Online examination anti-cheating method, system and electronic device

Abstract

The application discloses an online examination anti-cheating method and system and electronic equipment, and belongs to the field of online examination and artificial intelligence monitoring. The method comprises the following steps: receiving a screen switching event time sequence feature vector reported by a front end, wherein the vector comprises a timestamp, a single screen switching duration, a cumulative screen switching number and IP change information; comparing the single screen switching duration with a first threshold value, comparing the cumulative screen switching number with a second threshold value, combining the IP change and the cumulative screen switching number to determine a violation level; in response to the screen switching event, generating a breakpoint snapshot containing answered content, remaining time, cumulative screen switching number and violation level and storing the snapshot; in response to a make-up request, restoring a test state from the snapshot, retaining and continuing to accumulate the cumulative screen switching number and the violation level, and dynamically adjusting a screen switching detection threshold value after the restoration according to the violation level. Through the bidirectional linkage of screen switching detection and breakpoint make-up, the application realizes lossless restoration of a violation state and adaptive adjustment of a detection parameter.

Description

Technical Field

[0001] This invention belongs to the field of online examination systems and artificial intelligence security monitoring technology, specifically involving an online examination anti-cheating method, system, and electronic device based on temporal behavior characteristics and breakpoint continuation linkage. Background Technology

[0002] In online examination systems, preventing cheating behaviors such as switching browser tabs or applications to access materials or communicate with others is crucial to ensuring exam fairness. Current technologies primarily rely on counting screen-switching incidents: when a candidate switches screens more than a preset threshold (e.g., 3 times), the system determines it as cheating and terminates the exam. However, this coarse-grained detection method has serious flaws: during the exam, non-subjective factors such as operating system pop-ups, input method bugs, or instant messaging notifications may trigger screen-switching events, leading to false positives and severely impacting exam fairness and candidate experience. Furthermore, existing systems lack effective state preservation mechanisms in the event of network fluctuations, device malfunctions, or unexpected page closures. Candidates' answers, remaining time, and exam progress cannot be recovered after an interruption, forcing them to restart the exam, resulting in poor exam continuity. In addition, existing breakpoint continuation schemes (such as periodically saving answer data) are independent of the screen-switching detection mechanism, failing to dynamically adjust monitoring strategies after resumption based on pre-interruption violation records. This means that candidates who have violated regulations are still monitored with the same detection sensitivity after resuming the exam, undermining the seriousness of the exam.

[0003] Therefore, how to provide a technical solution that can accurately distinguish between subjective cheating screen switching and non-subjective interference screen switching to reduce false alarms, and can achieve lossless recovery of answer data and violation status after the exam is interrupted, and dynamically adjust the detection parameters according to the violation level before recovery, is a technical problem that urgently needs to be solved in this field.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of the embodiments of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.

[0006] This disclosure provides a method and system for preventing cheating in online examinations, which solves the above-mentioned problems by establishing a two-way linkage mechanism between screen switching detection and breakpoint continuation of examination.

[0007] In some embodiments, an online examination anti-cheating method is provided, including the following steps: Receive the time-series feature vector of each screen-switching event of the examinee, which is collected and reported by the front end in real time. The time-series feature vector includes at least the timestamp of the screen-switching event, the duration of a single screen-switching event, the cumulative number of screen-switching events, and the change information of the client's IP address before and after the screen-switching event. The duration of a single screen-switching event in the time-series feature vector is compared with a first threshold, the cumulative number of screen-switching events is compared with a second threshold, the change information of the IP address is combined with the cumulative number of screen-switching events for judgment, and the corresponding violation level is output based on the comparison result and the combined judgment result. In response to the detection of a screen-switching event, a breakpoint snapshot of the current exam status is generated and stored. The breakpoint snapshot includes at least all the candidate's completed answers, the remaining exam time, the cumulative number of screen-switching events, and the violation level. In response to receiving a continuation request, the system reads the latest breakpoint snapshot from storage, restores the answer interface based on the answered content in the breakpoint snapshot, restores the countdown based on the remaining exam time in the breakpoint snapshot, retains the cumulative number of screen switches and the violation level in the restored exam status, continues to accumulate new screen switch events after restoration based on the cumulative number of screen switches, and determines the screen switch detection threshold after restoration based on the violation level.

[0008] In some embodiments, an online examination anti-cheating system is provided, comprising: The data receiving module is configured to receive the time-series feature vector of each screen-switching event of the examinee collected in real time and reported by the front end. The time-series feature vector includes at least the timestamp of the screen-switching event, the duration of a single screen-switching event, the cumulative number of screen-switching events after this screen-switching event, and the change information of the client's IP address before and after the screen-switching event. The judgment module is configured to compare the duration of a single screen switch in the time-series feature vector with a first threshold, compare the cumulative number of screen switches with a second threshold, combine the IP address change information with the cumulative number of screen switches for judgment, and output the corresponding violation level based on the comparison results and the combined judgment results. The snapshot storage module is configured to generate and store a breakpoint snapshot of the current exam status in response to the detection of a screen-switching event. The breakpoint snapshot includes at least all the candidate's answers, the remaining exam time, the cumulative number of screen-switching events, and the violation level. The exam continuation recovery module is configured to, in response to receiving an exam continuation request, read the latest breakpoint snapshot from storage, restore the answer interface based on the answered content in the breakpoint snapshot, restore the countdown based on the remaining exam time in the breakpoint snapshot, and retain the cumulative number of screen switching events and the violation level in the restored exam status, and continue to accumulate new screen switching events that occur after restoration based on the cumulative number of screen switching events, and determine the screen switching detection threshold after restoration based on the violation level.

[0009] In some embodiments, an electronic device is provided, comprising: At least one processor; and A memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the processor to perform the online examination anti-cheating method described in the first aspect.

[0010] The online examination anti-cheating method, system, and electronic device provided in this disclosure can achieve the following technical effects: This invention achieves deep integration of screen-switching detection and breakpoint continuation of the exam through the above technical solution: screen-switching events trigger snapshot storage, and the violation level in the snapshot affects the detection threshold after recovery, forming a closed loop. This solution, through multi-dimensional temporal feature acquisition and combined judgment, can distinguish between non-subjective screen-switching caused by operating system pop-ups and input method events and subjective cheating screen-switching; through parallel snapshot storage triggered by screen-switching events, it ensures that answer content, remaining time, and violation status data are not lost when the exam is interrupted; and by using the violation level in the snapshot as a feedback signal to dynamically adjust the detection threshold after recovery, it achieves automatic adaptation of detection parameters to the violation status.

[0011] The above general description and the description below are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0012] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein: Figure 1 This is a schematic diagram of the structure of the online examination anti-cheating system provided in this embodiment. Figure 2 This is a flowchart illustrating the online examination anti-cheating method provided in this embodiment of the disclosure; Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this disclosure. Detailed Implementation

[0013] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.

[0014] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.

[0015] Unless otherwise stated, the term "multiple" means two or more.

[0016] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0017] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0018] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.

[0019] The values ​​(such as threshold, duration, number of times, etc.) in the following examples are merely illustrative and do not constitute a limitation of the present invention. In practical applications, different parameters can be configured according to the type of examination and regulatory requirements.

[0020] Example 1

[0021] This embodiment provides an online examination anti-cheating system for executing the methods described in this invention. The system includes a data receiving module, a judgment module, a snapshot storage module, and a continuation / recovery module. The system can be deployed on a server, and each module is implemented by a processor executing a corresponding computer program. For example... Figure 1As shown, the data receiving module receives the front-end screen-switching event and passes the parsed feature vector to the judgment module; the judgment module outputs the violation level. The snapshot storage module and the judgment module respond to the same screen-switching event. The snapshot storage module first stores a temporary snapshot without a violation level; after the judgment module outputs the violation level, it writes the violation level back to this snapshot. The exam continuation recovery module responds to the exam continuation request, reads the breakpoint snapshot from the snapshot storage module to restore the exam state, and feeds back the restored violation level to the judgment module for dynamically adjusting the screen-switching detection threshold.

[0022] The data receiving module is configured to receive the temporal feature vector of each screen-switching event of the examinee, which is collected and reported by the front end in real time.

[0023] Specifically, the front-end (the candidate's terminal browser) listens for events such as `visibilitychange` and `blur` using JavaScript. When it detects that the page loses focus or switches to the background, it records the timestamp of the screen switch (millisecond precision), the duration of the single screen switch (the time difference from leaving to returning), the cumulative number of screen switches since this switch (a counter maintained by the front-end), and the client's IP address change information before and after the screen switch obtained through the back-end API. The front-end encapsulates this data into a temporal feature vector and reports it to the system via HTTPS. After receiving this feature vector, the data receiving module parses it into structured data for use by the subsequent judgment module. Simply relying on the cumulative number of screen switches cannot distinguish between long-duration and short-duration screen switches, nor can it distinguish between single-device screen switches and device-switching screen switches. Introducing the duration of a single screen switch and IP change information allows subsequent judgments to distinguish between different scenarios such as "brief accidental touch" (extremely short duration), "reviewing materials" (longer duration), and "device-switching cheating" (IP change + screen switch), fundamentally improving the precision of detection.

[0024] The determination module is configured to compare the duration of a single screen switch in the time-series feature vector with a first threshold, compare the cumulative number of screen switches with a second threshold, combine the IP address change information with the cumulative number of screen switches for determination, and output the corresponding violation level based on the comparison results and the combined determination results.

[0025] Specifically, the judgment module performs judgments in the following order: First, it checks whether the duration of a single screen switch is greater than or equal to the first threshold (e.g., 30 seconds). If so, it outputs a serious violation level. Otherwise, it checks whether the cumulative number of screen switches is greater than or equal to the second threshold (e.g., 5 times). If so, it outputs a warning level. Otherwise, it checks whether the IP address has changed and whether the cumulative number of screen switches is greater than or equal to the third threshold (e.g., 2 times). If so, it outputs a suspicious level; otherwise, it outputs a normal level. The first, second, and third thresholds can be dynamically adjusted by the exam administrator through the configuration center according to the exam type. This judgment order is designed based on a progressive logic of risk severity: a single long screen switch (possibly while reviewing a large amount of information) has the most direct harm, so it is prioritized as a serious violation; high-frequency short screen switches (such as repeatedly switching windows) have less harm per instance, but a high cumulative number indicates a suspicious behavior pattern, so they are judged as a warning; IP changes combined with screen switches point to the possibility of cheating by changing devices, requiring manual review. This layered design allows the system to take differentiated interventions according to the severity of different cheating types, avoiding excessive punishment caused by a "one-size-fits-all" termination of the exam.

[0026] The snapshot storage module is configured to generate and store a breakpoint snapshot of the current exam state in response to a detected screen-switching event. Regardless of the violation level output by the judgment module, the snapshot storage module immediately performs the snapshot generation operation as soon as a screen-switching event is detected.

[0027] Specifically, this module extracts the following information from the current exam session: all answers completed by the examinee (stored as key-value pairs, where the key is the question ID and the value is the examinee's completed answer), remaining exam time (the number of seconds remaining in the current exam countdown), elapsed time, current question number, cumulative screen-switching count maintained by the data receiving module, and the violation level output by the judgment module. This information is serialized into a JSON string and written to a Redis cache with the key `exam_snapshot:{examID}:{examineeID}`, while simultaneously being asynchronously written to a MySQL database for persistent backup. Including the violation level and cumulative screen-switching count in the snapshot ensures that the violation status can be restored during subsequent exam resumption, preventing examinees from "whitewashing" their violation records by interrupting the exam. This dual storage strategy of Redis hot storage and MySQL persistence balances fast read speeds (millisecond-level) during exam resumption with data security (preventing data loss during downtime).

[0028] The exam continuation recovery module is configured to, in response to receiving an exam continuation request, read the latest breakpoint snapshot from storage, restore the answer interface based on the answered content in the breakpoint snapshot, restore the countdown based on the remaining exam time in the breakpoint snapshot, and retain the cumulative number of screen switching events and the violation level in the restored exam status, and continue to accumulate new screen switching events that occur after restoration based on the cumulative number of screen switching events, and determine the screen switching detection threshold after restoration based on the violation level.

[0029] Specifically, when a candidate logs out of the exam due to network interruption, page closure, or other reasons and then logs back in to request a continuation of the exam, the continuation recovery module first reads the latest breakpoint snapshot from Redis. If the snapshot is not found in Redis, it automatically falls back to reading from MySQL. The module parses the snapshot, extracts the `answers` field to render the answers to the corresponding positions on the front-end answer interface, and extracts the `remain_sec` field to start a countdown timer that decrements from this remaining value. Simultaneously, the module restores the cumulative number of screen switches and the violation level from the snapshot to the front-end state storage, and subsequent new screen switch events are accumulated based on this cumulative number. Furthermore, the module determines the restored screen switch detection threshold based on the violation level in the snapshot: if the violation level is a serious violation or suspicious, the first threshold and / or the second threshold are updated to smaller values ​​(e.g., in the case of a serious violation, the first threshold is reduced from 30 seconds to 15 seconds, and the second threshold from 5 times to 2 times), and the post-continuation judgment operation is performed using the updated threshold. This solution uses the violation level in the snapshot as a feedback signal to dynamically lower the detection threshold for violating candidates, ensuring that candidates who have violated regulations are subject to stricter monitoring after resuming the exam.

[0030] Taking a 60-minute online exam as an example, the exam configuration includes a first threshold of 30 seconds, a second threshold of 5 screen switches, and a third threshold of 2 screen switches. A candidate switches screens 28 minutes after the exam starts. The front-end collects the data for a duration of 38.2 seconds (≥30 seconds) and reports it to the data receiving module. The judgment module outputs a serious violation level. The snapshot storage module generates a breakpoint snapshot and writes the serious violation level to the snapshot after the violation level is determined. Subsequently, the server receives a continuation request from the candidate (this request can be initiated independently of this system, for example, forwarded by the exam management platform). The continuation recovery module reads data from the snapshot, restores the answer interface and countdown timer, retains the violation level and the cumulative number of screen switches, and lowers the first threshold to 15 seconds and the second threshold to 2 screen switches based on the serious violation level. After the exam resumed, the candidate switched screens again, lasting for 10 seconds (less than the original first threshold of 30 seconds, and also less than the lowered first threshold of 15 seconds). This screen switch did not trigger a duration violation; however, the cumulative number of screen switches increased from 1 to 2, reaching the lowered second threshold (2 times), and the judgment module output a warning level.

[0031] Example 2

[0032] This disclosure provides a method for preventing cheating in online examinations. This method can be executed by the system described in Embodiment 1, and includes the following steps: Step S1: Receive the time-series feature vector of each screen-switching event of the examinee, which is collected and reported by the front end in real time. The time-series feature vector includes at least the timestamp of the screen-switching event, the duration of a single screen-switching event, the cumulative number of screen-switching events, and the change information of the client's IP address before and after the screen-switching event.

[0033] This step is executed by the data receiving module. The front-end (candidate terminal) registers listeners for the `visibilitychange`, `blur`, and `beforeunload` events provided by the browser. When the candidate switches the exam page to the background, the `visibilitychange` event is triggered, and the front-end records the current timestamp (millisecond precision, obtained via `Date.now()`) as the start time of the screen switch; when the candidate switches back to the exam page, it records the timestamp again as the end time of the screen switch. The front-end calculates the difference between the end time and the start time to obtain the duration of a single screen switch (in milliseconds). Simultaneously, the front-end maintains a cumulative screen switch counter. Each time a screen switch event (from visible to invisible) is detected, the counter increments by 1, and the current count is used as the cumulative number of screen switches since the start of this exam (the cumulative number of screen switches is the cumulative value since the start of this exam and is not reset for continued exams). Furthermore, the front-end obtains the client's IP address before and after the screen switch from the back-end server (via the X-Forwarded-For header in the HTTP request or TCP connection information). If the two IPs are different, the IP change flag is recorded as true. Ultimately, the front-end encapsulates the timestamp, duration, cumulative screen-switching count, and IP change information into a temporal feature vector, which is then reported to the system via HTTPS. The data receiving module receives this feature vector and parses it into structured data. Since relying solely on the cumulative screen-switching count cannot distinguish between long-duration and short-duration screen-switching, nor between single-device screen-switching and device-switching, introducing the duration of each screen-switching event and IP change information allows subsequent judgments to differentiate between different scenarios, fundamentally improving the precision of the detection.

[0034] Step S2: Compare the duration of a single screen switch in the time-series feature vector with a first threshold, compare the cumulative number of screen switches with a second threshold, combine the IP address change information with the cumulative number of screen switches for judgment, and output the corresponding violation level based on the comparison result and the combined judgment result.

[0035] This step is performed by the judgment module. After receiving the time-series feature vector, the server-side processor performs the following comparison and combination judgment operations: comparing the duration of a single screen switch with a preset first threshold (e.g., 30 seconds); comparing the cumulative number of screen switches with a preset second threshold (e.g., 5 times); and combining IP address change information with the cumulative number of screen switches (e.g., IP change and cumulative number of screen switches ≥ preset third threshold 2 times). Based on the above comparison and combination results, the corresponding violation level (one of normal, warning, serious violation, or suspicious) is output.

[0036] A serious violation level is output when the duration of a single screen switch is greater than or equal to the first threshold; a warning level is output when the cumulative number of screen switches is greater than or equal to the second threshold; a suspicious level is output when the IP address changes and the cumulative number of screen switches is greater than or equal to the third threshold; otherwise, a normal level is output. The first, second, and third thresholds are all components of the "screen switch detection threshold" and can be dynamically adjusted by the exam administrator through the configuration center according to the exam type. For example, if a candidate's IP changes from 192.168.1.101 to 117.88.123.45, and the current cumulative number of screen switches is 2, and the third threshold is 2, a suspicious level is output, marked for manual review. As another example, if a candidate's single screen switch lasts 5 seconds, accumulating 1 screen switch, and the IP address remains unchanged, a normal level is output, and monitoring continues.

[0037] The above judgment rules are designed based on a progressive logic of risk severity. A single long screen-switching incident has the most direct harm and is prioritized as a serious violation; while high-frequency short screen-switching may have less harm per incident, a high cumulative number indicates a suspicious behavioral pattern and is judged as a warning; IP address changes combined with screen-switching pointing to a different device for cheating require manual review. This layered design allows the system to take differentiated interventions based on different types of cheating.

[0038] Step S3: In response to the detection of a screen-switching event, generate and store a breakpoint snapshot of the current exam status. The breakpoint snapshot includes at least all the candidate's answers, the remaining exam time, the cumulative number of screen-switching events, and the violation level.

[0039] This step is performed by the snapshot storage module. Regardless of the violation level output in step S2, as soon as a screen-switching event is detected, the processor immediately executes the breakpoint snapshot generation operation. The processor extracts the following information from the current exam session: all answers completed by the examinee (stored in key-value pairs, where the key is the question ID and the value is the answer completed by the examinee), remaining exam time (the number of seconds remaining in the current exam countdown), elapsed time, current question number, the cumulative number of screen-switching events maintained in step S1, and the violation level output in step S2. This information is serialized into a JSON format string and written to the Redis cache with the key `exam_snapshot:{examID}:{examineeID}`, while simultaneously being asynchronously written to the MySQL database for persistent backup. This invention incorporates the violation level and the cumulative number of screen-switching events into the snapshot so that the violation status can be restored when the exam is resumed.

[0040] Step S4: In response to receiving a continuation request, read the latest breakpoint snapshot from storage, restore the answer interface based on the answered content in the breakpoint snapshot, restore the countdown based on the remaining exam time in the breakpoint snapshot, and retain the cumulative number of screen switching events and the violation level in the restored exam status, and continue to accumulate new screen switching events that occur after restoration based on the cumulative number of screen switching events, and determine the screen switching detection threshold after restoration based on the violation level.

[0041] This step is executed by the exam continuation recovery module. When a candidate logs back in and initiates a continuation request after exiting the exam due to network interruption, page closure, or other reasons, the processor first reads the latest breakpoint snapshot from Redis. If it is not found in Redis, it automatically falls back to reading from MySQL. The processor parses the snapshot, extracts the `answers` field to render the answers to the corresponding positions on the front-end answer interface, and extracts the `remain_sec` field to start a countdown timer that decrements from this remaining value. Simultaneously, the processor restores the cumulative number of screen switches and the violation level from the snapshot to the front-end state storage, and subsequent new screen switch events are accumulated based on this cumulative number. Furthermore, the processor determines the restored screen switch detection threshold based on the violation level in the snapshot: if the violation level is a serious violation or suspicious, the first threshold and / or the second threshold are updated to a smaller value, and the comparison operation in step S2 after continuation is performed with the updated threshold. By using the violation level in the snapshot as a feedback signal, the detection threshold for violating candidates is dynamically lowered, ensuring that violating candidates are subject to stricter monitoring after continuation, achieving the effect of automatically increasing detection parameters according to the violation status.

[0042] In one embodiment of this disclosure, the real-time collection of the temporal feature vector of each screen-switching event by the front end further includes: while collecting the screen-switching event, obtaining whether there is a system-level pop-up or input method event at the current moment by calling the notification access interface provided by the operating system; if so, setting the event source tag of this screen-switching event to system-triggered, otherwise setting it to subjective trigger; before comparing the duration of a single screen-switching event in the temporal feature vector with the first threshold, when the duration of a single screen-switching event is less than the fourth threshold and the event source tag is system-triggered, or when the duration of multiple consecutive screen-switching events is less than the fifth threshold, marking the screen-switching event as non-subjective screen-switching and not counting it in the cumulative number of screen-switching events.

[0043] Specifically, during the process of collecting screen switching events in step S1, the processor performs the following operations in parallel: Obtaining the event source tag: Each time the page loses focus, the processor calls the notification access interface provided by the operating system. If there is a system-level pop-up (such as a Windows update reminder or antivirus software notification) or input method candidate box pop-up event triggered by a non-exam application, the event_source tag of this screen switching event is set to "system triggered"; otherwise, it is set to "subjective triggered". For example, on the Windows platform, the processor detects changes in the currently active window by calling the GetGuiResources or GetForegroundWindow functions in the Windows API. When the page loses focus, the processor calls GetWindowThreadProcessId to obtain the process to which the current foreground window belongs and compares it with the PID of the exam browser process. If the current foreground process is not the exam browser process, it further obtains the executable file name of the process through QueryFullProcessImageName and matches it with a preset system process whitelist (such as explorer.exe, ShellExperienceHost.exe, etc.). If the match is successful, it is determined that there is a system-level pop-up or notification. In addition, for Windows 10 and above, the processor can capture system-level notification events through the IUserNotification interface or by registering an HWND message hook. For macOS, the processor obtains the Bundle ID of the currently active application by calling the `activeApplication` property of `NSWorkspace`. If the currently active application is not a browser (such as Safari or Chrome), and the Bundle ID matches a system notification-related process (such as `com.apple.notificationcenterui`), then a system-level pop-up is determined to exist. For mobile devices (Android), full-screen pop-ups are detected via `onHideCustomView` and `onShowCustomView` of `WebChromeClient`; soft keyboard pop-up events are detected via `InputMethodManager`. For mobile devices (iOS), input method pop-ups are detected via the `didHideKeyboard` and `didShowKeyboard` callbacks of `WKWebView`; application switching is detected via the `didEnterBackgroundNotification` notification of `UIApplication`.

[0044] Non-subjective screen switching filtering: Before performing the comparison in step S2, the processor checks: if the duration of a single screen switching is less than the fourth threshold and the label is "system triggered", or if the duration of multiple consecutive screen switching events is less than the fifth threshold and the label is "system triggered", then the screen switching event is marked as non-subjective screen switching, not counted in the cumulative screen switching count counter, and the violation judgment in step S2 is skipped; otherwise, step S2 is entered normally.

[0045] This step addresses the issue in existing technologies where screen switching caused by non-subjective behaviors such as system pop-ups and input method bugs is mistakenly flagged as cheating. By proactively detecting pop-ups and input method events through native operating system interfaces, it can accurately distinguish between "user-initiated window switching" and "forced focus loss by the system." Furthermore, multiple consecutive, extremely short screen switches (such as continuously flashing advertising pop-ups) are automatically exempted. Intelligent identification of interference events significantly reduces the false positive rate and user complaints.

[0046] For example, if a candidate's operating system pops up a "Windows Update" prompt during the exam, causing the browser to lose focus, the processor detects the system pop-up and labels it as "system-triggered." If the screen-switching duration is less than the fourth threshold of 2000 milliseconds, it is marked as non-subjective, the cumulative number of screen-switchings remains unchanged, and no violation is triggered. As another example, if a candidate's input method pops up candidate input boxes three times consecutively, each lasting approximately 300 milliseconds (less than the fifth threshold of 500 milliseconds), and the event source label for each screen-switching is "system-triggered," then these multiple short-duration screen-switchings are exempted and not counted as violations. The fourth and fifth thresholds can be configured by the exam administrator based on the seriousness of the exam.

[0047] In one embodiment of this disclosure, the generation of the breakpoint snapshot of the current exam state and the corresponding violation level of the output are executed in the same screen-off event, and the violation level in the snapshot is written to the breakpoint snapshot after the judgment is completed.

[0048] Specifically, when the same screen-switching event is triggered, the processor starts two asynchronous tasks: Task A executes step S2 (violation level determination), and Task B executes step S3 (breakpoint snapshot generation, extracting answer content, remaining time, etc., and writing to Redis and MySQL). In the snapshot generated by Task B, the violation level field is temporarily set to empty or a default value. After Task A completes its determination, it asynchronously writes the violation level to the stored breakpoint snapshot (e.g., by updating the corresponding field in Redis). The two tasks execute in parallel without waiting for each other, thus avoiding the risk of snapshot loss due to time-consuming determination and ensuring that the final stored snapshot contains the complete violation level. If Task A's determination takes a long time, Task B can still immediately save the examinee's answer content and remaining time, ensuring that the state is not lost; the violation level is then added after the determination is completed.

[0049] In one embodiment of this disclosure, the real-time acquisition of the temporal feature vector of each screen-switching event of the examinee at the front end further includes: for each screen-switching event, recording the first interactive behavior feature within a first time window before the screen-switching occurs, and the second interactive behavior feature within a second time window after the screen-switching returns, and calculating the behavior pattern deviation degree D between the first interactive behavior feature and the second interactive behavior feature; in the output of the corresponding violation level, when the behavior pattern deviation degree D exceeds a preset threshold, even if the duration of the single screen-switching is less than the first threshold, a serious violation level is still output.

[0050] Specifically, the calculation process for behavioral pattern deviation is as follows: I. Feature Collection: Within the first time window before the screen switch (e.g., 5 seconds before the switch), the front-end continuously collects three interactive behavior data of the examinee through the browser's standard event listening mechanism: mouse movement frequency (including touch point movement on touchscreen devices, each movement is counted as one valid movement, e.g., each movement of 5 pixels counts as one movement), keyboard keystroke frequency (only keys that can input content are counted, ignoring modifier keys such as Ctrl and Alt), and page scrolling frequency (each scroll event trigger is counted as one scrolling event). Within the second time window after the screen switch (e.g., 5 seconds after the screen switch), the above three data are collected in the same way and with the same parameters. The length of the two time windows can be configured by the examination administrator according to the seriousness of the examination; for example, it can be shortened to 3 seconds in strict mode. If the examinee has no interactive behavior within a certain time window (e.g., closing the page directly after the screen switch), the deviation is marked as invalid and will not participate in subsequent judgment.

[0051] II. Normalization Processing: Due to differences in operating habits among test takers and the input performance of different devices (e.g., the movement frequency of a gaming mouse is much higher than that of a regular mouse), directly using the raw frequencies would lead to inconsistent feature dimensions. Therefore, the system pre-calculates the 95th percentile of each feature from no fewer than 1000 historical normal examinations as the upper limit and the 5th percentile as the lower limit. For the currently collected raw frequencies, a linear mapping formula is used to transform them to the [0,1] interval: if the raw value is less than the lower limit, it is taken as 0; if it is greater than the upper limit, it is taken as 1; and if it is between, it is calculated proportionally. For example, if the upper limit of mouse movement frequency in historical statistics is 30 times / second and the lower limit is 0 times / second, then the actual collected 20 times / second is normalized to 0.667. In this way, the feature vectors of different test takers are comparable.

[0052] III. Deviation Calculation: The three normalized feature values ​​collected before screen switching are organized into a three-dimensional vector V_before, and the three features collected after screen switching are organized into a three-dimensional vector V_after. The system calculates the Euclidean distance between these two vectors using the formula: D=√[(Fm,1−Fm,2)²+ (Fk,1−Fk,2)²+ (Fs,1− Fs,2)²], where D is the behavior pattern deviation, which is equal to the square root of the sum of the squares of the three differences; Fm is the mouse movement frequency (or the touch movement frequency of the touchscreen device), in units of times / second; Fk is the keyboard input frequency (number of effective keystrokes), in units of times / second; Fs is the page scrolling frequency, in units of times / second; Fm,1 represents the normalized value of the mouse movement frequency in the first time window before screen switching, Fm,2 represents the normalized value of the mouse movement frequency in the second time window after screen switching, and so on. The theoretical value of D ranges from 0 to approximately 1.732, with a larger value indicating a more significant difference in the candidate's interaction behavior patterns before and after the screen switch. Alternatively, the system can use cosine similarity and convert it to deviation, with Euclidean distance as the default.

[0053] IV. Threshold and Judgment: A deviation threshold is preset, with a default value of 0.7. This threshold is calibrated through offline experiments: 2000 cheating samples and 2000 normal samples, all manually verified, are collected. The D-value of each sample is calculated, an ROC curve is plotted, and the D-value corresponding to the maximum Youden index (the sum of sensitivity and specificity minus 1) is selected as the threshold. Administrators can also manually adjust this threshold in the exam management backend (the adjustment range is usually 0.3 to 1.2) to adapt to the monitoring requirements of different exams. When determining the level of violation, the system first executes the basic rules (based on screen switching duration, cumulative number of times, and IP changes). If the calculated D-value exceeds the preset threshold, a serious violation level is output regardless of the judgment result of the basic rules; if the D-value does not exceed the threshold, the judgment result of the basic rules is maintained.

[0054] Traditional screen-switching detection only focuses on "duration of absence," but cannot determine whether a candidate actually cheated during that time. For example, a candidate switching screens for 3 seconds might just be glancing at their phone, while another might only be doing so because of a browser flash; the duration is indistinguishable. This step infers cheating intent by analyzing the continuity of interaction behavior before and after the screen switch. The core principle is: if a candidate consults external materials during the screen switch, they will usually directly fill in answers upon returning, causing a break in mouse and keyboard interactions (a sudden drop in frequency or abrupt change in pattern); however, if the absence is not for cheating (such as answering a phone call), the behavior pattern will naturally return upon returning. Therefore, the deviation degree D can more accurately identify short-duration screen switches with cheating intent, compensating for the shortcomings of the duration threshold. For example, if a candidate switches screens for 20 seconds (less than the first threshold of 30 seconds), upon returning, the mouse movement frequency drops sharply from 20 times / second to 2 times / second, and keyboard input drops from 15 times / second to 0 times / second. The calculated D = 0.85 > 0.7, and step S2 outputs a severe violation level. The system logs indicate that the candidate exhibited behavior of consulting external materials during the screen switching period. Another candidate also switched screens for 20 seconds, and upon returning, their behavior pattern remained largely unchanged (D=0.2), resulting in a normal grade being output.

[0055] In one embodiment of this disclosure, the breakpoint snapshot also stores the historical record of the behavior pattern deviation D; in the violation level corresponding to the output, the historical change trend of the behavior pattern deviation in at least one historical breakpoint snapshot stored by the examinee is obtained, and the historical change trend is used as the input feature of the time series prediction model to predict the probability of cheating tendency in the current screen switching event, and the output violation level is adjusted according to the probability of cheating tendency.

[0056] Specifically, each time a screen-switching event triggers step S3 to generate a breakpoint snapshot, the calculated behavioral pattern deviation degree D is also stored in the snapshot, forming a historical deviation history sequence for the examinee (e.g., deviation_history: [0.12, 0.15, ...]). When a new screen-switching event occurs, in step S2, the processor reads at least one historical breakpoint snapshot (e.g., the last 3) of the examinee from the database and extracts the historical trend of D value changes. This historical trend is used as input features and fed into a pre-trained Long Short-Term Memory (LSTM) temporal prediction model. The model takes the historical D value sequence as input and outputs the probability (0~1) of cheating tendency for the current screen-switching event. The processor adjusts the violation level according to this probability: if the probability > 0.8, a serious violation is output directly; if it is 0.5~0.8, a warning is output; if it is < 0.5, the rule judgment result is maintained.

[0057] This invention, by storing historical deviation sequences and using an LSTM model to capture temporal patterns, enables the system to distinguish between two different cheating evolution paths: one is "abrupt cheating"—the examinee's behavior is usually normal, but a sudden high deviation occurs during a screen switch. This pattern usually corresponds to impulsive cheating, with a moderate probability of cheating tendency (approximately 0.7~0.8), and a warning is appropriate; the other is "gradual cheating"—the examinee's deviation shows a continuous upward trend across multiple screen switches, indicating that their cheating behavior is escalating. This pattern has a higher probability of cheating tendency (>0.9) and should be directly judged as a serious violation. This design makes the judgment result not only dependent on the current single screen switch but also integrates the historical behavioral evolution trend, resulting in stronger intelligence and robustness. For example, if the examinee's D values ​​for the first three screen switches are 0.1, 0.15, and 0.12 (stable low values), and the fourth D=0.8, the processor reads the historical sequence [0.1, 0.15, 0.12], the LSTM model identifies the abrupt change, outputs a probability of 0.75, and outputs a warning level. Another candidate's D values ​​for the first three tests were 0.6, 0.7, and 0.8 (consistently high values), and the fourth test D value was 0.85. The model output probability was 0.95, which directly resulted in a serious violation.

[0058] The LSTM model in this embodiment is a well-known deep learning time series prediction model. For example, its specific architecture and training method are as follows: The model uses a single-layer LSTM network with a hidden layer dimension of 64. The input layer receives a D-value sequence of length 3, with an input dimension of 1 at each time step. After the LSTM layer, a fully connected layer is connected, and then a Sigmoid activation function is used to output probability values ​​between 0 and 1. The model has approximately 10,000 parameters and can perform real-time inference on a CPU. Training data is extracted from historical exam behavior logs, using the D-values ​​of three consecutive screen switches as input features, with the true label indicating whether the examinee was confirmed to have cheated during that time period. If the number of screen switches is less than three, missing positions are filled with 0 values; the cheating label is determined based on manual review or final confirmation of cheating records. The D-value sequence input to the model is first normalized. Since the theoretical maximum value of D is √3≈1.732, D_norm = D / 1.732 is used to map it to the [0,1] interval. During training, due to the scarcity of cheating samples, oversampling was used to ensure a near 1:1 ratio of positive to negative samples. A binary cross-entropy loss function and the Adam optimizer were employed, with an initial learning rate of 0.001. After training, the model was deployed to the server-side inference engine. The cheating tendency probability P output by the model was adjusted to determine the violation level according to the following rules: if P ≥ 0.8, a severe violation was output; if 0.5 ≤ P < 0.8, a warning was output; if P < 0.5, the violation level determined by the basic rules was maintained.

[0059] In this embodiment of the disclosure, after the response to receiving the retake request, the method further includes: determining the screen-switching detection threshold after recovery based on the violation level stored in the read breakpoint snapshot; specifically, when the violation level is a serious violation level or a suspicious level, the first threshold or the second threshold is updated to a smaller value, and the updated threshold is used to compare the duration of a single screen-switching event after the retake with the first threshold and the cumulative number of screen-switching events with the second threshold.

[0060] Specifically, the violation level field is extracted from the snapshot. If the violation level is "serious violation" or "suspicious," the threshold is updated according to the preset adjustment coefficients: Serious violation: New first threshold value = original first threshold value × 0.5, New second threshold value = original second threshold value × 0.4. Suspicious violation: New first threshold value = original first threshold value × 0.7, New second threshold value = original second threshold value × 0.6. If the violation level is normal or warning, the original threshold remains unchanged. The new threshold is written to the memory configuration, and the new threshold is used for comparison in step S2 of subsequent new screen switching events. This invention dynamically lowers the detection threshold for violating candidates by using the violation level in the snapshot as a feedback signal, so that candidates who have violated the rules are subject to stricter monitoring after the exam continues (for example, if it used to be 30 seconds to be considered a violation, now it is 15 seconds).

[0061] In one embodiment of this disclosure, while the front end collects the temporal feature vector of each screen-switching event of the examinee in real time, it calculates the statistical baseline of the screen-switching duration of all examinees in the current exam in real time. The statistical baseline includes the mean screen-switching duration and its standard deviation. When the dynamic increase of the mean screen-switching duration exceeds a preset threshold, a collective anomaly marker is generated. In response to the collective anomaly marker, an additional identity verification step is added after receiving the continuation request and before restoring the answer interface based on the answered content in the breakpoint snapshot.

[0062] Specifically, the system collects real-time data on the screen-switching duration of all examinees, calculating the average screen-switching duration μ_duration and standard deviation σ_duration for all examinees (maintaining a sliding time window, e.g., the most recent 5 minutes). The current μ_duration is compared to the baseline μ_duration of the first 5 minutes after the exam begins. If the dynamic increase exceeds a preset threshold (e.g., 200%), a "collective anomaly flag" is generated and stored in a global cache (e.g., Redis). When any examinee initiates a request to continue the exam, before step S4 reaches "restore the answer interface based on breakpoint snapshot," the system checks if the collective anomaly flag exists. If it exists, an additional authentication step (e.g., facial recognition, dynamic verification code) is forcibly added; the answer interface is only restored after successful authentication. If the flag does not exist, normal restoration occurs.

[0063] This step represents an upgrade from individual monitoring to collaborative group defense. In large-scale online exams, if a test paper is leaked, a large number of candidates often switch screens simultaneously or sequentially (e.g., to check answers on their phones). Traditional individual behavior detection methods struggle to identify such group anomalies because each candidate may only switch screens once or twice, failing to reach an individual threshold. This solution, by monitoring the average screen-switching duration of all candidates, can sensitively capture collective shifts in group behavior. Once an anomaly is detected, the system automatically raises the authentication level for the continuation of the exam, effectively preventing cheaters from continuing to cheat by changing devices or having someone else take the exam for them.

[0064] The online examination anti-cheating method provided in this disclosure achieves automatic identification of the source of screen-switching events (subjective triggering or system triggering) through multi-dimensional temporal feature collection and combined judgment; achieves zero-loss preservation of answer content, remaining time and violation status data through parallel snapshot storage triggered by screen-switching events; achieves automatic adaptation of detection parameters to violation status by reverse adjustment of the detection threshold after recovery through violation level in the breakpoint snapshot; and achieves automatic enhancement of the continuation verification process in group abnormal scenarios through real-time monitoring and abnormal marking of the overall screen-switching time baseline of the examination room.

[0065] Example 3

[0066] Combination Figure 3 As shown in the illustration, this disclosure also provides an electronic device, including a processor 800 and a memory 801. Optionally, the electronic device may further include a communication interface 802 and a bus 803. The processor 800, communication interface 802, and memory 801 can communicate with each other via the bus 803. The communication interface 802 can be used for information transmission, such as communicating with a front-end device (examinee terminal), receiving screen-switching event reports and continuation requests, and returning recovery data to the front-end. The processor 800 can call logical instructions in the memory 801 to execute the online examination anti-cheating method of the above embodiments.

[0067] The processor 800 is the computing core of the electronic device and can be one or more combinations of a central processing unit (CPU), a graphics processing unit (GPU), an application-specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). During operation, the server-side processor 800 executes instructions stored in memory 801 to perform the following operations: receiving the timing feature vector of screen-switching events reported by the front end; comparing the duration of a single screen-switching event with a first threshold, comparing the cumulative number of screen-switching events with a second threshold, combining IP address change information with the cumulative number of screen-switching events to determine the violation level; generating a breakpoint snapshot in response to a screen-switching event and storing it in Redis and MySQL; reading the snapshot in response to a continuation request, returning the answered content and remaining time to the front end to restore the answer interface and countdown, retaining the cumulative number of screen-switching events and the violation level, continuing to accumulate new events based on the cumulative number of screen-switching events, and determining the restored screen-switching detection threshold based on the violation level.

[0068] Furthermore, the logic instructions in the aforementioned memory 801 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0069] The memory 801, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as the program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 800 executes functional applications and data processing by running the program instructions / modules stored in the memory 801, thereby implementing the online examination anti-cheating method based on timing behavior characteristics and breakpoint continuation linkage in the above embodiments.

[0070] The memory 801 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 801 may include high-speed random access memory and may also include non-volatile memory.

[0071] For example, an online examination service platform is deployed on a cloud server cluster, with each server node acting as an electronic device as described in this embodiment. When tens of thousands of candidates take the exam simultaneously, each server node receives screen-switching event reports from the candidate terminals it is responsible for, performs violation judgment and snapshot storage, and responds to continuation requests. A Redis cluster serves as a hot storage layer to ensure low latency for snapshot reading; a MySQL database serves as a persistent layer, storing full snapshot records for auditing and downgrade recovery.

[0072] The foregoing description and accompanying drawings fully illustrate embodiments of the present disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in the embodiments of this disclosure is for descriptive purposes only and is not intended to limit the claims. As used in the description of the embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used in the embodiments of this disclosure refers to any and all possible combinations of one or more of the associated listed elements. Additionally, when used in embodiments of this disclosure, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, then the relevant parts can be referred to the description of the method section.

[0073] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

Claims

1. A method for preventing cheating in online examinations, characterized in that, include: Receive the time-series feature vector of each screen-switching event of the examinee, which is collected and reported by the front end in real time. The time-series feature vector includes at least the timestamp of the screen-switching event, the duration of a single screen-switching event, the cumulative number of screen-switching events, and the change information of the client's IP address before and after the screen-switching event. The duration of a single screen-switching event in the time-series feature vector is compared with a first threshold, the cumulative number of screen-switching events is compared with a second threshold, the change information of the IP address is combined with the cumulative number of screen-switching events for judgment, and the corresponding violation level is output based on the comparison result and the combined judgment result. In response to the detection of a screen-switching event, a breakpoint snapshot of the current exam status is generated and stored. The breakpoint snapshot includes at least all the candidate's completed answers, the remaining exam time, the cumulative number of screen-switching events, and the violation level. In response to receiving a continuation request, the system reads the latest breakpoint snapshot from storage, restores the answer interface based on the answered content in the breakpoint snapshot, restores the countdown based on the remaining exam time in the breakpoint snapshot, retains the cumulative number of screen switches and the violation level in the restored exam status, continues to accumulate new screen switch events after restoration based on the cumulative number of screen switches, and determines the screen switch detection threshold after restoration based on the violation level.

2. The method according to claim 1, characterized in that, The screen-switching detection thresholds include: a first threshold, a second threshold, and a third threshold. Among the corresponding violation levels output, a serious violation level is output when the duration of a single screen-switching is greater than or equal to the first threshold; a warning level is output when the cumulative number of screen-switching is greater than or equal to the second threshold; a suspicious level is output when the IP address changes and the cumulative number of screen-switching is greater than or equal to the third threshold; otherwise, a normal level is output.

3. The method according to claim 1, characterized in that, The real-time acquisition of the temporal feature vector of each screen-switching event by the examinee further includes: while acquiring the screen-switching event, calling the notification access interface provided by the operating system to obtain whether there is a system-level pop-up or input method event at the current moment; if so, setting the event source label of this screen-switching event to system-triggered; otherwise, setting it to subjective-triggered; before comparing the duration of a single screen-switching event in the temporal feature vector with the first threshold, when the duration of a single screen-switching event is less than the fourth threshold and the event source label is system-triggered, or when the duration of multiple consecutive screen-switching events is less than the fifth threshold and the event source label is system-triggered, the screen-switching event is marked as non-subjective screen-switching and is not included in the cumulative number of screen-switching events.

4. The method according to claim 1, characterized in that, The breakpoint snapshot that generates the current exam status and the violation level corresponding to the output are executed in the same screen-off event, and the violation level in the snapshot is written to the breakpoint snapshot after the judgment is completed.

5. The method according to claim 3, characterized in that, The real-time acquisition of the temporal feature vector of each screen-switching event of the examinee also includes: for each screen-switching event, recording the first interactive behavior feature in the first time window before the screen-switching occurs, and the second interactive behavior feature in the second time window after the screen-switching returns, and calculating the behavioral pattern deviation between the first interactive behavior feature and the second interactive behavior feature; in the output of the corresponding violation level, when the behavioral pattern deviation exceeds the preset threshold, even if the duration of the single screen-switching is less than the first threshold, a serious violation level is still output.

6. The method according to claim 5, characterized in that, The breakpoint snapshot also stores the historical records of the behavioral pattern deviation; in the violation level corresponding to the output, the historical change trend of the behavioral pattern deviation in at least one historical breakpoint snapshot stored by the examinee is obtained, and the historical change trend is used as the input feature of the time series prediction model to predict the probability of cheating tendency in the current screen switching event, and the output violation level is adjusted according to the probability of cheating tendency.

7. The method according to claim 1, characterized in that, In response to receiving a renewal request, the method further includes: determining a screen-switching detection threshold after recovery based on the violation level stored in the read breakpoint snapshot; when the violation level is a serious violation level or a suspicious level, updating the first threshold or the second threshold to a smaller value, and using the updated threshold to compare the duration of a single screen-switching event after renewal with the first threshold and the cumulative number of screen-switching events with the second threshold.

8. The method according to claim 1, characterized in that, While collecting the temporal feature vector of each screen-switching event of the examinee in real time, the statistical baseline of screen-switching duration for all examinees in the current exam is also calculated in real time. The statistical baseline includes the mean screen-switching duration and its standard deviation. When the dynamic increase of the average screen switching time exceeds a preset threshold, a collective anomaly marker is generated; In response to the collective anomaly flag, an additional authentication step is added after the response to receive the continuation request and before the answer interface is restored based on the answers in the breakpoint snapshot.

9. An online examination anti-cheating system, characterized in that, include: The data receiving module is configured to receive the temporal feature vector of each screen-switching event of the examinee, which is collected and reported in real time from the front end. The temporal feature vector includes at least the timestamp of the screen-switching event, the duration of a single screen-switching event, the cumulative number of screen-switching events after this screen-switching event, and the change information of the client's IP address before and after the screen-switching event. The judgment module is configured to compare the duration of a single screen switch in the time-series feature vector with a first threshold, compare the cumulative number of screen switches with a second threshold, combine the change information of the IP address with the cumulative number of screen switches for judgment, and output the corresponding violation level based on the comparison results and the combined judgment results. The snapshot storage module is configured to generate and store a breakpoint snapshot of the current exam status in response to the detection of a screen-switching event. The breakpoint snapshot includes at least all the candidate's answers, the remaining exam time, the cumulative number of screen-switching events, and the violation level. The exam continuation recovery module is configured to, in response to receiving an exam continuation request, read the latest breakpoint snapshot from storage, restore the answer interface based on the answered content in the breakpoint snapshot, restore the countdown based on the remaining exam time in the breakpoint snapshot, and retain the cumulative number of screen switching events and the violation level in the restored exam status, and continue to accumulate new screen switching events that occur after restoration based on the cumulative number of screen switching events, and determine the screen switching detection threshold after restoration based on the violation level.

10. An electronic device, characterized in that, Includes at least one processor; as well as A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the processor to perform the method according to any one of claims 1-8.

Images