CN117997938A - User behavior monitoring method, system, electronic device and readable storage medium - Google Patents
User behavior monitoring method, system, electronic device and readable storage medium Download PDFInfo
- Publication number
- CN117997938A CN117997938A CN202211363386.3A CN202211363386A CN117997938A CN 117997938 A CN117997938 A CN 117997938A CN 202211363386 A CN202211363386 A CN 202211363386A CN 117997938 A CN117997938 A CN 117997938A
- Authority
- CN
- China
- Prior art keywords
- monitoring
- information
- picture
- user
- virtual space
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 320
- 238000000034 method Methods 0.000 title claims abstract description 50
- 238000012550 audit Methods 0.000 claims abstract description 133
- 230000006399 behavior Effects 0.000 claims description 67
- 230000002159 abnormal effect Effects 0.000 claims description 12
- 230000000694 effects Effects 0.000 claims description 8
- 238000012098 association analyses Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 5
- 239000000758 substrate Substances 0.000 claims 3
- 238000010586 diagram Methods 0.000 description 6
- 230000005856 abnormality Effects 0.000 description 4
- 238000010219 correlation analysis Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 241000168254 Siro Species 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V20/00—Scenes; Scene-specific elements
- G06V20/50—Context or environment of the image
- G06V20/52—Surveillance or monitoring of activities, e.g. for recognising suspicious objects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
- G06V40/20—Movements or behaviour, e.g. gesture recognition
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/80—Database-specific techniques
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- Multimedia (AREA)
- Computing Systems (AREA)
- Social Psychology (AREA)
- Human Computer Interaction (AREA)
- Psychiatry (AREA)
- General Health & Medical Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Mathematical Physics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a user behavior monitoring method, a system, electronic equipment and a readable storage medium, wherein the user behavior monitoring method comprises the following steps: collecting related information of a monitoring picture of the virtual space, and storing the related information into a picture monitoring information database; recording an audit log of a user in the virtual space, and storing the audit log into an audit information database; and after the alarm information is monitored, the relevant information of the monitoring picture related to the alarm information is called from the picture monitoring information database, and/or the audit log related to the alarm information is called from the audit information database, and the user behavior is analyzed according to the relevant information and/or the audit log of the monitoring picture related to the alarm information. The invention analyzes the association of the monitoring picture and the audit log in the virtual space, and realizes the effective monitoring of the user behavior in the virtual space.
Description
Technical Field
The embodiment of the invention relates to the technical field of virtual reality, in particular to a user behavior monitoring method, a system, electronic equipment and a readable storage medium.
Background
The meta space, the microblog space (or referred to as Virtual space), and the VR (Virtual Reality) space are novel data services for improving user experience.
Currently, as a provider of these new data services, user behavior is monitored through conventional log auditing, generally according to requirements of the data service field. Based on the audit of the log text, record when the user logs in, what operation is performed, and the like.
However, in a virtual space such as a meta space, the user activities are more various and free. The traditional log-based user behavior monitoring method cannot meet the requirement of security monitoring.
Disclosure of Invention
The embodiment of the invention provides a user behavior monitoring method, a system, electronic equipment and a readable storage medium, which are used for solving the problem that the existing log-based user behavior monitoring method cannot meet the requirement of safety monitoring aiming at a virtual space.
In order to solve the technical problems, the invention is realized as follows:
In a first aspect, an embodiment of the present invention provides a method for monitoring user behavior, including:
Collecting related information of a monitoring picture of the virtual space, and storing the related information into a picture monitoring information database;
recording an audit log of a user in the virtual space, and storing the audit log into an audit information database;
And after the alarm information is monitored, the relevant information of the monitoring picture related to the alarm information is called from the picture monitoring information database, and/or the audit log related to the alarm information is called from the audit information database, and the user behavior is analyzed according to the relevant information and/or the audit log of the monitoring picture related to the alarm information.
Optionally, the monitoring screen includes: and the monitoring picture is collected by the server side and/or the monitoring picture is collected by the user side.
Optionally, the monitoring frames include monitoring frames collected by a server, and the relevant information of the collecting monitoring frames of the virtual space includes:
After a user enters the virtual space, triggering a server to collect a monitoring picture of the virtual space;
And when no user exists in the virtual space, triggering the server to stop the collection of the monitoring picture of the virtual space.
Optionally, when the monitoring picture is a monitoring picture collected by the server, the relevant information of the monitoring picture includes at least one of the following:
virtual space point location ID;
Virtual monitor ID;
Monitoring picture content data;
the acquisition time of the picture is monitored.
Optionally, when the monitoring picture is a monitoring picture collected by the user side, the relevant information of the monitoring picture includes at least one of the following:
virtual space point location ID;
A user name;
Monitoring picture content data;
the acquisition time of the picture is monitored.
Optionally, before the alarm information is monitored, the method further includes: analyzing the monitoring picture; if the monitoring picture is analyzed to be a bad picture, generating the alarm information, wherein the alarm information comprises at least one of the following: virtual space point location ID corresponding to the bad picture, monitoring picture acquisition time and user name of the acquired monitoring picture;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
Correlating virtual space point position IDs, monitoring picture acquisition time and/or user names of acquisition monitoring pictures corresponding to bad pictures in the alarm information with audit logs in the audit information database to obtain user operations of other users moving in the virtual space in the same time period, and analyzing the user operations of the other users;
And/or
And correlating the virtual space point position ID, the monitoring picture acquisition time and/or the user name of the acquired monitoring picture corresponding to the bad picture in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space acquired by other users and/or the server side in the same time period, and analyzing the related information of the monitoring picture of the virtual space acquired by the other users and/or the server side.
Optionally, the audit log includes at least one of:
User information;
user operation;
time of user operation;
An object operated by a user;
The type of user operation;
A result of the user operation;
Virtual spatial point location ID.
Optionally, before the alarm information is monitored, the method further includes:
The method further comprises the following steps of: analyzing the audit log; if the audit log is analyzed to be abnormal, generating the alarm information; the alarm information comprises at least one of the following: virtual space point location ID and user operation time;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
And correlating the virtual space point position ID and/or the user operation time corresponding to the abnormal audit log in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space collected by the related user and/or the server in the same time period, and analyzing the related information of the monitoring picture of the virtual space collected by the related user and/or the server.
Optionally, the monitoring the alarm information includes: receiving alarm information sent by a user terminal, wherein the alarm information comprises at least one of the following components: user name, virtual space point location ID, alarm information sending time;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with the relevant information of the monitoring picture in the picture monitoring information database to obtain the relevant information of the monitoring picture of the virtual space collected by other users and/or servers in the same time period, and analyzing the relevant information of the monitoring picture of the virtual space collected by the other users and/or servers;
And/or
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with an audit log in the audit information database to obtain user operations of other users in the virtual space activity within the same time period, and analyzing the user operations of the other users;
The method further comprises the steps of:
And returning a user behavior analysis result to the user terminal.
In a second aspect, an embodiment of the present invention provides a user behavior monitoring system, including:
The first monitoring module is used for collecting related information of a monitoring picture of the virtual space and storing the related information into a picture monitoring information database;
the second monitoring module is used for recording an audit log of the user in the virtual space and storing the audit log into an audit information database;
And the association analysis module is used for retrieving relevant information of a monitoring picture associated with the alarm information from the picture monitoring information database after the alarm information is monitored, and/or retrieving an audit log associated with the alarm information from the audit information database, and analyzing user behaviors according to the relevant information and/or the audit log of the monitoring picture associated with the alarm information.
In a third aspect, an embodiment of the present invention provides an electronic device, including: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the user behavior monitoring method as described in the first aspect above.
In a fourth aspect, embodiments of the present invention provide a computer readable storage medium having a computer program stored thereon, which when executed by a processor implements the steps of the user behavior monitoring method according to the first aspect described above.
In the embodiment of the invention, on one hand, the related information of the monitoring picture of the virtual space is collected, on the other hand, the audit log of the user in the virtual space is recorded, when the alarm information appears, the monitoring picture and the audit log in the virtual space are subjected to correlation analysis, the monitoring picture can more intuitively discover the bad behavior in the virtual space, and the audit log can provide more detailed user information, so that the effective monitoring of the user behavior in the virtual space is realized.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to designate like parts throughout the figures. In the drawings:
FIG. 1 is a flow chart of a user behavior monitoring method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a user behavior monitoring system according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a working process of an internal monitoring module for performing user behavior monitoring according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of a working process of an external monitoring module for performing user behavior monitoring according to an embodiment of the present invention;
FIG. 5 is a schematic diagram of a working process of user behavior monitoring for user reporting or complaints according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of a user behavior monitoring system according to an embodiment of the present invention;
Fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1 and 2, an embodiment of the present invention provides a method for monitoring user behavior, including:
Step 11: collecting related information of a monitoring picture of the virtual space, and storing the related information into a picture monitoring information database;
The virtual space may be a meta space, a siro space, or a VR space, etc. The virtual space may be a specific virtual space in a certain service or game or the like, or all virtual spaces in a certain service or game or the like.
Step 12: recording an audit log of a user in the virtual space, and storing the audit log into an audit information database;
Step 13: and after the alarm information is monitored, the relevant information of the monitoring picture related to the alarm information is called from the picture monitoring information database, and/or the audit log related to the alarm information is called from the audit information database, and the user behavior is analyzed according to the relevant information and/or the audit log of the monitoring picture related to the alarm information.
In the embodiment of the invention, on one hand, the related information of the monitoring picture of the virtual space is collected, on the other hand, the audit log of the user in the virtual space is recorded, and when the alarm information is monitored, the monitoring picture and the audit log in the virtual space related to the alarm information are subjected to correlation analysis, the monitoring picture can more intuitively discover the bad behavior in the virtual space, and the audit log can provide more detailed user information, so that the effective monitoring of the user behavior in the virtual space is realized.
The internal monitoring in fig. 2 collects the relevant information of the monitoring picture of the virtual space, and stores the collected relevant information of the monitoring picture of the virtual space into a picture monitoring information database. And (3) collecting the external monitoring, namely recording an audit log of the user in the virtual space, and storing the audit log into an audit information database.
The existing scheme (whether conventional game monitoring or VR game monitoring) can only provide a single-view monitoring picture record and cannot meet the monitoring requirement of the virtual space. There may be a large difference in the viewing angles of different users in the virtual space, and the bad behavior of one user may require multiple other viewing angles to be presented and restored. In an embodiment of the present invention, in order to solve the above problem, optionally, the monitoring screen includes: and the monitoring picture is collected by the server side and/or the monitoring picture is collected by the user side.
In the embodiment of the application, the virtual monitor for collecting the monitoring picture at the server side can be set as the virtual monitor with the appointed public view angle.
In the embodiment of the present application, optionally, the monitoring picture collection at the user side may involve the privacy of the user, so that the consent of the user needs to be obtained first.
In the embodiment of the invention, the server side and/or the user side can acquire the monitoring picture of the virtual space in real time. Of course, in order to save the overhead, the server may trigger the acquisition of the monitoring frame of the virtual space after the user enters the specific virtual space. Meanwhile, when no user exists in the virtual space, the collection of the monitoring picture of the virtual space can be stopped.
That is, the monitoring frames include monitoring frames collected by the server, and the relevant information of the monitoring frames of the collected virtual space includes: after a user enters the virtual space, triggering a server to collect a monitoring picture of the virtual space; and when no user exists in the virtual space, triggering the server to stop the collection of the monitoring picture of the virtual space.
In an embodiment of the present invention, optionally, when the monitoring picture is a monitoring picture collected by the server, the relevant information of the monitoring picture includes at least one of the following:
1) Virtual space point location ID;
The virtual space point location ID is a unique identifier for confirming the position of the virtual space, and may be a scene server number, a virtual machine number, a scene ID, a service ID, a game scene area code, or the like.
2) Virtual monitor ID;
3) Monitoring picture content data;
The monitoring picture content data can be screen recording content or pictures intercepted at intervals.
4) The acquisition time of the picture is monitored.
In an embodiment of the present invention, optionally, when the monitoring picture is a monitoring picture collected by the user side, the relevant information of the monitoring picture includes at least one of the following:
1) Virtual space point location ID;
2) A user name;
3) Monitoring picture content data;
4) The acquisition time of the picture is monitored.
In an embodiment of the present invention, optionally, the audit log includes at least one of:
1) User information;
2) User operation;
3) Time of user operation;
4) An object operated by a user;
5) The type of user operation;
6) A result of the user operation;
7) Virtual spatial point location ID.
In the embodiment of the invention, unlike the traditional audit log, the virtual space point position ID is added, so that the virtual space point position ID is conveniently associated with a monitoring picture (the related information of the monitoring picture can also comprise the virtual space point position ID).
In an embodiment of the present invention, optionally, referring to fig. 3, before the monitoring of the alarm information, the method further includes: analyzing the monitoring picture; and if the monitoring picture is analyzed to be a bad picture (such as a yellow picture, a storm picture and the like), generating the alarm information. In the embodiment of the invention, the monitoring picture can be automatically analyzed through technologies such as computer vision, motion capture and the like. The monitoring picture can also be manually checked in a manual checking mode. The alert information (i.e., internally monitored alert information) may include at least one of: virtual space point location ID corresponding to the bad picture, monitoring picture acquisition time and user name of the acquired monitoring picture.
And after receiving the alarm information (namely the internally monitored alarm information), retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving an audit log related to the alarm information from the audit information database, and analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information.
Optionally, the bad picture alarm found by the inner monitoring can be associated with the audit log collected by the outer monitoring through virtual space point position ID, monitoring picture collection time and/or user name of the collected monitoring picture. And acquiring all user behavior information of the activities in the virtual space within the same time period to obtain complete event description.
That is, the retrieving, from the screen monitoring information database, the related information of the monitoring screen associated with the alarm information, and/or retrieving, from the audit information database, an audit log associated with the alarm information, and analyzing, according to the related information and/or the audit log of the monitoring screen associated with the alarm information, user behavior includes:
Correlating virtual space point position IDs, monitoring picture acquisition time and/or user names of acquisition monitoring pictures corresponding to bad pictures in the alarm information with audit logs in the audit information database to obtain user operations of other users moving in the virtual space in the same time period, and analyzing the user operations of the other users;
And/or
And correlating the virtual space point position ID, the monitoring picture acquisition time and/or the user name of the acquired monitoring picture corresponding to the bad picture in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space acquired by other users and/or the server side in the same time period, and analyzing the related information of the monitoring picture of the virtual space acquired by the other users and/or the server side.
For example, when a user (or users) is found to have bad behaviors in a virtual space in the monitoring screen, the user is just a problem finder, and is not a user with bad behaviors or bad information propagation. At this point, all audit logs for this virtual space may be called. In the period, the operation behaviors of other users with active virtual space can be obtained, and scenes of bad information are complemented. Meanwhile, the monitoring pictures under the visual angles of the virtual monitors of other users or service sides in the same virtual space and time are also called, so that complete event description is further obtained, and the accuracy of confirming bad users or bad events can be improved.
The monitoring picture can more intuitively find out bad behaviors in the virtual space, but under the condition that the bad behaviors of the user are confirmed and evidence is required to be obtained, the user virtual image (the user name may not be real or displayed) which is singly displayed in the monitoring picture of the virtual space cannot confirm the identity of the user which triggers abnormal behaviors or shows the bad behaviors, and then audit logs are required to assist in user behavior analysis, so that the effective monitoring of the user behaviors in the virtual space is realized, and meanwhile, the identity of dangerous users can be confirmed.
In the above embodiment, the user behavior analysis may be performed on the abnormality found by the internal monitoring in association with the audit log of the external monitoring, and the user behavior analysis may be performed on the abnormality sent by the external monitoring in association with the monitoring screen of the internal monitoring.
In an embodiment of the present invention, optionally, referring to fig. 4, before the monitoring of the alarm information, the method further includes: analyzing the audit log; and if the audit log is analyzed to be abnormal, generating the alarm information. The alarm information (i.e., externally monitored alarm information) may include at least one of: virtual space point location ID and time of user operation, etc.
After receiving alarm information (alarm information of external monitoring), relevant information of a monitoring picture related to the alarm information is called from the picture monitoring information database, and/or audit logs related to the alarm information are called from the audit information database, and user behaviors are analyzed according to the relevant information and/or audit logs of the monitoring picture related to the alarm information.
In the embodiment of the invention, the alarm information found by the external monitoring is associated with the monitoring picture acquired by the internal monitoring through the virtual space point position ID and/or the time of user operation and the like, so that the alarm details are confirmed.
That is, the retrieving, from the screen monitoring information database, the related information of the monitoring screen associated with the alarm information, and/or retrieving, from the audit information database, an audit log associated with the alarm information, and analyzing, according to the related information and/or the audit log of the monitoring screen associated with the alarm information, user behavior includes:
And correlating the virtual space point position ID and/or the user operation time corresponding to the abnormal audit log in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space collected by the related user and/or the server in the same time period, and analyzing the related information of the monitoring picture of the virtual space collected by the related user and/or the server.
For example, by audit log monitoring, an operation object or operation result is found to return an error code. By calling out the relevant information of the monitoring picture of the relevant user (or the virtual monitor), whether the bug appears in the scene or not can be confirmed from the view angle of the user (such as game card bug caused by abnormal walking of the user), thereby improving the accuracy of problem discovery and the user experience.
In the above embodiments, the server side finds out the abnormality through the analysis of the monitoring picture or the analysis of the audit log and gives an alarm, and in other embodiments of the present invention, the user side may report or complain about the abnormal event.
The monitoring of the alarm information comprises the following steps: receiving alarm information sent by a user terminal, wherein the alarm information comprises at least one of the following components: user name, virtual space point location ID, alarm information sending time;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with the relevant information of the monitoring picture in the picture monitoring information database to obtain the relevant information of the monitoring picture of the virtual space collected by other users and/or servers in the same time period, and analyzing the relevant information of the monitoring picture of the virtual space collected by the other users and/or servers;
And/or
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with an audit log in the audit information database to obtain user operations of other users in the virtual space activity within the same time period, and analyzing the user operations of the other users;
The method further comprises the steps of:
And returning a user behavior analysis result to the user terminal.
Referring to fig. 5, by analyzing the alarm information sent by the user side, a user name, a virtual space point location ID, a sending time of the alarm information, and the like are obtained, relevant information of a monitoring picture associated with the alarm information is called from the picture monitoring information database, and/or an audit log associated with the alarm information is called from the audit information database, and user behavior is analyzed according to the relevant information and/or the audit log of the monitoring picture associated with the alarm information.
In the above embodiment, the analysis of the related information of the monitoring screen associated with the alarm information may be performed by the screen analysis unit in the above internal monitoring, and the analysis of the audit log associated with the alarm information may be performed by the log audit monitoring unit in the above external monitoring. After analysis, determining whether the report of the user terminal is true, and returning a user behavior analysis result to the user terminal.
In the above embodiment, after the user behavior analysis result is obtained, the relevant information and/or audit log of the invoked monitoring picture associated with the alarm information may be saved.
The user behavior monitoring method of the invention has the following advantages:
1) Through the association of the double monitoring systems, accurate monitoring of user behaviors in the virtual space is realized.
2) And through multi-view monitoring, event recovery in the virtual space is realized.
3) By the scheme combining picture monitoring and log audit, users can be traced back when abnormality is found.
Referring to fig. 6, the present invention further provides a user behavior monitoring system 60, including:
The first monitoring module 61 is configured to collect relevant information of a monitoring picture in the virtual space, and store the relevant information in a picture monitoring information database;
The second monitoring module 62 is configured to record an audit log of the user in the virtual space, and store the audit log in an audit information database;
And the association analysis module 63 is configured to retrieve relevant information of a monitoring picture associated with the alarm information from the picture monitoring information database after the alarm information is monitored, and/or retrieve an audit log associated with the alarm information from the audit information database, and analyze user behavior according to the relevant information and/or the audit log of the monitoring picture associated with the alarm information.
Optionally, the monitoring screen includes: and the monitoring picture is collected by the server side and/or the monitoring picture is collected by the user side.
Optionally, the monitoring frames include monitoring frames collected by a server, and the first monitoring module 61 is configured to trigger the server to collect monitoring frames of the virtual space after a user enters the virtual space; and when no user exists in the virtual space, triggering the server to stop the collection of the monitoring picture of the virtual space.
Optionally, when the monitoring picture is a monitoring picture collected by the server, the relevant information of the monitoring picture includes at least one of the following:
virtual space point location ID;
Virtual monitor ID;
Monitoring picture content data;
the acquisition time of the picture is monitored.
Optionally, when the monitoring picture is a monitoring picture collected by the user side, the relevant information of the monitoring picture includes at least one of the following:
virtual space point location ID;
A user name;
Monitoring picture content data;
the acquisition time of the picture is monitored.
Optionally, the first monitoring module 61 includes:
The picture analysis unit is used for analyzing the monitoring picture;
And the abnormal alarm unit is used for generating the alarm information if the monitoring picture is analyzed to be a bad picture, wherein the alarm information comprises at least one of the following items: virtual space point location ID corresponding to the bad picture, monitoring picture acquisition time and user name of the acquired monitoring picture;
The association analysis module 63 is configured to associate a virtual space point location ID, a monitoring picture acquisition time and/or a user name of an acquisition monitoring picture corresponding to a bad picture in the alarm information with an audit log in the audit information database, obtain user operations of other users moving in the virtual space within the same time period, and analyze the user operations of the other users; and/or associating the virtual space point position ID, the monitoring picture acquisition time and/or the user name of the acquired monitoring picture corresponding to the bad picture in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space acquired by other users and/or the server side in the same time period, and analyzing the related information of the monitoring picture of the virtual space acquired by the other users and/or the server side.
Optionally, the audit log includes at least one of:
User information;
user operation;
time of user operation;
An object operated by a user;
The type of user operation;
A result of the user operation;
Virtual spatial point location ID.
Optionally, the second monitoring module 62 includes:
the log audit monitoring unit is used for analyzing the audit log;
The abnormal alarm unit is used for generating the alarm information if the audit log is analyzed to be abnormal; the alarm information comprises at least one of the following: virtual space point location ID and user operation time;
The association analysis module 63 is configured to associate the virtual space point location ID and/or the time of the user operation corresponding to the abnormal audit log in the alarm information with the related information of the monitoring picture in the picture monitoring information database, obtain the related information of the monitoring picture of the virtual space collected by the related user and/or the server in the same time period, and analyze the related information of the monitoring picture of the virtual space collected by the related user and/or the server.
Optionally, the association analysis module 63 is configured to receive alarm information sent by the user, where the alarm information includes at least one of the following: user name, virtual space point location ID, alarm information sending time; correlating the user name, virtual space point location ID and/or sending time of the alarm information with the relevant information of the monitoring picture in the picture monitoring information database to obtain the relevant information of the monitoring picture of the virtual space collected by other users and/or servers in the same time period, and analyzing the relevant information of the monitoring picture of the virtual space collected by the other users and/or servers; and/or associating the user name, the virtual space point location ID and/or the sending time of the alarm information with the audit log in the audit information database to obtain user operations of other users in the virtual space activity within the same time period, and analyzing the user operations of the other users;
The user behavior monitoring system 60 further comprises:
and the sending module is used for returning the user behavior analysis result to the user terminal.
Referring to fig. 7, an embodiment of the present invention further provides an electronic device 70, including a processor 71, a memory 72, and a computer program stored in the memory 72 and capable of running on the processor 71, where the computer program when executed by the processor 71 implements the processes of the above-mentioned embodiment of the user behavior monitoring method, and the same technical effects can be achieved, and for avoiding repetition, a detailed description is omitted herein.
The embodiment of the invention also provides a computer readable storage medium, on which a computer program is stored, which when executed by a processor, implements the processes of the above embodiment of the user behavior monitoring method, and can achieve the same technical effects, so that repetition is avoided, and no further description is given here. Wherein the computer readable storage medium is selected from Read-Only Memory (ROM), random access Memory (Random Access Memory, RAM), magnetic disk or optical disk.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present invention.
The embodiments of the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many forms may be made by those having ordinary skill in the art without departing from the spirit of the present invention and the scope of the claims, which are to be protected by the present invention.
Claims (12)
1. A method for monitoring user behavior, comprising:
Collecting related information of a monitoring picture of the virtual space, and storing the related information into a picture monitoring information database;
recording an audit log of a user in the virtual space, and storing the audit log into an audit information database;
And after the alarm information is monitored, the relevant information of the monitoring picture related to the alarm information is called from the picture monitoring information database, and/or the audit log related to the alarm information is called from the audit information database, and the user behavior is analyzed according to the relevant information and/or the audit log of the monitoring picture related to the alarm information.
2. The method of claim 1, wherein the monitoring screen comprises: and the monitoring picture is collected by the server side and/or the monitoring picture is collected by the user side.
3. The method of claim 2, wherein the monitoring frames comprise monitoring frames collected by a server, and the collecting information about the monitoring frames of the virtual space comprises:
After a user enters the virtual space, triggering a server to collect a monitoring picture of the virtual space;
And when no user exists in the virtual space, triggering the server to stop the collection of the monitoring picture of the virtual space.
4. The method of claim 2, wherein when the monitoring frame is a monitoring frame collected by a server, the relevant information of the monitoring frame includes at least one of the following:
virtual space point location ID;
Virtual monitor ID;
Monitoring picture content data;
the acquisition time of the picture is monitored.
5. The method of claim 2, wherein when the monitoring frame is a monitoring frame collected by a user, the relevant information of the monitoring frame includes at least one of the following:
virtual space point location ID;
A user name;
Monitoring picture content data;
the acquisition time of the picture is monitored.
6. The method of claim 1, wherein the step of determining the position of the substrate comprises,
The method further comprises the following steps of: analyzing the monitoring picture; if the monitoring picture is analyzed to be a bad picture, generating the alarm information, wherein the alarm information comprises at least one of the following: virtual space point location ID corresponding to the bad picture, monitoring picture acquisition time and user name of the acquired monitoring picture;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
Correlating virtual space point position IDs, monitoring picture acquisition time and/or user names of acquisition monitoring pictures corresponding to bad pictures in the alarm information with audit logs in the audit information database to obtain user operations of other users moving in the virtual space in the same time period, and analyzing the user operations of the other users;
And/or
And correlating the virtual space point position ID, the monitoring picture acquisition time and/or the user name of the acquired monitoring picture corresponding to the bad picture in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space acquired by other users and/or the server side in the same time period, and analyzing the related information of the monitoring picture of the virtual space acquired by the other users and/or the server side.
7. The method of claim 1, wherein the audit log includes at least one of:
User information;
user operation;
time of user operation;
An object operated by a user;
The type of user operation;
A result of the user operation;
Virtual spatial point location ID.
8. The method of claim 1, wherein the step of determining the position of the substrate comprises,
The method further comprises the following steps of: analyzing the audit log; if the audit log is analyzed to be abnormal, generating the alarm information; the alarm information comprises at least one of the following: virtual space point location ID and user operation time;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
And correlating the virtual space point position ID and/or the user operation time corresponding to the abnormal audit log in the alarm information with the related information of the monitoring picture in the picture monitoring information database to obtain the related information of the monitoring picture of the virtual space collected by the related user and/or the server in the same time period, and analyzing the related information of the monitoring picture of the virtual space collected by the related user and/or the server.
9. The method of claim 1, wherein the step of determining the position of the substrate comprises,
The monitoring of the alarm information comprises the following steps: receiving alarm information sent by a user terminal, wherein the alarm information comprises at least one of the following components: user name, virtual space point location ID, alarm information sending time;
And the steps of retrieving the relevant information of the monitoring picture related to the alarm information from the picture monitoring information database, and/or retrieving the audit log related to the alarm information from the audit information database, analyzing the user behavior according to the relevant information and/or the audit log of the monitoring picture related to the alarm information include:
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with the relevant information of the monitoring picture in the picture monitoring information database to obtain the relevant information of the monitoring picture of the virtual space collected by other users and/or servers in the same time period, and analyzing the relevant information of the monitoring picture of the virtual space collected by the other users and/or servers;
And/or
Correlating the user name, virtual space point location ID and/or sending time of the alarm information with an audit log in the audit information database to obtain user operations of other users in the virtual space activity within the same time period, and analyzing the user operations of the other users;
The method further comprises the steps of:
And returning a user behavior analysis result to the user terminal.
10. A user behavior monitoring system, comprising:
The first monitoring module is used for collecting related information of a monitoring picture of the virtual space and storing the related information into a picture monitoring information database;
the second monitoring module is used for recording an audit log of the user in the virtual space and storing the audit log into an audit information database;
And the association analysis module is used for retrieving relevant information of a monitoring picture associated with the alarm information from the picture monitoring information database after the alarm information is monitored, and/or retrieving an audit log associated with the alarm information from the audit information database, and analyzing user behaviors according to the relevant information and/or the audit log of the monitoring picture associated with the alarm information.
11. An electronic device, comprising: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the user behavior monitoring method of any one of claims 1 to 9.
12. A computer readable storage medium, characterized in that the computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the user behavior monitoring method of any of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211363386.3A CN117997938A (en) | 2022-11-02 | 2022-11-02 | User behavior monitoring method, system, electronic device and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211363386.3A CN117997938A (en) | 2022-11-02 | 2022-11-02 | User behavior monitoring method, system, electronic device and readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117997938A true CN117997938A (en) | 2024-05-07 |
Family
ID=90900224
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211363386.3A Pending CN117997938A (en) | 2022-11-02 | 2022-11-02 | User behavior monitoring method, system, electronic device and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117997938A (en) |
-
2022
- 2022-11-02 CN CN202211363386.3A patent/CN117997938A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112631913B (en) | Method, device, equipment and storage medium for monitoring operation faults of application program | |
| EP2717564B1 (en) | Method, device and system for realizing video retrieval | |
| CN110225299B (en) | Video monitoring method and device, computer equipment and storage medium | |
| CN103026345B (en) | For the dynamic multidimensional pattern of event monitoring priority | |
| CN108322350B (en) | Service monitoring method and device and electronic equipment | |
| CN114077525A (en) | Abnormal log processing method and device, terminal equipment, cloud server and system | |
| CN105144117B (en) | To the automatic correlation analysis method of allocating stack and context data | |
| CN111405222B (en) | Video alarm method, video alarm system and alarm picture acquisition method | |
| CN111078513A (en) | Log processing method, device, equipment, storage medium and log alarm system | |
| CN111478889A (en) | Alarm method and device | |
| CN110619308A (en) | Aisle sundry detection method, device, system and equipment | |
| CN111158926B (en) | Service request analysis method, device and equipment | |
| CN110825466B (en) | Program jamming processing method and jamming processing device | |
| CN111526109B (en) | Method and device for automatically detecting running state of web threat recognition defense system | |
| CN108650123B (en) | Fault information recording method, device, equipment and storage medium | |
| CN117997938A (en) | User behavior monitoring method, system, electronic device and readable storage medium | |
| CN111831515A (en) | Application system running state monitoring system and monitoring method thereof | |
| CN110602483A (en) | Video fault determination method, device and computer readable storage medium | |
| KR101973728B1 (en) | Integration security anomaly symptom monitoring system | |
| CN110620698A (en) | Software abnormity diagnosis method, device, equipment and system | |
| CN115801559A (en) | Exception response method, device and system | |
| JP2005227982A (en) | Network system equipped with security monitoring function, log data analysis terminal and information terminal | |
| CN115878358A (en) | Abnormal log analysis method and device, electronic equipment and storage medium | |
| CN113473092A (en) | Production workshop management system, method, equipment and computer program product | |
| CN114490261A (en) | Terminal security event linkage processing method, device and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |