CN105653944A - Detection method and device of cheating behaviors - Google Patents

Abstract

The present invention discloses a cheating behavior detection method and device, wherein the cheating behavior detection method includes: responding to a page display request triggered by a terminal to be detected, sending a page for submitting data to the terminal to be detected; The data writing event of the above-mentioned page, to obtain the monitoring result of data writing; According to the monitoring result, it is judged whether the terminal to be detected has cheating behavior. The technical scheme of the invention accurately detects the cheating behavior of a third party automatically writing data through a computer, effectively avoids unfair treatment for general users, and improves user experience.

Description

Cheating behavior detection method and device

technical field

The invention relates to the field of network technology, in particular to a cheating behavior detection method and device.

Background technique

The application of Internet technology is getting deeper and deeper, and more promotional activities and interactive links will introduce cash, physical and virtual rewards (such as: grabbing red envelopes in WeChat groups, Double 11 flash sales or phone call activities, etc.), while some scalpers, Hackers took advantage of various rules and loopholes in the system and cheated by automatically writing data into the computer to steal these prizes, resulting in unfair treatment for normal users.

The traditional prevention mechanism is limited to login users, limited IP or adding verification codes on the server side, but these prevention mechanisms can be dealt with by automatic identification and tampering of information by computers, and the server cannot accurately judge the information submitted by computers. Whether the data is written by the user through the computer or automatically by the computer, it is difficult to avoid unfair treatment for ordinary users, which seriously affects the user experience.

Contents of the invention

In view of the above problems, the present invention is proposed in order to provide a method and device for detecting cheating that overcomes the above problems or at least partially solves or slows down the above problems, and accurately realizes the detection of cheating that a third party automatically writes data through a computer, Improve user experience.

According to one aspect of the present invention, a method for detecting cheating behavior is provided, the method comprising:

In response to a page display request triggered by the terminal to be detected, sending a page for submitting data to the terminal to be detected;

Monitoring the data writing event of the page to obtain the monitoring result of data writing;

and judging whether the terminal to be detected has cheating behavior according to the monitoring result.

Optionally, the monitoring the data writing event of the page to obtain the monitoring result of data writing further includes:

Listening to the data writing event of the page, determining the writing speed at which the terminal to be detected writes data to the page according to the data written in the page and the writing time, and using the writing speed as the Describe the monitoring results.

Optionally, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes:

Judging whether the writing speed is greater than a preset speed, and determining that the terminal to be detected has a cheating behavior when the writing speed is greater than the preset speed.

Optionally, the monitoring the data writing event of the page to obtain the monitoring result of data writing further includes:

Listening to the data write event in the page, and obtaining the focus window when the terminal to be detected writes data to the page;

Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes:

It is judged whether the focus window is the page, and when the focus window is not the page, it is determined that the terminal to be detected has cheating behavior.

Optionally, the monitoring the data writing event of the page to obtain the monitoring result of data writing further includes:

Listening to the data write event in the page, obtaining the focus window when the terminal to be detected writes data to the page, and obtaining the keyboard state and cursor when the terminal to be detected writes data to the page state;

Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes:

When the focus window is the page, it is judged whether the keyboard state or the cursor state satisfies a preset condition, and if neither the keyboard state nor the cursor state satisfies the preset condition, it is determined that the terminal to be detected has cheating behavior.

Optionally, the keyboard state is an event record of a keyboard switch key, and the cursor state is the position of the cursor;

Correspondingly, the preset conditions include:

The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page.

Optionally, after determining whether the terminal to be detected has cheating behavior according to the monitoring result, the method further includes:

In response to the request of the terminal to be detected to submit data through the page, the data submitted by the terminal to be detected through the page is processed according to the cheating detection result.

Optionally, the processing the data submitted by the terminal to be detected through the page according to the cheating detection result further includes:

When the cheating detection result is that the terminal to be detected has a cheating behavior, the data submitted through the page is intercepted so that it cannot reach the corresponding destination.

According to another aspect of the present invention, a cheating behavior detection device is provided, the device comprising:

The sending unit is adapted to send a page for submitting data to the terminal to be detected in response to a page display request triggered by the terminal to be detected;

The monitoring unit is adapted to monitor the data writing event of the page sent by the sending unit, so as to obtain the monitoring result of data writing;

The judging unit is adapted to judge whether the terminal to be detected has cheating behavior according to the monitoring result of the monitoring unit.

Optionally, the monitoring unit is further adapted to monitor the data writing event of the page, and determine whether the terminal to be detected writes data to the page according to the data written in the page and the writing time. input speed, and use the writing speed as the monitoring result.

Optionally, the determining unit is further adapted to determine whether the writing speed is greater than a preset speed, and when the writing speed is greater than the preset speed, it is determined that the terminal to be detected has cheating behavior.

Optionally, the monitoring unit is further adapted to monitor a data writing event in the page, and acquire a focus window when the terminal to be detected writes data to the page;

Correspondingly, the judging unit is further adapted to judge whether the focus window is the page, and if the focus window is not the page, determine that the terminal to be detected has cheating behavior.

Optionally, the monitoring unit is further adapted to monitor the data writing event in the page, obtain the focus window when the terminal to be detected writes data to the page, and obtain the The keyboard state and cursor state when the page is writing data;

Correspondingly, the judging unit is further adapted to judge whether the keyboard state or the cursor state satisfies a preset condition when the focus window is the page, and if neither the keyboard state nor the cursor state satisfies the preset condition , it is determined that the terminal to be detected has cheating behavior.

Optionally, the keyboard state is an event record of a keyboard switch key, and the cursor state is the position of the cursor;

Correspondingly, the preset conditions include:

The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page.

Optionally, the device also includes:

The processing unit is adapted to respond to the request of the terminal to be detected to submit data through the page after judging whether the terminal to be detected has cheating behavior according to the monitoring result, and to respond to the request of the terminal to be detected to submit data through the page according to the cheating detection result. The terminal processes the data submitted by the page.

Optionally, the processing unit is further adapted to intercept the data submitted through the page so that it cannot reach the corresponding destination when the cheating detection result is that the terminal to be detected has cheating behavior.

The beneficial effects of the present invention are:

The method and device for detecting cheating behavior proposed by the present invention, in response to the page display request triggered by the terminal to be detected, sends a page for submitting data to the terminal to be detected, and obtains data by listening to the data writing event of the page The written monitoring result, and judging whether the terminal to be detected has cheating behavior according to the monitoring result. Accurately realize the detection of the cheating behavior of the third party automatically writing data through the computer, effectively avoiding the unfair treatment of ordinary users and improving the user experience.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same parts. In the attached picture:

Fig. 1 schematically shows a schematic flow chart of a cheating behavior detection method according to an embodiment of the present invention;

Fig. 2 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Fig. 3 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Fig. 4 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Fig. 5 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Fig. 6 schematically shows a schematic structural diagram of a cheating behavior detection device according to an embodiment of the present invention;

Fig. 7 schematically shows a schematic structural diagram of a cheating behavior detection device according to another embodiment of the present invention.

detailed description

The specific implementation manners of the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

Embodiments of the present invention are described in detail below, examples of which are shown in the drawings, wherein the same or similar reference numerals designate the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

Those skilled in the art will understand that unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the word "comprising" used in the description of the present invention refers to the presence of said features, integers, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components, and/or groups thereof.

Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this invention belongs. It should also be understood that terms, such as those defined in commonly used dictionaries, should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be used in an idealized or overly formal sense unless specifically defined to explain.

Fig. 1 schematically shows a schematic flow chart of a cheating behavior detection method according to an embodiment of the present invention;

Referring to Fig. 1, the cheating behavior detection method of the embodiment of the present invention specifically includes the following steps:

S11. In response to the page display request triggered by the terminal to be detected, send a page for submitting data to the terminal to be detected.

It should be noted that the execution subject of the method in this embodiment is the server. In this embodiment, the terminals to be detected are devices such as computers, mobile phones, tablet computers, PDAs, or notebooks. Of course, they can also be other devices with similar functions, and the present invention is not limited thereto.

It can be understood that the page display request triggered by the terminal to be detected can be understood as a page display request triggered by the terminal to be detected for submitting data, and correspondingly, the page for submitting data can be understood as a page for receiving user input Relevant user data and upload it to the server page. In a specific example, the relevant user data input by the user includes data such as user account number and user password.

In a specific implementation, the page display request can be triggered in various ways, for example, by clicking an entry element displayed on the activity promotion interface with a mouse, or clicking the entry element on a touch screen displaying the activity promotion interface.

Wherein, the entry element is implemented by a graphic element, a text element, a button element, etc. or any combination thereof, which is not specifically limited in this embodiment of the present invention.

It should be noted that the triggering method of the page display request mentioned above is only an example, and other situations may be included in addition to the above-mentioned situations, such as double-clicking an entry element displayed on the activity promotion interface or triggering by a gesture. The present invention does not need to limit the specific mode according to which the triggering of the page display request is implemented, and those skilled in the art can set it according to the actual application.

S12. Monitor the data writing event of the page to obtain a monitoring result of data writing.

In a specific implementation, the server obtains the monitoring result corresponding to the data writing process of the current page by monitoring the data writing event of the page for submitting data.

In a specific example, the data writing event includes, but is not limited to, the written data content and the corresponding writing time, the way of writing data, and the dynamic state of the current page during the data writing process or the user's Auxiliary operations, etc.

S13. Determine whether the terminal to be detected has cheating behavior according to the monitoring result.

It should be noted that the cheating in this embodiment specifically refers to the introduction of cash, physical, and virtual rewards in various promotional activities and interactive links of the Internet application mall, such as: grabbing red envelopes in WeChat groups, double 11 seckill or give away phone bills, etc., and some scalpers, hackers and other third parties take advantage of various rules and system loopholes, and use the cheating method of automatically writing data into the computer to steal these prizes.

The cheating behavior detection method provided by the embodiment of the present invention obtains the monitoring result of data writing by monitoring the data writing event of the page used for submitting data on the terminal side, and judges whether the terminal to be detected is There are cheating behaviors, so as to accurately detect the cheating behaviors of third parties who automatically write data through computers, so as to ensure that normal users can receive fair treatment and improve user experience.

Fig. 2 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Referring to Fig. 2, the cheating behavior detection method of the embodiment of the present invention specifically includes the following steps:

S21. In response to the page display request triggered by the terminal to be detected, send a page for submitting data to the terminal to be detected.

Step S21 is the same as step S11 in the embodiment shown in FIG. 1 , and will not be repeated here.

S22. Monitor the data writing event of the page, determine the writing speed of the terminal to be detected to write data to the page according to the data written in the page and the writing time, and set the writing speed As a result of the monitoring.

In a specific implementation, the data written in the page and the corresponding writing time are obtained by monitoring the data writing event of the page used to submit the data, and further according to the data amount of the content of the written data and the corresponding The writing time length calculates the writing speed of the terminal to be detected to write data to the page according to the preset model, and takes the obtained writing speed as the monitoring result.

It should be noted that the preset model can be obtained by training data and learning preset data.

S23. Determine whether the writing speed is greater than a preset speed, and if the writing speed is greater than the preset speed, determine that the terminal to be detected has a cheating behavior.

It can be understood that, the specific value of the preset speed can be set by those skilled in the art according to the test and training of the actual data input speed of general users, which is not specifically limited in this embodiment of the present invention.

In this embodiment, the data write event of the page can be monitored, and the write speed of the terminal to be detected to write data to the page can be determined according to the data written in the page and the write time, and the write The input speed is compared with the preset speed to realize the identification of the cheating behavior of the terminal to be detected, thereby preventing the cheating behavior of the third party automatically writing data through the computer, improving security, ensuring that normal users can get fair treatment, and improving user experience.

Due to the scheme of identifying the cheating behavior of the terminal to be detected by comparing the writing speed with the preset speed, third parties such as scalpers and hackers can still adjust the written data through computer settings, causing the server to It is impossible to accurately detect its cheating behavior. For this reason, the present invention also provides another embodiment of a cheating behavior detection method.

Fig. 3 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Referring to Fig. 3, the cheating detection method of the embodiment of the present invention specifically includes the following steps:

S31. In response to the page display request triggered by the terminal to be detected, send a page for submitting data to the terminal to be detected.

Step S21 is the same as step S11 in the embodiment shown in FIG. 1 , and will not be repeated here.

S32. Listen to a data write event in the page, and acquire a focus window when the terminal to be detected writes data to the page.

It can be understood that when the user writes data to the page for submitting data on the terminal to be detected, the corresponding focus window must be the page for submitting data. Therefore, by listening to the data writing event in the page for submitting data, obtaining the focus window when the terminal to be detected writes data to the page, the cheating behavior of the terminal to be detected can be identified.

S33. Determine whether the focus window is the page, and if the focus window is not the page, determine that the terminal to be detected has cheating behavior.

In a specific example, the terminal to be detected currently has a plurality of opened windows, such as a music playback window, a document editing window, a chat window, and a window corresponding to a page for submitting data, etc., and monitors the data writing in the page event, if the terminal to be detected writes data to the page, and the corresponding focus window is not the page for submitting data, but a chat window, then it is determined that the terminal to be detected has cheating behavior.

In this embodiment, the data write event of the page can be monitored to obtain the focus window corresponding to the data written in the page, and further by judging whether the focus window is the page for submitting data , realize the determination of the cheating behavior of the terminal to be detected, and accurately realize the detection of the cheating behavior of the third party automatically writing data through the computer, thereby effectively preventing the cheating behavior of the third party automatically writing data through the computer and improving security. Ensure that normal users can get fair treatment and improve user experience.

Fig. 4 schematically shows a schematic flowchart of a cheating behavior detection method according to another embodiment of the present invention;

Referring to Fig. 4, the method for detecting cheating in the embodiment of the present invention specifically includes the following steps:

S41. In response to the page display request triggered by the terminal to be detected, send a page for submitting data to the terminal to be detected.

Step S21 is the same as step S11 in the embodiment shown in FIG. 1 , and will not be repeated here.

S42. Listen to the data writing event in the page, acquire the focus window when the terminal to be detected writes data to the page, and acquire the keyboard state when the terminal to be detected writes data to the page and cursor status.

In this embodiment, the keyboard state is an event record of a keyboard switch key, and the cursor state is a cursor position.

S43. When the focus window is the page, judge whether the keyboard state or the cursor state satisfies the preset condition, and if neither the keyboard state nor the cursor state satisfies the preset condition, determine that the terminal to be detected is cheating Behavior.

In this embodiment, the preset conditions include: the event record of the keyboard switch key has a triggered event, and the position of the cursor is located at a position where data is written on the page.

In this embodiment, on the basis of judging whether the focus window corresponding to the terminal to be detected is the page for submitting data when writing data, and further monitoring the data writing event in the page to obtain the Describe the keyboard state and the cursor state when the terminal to be detected writes data to the page, through the combination of the two, the identification of the cheating behavior of the terminal to be detected can be further realized, although the terminal to be detected writes data to the page , the corresponding focus window is the page for submitting data, but the terminal does not identify the status of data writing operation, so as to more accurately detect the cheating behavior of third parties automatically writing data through computers, It effectively prevents third parties from cheating by automatically writing data through computers, improves security, ensures that normal users can receive fair treatment, and improves user experience.

Fig. 5 schematically shows a schematic flowchart of a cheating behavior detection method according to an embodiment of the present invention;

Referring to Fig. 5, the cheating behavior detection method in the embodiment of the present invention specifically includes the following steps:

S51. In response to a page display request triggered by the terminal to be detected, send a page for submitting data to the terminal to be detected.

S52. Monitor the data writing event of the page to obtain a monitoring result of data writing.

S53. Determine whether the terminal to be detected has cheating behavior according to the monitoring result.

Steps S51 to S53 are the same as steps S11 to S13 in the embodiment shown in FIG. 1 , and will not be repeated here.

S54. In response to the request of the terminal to be detected to submit data through the page, process the data submitted by the terminal to be detected through the page according to a cheating detection result.

In a specific application, the processing of the data submitted by the terminal to be detected through the page according to the cheating detection result further includes: when the cheating detection result shows that the terminal to be detected has cheating behavior, processing the data submitted by the terminal to be detected through the page The submitted data is intercepted so that it cannot reach the corresponding destination.

It is understandable that intercepting the data submitted through the page so that it cannot reach the corresponding destination is a processing strategy in submitting data to the page corresponding to the cheating behavior. Of course, submitting data to the page corresponding to the cheating behavior Other processing strategies can also be used, for example, adding the data submitted to the page corresponding to the cheating behavior to the blacklist database, etc., which is not limited in this embodiment.

In this embodiment, by responding to the request of the terminal to be detected to submit data through the page, the data submitted by the terminal to be detected through the page is processed according to the cheating detection results, so as to ensure that some scammers, hackers, etc. The cheating behavior of the three parties will not have an actual impact on the current promotional activities and interactive links, thereby ensuring that normal users can receive fair treatment and improve user experience.

Further, after processing the data submitted by the terminal to be detected through the page according to the cheating detection result, the method further includes the step of sending a prompt message of data interception to the terminal to be detected, so that the user can understand the current activity The specific reasons for the failure of the application will prevent users from losing trust in the various promotional activities and interactive links of the Internet application mall, which will affect the user experience.

For the method embodiment, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the embodiment of the present invention is not limited by the described action order, because according to the embodiment of the present invention , certain steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Fig. 6 schematically shows a schematic structural diagram of a cheating behavior detection device according to an embodiment of the present invention.

Referring to FIG. 6 , the cheating behavior detection device according to the embodiment of the present invention specifically includes a sending unit 601, a monitoring unit 602, and a judging unit 603, wherein:

The sending unit 601 is adapted to send a page for submitting data to the terminal to be detected in response to a page display request triggered by the terminal to be detected;

The monitoring unit 602 is adapted to monitor the data writing event of the page sent by the sending unit 601, so as to obtain the monitoring result of data writing;

The judging unit 603 is adapted to judge whether the terminal to be detected has cheating behavior according to the monitoring result of the monitoring unit 602 .

The cheating behavior detection device provided by the embodiment of the present invention obtains the monitoring result of data writing by monitoring the data writing event of the page used for submitting data on the terminal side, and judges whether the terminal to be detected is There are cheating behaviors, so as to accurately detect the cheating behaviors of third parties who automatically write data through computers, so as to ensure that normal users can receive fair treatment and improve user experience.

In an optional embodiment of the present invention, the monitoring unit is further adapted to monitor the data writing event of the page, and determine the address of the terminal to be detected according to the data written in the page and the writing time. The write speed of the page write data, and use the write speed as the monitoring result.

In an optional embodiment of the present invention, the judging unit is further adapted to judge whether the writing speed is greater than a preset speed, and when the writing speed is greater than the preset speed, determine that the waiting Detect cheating behavior on the terminal.

In an optional embodiment of the present invention, the monitoring unit is further adapted to monitor a data writing event in the page, and acquire a focus window when the terminal to be detected writes data to the page;

Correspondingly, the judging unit is further adapted to judge whether the focus window is the page, and if the focus window is not the page, determine that the terminal to be detected has cheating behavior.

In an optional embodiment of the present invention, the monitoring unit is further adapted to monitor a data write event in the page, and acquire a focus window when the terminal to be detected writes data to the page, And obtain the keyboard state and the cursor state when the terminal to be detected writes data to the page;

Correspondingly, the judging unit is further adapted to judge whether the keyboard state or the cursor state satisfies a preset condition when the focus window is the page, and if neither the keyboard state nor the cursor state satisfies the preset condition , it is determined that the terminal to be detected has cheating behavior.

In an optional embodiment of the present invention, the keyboard state is an event record of a keyboard switch key, and the cursor state is the position of the cursor;

Correspondingly, the preset conditions include:

The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page.

Fig. 7 schematically shows a schematic structural diagram of a cheating behavior detection device according to an embodiment of the present invention.

Referring to FIG. 7 , the cheating detection device according to the embodiment of the present invention specifically includes a sending unit 701, a listening unit 702, a judging unit 703, and a processing unit 704, wherein:

The sending unit 701 is adapted to send a page for submitting data to the terminal to be detected in response to a page display request triggered by the terminal to be detected;

The monitoring unit 702 is adapted to monitor the data writing event of the page sent by the sending unit 701, so as to obtain the monitoring result of data writing;

The judging unit 703 is adapted to judge whether the terminal to be detected has cheating behavior according to the monitoring result of the monitoring unit 702 .

The processing unit 704 is adapted to respond to the request of the terminal to be detected to submit data through the page after the judging unit 703 judges whether the terminal to be detected has cheating behavior according to the monitoring result, according to the cheating The detection result processes the data submitted by the terminal to be detected through the page.

In an optional embodiment of the present invention, the processing unit 704 is further adapted to intercept the data submitted through the page when the cheating detection result shows that the terminal to be detected has cheating behavior, so that it cannot reach the corresponding destination.

As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

To sum up, the cheating behavior detection method and device proposed by the embodiments of the present invention respond to the page display request triggered by the terminal to be detected, and send a page for submitting data to the terminal to be detected, and monitor the data of the page Writing an event to obtain a monitoring result of data writing, and judging whether there is cheating in the terminal to be detected according to the monitoring result. Effectively realize the detection of third-party cheating behaviors that automatically write data through computers, thereby ensuring that normal users can receive fair treatment and improve user experience.

It should be noted that the algorithms and formulas presented herein are not inherently related to any particular computer, virtual system, or other device. Various general systems can also be used with the examples based here. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline the present invention and to facilitate an understanding of one or more of its various aspects, various features of the invention are sometimes grouped together into a single embodiment , figure, or description of it. This disclosed method and apparatus, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the website security detection device according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

The above descriptions are only part of the embodiments of the present invention. It should be pointed out that those skilled in the art can make some improvements and modifications without departing from the principles of the present invention. It should be regarded as the protection scope of the present invention.

Other embodiments of the present invention also disclose the following content:

A1, a cheating behavior detection method, comprising:

In response to a page display request triggered by the terminal to be detected, sending a page for submitting data to the terminal to be detected;

Monitoring the data writing event of the page to obtain the monitoring result of data writing;

and judging whether the terminal to be detected has cheating behavior according to the monitoring result.

A2. The method as described in A1, the monitoring the data writing event of the page to obtain the monitoring result of data writing, further comprising:

Listening to the data writing event of the page, determining the writing speed at which the terminal to be detected writes data to the page according to the data written in the page and the writing time, and using the writing speed as the Describe the monitoring results.

A3. The method as described in A2, the judging whether there is cheating in the terminal to be detected according to the monitoring result, further comprising:

Judging whether the writing speed is greater than a preset speed, and determining that the terminal to be detected has a cheating behavior when the writing speed is greater than the preset speed.

A4. The method as described in A1, the monitoring the data writing event of the page to obtain the monitoring result of data writing further includes:

Listening to the data write event in the page, and obtaining the focus window when the terminal to be detected writes data to the page;

Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes:

It is judged whether the focus window is the page, and when the focus window is not the page, it is determined that the terminal to be detected has cheating behavior.

A5. The method as described in A1, the monitoring the data writing event of the page to obtain the monitoring result of data writing, further comprising:

Listening to the data write event in the page, obtaining the focus window when the terminal to be detected writes data to the page, and obtaining the keyboard state and cursor when the terminal to be detected writes data to the page state;

Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes:

When the focus window is the page, it is judged whether the keyboard state or the cursor state satisfies a preset condition, and if neither the keyboard state nor the cursor state satisfies the preset condition, it is determined that the terminal to be detected has cheating behavior.

A6, the method as described in A5, described keyboard state is the event record of keyboard switching key, and described cursor state is the position of cursor;

Correspondingly, the preset conditions include:

The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page.

A7. The method according to any one of A1-A6, after determining whether the terminal to be detected has cheating behavior according to the monitoring result, the method further includes:

In response to the request of the terminal to be detected to submit data through the page, the data submitted by the terminal to be detected through the page is processed according to the cheating detection result.

A8. The method as described in A7, wherein the processing of the data submitted by the terminal to be detected through the page according to the cheating detection result further includes:

When the cheating detection result is that the terminal to be detected has a cheating behavior, the data submitted through the page is intercepted so that it cannot reach the corresponding destination.

B9. A cheating behavior detection device, comprising:

The sending unit is adapted to send a page for submitting data to the terminal to be detected in response to a page display request triggered by the terminal to be detected;

The monitoring unit is adapted to monitor the data writing event of the page sent by the sending unit, so as to obtain the monitoring result of data writing;

The judging unit is adapted to judge whether the terminal to be detected has cheating behavior according to the monitoring result of the monitoring unit.

B10, the device as described in B9, the monitoring unit is further adapted to monitor the data writing event of the page, and determine the terminal to be detected to the page according to the data written in the page and the writing time Write the writing speed of the data, and use the writing speed as the monitoring result.

B11. The device as described in B10, the judging unit is further adapted to judge whether the writing speed is greater than a preset speed, and when the writing speed is greater than the preset speed, it is determined that the terminal to be detected exists cheating.

B12, the device as described in B9, the monitoring unit is further adapted to monitor the data writing event in the page, and obtain the focus window when the terminal to be detected writes data to the page;

Correspondingly, the judging unit is further adapted to judge whether the focus window is the page, and if the focus window is not the page, determine that the terminal to be detected has cheating behavior.

B13, the device as described in B9, the monitoring unit is further adapted to monitor the data writing event in the page, obtain the focus window when the terminal to be detected writes data to the page, and obtain the Describe the keyboard state and cursor state when the terminal to be detected writes data to the page;

Correspondingly, the judging unit is further adapted to judge whether the keyboard state or the cursor state satisfies a preset condition when the focus window is the page, and if neither the keyboard state nor the cursor state satisfies the preset condition , it is determined that the terminal to be detected has cheating behavior.

B14, the device as described in B13, described keyboard state is the event record of keyboard switching key, and described cursor state is the position of cursor;

Correspondingly, the preset conditions include:

The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page.

B15. The device according to any one of B9 to B14, the device further comprising:

The processing unit is adapted to respond to the request of the terminal to be detected to submit data through the page after judging whether the terminal to be detected has cheating behavior according to the monitoring result, and to respond to the request of the terminal to be detected to submit data through the page according to the cheating detection result. The terminal processes the data submitted by the page.

B16, the device as described in B15, the processing unit is further adapted to intercept the data submitted through the page when the cheating detection result shows that the terminal to be detected has cheating behavior, so that it cannot reach the corresponding destination .

Claims (10)

1. A cheating behavior detection method, comprising: In response to a page display request triggered by the terminal to be detected, sending a page for submitting data to the terminal to be detected; Monitoring the data writing event of the page to obtain the monitoring result of data writing; and judging whether the terminal to be detected has cheating behavior according to the monitoring result. 2. The method according to claim 1, said monitoring the data writing event of said page to obtain the monitoring result of data writing, further comprising: Listening to the data writing event of the page, determining the writing speed at which the terminal to be detected writes data to the page according to the data written in the page and the writing time, and using the writing speed as the Describe the monitoring results. 3. The method according to claim 2, said judging whether said terminal to be detected has cheating behavior according to said monitoring result, further comprising: Judging whether the writing speed is greater than a preset speed, and determining that the terminal to be detected has a cheating behavior when the writing speed is greater than the preset speed. 4. The method according to claim 1, said monitoring the data writing event of said page to obtain the monitoring result of data writing, further comprising: Listening to the data write event in the page, and obtaining the focus window when the terminal to be detected writes data to the page; Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes: It is judged whether the focus window is the page, and when the focus window is not the page, it is determined that the terminal to be detected has cheating behavior. 5. The method according to claim 1, said monitoring the data writing event of said page to obtain the monitoring result of data writing, further comprising: Listening to the data write event in the page, obtaining the focus window when the terminal to be detected writes data to the page, and obtaining the keyboard state and cursor when the terminal to be detected writes data to the page state; Correspondingly, the judging whether the terminal to be detected has cheating behavior according to the monitoring result further includes: When the focus window is the page, it is judged whether the keyboard state or the cursor state satisfies a preset condition, and if neither the keyboard state nor the cursor state satisfies the preset condition, it is determined that the terminal to be detected has cheating behavior. 6. The method according to claim 5, the keyboard state is an event record of a keyboard switch key, and the cursor state is the position of the cursor; Correspondingly, the preset conditions include: The event record of the keyboard switch key has a triggered event, and the position of the cursor is located at the position where data is written on the page. 7. The method according to any one of claims 1 to 6, after determining whether the terminal to be detected has cheating behavior according to the monitoring result, the method further comprises: In response to the request of the terminal to be detected to submit data through the page, the data submitted by the terminal to be detected through the page is processed according to the cheating detection result. 8. The method according to claim 7, said processing the data submitted by the terminal to be detected through the page according to the cheating detection result, further comprising: When the cheating detection result is that the terminal to be detected has a cheating behavior, the data submitted through the page is intercepted so that it cannot reach the corresponding destination. 9. A cheating detection device, comprising: The sending unit is adapted to send a page for submitting data to the terminal to be detected in response to a page display request triggered by the terminal to be detected; The monitoring unit is adapted to monitor the data writing event of the page sent by the sending unit, so as to obtain the monitoring result of data writing; The judging unit is adapted to judge whether the terminal to be detected has cheating behavior according to the monitoring result of the monitoring unit. 10. The device according to claim 9, the monitoring unit is further adapted to monitor the data write event of the page, and determine the information sent by the terminal to be detected according to the data written in the page and the writing time. The writing speed of data written in the page is determined, and the writing speed is used as the monitoring result.