CN115984971A

CN115984971A - User behavior monitoring method and device and electronic equipment

Info

Publication number: CN115984971A
Application number: CN202310261757.5A
Authority: CN
Inventors: 孙征宇; 宋雷; 吴胜勇; 徐沛林; 刘兆坤
Original assignee: Contemporary Amperex Technology Co Ltd
Current assignee: Contemporary Amperex Technology Co Ltd
Priority date: 2023-03-17
Filing date: 2023-03-17
Publication date: 2023-04-18

Abstract

The application provides a user behavior monitoring method, a user behavior monitoring device and electronic equipment, wherein a specific implementation mode of the method comprises the following steps: the method is applied to an application program developed based on a laboratory virtual instrument integration environment, and comprises the following steps: receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types; and monitoring the user behavior indicated by the user behavior monitoring instruction. The method can monitor more user behavior information, and effectively reduces the risk of enterprise information leakage.

Description

User behavior monitoring method and device and electronic equipment

Technical Field

The application relates to the field of information security, in particular to a user behavior monitoring method and device and electronic equipment.

Background

The enterprise information includes related information involved in the processes of generation, transmission and communication inside the enterprise, and has an important role in positioning the development direction of the enterprise, determining the operation management mode and the like.

In order to ensure the security of enterprise information, user behavior is generally monitored in certain specific scenarios. The specific scenarios herein may include, for example, technology development scenarios involving business secrets, technology archive viewing scenarios, and the like.

In the related technology, the problem that the leakage risk of enterprise information is high due to incomplete monitoring of user behaviors exists.

Disclosure of Invention

An object of the embodiment of the application is to provide a user behavior monitoring method and device and electronic equipment, which are used for monitoring more user behavior information and reducing the risk of enterprise information leakage.

In a first aspect, an embodiment of the present application provides a user behavior monitoring method, where the method is applied to an application program developed based on a laboratory virtual instrument integration environment, and the method includes: receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types; and monitoring the user behavior indicated by the user behavior monitoring instruction.

In this embodiment, the application program may monitor a plurality of user behaviors based on the received plurality of user behavior monitoring instructions. Therefore, more user behavior information can be monitored, and the risk of enterprise information leakage is effectively reduced.

Optionally, the user behavior monitoring instruction includes a screen monitoring instruction, and the receiving any user behavior monitoring instruction includes: in response to detecting a trigger operation for a virtual screenshot key, determining that the screen monitoring instruction is received; the virtual screenshot key is associated with the screenshot key of the keyboard through a virtual screenshot key value; and the monitoring the user behavior indicated by the user behavior monitoring instruction comprises the following steps: and intercepting a screen image before detecting the bounce operation of the virtual screenshot key so as to monitor the user behavior through the intercepted screen image.

In the implementation mode, the virtual screenshot key can simulate the screenshot key in the keyboard, and the screen image can be captured in real time within a set time range, so that the purpose of monitoring the related operation executed by the user in the application program is achieved.

Optionally, the user behavior monitoring instruction includes an operation object monitoring instruction, and the receiving any user behavior monitoring instruction includes: responding to the detected camera starting instruction, and determining that the operating object monitoring instruction is received; and the monitoring the user behavior indicated by the user behavior monitoring instruction comprises the following steps: calling a continuous shooting function to shoot a current operation object; the photographed images are stored at relative addresses to monitor user behavior through the stored photographed images. Therefore, the monitoring purpose of monitoring whether the operation objects are consistently in a confidential environment or have operation authority or not can be achieved by shooting the images of the operation objects.

Optionally, after the storing the shot images at the relative addresses, the method further comprises: responding to the detected camera stopping instruction, and stopping calling the continuous shooting function; and if the shot image is determined to be successfully stored, releasing the shooting process. Therefore, after the shot images are successfully stored, the camera process can be released, and the purposes of releasing the memory and saving resources are achieved.

Optionally, the step of receiving the user behavior monitoring instruction includes: in response to detecting a triggering operation for a keyboard key, determining that the keying monitoring instruction is received; and the monitoring the user behavior indicated by the user behavior monitoring instruction comprises the following steps: after the keyboard is initialized, calling a key-in information acquisition function to acquire currently key-in information; and in response to detecting the bounce operation aiming at the keyboard keys, unloading the input information to monitor the user behavior through the unloaded input information. Therefore, the current keying information can be obtained through the triggering operation aiming at the keyboard keys, and the keying information can be stored after the bounce operation aiming at the keyboard keys is detected, so that the purpose of monitoring the keying information of the operation object in real time is achieved.

Optionally, the unloading the entered information in response to detecting the bounce operation for the keyboard key includes: for each character typed, acquiring the character and historical characters typed before the character; and connecting the character and the history character into a character string for storage. Therefore, the key-in characters are acquired one by one, and the current key-in character is connected with the historical characters before the key-in character to form a character string for storage, so that the key-in information can be stored more perfectly, and the accuracy of the key-in information is improved.

Optionally, the connecting the character and the history character into a character string for saving includes: and regarding each typed character, taking the time point of detecting the bounce operation aiming at the keyboard key as a starting point, and if the character is detected after a preset time length, performing line feed processing on the character. Therefore, each character which is typed can be subjected to line feed processing by the bounce operation of the keyboard keys and the preset time length so as to achieve the purpose of facilitating reading.

Optionally, after the monitoring the user behavior indicated by the user behavior monitoring instruction, the method further includes: calling a mail sending function, and sending the monitoring information to a target mailbox through a third-party server; and if the feedback information representation of the third-party server is successfully sent, judging that the monitoring information is successfully sent to the target mailbox. Therefore, the monitoring information can be forwarded to the target mailbox through the third-party server, and the condition of messy codes of the monitoring information is improved. And whether the monitoring information is successfully sent to the target mailbox can be determined through the feedback information returned by the monitoring information checking system, so that a user with monitoring information checking authority can normally check the monitoring information.

Optionally, if the feedback information representation of the third-party server is successfully sent, determining that the monitoring information is successfully sent to the target mailbox includes: if the feedback information representation of the third-party server is successfully sent, splitting the feedback information; and selecting key information which is successfully sent from the feedback information, and judging that the monitoring information is successfully sent to the target mailbox through the key information. Therefore, by splitting the feedback information, the key information in the feedback information can be selected, so that the effect of facilitating reading and quickly and definitely sending the monitoring information to the target mailbox successfully is achieved.

Optionally, the monitoring information includes a monitoring image, the monitoring image includes the screen image and/or the shot image, and before the calling the mail sending function and sending the monitoring information to the target mailbox through the third-party server, the method further includes; adjusting the size of the monitoring image according to a preset size; the preset size is set based on the display frame specification of the monitoring image; and responding to the detected preview instruction, and displaying the monitoring image according to the adjusted size. Therefore, the preset size can be set according to the specification of the monitoring image display frame, and the size of the monitoring image is adjusted based on the preset size, so that the aim of completely displaying the displayed monitoring image is fulfilled.

Optionally, the method further comprises: hiding and running the application program based on the configuration file in response to the detected hidden running instruction; the configuration file is generated based on an executable file of the application program. Therefore, when the hidden operation instruction is detected, the application program can be hidden and operated, and the purpose of not disturbing the operation object is achieved.

In a second aspect, an embodiment of the present application provides a user behavior monitoring apparatus, where the user behavior monitoring apparatus runs an application program developed based on a laboratory virtual instrument integration environment, and the application program includes: the receiving module is used for receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types; and the monitoring module is used for monitoring the user behavior indicated by the user behavior monitoring instruction. Therefore, more user behavior information can be monitored, and the risk of enterprise information leakage is effectively reduced.

In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, where the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method as provided in the first aspect are executed.

In a fourth aspect, embodiments of the present application provide a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, performs the steps in the method as provided in the first aspect above.

Additional features and advantages of the present application will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the embodiments of the present application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and that those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.

Fig. 1 is a flowchart of a user behavior monitoring method according to an embodiment of the present disclosure;

fig. 2 is a schematic program diagram for implementing an application screenshot function according to an embodiment of the present application;

fig. 3 is a schematic diagram of a program for implementing an application to acquire a screen image according to an embodiment of the present application;

FIG. 4 is a schematic diagram of a process for implementing zooming an image by an application according to an embodiment of the present application;

fig. 5 is a schematic diagram of a process for implementing creation of a save path for an application according to an embodiment of the present application;

fig. 6 is a schematic program diagram for implementing monitoring of an operation object by an application according to an embodiment of the present application;

FIG. 7 is a schematic diagram illustrating an implementation of selecting a target resolution for an application according to an embodiment of the present application;

FIG. 8 is a schematic diagram of an embodiment of the present application for displaying key-in information of an application;

FIG. 9 is a schematic diagram of a process for implementing monitoring key-in information of an application according to an embodiment of the present application;

FIG. 10 is a schematic diagram of a process for implementing an application to concatenate a new character and a historical character into a character string according to an embodiment of the present disclosure;

FIG. 11 is a diagram illustrating an application program sending an email based on Chinese according to an embodiment of the present application;

fig. 12 is a schematic diagram of a program for implementing sending a mail by an application according to an embodiment of the present application;

fig. 13 is a schematic diagram of a process for implementing application split feedback information according to an embodiment of the present application;

fig. 14 is a schematic diagram of a procedure for implementing application program combination key information according to an embodiment of the present application;

fig. 15 is a schematic diagram of a process for selecting a monitoring image by an application according to an embodiment of the present application;

fig. 16 is a schematic diagram of a program for implementing an application sending screen image according to an embodiment of the present application;

fig. 17 is a schematic diagram of a process for implementing an application to implement sending video according to an embodiment of the present application;

fig. 18 is a schematic diagram of a process for implementing an application to resize a monitoring image according to an embodiment of the present application;

fig. 19 is a schematic program diagram for implementing hidden operation of an application according to an embodiment of the present application;

FIG. 20 is a diagram illustrating a related art procedure for minimizing applications according to an embodiment of the present application;

fig. 21 is a schematic diagram of a process for implementing configuration file saving of an application according to an embodiment of the present application;

fig. 22 is a schematic diagram of a process for reading a configuration file by an application according to an embodiment of the present application;

fig. 23 is a block diagram of a structure of a user behavior monitoring apparatus according to an embodiment of the present application;

fig. 24 is a schematic structural diagram of an electronic device for executing a user behavior monitoring method according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the present application without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined or explained in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only for distinguishing the description, and are not construed as indicating or implying relative importance.

It should be noted that embodiments or technical features in embodiments in the present application may be combined without conflict.

In the related technology, the problem that the leakage risk of enterprise information is large due to incomplete monitoring of user behaviors exists; in order to solve the problem, the application provides a user behavior monitoring method, a user behavior monitoring device and electronic equipment; further, the application can be applied to an application program developed based on a Laboratory Virtual Instrument integration environment (Labview for short), and the application program can receive various user behavior monitoring instructions, execute corresponding monitoring operations based on the user behavior monitoring instructions, and then monitor user behaviors so as to reduce the risk of enterprise information leakage.

The Labview may use icons to construct program codes, and use connecting lines to indicate data flow, so as to determine the execution sequence of the program.

In some application scenarios, the application program may be installed on a terminal, such as a notebook, a desktop, or the like, which is capable of performing monitoring operations. The application program on the terminal can receive various user behavior monitoring instructions and execute corresponding monitoring operation based on the user behavior monitoring instructions so as to monitor user behaviors.

In other application scenarios, the application may be installed on a server capable of substantially performing the monitoring operation. The application program on the server may receive a user behavior monitoring instruction sent by the terminal, for example, and then may instruct the terminal to perform a corresponding monitoring operation based on the user behavior monitoring instruction to monitor the user behavior.

It should be understood that the user behavior monitoring method, device and electronic equipment provided by the application aim to discover behaviors of leaking the confidential business information and reduce risks of leaking the confidential business information, and data collection and use behaviors in the scheme should not violate laws and regulations of the place where the scheme is implemented and related to personal privacy protection.

The above solutions in the related art are all the results of practical and careful study of the inventor, and therefore, the discovery process of the above problems and the solutions proposed by the following embodiments of the present invention to the above problems should be the contribution of the inventor to the present invention in the course of the present invention.

Please refer to fig. 1, which shows a flowchart of a user behavior monitoring method according to an embodiment of the present application. The user behavior monitoring method can be applied to application programs developed based on Labview. As shown in fig. 1, the user behavior monitoring method includes the following steps 101 to 102.

Step 101, receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types.

In some application scenarios, the application may receive arbitrary user behavior monitoring instructions.

The user behavior monitoring instruction may include, for example, instructions for instructing a monitoring user to input information, whether the monitoring user is a specific user with operation authority, and information content viewed by the monitoring user. The information content viewed by the user can comprise technical development documents, bidding documents and the like;

in these application scenarios, the application may receive a variety of user behavior monitoring instructions. For example, the application may first receive an instruction indicating whether the monitoring user is a specified user having an operation right, and then may continue to receive an instruction for monitoring the information content viewed by the user, and the like.

In these application scenarios, the application may determine what user behavior is currently being monitored for instructions received in response to different detected triggers. For example, the application may determine that an instruction for monitoring whether the user has performed the relevant operation in the confidential environment at all times is currently received in response to detecting a trigger operation such as a click or a long press on a "video" button.

And 102, monitoring the user behavior indicated by the user behavior monitoring instruction.

In some application scenarios, after an application receives any user behavior monitoring instruction, it may monitor the user behavior it indicates. For example, if an instruction for monitoring the information content viewed by the user is received, the storage path where the information content is located may be acquired to monitor whether the user views the document related to technical confidentiality.

In some application scenarios, the application program may sequentially perform the corresponding monitoring operations according to the receiving time of the user behavior monitoring instruction. For example, the application receives an instruction a for monitoring whether the user is a designated user with operation authority at 13: when an instruction B for monitoring the information content viewed by the user is received at time 05, the relevant operation required for implementing the instruction a may be executed first, and then the relevant operation required for implementing the instruction B may be executed continuously.

In other application scenarios, the application program may monitor the instructions based on the received multiple user behaviors and simultaneously perform the corresponding related operations. For example, if the application receives an instruction for monitoring whether the user is a designated user with operation authority, and then receives an instruction for monitoring whether the user is always in a confidential environment, it may be determined whether the user is the designated user with operation authority (for example, it is determined whether an account of the user is an account with operation authority) in the process of shooting the relevant video of the user.

In some optional implementation manners, the user behavior monitoring instruction includes a screen monitoring instruction, and the receiving any user behavior monitoring instruction in step 101 may include: in response to detecting a trigger operation for a virtual screenshot key, determining that the screen monitoring instruction is received; the virtual screenshot key is associated with the screenshot key of the keyboard through a virtual screenshot key value;

the virtual screenshot key may be regarded as a virtual key having the same function as the screenshot key (i.e. the Print Screen key) of the keyboard, for example. It can be associated with the screenshot button by a virtual screenshot button key value.

In some application scenarios, for example, the application program may store a virtual key value table in advance, where the virtual key value table may store, for example, a plurality of virtual keys, information of each virtual key and key of the keyboard that implements the same function of the virtual key, and may set an association relationship between each virtual key and another key that implements the same function of the virtual key.

For example, the virtual bond value table may include virtual bonds such as "VK-LWIN", "VK-CONTROL", "VK-MENU", "VK-A", "VK-SNAPSHOT", and the like. The function of the virtual key VK-LWIN may be the same as that of a Windows key in a keyboard, which may be implemented by 91 decimal or 5B hexadecimal, for example. The function of the virtual key VK-CONTROL may be, for example, the same as that of the Ctrl key in the keyboard, which may be implemented, for example, by 17 in decimal or 11 in hexadecimal; the function of the virtual key VK-MENU may be, for example, the same as that of the Alt keys in the keyboard, which may be realized, for example, by 18 decimal or 12 hexadecimal; the function of the virtual key VK-A may be, for example, the same as the function of the A key in A keyboard, which may be realized, for example, by 65 in decimal or 41 in hexadecimal; the function of the virtual key VK-SNAPSHOT may be, for example, the same as that of the Print Screen key in a keyboard, which may be implemented, for example, by 44 decimal or 2C hexadecimal.

It should be noted that when the application is developed based on Labview, for example, the corresponding numerical values in decimal or hexadecimal as described above may be filled in the corresponding pins. For example, if the virtual screenshot button function of the above-mentioned screen monitoring command is to be implemented, decimal 44 may be filled in the pin. Furthermore, each pin in the Labview has a specific function, and after the numerical value is filled in the pin, the corresponding function can be realized.

In some application scenarios, for example, the process of implementing the screenshot function through the virtual screenshot button in the application program may be implemented through the program schematic diagram shown in fig. 2. As shown in fig. 2, "U8" and "U32" can be regarded as a default interface for receiving corresponding pin information. Inputting decimal '44' in the first pin can be regarded as pressing the virtual screenshot key, and inputting decimal '0' in the last pin can be regarded as pressing the current virtual screenshot key; when the delay time length set by the timer reaches 100 milliseconds, the input '0' in the tail pin can be modified into '2', so that the pressing state of the virtual screenshot key is modified into the bounce state, and at this time, the screenshot can be regarded as being stopped.

In these application scenarios, the application developed based on Labview may be considered as receiving a screen monitoring command when it receives "44" in decimal.

In some application scenarios, if the application detects a trigger operation for the virtual screenshot key, it may be determined that a screen monitoring instruction is received. The trigger operation may include, for example, "44" in the input decimal noted above.

Thus, the monitoring the user behavior indicated by the user behavior monitoring instruction in step 102 includes: and intercepting a screen image before detecting the bounce operation of the virtual screenshot key so as to monitor the user behavior through the intercepted screen image.

In some application scenarios, if the application detects the pop-up operation of the virtual screenshot button, it may be considered that the screenshot operation may be currently stopped. For example, based on the program diagram shown in fig. 2, if the application program starts from the time point when the trigger operation for the virtual screenshot key is detected, the screen image may be captured in real time within 100 milliseconds, and when the capture time reaches 100 milliseconds, the capture of the screen image may be stopped. The operation performed by the user can then be monitored by the screen image intercepted within the 100 milliseconds.

In the implementation mode, the virtual screenshot key can simulate the screenshot key in the keyboard, and the screen image is captured in real time within a set time range, so that the purpose of monitoring the related operation executed by the user in the application program is achieved.

In some application scenarios, after the screen image is captured by the application program, the screen image may be saved in a clipboard, and the screen image may be obtained from the clipboard by a get image function and saved at a specified location. In these application scenarios, the function of acquiring a screen image from a clipboard in the application program can be developed based on Labview, for example, by the program diagram shown in fig. 3. As shown in fig. 3, for example, a click operation may be received in a blank position of the development interface, then the ". Net" attribute node may be queried based on a selection class selection operation, and then the program set information may be exposed so as to be able to call the get image function in the program set.

In some application scenarios, the application may also zoom the intercepted screen image. In these application scenarios, the application program may automatically zoom the screen image based on a preset size, for example, or may zoom the screen image based on size information input by the user.

In these application scenarios, the function of the application program to scale the image can be implemented, for example, by the program block diagram shown in fig. 4. As shown in fig. 4, labview may obtain the screen image in the clipboard by referring to the get image function and then calling the attribute node of "net" in the interconnection interface. And then modifying the length and width information of the screen image through the pin "height" and the pin "width". Then, a thumbnail function Get thumbnail image may be further called, and the modified length information and width information are respectively connected with a pin "thumbnail height" and a pin "thumbnail width" in the thumbnail function, so as to implement the zooming function. It should be noted that the pins such as "Callback", "Callbackdata", etc. shown in fig. 4 are default pins of Labview, and are not described herein.

After the application program zooms the intercepted screen image, the intercepted screen image can be stored in a folder where the application program is located, and the intercepted screen image can also be stored in other positions through an absolute path.

In some application scenarios, the save path may be created, for example, by the program diagram shown in fig. 5. As shown in fig. 5, after the thumbnail function is called in fig. 4, a saving function (Save) may be selected to Save the screen image with the modified size to the specified path in the specified file format. The pin "filename" in the Save function is used for setting a specified path of a user, and the "format" is used for setting a specified file format.

In these application scenarios, the application program may zoom the captured screen image based on the information of the size, the specified path, the file format, and the like input by the user, and store the zoomed image in the specified path, which is convenient for the user to manage the screen image.

In some optional implementation manners, the user behavior monitoring instruction includes an operation object monitoring instruction, and the receiving any user behavior monitoring instruction in step 101 includes: responding to the detected camera starting instruction, and determining that the operating object monitoring instruction is received;

in some application scenarios, the application may detect a camera startup instruction. The camera start instruction is also used for starting the camera to acquire an instruction of an operation object. The number of the cameras can be one or more. The operation object may be, for example, a user object that currently sends a camera start instruction, and may be one object or multiple objects.

In these application scenarios, the application program may, for example, consider that a camera start instruction is detected after detecting a click operation on the "camera" button.

Then, the application program may determine that the currently received user behavior monitoring instruction is an operation object monitoring instruction in response to detecting the camera start instruction.

In some application scenarios, when developing the monitoring operation object function of the application program based on labview, for example, a visual acquisition package VAS may be installed in labview to install hardware drivers such as a visual camera and an image acquisition card.

In these application scenarios, the application program may perform corresponding operations based on the program diagram shown in fig. 6, for example. As shown in fig. 6, when detecting an operation object monitoring instruction, the application program may Open the camera through an Open camera function, and may present a plurality of pieces of camera information to a user based on input pin information carried by the Open camera function, so that the user can select a target camera to perform shooting.

Further, after the application program determines the target camera, the application program may also acquire camera resolution information. For example, the application may select the target resolution through the interface shown in FIG. 7. As shown in fig. 7, a plurality of resolution information is shown, each resolution information may correspond to a gear, and a user may select any one of the gears to realize the selection of the target resolution. For example, the user may select gear 7 to determine "960 × 540 yuy230.00fps" as the target resolution.

Thus, the monitoring the user behavior indicated by the user behavior monitoring instruction in step 102 includes:

firstly, calling a continuous shooting function to shoot a current operation object;

after determining that the operation object monitoring instruction is detected, the application program may call a continuous shooting function to shoot the current operation object, so as to obtain the image or video information corresponding to the current operation. The continuous shooting function may include, for example, a Grab function configuration Grab, a Grab function, and a round function (e.g., a WHILE function). In some application scenarios, for example, the delay duration of the loop function may be set (e.g., 200 milliseconds) to reduce the occupancy of computer resources.

Then, the photographed image is stored at a relative address to monitor the user's behavior through the stored photographed image.

After the application program has shot the current operation object, a plurality of shot images may be acquired, and then it may further store the shot images at relative addresses. Here, when the application program is developed based on labview, it may be directly set to store the photographed image at a relative address so that the application program can be adapted to a larger number of computers.

When storing the captured image, the application program may store the captured image in a folder in which the application program is located, for example. Further, the storage format of the shot image may be, for example, JEPG2000 format or standard JPG format.

After the application stores the photographed image, the user behavior may be monitored through the stored photographed image.

In some application scenarios, the application may display multiple captured images in real time, which may be displayed as video information due to the round-robin function invoked. In these application scenarios, if there is a click phenomenon while displaying video, the improvement can be made by shortening the delay time of the called loop function (e.g., the delay time can be shortened from 200 ms to 180 ms).

In the implementation mode, the purpose of monitoring whether the operation objects are consistently in a confidential environment or have operation authority or not can be achieved by shooting images of the operation objects.

In some optional implementation manners, after the storing the shot images at the relative addresses, the user behavior monitoring method may further include: in response to the detected camera stopping instruction, stopping calling the continuous shooting function; and if the shot image is determined to be successfully stored, releasing the shooting process.

In some application scenarios, if the application detects a camera stop instruction, the application may stop calling the continuous shooting function to instruct the camera to stop the shooting operation. And the application program can detect whether the shot image is successfully stored or not, and if the shot image is successfully stored, the shooting process of the camera can be destroyed.

As shown in fig. 6, the application program may call a camera close function to stop shooting, and may stop calling the camera close function after determining that a shot image is saved. After stopping substituting the camera and closing the function, the camera release function can be continuously called to release the shooting process of the camera so as to release the memory and save computer resources.

In the implementation mode, the camera process can be released after the shot images are successfully stored, so that the aims of releasing the memory and saving resources are fulfilled.

In some optional implementations, the step of receiving the user behavior monitoring instruction in step 101 includes: in response to detecting a triggering operation for a keyboard key, determining that the typing monitoring instruction is received;

the triggering operation for the keyboard key may include any triggering operation for a hardware keyboard or a virtual keyboard, for example; for the hardware keyboard, the triggering operation may include, for example, detecting key-in information of any key. For example, if the key input information "a" is detected, it can be regarded that the trigger operation on the hardware keyboard is detected. For a virtual keyboard, the triggering operation may include, for example, a clicking operation or a long-pressing operation for any virtual key.

In some application scenarios, if the application detects a trigger operation for a keyboard key, it may be considered that a key-in monitoring instruction is received.

firstly, after the keyboard is initialized, a key-in information acquisition function is called to acquire the currently key-in information;

in some application scenarios, the application may first perform an initialization operation on the keyboard. As shown in fig. 8, a schematic diagram of one of the initialized typed information is shown. The application program can call a keyboard initialization function packaged in advance based on labview to initialize all the key information to be the parameter 0. Thus, the locations for storing the entered information may all be displayed as a parameter "0" until the entered information is not detected. It should be noted that the initialization operation may be performed when the application program is first run, and may be omitted when the application program is run later.

After the application initializes the keyboard, the typed information acquisition function may be called to acquire the currently typed information. The key-in information acquisition function may be, for example, an acquisition function of labview itself. The entered information may be displayed, for example, through a display control as shown in fig. 8. As shown in fig. 8, when the entered information is acquired, the parameter "0" at the corresponding position may be modified to the entered information. For example, when the value "1" is detected as the first entered value, the parameter "0" at the position for storing the value "1" may be modified to "1".

Then, in response to detecting a pop-up operation for a key of the keyboard, the entered information is dumped to monitor user behavior through the dumped entered information.

Here, the application program may detect a trigger operation for the keyboard at any time, and thus needs to monitor whether the keyboard is triggered in real time. In some application scenarios, the purpose of detecting a trigger operation for the keyboard in real time may be achieved, for example, by calling a loop function. In these application scenarios, if the key input information is not detected, it may be considered that the operation object does not press the hardware keyboard, and then the keyboard key may bounce (that is, the bounce operation may include, for example, an operation of not pressing the keyboard key), and the keyboard may be automatically reset. Therefore, after the application program acquires the currently-typed information, the application program can continue to detect the bounce operation aiming at the keyboard keys and dump the typed information so as to reduce the condition that the typed information is lost due to the automatic reset of the keyboard.

In some application scenarios, when the application program is developed based on labview, a function corresponding to entering the monitoring instruction may be implemented by the program diagram shown in fig. 9, for example. As shown in fig. 9, the keyboard may be acquired first, then the initialization operation may be performed, the trigger operation for the keyboard key is detected in real time, the currently entered information is acquired, and after the pop-up operation is detected, the keyboard is closed, and the memory is released.

In the implementation mode, the currently-typed information can be acquired through the triggering operation aiming at the keyboard keys, and the typed information can be stored after the bounce operation aiming at the keyboard keys is detected, so that the purpose of monitoring the typed information of the operation object in real time is achieved.

In some optional implementations, the unloading the entered information in response to detecting a pop-up operation for a key of the keyboard includes: for each character typed, acquiring the character and historical characters typed before the character; and connecting the character and the history character into a character string for storage.

In some application scenarios, the application may perform a dump operation based on each character typed when dumping the typed information. Specifically, for each character typed, the application may retrieve the character and historical characters typed before the character. For example, for the character string "123", if the application detects that the character "1" is currently typed, it may acquire the character "1" and the history character typed before the character, and only acquire the character "1" because there is no history character currently. If it is detected that the character "2" is currently typed, it can acquire the character "2" and the history character "1" typed before the character. If it is detected that the character "3" is currently typed, it can acquire the character "3" and the history characters "1", "2" typed before the character.

The application may then concatenate the currently entered character and the historical characters into a character string. For example, the character "2" may be connected to the history character "1" and the character string "12" may be obtained in the typing order, and the character "3" may be connected to the character string "12" and the character string "123" may be obtained in the typing order. Then, the currently dumped string may be "123".

In some application scenarios, the application may save the string in a string display control to enable real-time display of the entered character information. Further, the string display control may be configured, for example, to continue to display the entered information without detecting a null character. Then, in the case that the application program does not write an empty character in the character string display control, the entered character string is not erased. In these application scenarios, for example, when the above-mentioned pop-up operation is detected, an empty character may be written into the character string display control to erase the entered character string and release the memory.

In the implementation mode, the key-in characters are acquired one by one, and the current key-in character is connected with the historical characters before the key-in character to form a character string for storage, so that the key-in information can be stored more perfectly, and the accuracy of the key-in information is improved.

In some optional implementations, the concatenating the character and the history character into a character string for saving includes: and regarding each typed character, taking the time point of detecting the bounce operation of the keyboard key as a starting point, and if the character is detected after the preset time length, performing line feed processing on the character.

In some application scenarios, when each character is received, the application program may determine whether it needs to perform line feed processing according to the pop-up operation corresponding to the character. Specifically, the application program may determine whether a time period from a last pop-up operation to a typing operation of a new character exceeds a preset time period, and if so, may save the new character to a next line. The preset time period may include, for example, a time period of 1 second, 2 seconds, or the like, which can be substantially regarded as a case where a sentence break exists. In these application scenarios, the application program may determine the line feed timing in cooperation with the time difference subtraction method based on a time counter and a shift register, for example.

In some application scenarios, after the character is subjected to line feed processing, the process of connecting the new character and the historical character into a character string can be realized by the program diagram shown in fig. 10, for example. As shown in fig. 10, the application program may obtain an array corresponding to the pressed key, and then index each data in the array to obtain the corresponding element. The characters may then be detected one by one based on the time counter and the cycle duration, and the plurality of characters may be concatenated into a character string. For example, the size of the array corresponding to the pressed key is "123", the application program may index data "1", "2", and "3" in the array one by one, and the data "1", "2", and "3" may be regarded as elements in the array. Then "1", "2", "3" can be concatenated one by one into a string "123" by a time counter, in combination with a loop duration of 1000 milliseconds.

In these application scenarios, the character string may be placed in the first pin (i.e., the pin "pressed key") in the program diagram shown in FIG. 10 to place the elements of the first pin at the top of the character string, thereby improving the consistency between the saved character sequence and the key press sequence. It should be noted that the "boolean" control shown in fig. 10 and other controls, such as "Value" in the "string" control, which are owned by labview, and those skilled in the art know the usage rules and functions thereof, and are not described herein.

In the implementation mode, each character which is typed can be subjected to line feed processing by the bouncing operation of the keyboard keys and the preset duration, so that the aim of reading is fulfilled.

In some optional implementations, after monitoring the user behavior indicated by the user behavior monitoring instruction in step 102, the user behavior monitoring method further includes:

103, calling a mail sending function, and sending the monitoring information to a target mailbox through a third-party server;

in some application scenarios, after monitoring the user behavior indicated by the user behavior monitoring instruction, the application program may send the monitored monitoring information to the target mailbox. Specifically, the application program may call a mail sending function SMTP email, and send the monitoring information to the target mailbox through the third-party server. In these application scenarios, when an application program is developed based on Labview, the mail sending function can be found through the path information of "data communication" - "protocol" - "SMTP email", and then the mail sending function can be realized. The target mailbox can comprise a mailbox of a person with monitoring information viewing authority in the enterprise.

It should be noted that, if an application program developed based on Labview sends an email by using english, a messy code situation does not occur; however, if the mail is sent in Chinese, the messy code will occur. As shown in fig. 11, it shows a case of sending a mail based on the chinese language. As shown in fig. 11, if "who is not dead from old" is input at the mail message by the chinese language, "test" is input at the mail subject, and if the information of the target mailbox of the recipient is "aaaaaa," there is a messy code situation in the mail subject actually received by the recipient, which may output messy codes such as "0" and "1".

Therefore, the function of sending the mail can be realized through the third-party server, so that the messy code condition of the mail received by the receiver does not exist. That is, the third-party server has a mail sending function, and in the process of sending the mail, the messy code condition of the mail content or the mail subject cannot be caused.

In some application scenarios, when an application program is developed based on Labview, the function of sending a mail may be implemented by a program diagram shown in fig. 12, for example. As shown in fig. 12, labview may receive corresponding information through a "recipient" pin, a "subject" pin, and a "message" pin, and then may send a mail in english. It should be noted that the pins "error in", "error out", and the like shown in fig. 12 are default pins of Labview, and are not described herein.

And 104, if the feedback information representation of the third-party server is successfully sent, judging that the monitoring information is successfully sent to the target mailbox.

In some application scenarios, after the application program sends the monitoring information to the target mailbox through the third-party server, the third-party server may return feedback information to the application program, so that the application program can determine whether the monitoring information is successfully sent. At this time, if the application program determines that the representation of the feedback information is successfully sent, it can confirm that the monitoring information is successfully sent to the target mailbox. The feedback information may include, for example, "transmission success XXXX" or "transmission failure YYYY" or other information content that substantially allows the application program to determine that the monitoring information is successfully transmitted. The "XXXX" and "YYYY" may be any numerical value, character, letter, or the like.

In the implementation mode, the monitoring information can be forwarded to the target mailbox through the third-party server, so that the condition of messy codes of the monitoring information is improved. And whether the monitoring information is successfully sent to the target mailbox can be determined through the feedback information returned by the monitoring information checking system, so that a user with monitoring information checking authority can normally check the monitoring information.

In some optional implementation manners, if the feedback information of the third-party server in the step 104 represents that the sending is successful, determining that the monitoring information is successfully sent to the target mailbox includes the following sub-steps:

substep 1041, splitting the feedback information if the feedback information representation of the third-party server is successfully sent;

in some application scenarios, an application may split feedback information characterizing successful transmissions when receiving the feedback information. For example, the application may split a string corresponding to the feedback information into individual characters.

In these application scenarios, the function of splitting the feedback information can be realized by the program diagram shown in fig. 13, for example. Based on the application program in fig. 13, the website information of the third-party server may be filled in the "www. Third-party server" pin, and then the information of the recipient, such as the user name, the account number, the password, the name, and the like, may be sequentially filled in the corresponding "Username" pin, the "account number" pin, the "password" pin, the "recipient" pin, and may continue to fill the mail topic and the mail content in the corresponding "mail topic" pin and the "mail message" pin, respectively. A POST send function may then be invoked to send the information content in the respective pins to a third party server, which may return feedback information based on the sent information content, which may store the feedback information via a "header" pin storing the header information and a "body" pin storing the body information. Then, the feedback information can be split through the regular expression and a preset matching mode. For example, the feedback information includes "transmission success XXXX", which can be processed by a regular expression in the form of "transmission% to% work% X", it can then be split into "send", "get", "work", "X" according to the matching pattern of "split by%". And can be sequentially stored in an "OSSA" pin (store "send"), "polarity" pin (store "send"), "signature" pin (store "go"), "location" pin (store "work") and the like in order. It should be noted that the names of the above pins can be customized, and they can be any combination of numbers, characters or letters, for example, and are not limited herein.

And a substep 1042 of selecting key information which is used for expressing successful sending in the feedback information, and judging that the monitoring information is successfully sent to the target mailbox through the key information.

After the application splits the feedback information, the key information representing the successful sending can be selected. For example, for the feedback information "successful sending XXXX", key information such as "send", "success", etc. may be selected, so as to determine that the monitoring information is successfully sent to the target mailbox through the key information.

In these application scenarios, the selected key information may be combined for easy reading. For example, the combination may be performed by the position precedence order of the characters in the feedback information. That is, the characters of sending, forming, success, etc. are combined into the key information of sending success according to the position sequence.

In some application scenarios, the process of combining (bundling, integrating) the key information may be implemented, for example, by the program diagram shown in fig. 14. Based on fig. 14, the application program may bundle characters in the "OSSA" pin, the "policy" pin, the "signature" pin, and the "location" pin by name to create a corresponding array, then send the array to the "body" pin through a sending function post result.

In the implementation mode, the feedback information is split, so that the key information in the feedback information can be selected to obtain the effects of facilitating reading and quickly and clearly monitoring the successful sending of the information to the target mailbox.

In some optional implementations, the monitoring information includes a monitoring image, and the monitoring image includes the screen image and/or the photographed image.

In some application scenarios, after an application program intercepts a screen image or obtains a shot image by shooting with a camera, the screen image can be used as monitoring information for monitoring whether related operations of an operation object meet the security requirements of the interior of an enterprise.

In this way, before the calling the mail sending function in step 103 and sending the monitoring information to the target mailbox through the third-party server, the user behavior monitoring method may further include;

firstly, adjusting the size of the monitoring image according to a preset size; the preset size is set based on the display frame specification of the monitoring image;

in some application scenarios, if the monitoring image is used as the monitoring information, the size of the monitoring image may be adjusted before the monitoring image is sent to the target mailbox. Specifically, for example, the size may be adjusted to a predetermined size. The preset size may be set based on a display frame specification of the monitoring image. The display frame of the monitor image may be the same size as the screen, or may be a uniform size. It should be noted that the display frame of the monitoring image can be flexibly set in a situation that the monitoring image can be completely displayed, and is not limited herein.

Then, in response to the detected preview instruction, the monitor image is displayed in the adjusted size.

After the application program adjusts the size of the monitoring image, the adjusted monitoring image can be displayed when a preview instruction is detected. In some application scenarios, for example, a preview instruction may be considered to be detected when a click operation on a "preview" key is detected or input information characterizing "preview" is received.

In the related art, there may be a difference in the size of each monitoring image, and there may be a case where the monitoring image cannot be completely displayed in a display frame of a fixed size. Therefore, the size of the monitoring image needs to be adjusted.

In some application scenarios, the application program may select whether a screen image or a captured image is currently to be transmitted when transmitting the monitoring image. The selection process may be implemented, for example, by a selection diagram shown in fig. 15. Based on fig. 15, the application program may send the captured screen image after detecting a selection operation (e.g., a click operation) for the "screen capture" key. In these application scenarios, the function of transmitting the screen image can be realized by, for example, the program diagram shown in fig. 16. Based on fig. 16, the application program may transmit an instruction to send the screen image into the "screen capture" pin after detecting a selection operation for the "screen capture" key, and then may select a transmission path to send the screen image to the target mailbox. The transmission path may be regarded as a path of a third-party server or a target mailbox, for example.

Based on fig. 15, when the application detects a selection operation (for example, a click operation) for "video", it is possible to transmit a captured image captured by the camera. In some application scenarios, an application may drive multiple cameras, and thus may select a target camera that captures a captured image to be transmitted. For example, the target camera may be determined based on a pull-down menu of "Session In". The pull-down menu may include, for example, a plurality of pieces of camera information such as "cam0", "cam1", and "cam2", and if a click operation for "cam0" is detected, it may be considered that "cam0" is determined as a target camera, and then a captured image corresponding to "cam0" may be sent to a target mailbox. In the application scenes, the shot images continuously shot by the camera can be stored in a video format, so that the shot images can be sent to a target mailbox in a video form, and the recipient can conveniently read the shot images. In these application scenarios, the function of transmitting video can be realized by, for example, the program diagram shown in fig. 17. Based on fig. 17, a sending path may be selected, a target camera is then determined, a video image corresponding to the target camera is obtained, and the video image is sent to a target mailbox according to the sending path.

In some application scenarios, a storage path may be created for a screen image or a captured image to be transmitted to store it at a fixed location. In these application scenarios, for example, the path where the application program is located may be saved as the base path by a relative addressing manner.

In some application scenarios, for example, the process of obtaining the monitoring image to be sent from the storage location and adjusting the size of the monitoring image can be implemented by the program schematic diagram shown in fig. 18. Based on fig. 18, the application program may list a folder in which the monitoring images are stored, and may list each monitoring image in the folder by its name (file name). Here, when monitoring images in a file name list, for example, all files in the folder in a file format (for example, JPG format) may be retrieved, and file names corresponding to the files may be retrieved, and then the retrieved files and file names may be packaged into an array and stored in the created path.

In these application scenarios, the application program may also obtain the transmitted monitoring image from a third-party server. For example, the information contents filled in the "OSSA" pin, the "polarity" pin, the "signature" pin, the "location" pin, etc. can be bound into the "body" pin and the "heads" pin. And a reading function 'Read JPEG File. Vi' can be called to Read the bundled array so as to adjust the size of the monitoring image.

Here, when the application program reads, each monitoring image in the array may be read one by one using a loop function. Also, the application program may adjust the size of the monitor image for each of the read monitor images.

When the application program adjusts the size of the monitoring image, the binding can be released according to the file name of the application program. For example, for a monitoring image named "a.jpg", the length information and the width information of the monitoring image may be separated, and the separated length information and width information may be associated with the name "a.jpg". Then, the length information and the width information can be respectively adjusted according to the respective corresponding scaling factors to obtain the monitoring image meeting the preset size. Here, the separated length information may be filled in the "height" pin, the Width information may be filled in the "Width" pin, and then adjusted by being reduced by 2% by a preset scaling factor.

After the application adjusts the monitor image to a preset size, it may be presented in a display frame. Here, it may be in the display frame "new picture" based on, for example, the "draw flattening pixel map" function of labview itself. At this time, the monitoring image can be displayed on the display frame more completely.

In the implementation mode, the preset size can be set according to the specification of each image display frame to be monitored, and then the size of the monitoring image is adjusted based on the preset size, so that the displayed monitoring image can be completely displayed.

In some optional implementation manners, the user behavior monitoring method may further include: hiding and running the application program based on a configuration file in response to the detected hidden running instruction; the configuration file is generated based on an executable file of the application program.

In some application scenarios, the application may run hidden. Specifically, the application program may hide the operation based on the configuration file when the hidden operation instruction is detected. The configuration file may include, for example, a file with an extension of ". Net" in labview.

Further, the configuration file may be generated based on an executable file of the application program. The executable file may comprise, for example, a file with an application-related extension of ". Exe". That is, when the application program is developed based on labview, the executable file of the application program can be acquired, then the configuration file is generated based on the executable file, and then the purpose of hidden operation can be achieved.

In some application scenarios, the hidden run function may be implemented, for example, by the program diagram shown in fig. 19. As shown in fig. 19, for example, the name and related information of the application may be acquired based on the operation path of "application control" - "property node" - "application" - "name". And then connecting the content of the executable file of the application program except the extension with the extension of the configuration file, wherein the extension is 'net' to form a character string, and obtaining the configuration file. Then, a path can be created based on the configuration file, then the configuration file can be obtained from the created path, and then the configuration file can be opened through an opening function "Open Config data. Vi" so as to modify the value of the hidden parameter "hiderottowindow" in the configuration file into "true", thereby achieving the function of hidden operation.

In some application scenarios, when the application detects a selection operation for the "hidden run" key, it may be considered that a hidden run instruction is received, and then the application may be hidden run. It should be noted that hiding the running application may be regarded as not displaying the shortcut icon corresponding to the application in the taskbar of the terminal in which the application is installed.

In the related art, there is a scheme that can minimize an application program, but cannot hide it from running. Which can be minimized, for example, by a procedural schematic as shown in fig. 20. As shown in fig. 20, when an application is developed based on labview, information about the application may be obtained from a storage path of the application through an execution path of "file IO" - "file constant" - "current VI path", for example. The "file IO" may be regarded as a read-write file of the application program, and the "current VI path" may be regarded as a current storage location of the application program. Then, the node can be called, and the Hidden node can be found in the calling node, so that the minimization function can be realized.

In some application scenarios, an application program may also perform operations such as save, read, etc., for configuration files. In these application scenarios, the configuration file may be saved, for example, by the program diagram shown in fig. 21. As shown in fig. 21, when the application is developed based on labview, multiple "key" pins may be set, and the configuration file may be opened by an open function "open config data. Vi" to read out each character in the configuration file through the pin, and then write into the corresponding "value" pin. After saving each character, the profile can be closed by closing the function "close config data. Vi".

In some application scenarios, the application may also write individual characters in the configuration file. For example, the configuration file may be read by the program diagram shown in fig. 22. As shown in FIG. 22, when developing the application based on labview, multiple "key" pins can be set, and then the characters in their corresponding "value" pins are read out. It should be noted that the configuration file reading process may be similar to the writing process described above, and is not described herein again.

In this implementation manner, when the hidden operation instruction is detected, the application program can be hidden and operated, so as to achieve the purpose of not disturbing the operation object.

It will be understood by those skilled in the art that in the method described above in the specific embodiments, the writing order of the steps does not imply a strict order of execution and any limitations on the implementation process, and the specific order of execution of the steps should be determined by their function and possible inherent logic.

Referring to fig. 23, a block diagram of a user behavior monitoring device according to an embodiment of the present application is shown, where the user behavior monitoring device runs an application program developed based on a laboratory virtual instrument integration environment. It should be understood that the application program corresponds to the above-mentioned embodiment of the method of fig. 1, and can perform various steps related to the embodiment of the method of fig. 1, and specific functions of the application program can be referred to the description above, and detailed description is appropriately omitted here to avoid repetition.

Optionally, the application programs include a receiving module 2301 and a monitoring module 2302. The receiving module 2301 is configured to receive any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types; a monitoring module 2302 for monitoring the user behavior indicated by the user behavior monitoring instruction.

In some optional implementations, the user behavior monitoring instructions include screen monitoring instructions, and the receiving module 2301 is further configured to: in response to detecting a trigger operation for a virtual screenshot key, determining that the screen monitoring instruction is received; the virtual screenshot key is associated with the screenshot key of the keyboard through a virtual screenshot key value; and the monitoring module 2302 is further configured to: and intercepting a screen image before detecting the bounce operation of the virtual screenshot key so as to monitor the user behavior through the intercepted screen image.

In some optional implementations, the user behavior monitoring instruction includes an operand monitoring instruction, and the receiving module 2301 is further configured to: responding to the detected camera starting instruction, and determining that the operating object monitoring instruction is received; and the monitoring module 2302 is further configured to: calling a continuous shooting function to shoot a current operation object; the photographed images are stored at relative addresses to monitor user behavior through the stored photographed images.

In some optional implementations, the user behavior monitoring apparatus may further include a releasing module, and the releasing module is further configured to: after the shooting images are stored in the relative addresses, responding to a detected camera stopping instruction, and stopping calling the continuous shooting function; and if the shot image is determined to be successfully stored, releasing the shooting process.

In some optional implementations, the user behavior monitoring instruction comprises a typed monitoring instruction, and the receiving module 2301 is further to: in response to detecting a triggering operation for a keyboard key, determining that the keying monitoring instruction is received; and the monitoring module 2302 is further configured to: after the keyboard is initialized, calling a key-in information acquisition function to acquire currently key-in information; and in response to detecting the bounce operation aiming at the keyboard keys, unloading the input information to monitor the user behavior through the unloaded input information.

In some optional implementations, the monitoring module 2302 is further configured to: for each character typed, acquiring the character and historical characters typed before the character; and connecting the character and the history character into a character string for storage.

In some optional implementations, the monitoring module 2302 is further configured to: and regarding each typed character, taking the time point of detecting the bounce operation aiming at the keyboard key as a starting point, and if the character is detected after a preset time length, performing line feed processing on the character.

In some optional implementation manners, the user behavior monitoring apparatus may further include a sending module, where the sending module is configured to: after monitoring the user behavior indicated by the user behavior monitoring instruction, calling a mail sending function, and sending monitoring information to a target mailbox through a third-party server; and if the feedback information representation of the third-party server is successfully sent, judging that the monitoring information is successfully sent to the target mailbox.

In some optional implementations, the sending module is further configured to: if the feedback information representation of the third-party server is successfully sent, splitting the feedback information; and selecting key information which is successfully sent in the feedback information, and judging that the monitoring information is successfully sent to the target mailbox through the key information.

In some optional implementation manners, the monitoring information includes a monitoring image, the monitoring image includes the screen image and/or the shot image, and the user behavior monitoring apparatus may further include an adjusting module, where the adjusting module is configured to: before the calling mail sending function sends the monitoring information to the target mailbox through the third-party server, adjusting the size of the monitoring image according to a preset size; the preset size is set based on the display frame specification of the monitoring image; and displaying the monitoring image according to the adjusted size in response to the detected preview instruction.

In some optional implementations, the user behavior monitoring apparatus may further include a hiding module, where the hiding module is configured to: hiding and running the application program based on the configuration file in response to the detected hidden running instruction; the configuration file is generated based on an executable file of the application program.

It should be noted that, for convenience and simplicity of description, a person skilled in the art may clearly understand that, for the specific working process of the application program described above, reference may be made to the corresponding process in the foregoing method embodiment, and a description is not repeated here.

Referring to fig. 24, fig. 24 is a schematic structural diagram of an electronic device for executing a user behavior monitoring method according to an embodiment of the present application, where the electronic device may include: at least one processor 2401, e.g., a CPU, at least one communication interface 2402, at least one memory 2403, and at least one communication bus 2404. Wherein the communication bus 2404 is used for realizing direct connection communication of the components. In this embodiment, the communication interface 2402 of the device in this application is used for performing signaling or data communication with other node devices. The memory 2403 may be a high-speed RAM memory or a non-volatile memory (e.g., at least one disk memory). The memory 2403 may optionally also be at least one storage device located remotely from the aforementioned processor. The memory 2403 stores computer readable instructions, which when executed by the processor 2401, can cause the electronic device to perform the method processes described above with reference to fig. 1.

It will be appreciated that the configuration shown in fig. 24 is merely illustrative, and that the electronic device may include more or fewer components than shown in fig. 24, or have a different configuration than shown in fig. 24. The components shown in fig. 24 may be implemented in hardware, software, or a combination thereof.

Embodiments of the present application provide a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, may perform the method processes performed by an electronic device in the method embodiment shown in fig. 1.

Embodiments of the present application provide a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, which when executed by a computer, enable the computer to perform the method provided by the above-mentioned method embodiments, for example, the method may include: receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types; and monitoring the user behavior indicated by the user behavior monitoring instruction.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.

In addition, units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Furthermore, the functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

In this document, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

The above description is only an example of the present application and is not intended to limit the scope of the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A user behavior monitoring method is applied to an application program developed based on a laboratory virtual instrument integration environment, and comprises the following steps:

receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types;

and monitoring the user behavior indicated by the user behavior monitoring instruction.

2. The method of claim 1, wherein the user behavior monitoring instructions comprise screen monitoring instructions, and

the receiving any user behavior monitoring instruction comprises:

in response to detecting a trigger operation for a virtual screenshot key, determining that the screen monitoring instruction is received; the virtual screenshot key is associated with the screenshot key of the keyboard through a virtual screenshot key value; and

the monitoring the user behavior indicated by the user behavior monitoring instruction comprises:

and intercepting a screen image before detecting the bounce operation of the virtual screenshot key so as to monitor the user behavior through the intercepted screen image.

3. The method of claim 2, wherein the user behavior monitoring instructions comprise operand monitoring instructions, and

the receiving of any user behavior monitoring instruction includes:

responding to the detected camera starting instruction, and determining that the operating object monitoring instruction is received; and

the monitoring the user behavior indicated by the user behavior monitoring instruction comprises the following steps:

calling a continuous shooting function to shoot a current operation object;

the photographed images are stored at relative addresses to monitor user behavior through the stored photographed images.

4. The method of claim 3, wherein after said storing the captured images at the relative addresses, the method further comprises:

in response to the detected camera stopping instruction, stopping calling the continuous shooting function;

and if the shot image is determined to be successfully stored, releasing the shooting process.

5. A method according to claim 2 or 3, wherein the user behaviour monitoring instruction comprises entering a monitoring instruction, and

the receiving any user behavior monitoring instruction comprises:

in response to detecting a triggering operation for a keyboard key, determining that the keying monitoring instruction is received; and

after the keyboard is initialized, calling a key-in information acquisition function to acquire currently key-in information;

and in response to detecting the bounce operation of the keyboard keys, unloading the input information to monitor the user behavior through the unloaded input information.

6. The method of claim 5, wherein the responsive to detecting a pop-up operation for a keyboard key, unloading the entered information comprises:

for each character typed, acquiring the character and historical characters typed before the character; and

and connecting the character and the history character into a character string for storage.

7. The method of claim 6, wherein the concatenating the character and the historical character into a string for storage comprises:

and regarding each typed character, taking the time point of detecting the bounce operation of the keyboard key as a starting point, and if the character is detected after the preset time length, performing line feed processing on the character.

8. The method according to any one of claims 3-4 and 6-7, wherein after the monitoring the user behavior indicated by the user behavior monitoring instruction, the method further comprises:

calling a mail sending function, and sending the monitoring information to a target mailbox through a third-party server;

and if the feedback information representation of the third-party server is successfully sent, judging that the monitoring information is successfully sent to the target mailbox.

9. The method of claim 8, wherein the determining that the monitoring information is successfully sent to the target mailbox if the feedback information of the third-party server indicates that the sending is successful comprises:

if the feedback information representation of the third-party server is successfully sent, splitting the feedback information;

and selecting key information which is successfully sent from the feedback information, and judging that the monitoring information is successfully sent to the target mailbox through the key information.

10. The method according to claim 9, wherein the monitoring information includes a monitoring image including the screen image and/or the photographed image, and

before the calling mail sending function sends the monitoring information to the target mailbox through the third-party server, the method also comprises the following steps;

adjusting the size of the monitoring image according to a preset size; the preset size is set based on the specification of a display frame of the monitoring image;

and responding to the detected preview instruction, and displaying the monitoring image according to the adjusted size.

11. The method of any one of claims 1-4, 6-7, 9-10, further comprising:

hiding and running the application program based on a configuration file in response to the detected hidden running instruction; the configuration file is generated based on an executable file of the application program.

12. A user behavior monitoring device running an application developed based on a laboratory virtual instrument integration environment, the application comprising:

the receiving module is used for receiving any user behavior monitoring instruction; the user behavior monitoring instructions comprise at least two types;

and the monitoring module is used for monitoring the user behavior indicated by the user behavior monitoring instruction.

13. An electronic device comprising a processor and a memory, the memory storing computer readable instructions that, when executed by the processor, perform the method of any of claims 1-11.

14. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-11.