal window. Effective column coordinates. This refers to the target column position of the keystroke character on the terminal screen, determined through coordinate matching or coordinate deduction. The value ranges from one to the maximum number of columns in the terminal window. (Time information) This is the timing information for keystroke operations, used to identify when the keystroke occurred, serving as a time reference for subsequent timing analysis and historical backtracking. This keystroke timing information is typically obtained by uniformly formatting the keystroke time or cursor time.

[0115] In some embodiments, after generating keystroke coordinate records, a data splitting operation can be performed to meet different processing requirements for the data content: for the requirement of real-time intent monitoring, a first data stream can be generated, which includes the effective row coordinates, effective column coordinates, and time information in the keystroke coordinate records, but does not include the keystroke characters. The first data stream is used to update the screen activity matrix and calculate statistical features. By removing character content, user input privacy is protected while reducing data transfer overhead between modules. For instruction refactoring needs, a second data stream can be generated, containing complete four-tuple information: keystroke character, effective row coordinates, effective column coordinates, and time information. This second data stream is written to the historical record circular cache in chronological order.

[0116] Through the above-mentioned record generation and diversion mechanism, the original keystroke events are transformed into structured standard data units, and customized data views are provided for different processing needs, laying a complete and accurate data foundation for subsequent morphological statistical analysis, command intent recognition and instruction reconstruction.

[0117] In one design, the above S104 includes: S1041-S1044.

[0118] S1041. In response to the judgment result that there is a command input intention, extract the keystroke coordinate record within the trigger time period from the history cache.

[0119] One possible approach is to acquire a command input status flag. This flag indicates whether a command input intent exists on the current monitoring target line, and its value is either valid or invalid. When the command input status flag first changes from invalid to valid, it is determined that a command input action has begun on the current monitoring target line. The system then enters command collection mode and marks the current time as the collection start point.

[0120] During command collection, the system continuously receives changes in the command input status flag and executes debouncing logic. Specifically, if the command input status flag changes from a valid flag back to an invalid flag, collection does not immediately terminate; instead, a debouncing timer is started. If the command input status flag becomes valid again before the debouncing timer expires, the command collection state remains unchanged, and the debouncing timer is reset. If the command input status flag does not become valid again before the debouncing timer expires, or if the user presses the Enter key, the current command input process is considered complete, and this moment is recorded as the collection endpoint.

[0121] The aforementioned debounce timer timeout can be understood as the accumulated time of the debounce timer exceeding the preset waiting time, for example, the accumulated time of the debounce timer exceeding 500ms. The preset waiting time is greater than 200ms, exceeding the user's keystroke interval but less than 1 second, to avoid the user perceiving a significant delay.

[0122] When the command input process ends, the trigger time period is determined, which is the time interval from the start to the end of the collection. Using this time interval as the search range, keystroke coordinate records falling within this trigger time period are extracted from the history circular cache. Since the history circular cache always retains complete data within the most recent preset time period, and the collection start point usually falls within this preset time period, it is possible to completely trace back the entire process from the start to the end of the command input, ensuring that no keystroke operations are missed.

[0123] Subsequently, the extracted keystroke coordinate record set contains all keystroke operations generated by the user during this command input process, including ordinary print characters and control characters such as backspace, as well as the precise effective coordinates and time information of each character on the terminal screen. This record set is used as the raw data for subsequent instruction reconstruction to simulate the terminal rendering process and restore the instruction sequence that the user ultimately intended to execute.

[0124] Through the above extraction mechanism, the system can accurately obtain complete historical data related to the command input after confirming the command input intent, providing complete and accurate input materials for subsequent command reconstruction and ensuring the authenticity and reliability of the reconstruction results.

[0125] S1042. Initialize a temporary storage space corresponding to the width of the terminal screen.

[0126] As one possible approach, before executing the instruction reconstruction process, the specification parameters of the terminal screen's window size are first obtained. The current maximum number of columns is extracted from these parameters. This maximum number of columns represents the maximum number of characters the terminal screen can display in a single line, i.e., the screen width. This value is the core basis for initializing the temporary storage space. A temporary storage space is created in the memory of the security device to simulate the final rendering state of a line of characters on the terminal screen. This temporary storage space is specifically implemented as a one-dimensional temporary character array. The length of the temporary character array is set to be equal to the current maximum number of columns on the terminal screen; that is, the array contains n elements, each corresponding to a column position in the same row on the screen. The array element indices increase sequentially from the starting position, corresponding to the first column, second column, and so on up to the current maximum number of columns on the screen.

[0127] Next, the temporary character array is initialized. For example, all elements in the temporary character array are set to null values. A null value indicates that there are currently no valid characters at the corresponding column position, meaning that the position is blank on the screen. This initialization provides a clean initial state for subsequent character writing and overwriting, ensuring that only processed keystrokes are recorded in the array.

[0128] The initialization of the temporary character array is fundamental for subsequent timing playback and character overwrite operations. By creating an array the same width as the screen, the layout of a line of characters on the screen can be accurately simulated in memory, providing a precise spatial mapping for processing keystroke coordinate records one by one, simulating character writing and deletion effects. The lifespan of this temporary storage space is limited to the current instruction refactoring process; it is released after refactoring is complete to save memory resources.

[0129] S1043. Traverse the extracted keystroke coordinate records in chronological order. Update the content in the temporary storage space based on the character and effective coordinate in the currently traversed keystroke coordinate record. If the currently traversed character is a printable character, write the character to the position in the temporary storage space corresponding to the effective coordinate of the character to overwrite the original content at that position.

[0130] As one possible approach, after initializing the temporary storage space and extracting the set of keystroke coordinate records within the trigger time period from the historical circular cache, the timing playback and content update operations are performed. The core objective of this operation is to simulate the real-time rendering process of the user's keystroke sequence on the terminal screen and restore the final displayed valid instruction content.

[0131] Specifically, the extracted keystroke coordinate records are first sorted in chronological order to ensure that the playback order is completely consistent with the actual keystroke order of the user. After sorting, these keystroke coordinate records are traversed one by one.

[0132] For each keystroke coordinate record encountered during the current iteration, the keystroke character and the effective column coordinates are first parsed. The effective column coordinates represent the target column position of the keystroke character on the terminal screen, ranging from one to the maximum number of columns on the terminal screen. Different update logic is executed based on the type of the keystroke character: if the currently encountered keystroke character is a regular print character, a character write operation is performed. For example, the position at index c in the temporary character array (i.e., the c-th element in the array) is located, and the current keystroke character is updated. Write to this location, indicating as This write operation leverages the uniqueness of array indices. For the same column position c, if a character is written to that position again in subsequent keystroke coordinate records, the newly written character will automatically overwrite the existing character. This overwrite mechanism precisely simulates the behavior of the terminal screen; that is, at the same screen position, the later-entered character will directly overwrite the earlier-entered character, ultimately retaining only the result of the last operation.

[0133] For example, if a user first enters character 'a' to column position 5, and then enters character 'b' to the same column position 5, then after traversal processing, the temporary character array... Ultimately, the last character 'b' is saved. This mechanism effectively eliminates intermediate traces caused by user modifications during input, ensuring that the subsequently extracted instruction sequence reflects the final intent.

[0134] The system continues to iterate through subsequent keystroke coordinate records, repeating the above judgment and update operations for each record. During the iteration process, a temporary character array is used. The content changes dynamically as each record is processed, and finally freezes at the end of the traversal to the final rendered state of the characters on the screen.

[0135] In other embodiments, if the currently traversed character is a backspace character, the content corresponding to the previous coordinate position in the temporary storage space is cleared according to the effective coordinates of the backspace character.

[0136] Specifically, if the currently encountered keystroke character is a backspace character, which is a control character used to delete the previous character, then a simulated deletion operation is performed: the system locates the position at index c-1 in the temporary character array, which is the column position before the current cursor position, and clears the content at that position, setting it to null. This clearing operation is represented as follows: (Negative value). This operation precisely simulates the backspace behavior on the terminal screen: when the user presses the backspace key, the cursor moves back one space to the left and deletes the character at the new position.

[0137] For example, with the current temporary character array Taking the character "x" stored at index 3 as an example, traversing to the coordinates of an effective column... If the backspace character is recorded, the system will... The content at index 3 is cleared, making it null, thus simulating the effect of deleting the character "x". If the position at index 3 was originally null, it will remain null after the clearing operation.

[0138] When performing a clear operation, the system needs to ensure the validity of column coordinates. If the effective column coordinates of the backspace character are... If the value is equal to 1, meaning the cursor is currently in the first column of the screen, then the position in the previous column will be equal to 1. If the value is zero or negative, it exceeds the valid index range of the array. In this case, no clearing operation is performed, or special handling is performed depending on the specific behavior of the terminal device, typically simulating the effect of pressing the backspace key at the beginning of a line on the terminal device.

[0139] The backspace character itself is not written to any position in the temporary character array, which contrasts sharply with how ordinary printed characters are handled. The backspace character exists only as a deletion instruction, triggering a clearing operation on existing content; it is not part of the final instruction sequence itself.

[0140] The backspace handling mechanism described above accurately simulates user modification behavior during input. When a user presses the backspace key to delete an incorrect character and re-enters the correct character, the backspace character clears the previous content, and then the new content is written by subsequent normal print characters. Ultimately, only the correctly entered character state is retained in the temporary character array. This mechanism effectively eliminates intermediate traces caused by modifications during input, ensuring that the subsequently extracted instruction sequence reflects the pure instruction content intended by the user. Backspace handling and normal print character handling together constitute a complete terminal rendering simulation logic, enabling accurate handling of various editing operations during user input and providing an accurate technical means to recreate the true instruction sequence.

[0141] Through the aforementioned timing playback and overwrite operations, the system successfully simulated the character rendering process of the terminal screen, transforming the user's complex keystroke sequence into a stable and pure final character state, laying an accurate foundation for subsequent extraction of instruction sequences.

[0142] S1044. After the traversal is complete, extract the non-empty characters from the temporary storage space in order and concatenate them to form an instruction sequence.

[0143] As one possible approach, after traversing all keystroke coordinate records within the trigger time period, the temporary character array records the final rendering state of the characters on the target line. At this point, each position in the temporary character array either stores the character that was ultimately retained after multiple overwrites, or remains empty, indicating that the position was never occupied by a valid character during the input process or was eventually deleted.

[0144] During the instruction sequence extraction phase, the temporary character array is scanned in ascending order of column coordinates, starting from index 1 and incrementing until the largest column is reached. For each position in the temporary character array, it is checked whether the content stored at that position is a non-empty character. If the character stored at the currently scanned position is not empty, the character is retrieved and added to a temporary sequence buffer in the scanning order. If the currently scanned position is empty, the system skips that position and continues scanning the next position.

[0145] Furthermore, during the scanning process, the original order of the characters is maintained; that is, the first character extracted corresponds to the leftmost column position on the screen, and the last character extracted corresponds to the rightmost column position. This column-coordinate-based extraction method ensures that the final concatenated instruction sequence is completely consistent with the character order that the user reads on the screen from left to right.

[0146] After the scan is complete, all characters stored sequentially in the temporary sequence cache are concatenated to form a complete string, denoted as the reconstructed instruction sequence. This reconstructed instruction sequence represents the pure instruction content that the user ultimately intends to execute on the target line being monitored. The reconstructed instruction sequence has eliminated intermediate traces caused by editing operations such as backspace, modification, and overwrite during the input process, truly reflecting the final instruction state displayed on the screen before the user presses the Enter key.

[0147] For example, if a user sequentially performs the following operations during input: inputting character 'a' to column coordinate 2, inputting character 'b' to column coordinate 3, pressing the backspace key to delete the content at column coordinate 3, and inputting character 'c' to column coordinate 3, then after the aforementioned traversal and update, the temporary character array will store 'a' at index 2, 'c' at index 3, and the other positions will be empty. After sequential extraction, the system will concatenate characters 'a' and 'c' to form the instruction sequence "ac", rather than the original keystroke sequence "abc" plus the mixed content of the backspace key.

[0148] In one design, the high-risk operation command identification method provided in this application embodiment further includes: S105-S107.

[0149] S105. In the process of determining whether there is a command input intention, when it is first determined that there is a command input intention, the system enters the instruction collection state.

[0150] One possible approach is to acquire a command input status flag and determine whether a command input intent exists based on the flag. During this determination, upon first identifying a command input intent, the system enters a command collection state. The command input status flag is the result of a comprehensive assessment of the total activity, column distribution dispersion, and active point fill rate on the monitored target row within each analysis cycle, indicating whether a command input intent exists on the current monitored target row.

[0151] In some embodiments, changes in the command input status flag are continuously monitored. Initially, the system is in a non-collection state, meaning no command collection process has been initiated. The system records the current value of the command input status flag and compares it in real time with the latest received value to detect changes in the status. When the system detects that the command input status flag has changed from an invalid status flag to a valid status flag, it determines for the first time that a command input intention exists, and immediately enters the command collection state in response to this status change.

[0152] Upon entering the command collection state, the system does not immediately perform command reconstruction. Instead, it enters a waiting phase to collect the complete command input process. This design is based on the following considerations: command input is usually a continuous process involving multiple keystrokes, with a certain time span between the input of the first character and the final pressing of the Enter key. If reconstruction were performed immediately upon the first determination of command input intent, the command might not have been fully entered, resulting in an incomplete command sequence.

[0153] By entering the command collection state, a time window is provided for subsequent command input, allowing users to continue entering more characters, including ordinary print characters and control characters such as backspace. During the command collection state, changes in the subsequent command input status flags are continuously monitored. Combined with debouncing mechanisms and end-of-command detection, the system ultimately determines when the command input process ends, thus triggering the complete command reconstruction process.

[0154] The mechanism of entering the command collection state ensures that command reconstruction is performed after the complete command input process has been obtained, avoiding the problem of incomplete commands due to premature triggering, and laying the foundation for accurately reconstructing the command sequence that the user ultimately intended to execute.

[0155] S106. In the instruction collection state, if it is determined that there is no intention to input a command, a timer is started. If it is determined again that there is an intention to input a command before the timer expires, the instruction collection state is maintained.

[0156] One possible approach is to acquire information about changes in the command input status flag after entering the command collection state. This command input status flag indicates whether a command input intent exists on the target line, and its value changes dynamically as the user's keystrokes and the analysis cycle progresses.

[0157] During command collection, a situation may arise where the command input status flag changes from valid to invalid. This typically occurs when there is a short pause during user input or a long time interval between two consecutive keystrokes, leading to the determination that no command input intent exists within one or more analysis cycles. If command collection is immediately terminated every time the command input status flag becomes invalid, the collection process will be frequently interrupted, causing keystroke sequences that should belong to the same command input to be fragmented into multiple segments, making it impossible to fully reconstruct the command that the user ultimately intended to execute.

[0158] To address the aforementioned technical issues, a debouncing mechanism is introduced. Specifically, when the command input status flag changes from valid to invalid during command collection, command collection is not immediately terminated; instead, a debouncing timer is started. The duration of the debouncing timer can be a preset length to tolerate short pauses during command input. Its value is typically configured based on the statistical characteristics of user input behavior; for example, the preset length might be set to 500ms.

[0159] After the debounce timer starts, it enters a waiting state. In this waiting state, it continues to monitor changes in the command input status flag, while the debounce timer counts down in the background. During this process, the following two scenarios may occur: In the first scenario, before the debounce timer expires, the command input status flag changes from invalid to valid. This indicates that the user continued input after a short pause, and the current command input process has not yet ended. In response to this status change, operations to maintain the command collection state are executed, specifically: immediately stopping and resetting the debounce timer to zero; continuing to maintain the command collection state; and including subsequently received keystroke coordinate records within the scope of this command collection. Through this mechanism, the system successfully classifies the keystrokes before and after the user's pause into the same command input process.

[0160] In the second scenario, the command input status flag remains invalid during the debounce timer's operation until the timer times out. This indicates that the user did not continue inputting after the pause, and the current command input process may have ended naturally. In this case, the system considers the debounce timer timeout as one of the conditions for the end of the command input process, subsequently triggering the subsequent instruction refactoring process.

[0161] Through the aforementioned debouncing mechanism, the system can effectively distinguish between natural pauses during command input and the actual end of input, avoiding misjudgments caused by fluctuations in input rhythm. This ensures that a complete command input can be accurately identified and collected, providing a complete and continuous data foundation for subsequent instruction reconstruction.

[0162] S107. When a newline character is detected, or the timer times out, determine that the current instruction input process has ended, and trigger the step of reconstructing the instruction sequence that the user ultimately intends to execute.

[0163] One possible approach is to continuously run the debouncing mechanism during instruction collection and obtain termination conditions. These termination conditions include a first termination condition and a second termination condition. The first termination condition is the occurrence of a newline character input by the user, and the second termination condition is the timeout event of the debouncing timer.

[0164] For the first termination condition, during the traversal of keystroke coordinate records, the system continuously checks whether the currently processed keystroke character is a carriage return character and records it as a specific control character. A carriage return character is the standard operation for users to submit commands in the command-line interface, indicating that the currently edited command has been completed and requesting the server to execute the command. When the system detects a carriage return character in the command collection state, regardless of the current command input status flag value, the system immediately determines that the current command input process has ended and records the moment the carriage return character is detected as the collection endpoint.

[0165] For the second termination condition, the status of the debounce timer is continuously monitored. When the command input status flag changes from valid to invalid, the system starts the debounce timer. If the command input status flag does not become valid again during the timer's operation, and the system does not detect a newline character, a timeout event is triggered when the debounce timer's duration reaches a preset threshold. The system determines this timeout event as a sign that the command input process has ended naturally, and records the timeout occurrence as the collection endpoint. This mechanism is used to handle situations where the user completes input but does not press Enter and remains inactive for an extended period, preventing the collection window from remaining indefinitely.

[0166] When either of the above two conditions is met, the system determines that the current instruction input process has ended. After the determination, the following operations are performed to trigger subsequent processes: Determine the trigger time period: The system uses the previously marked collection start point and the currently determined collection end point as boundaries to form a complete time interval, namely the trigger time period. This time period covers the entire process from when the user begins to input a command to when the input ends.

[0167] Triggering Instruction Reconstruction: The system sends a start signal to the instruction reconstruction sub-process, instructing it to begin executing the instruction reconstruction operation. This reconstruction operation specifically includes: retrieving keystroke coordinate records from the historical circular cache based on the trigger time period, initializing temporary storage space, traversing the records and updating the content of the temporary storage space, and finally extracting non-empty characters and concatenating them to form a reconstructed instruction sequence.

[0168] Reset Collection Status: The system clears the current command collection status and related records, including resetting the debounce timer and clearing the collection start point marker, to prepare for the next possible command input. The system restores the initial monitoring status of the command input status flag.

[0169] Through the aforementioned judgment and triggering mechanism, the system can precisely initiate the instruction reconstruction process at the exact moment the user completes the command input, whether through active submission or natural timeout. This ensures that the reconstructed instruction sequence completely and accurately reflects the user's final intention to execute, providing a reliable input basis for the subsequent execution of security policies.

[0170] This application provides a high-risk operation command identification method, which offers at least the following benefits: By acquiring keystroke coordinate records containing keystroke characters, effective coordinates, and time information, a complete data foundation is provided for user intent analysis; then, based on the effective coordinates and time information, the column distribution dispersion (characterizing the horizontal distribution width of keystroke operations on the monitored target row) and the active point fill rate (characterizing the horizontal continuity) are directly calculated, and the command input intent is identified through a comprehensive judgment of these two statistical features; when a command input intent is determined to exist, the command sequence executed by the user's final intent is reconstructed based on the complete keystroke information. This method effectively distinguishes linear continuous command input, dotted accidental touch operations, and discrete jumping scrolling noise from the operation form level through the statistical features of column distribution dispersion and active point fill rate, avoiding the misjudgment and omission problems caused by traditional technologies that rely solely on cursor position or keyword matching; at the same time, by reconstructing the command, the user's final intent is restored, eliminating the confusion caused by backspace, modification, and other editing operations during the input process, achieving accurate identification of high-risk operation commands in full-screen interactive programs, and significantly improving the security and accuracy of operation and maintenance audits.

[0171] Please see Figure 2 The diagram illustrates a high-risk operation command identification device according to an embodiment of the present invention. This device includes: a keystroke information unit 201, a feature calculation unit 202, an intent recognition unit 203, and an intent reconstruction unit 204. The units can communicate bidirectionally via a communication link, ensuring real-time interaction of collected data and analysis results. The communication link can employ wired or wireless transmission methods to meet the communication needs of different monitoring scenarios.

[0172] The keystroke information unit 201 is used to acquire keystroke coordinate records; the keystroke coordinate records include the keystroke character corresponding to the user's keystroke operation on the terminal screen, the effective coordinates of the keystroke character on the terminal screen, and the time information of the keystroke operation.

[0173] The feature calculation unit 202 is used to calculate the column distribution dispersion, which characterizes the horizontal distribution width of keystrokes on the target row, and the active point fill rate, which characterizes the horizontal continuity of keystrokes on the target row.

[0174] The intent recognition unit 203 is used to determine whether there is a command input intent on the target row of the monitoring based on the column distribution dispersion and the active point fill rate.

[0175] The intent reconstruction unit 204 is used to reconstruct the instruction sequence that the user ultimately intends to execute based on the keystroke characters, effective coordinates, and keystroke operation time information in response to the judgment result that there is a command input intent.

[0176] In one design, the feature calculation unit 202 is specifically used to: update the screen activity matrix based on the effective coordinates and keystroke time information; the screen activity matrix is ​​used to characterize the frequency of operation at each position on the terminal screen. Based on the matrix elements in the screen activity matrix corresponding to the monitored target row, the column distribution dispersion and active point fill rate are calculated.

[0177] In one design, the feature calculation unit 202 is specifically used to: extract matrix elements with values ​​greater than zero from the screen activity matrix, which are then designated as active points; calculate the weighted average column coordinates of all active points in the target row based on the values ​​and column coordinates of each active point, and use these weighted average column coordinates as the operation centroid coordinates; and calculate the weighted dispersion of all active points in the target row relative to the operation centroid coordinates based on the operation centroid coordinates, the values, and column coordinates of each active point, and use the calculated weighted dispersion as the column distribution dispersion.

[0178] In one design, the feature calculation unit 202 is specifically used to: extract matrix elements with values ​​greater than zero from the monitoring target row of the screen activity matrix, as active points; map each active point to a binary state; the binary state is used to indicate whether a keystroke operation has occurred at the corresponding position within a preset time period; determine the horizontal span covered by all active points on the monitoring target row based on the column coordinates of each active point; calculate the density of binary states filling the horizontal span based on the horizontal span and the total number of binary states with operation status, and use the calculated density as the active point filling rate. The presence of operation status indicates that a keystroke operation has occurred at the corresponding position within the preset time period.

[0179] In one design, the keystroke information unit 201 is specifically used to: parse the uplink data stream in the Secure Shell Protocol (SEP) session to obtain the keystroke character and the keystroke time of its arrival. If a cursor positioning instruction is matched within a preset time window, the coordinates indicated by the cursor positioning instruction are determined as the effective coordinates of the keystroke character; the start time of the preset time window is the keystroke time. If no cursor positioning instruction is matched within the preset time window, the effective coordinates of the keystroke character are determined based on the current position of the cursor and the type of keystroke character. A keystroke coordinate record is generated based on the keystroke character, the effective coordinates of the keystroke character, and the keystroke time.

[0180] In one design, the intent reconstruction unit 204 is specifically used to: in response to a judgment result indicating the existence of a command input intent, extract keystroke coordinate records within the triggering time period from the history cache; initialize a temporary storage space corresponding to the width of the terminal screen; traverse the extracted keystroke coordinate records in chronological order, and update the content in the temporary storage space based on the character and effective coordinates of the currently traversed keystroke coordinate record; wherein, if the currently traversed character is a printable character, the character is written to the position in the temporary storage space corresponding to the effective coordinates of the character to overwrite the original content at that position; after the traversal is complete, extract non-empty characters from the temporary storage space in sequence and concatenate them to form an instruction sequence.

[0181] In one design, the intentional refactoring unit 204 is specifically used to: if the currently traversed character is a backspace character, then based on the effective coordinates of the backspace character, clear the content in the temporary storage space corresponding to the previous coordinate position.

[0182] In one design, the intent recognition unit 203 is further configured to: enter an instruction collection state when a command input intent is first determined to exist during the process of determining whether a command input intent exists. In the instruction collection state, if no command input intent is determined to exist, a timer is started; if a command input intent is determined to exist again before the timer expires, the instruction collection state is maintained. When a newline character is detected, or the timer expires, the current instruction input process is determined to have ended, and the step of reconstructing the instruction sequence that represents the user's final intent to execute is triggered.

[0183] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0184] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for identifying high-risk operation commands, characterized in that, include: Acquire keystroke coordinate records; the keystroke coordinate records include the keystroke characters corresponding to the keystroke operations on the terminal screen, the effective coordinates of the keystroke characters on the terminal screen, and the time information of the keystroke operations; Based on the effective coordinates and the timing information of the keystrokes, calculate the column distribution dispersion, which characterizes the horizontal distribution width of keystrokes on the target row, and the active point fill rate, which characterizes the horizontal continuity of keystrokes on the target row. Based on the column distribution dispersion and the active point fill rate, determine whether there is a command input intent on the monitored target row; In response to the determination that there is a command input intention, the sequence of instructions that the user ultimately intends to execute is reconstructed based on the keystroke character, the effective coordinates, and the time information of the keystroke operation.

2. The high-risk operation instruction identification method according to claim 1, characterized in that, The process of determining the column distribution dispersion and the active point fill rate includes: The screen activity matrix is ​​updated based on the effective coordinates and the timing information of the keystroke operation; the screen activity matrix is ​​used to characterize the frequency of operation at each position on the terminal screen; The column distribution dispersion and the active point fill rate are calculated based on the matrix elements corresponding to the monitored target row in the screen activity matrix.

3. The high-risk operation instruction identification method according to claim 2, characterized in that, The step of calculating the column distribution dispersion based on the matrix elements corresponding to the monitored target row in the screen activity matrix includes: Extract the matrix elements with values ​​greater than zero from the monitored target row of the screen activity matrix, and use them as active points; Based on the values ​​and column coordinates of each active point, calculate the weighted average column coordinates of all active points on the monitored target row, and use the weighted average column coordinates as the operation centroid coordinates; Based on the coordinates of the operation centroid and the values ​​and column coordinates of each active point, the weighted dispersion of all active points on the monitoring target row relative to the coordinates of the operation centroid is calculated, and the calculated weighted dispersion is used as the column distribution dispersion.

4. The high-risk operation instruction identification method according to claim 2, characterized in that, The step of calculating the active point fill rate based on the matrix elements corresponding to the monitored target row in the screen activity matrix includes: Extract the matrix elements with values ​​greater than zero from the monitored target row of the screen activity matrix, and use them as active points; Each active point is mapped to a binary state; the binary state is used to indicate whether a keystroke operation has occurred at the corresponding position within a preset time period; Based on the column coordinates of each active point, determine the horizontal span covered by all active points on the monitoring target row; Based on the horizontal span and the total number of binary states that are in an operational state, the density of the binary states filling the horizontal span is calculated, and the calculated density is used as the active point filling rate; the operational state is used to characterize that the corresponding position has undergone a keystroke operation within the preset time period.

5. The high-risk operation instruction identification method according to claim 1, characterized in that, The process of determining the keystroke coordinate record includes: Parse the uplink data stream in the Secure Shell Protocol session to obtain the keystroke character and the keystroke time when the keystroke character arrives; If a cursor positioning instruction is matched within a preset time window, the coordinates indicated by the cursor positioning instruction are determined as the effective coordinates of the keystroke character; the starting time of the preset time window is the keystroke time. If the cursor positioning instruction is not matched within the preset time window, the effective coordinates of the keystroke character are determined based on the current position of the cursor and the type of the keystroke character. The keystroke coordinate record is generated based on the keystroke character, the effective coordinates of the keystroke character, and the keystroke time.

6. The high-risk operation instruction identification method according to any one of claims 1-5, characterized in that, The reconstructed sequence of instructions that the user ultimately intends to execute includes: In response to the determination result that there is a command input intention, the keystroke coordinate records within the trigger time period are extracted from the history cache; Initialize a temporary storage space corresponding to the width of the terminal screen; The keystroke coordinate records are extracted in chronological order. Based on the character and effective coordinate in the currently traversed keystroke coordinate record, the content in the temporary storage space is updated. If the currently traversed character is a printable character, the character is written to the position in the temporary storage space corresponding to the effective coordinate of the character, so as to overwrite the original content at that position. After the traversal is complete, non-empty characters are extracted sequentially from the temporary storage space and concatenated to form the instruction sequence.

7. The high-risk operation instruction identification method according to claim 6, characterized in that, The update of the contents in the temporary storage space also includes: If the currently traversed character is a backspace character, then based on the effective coordinates of the backspace character, the content in the temporary storage space corresponding to the previous coordinate position is cleared.

8. The high-risk operation instruction identification method according to any one of claims 1-5, characterized in that, Also includes: In the process of determining whether there is a command input intention, when the first determination of a command input intention, the system enters the command collection state; In the instruction collection state, if it is determined that there is no intention to input a command, a timer is started; if it is determined that there is an intention to input a command again before the timer expires, the instruction collection state is maintained. When a newline character is detected, or the timer times out, the current instruction input process is determined to have ended, and the step of reconstructing the instruction sequence that the user ultimately intends to execute is triggered.

9. A high-risk operation command identification device, characterized in that, include: A keystroke information unit is used to acquire keystroke coordinate records; the keystroke coordinate records include the keystroke character corresponding to the user's keystroke operation on the terminal screen, the effective coordinates of the keystroke character on the terminal screen, and the time information of the keystroke operation; The feature calculation unit is used to calculate the column distribution dispersion, which characterizes the horizontal distribution width of keystrokes on the target row of the monitoring, and the active point fill rate, which characterizes the horizontal continuity of keystrokes on the target row of the monitoring. An intent recognition unit is used to determine whether there is a command input intent on the monitored target row based on the column distribution dispersion and the active point fill rate; The intent reconstruction unit is used to reconstruct the instruction sequence that the user ultimately intends to execute based on the keystroke character, the effective coordinate, and the timing information of the keystroke operation, in response to the determination result that there is a command input intent.

10. A storage medium, characterized in that, The storage medium includes stored instructions, wherein, when the instructions are executed, the device containing the storage medium is controlled to perform the high-risk operation instruction identification method as described in any one of claims 1-8.

Images