## 4 Privileged User Behavior Audit Subsystem
### Deep-Learning-Based Text Information Extraction
#### 4.2.1 Text Detection Process  
The text detection process in this module aims to detect the text regions from the images representing user behaviors. The images generated during user access to cloud computing resources usually contain horizontal text. The deep-learning-based text detection model Connectionist Text Proposal Network (CTPN) [21; 22] happens to be suitable for this situation. Aiming at the problem of a complex background in the user behavior audit scene, the CTPN model is specifically modified in this paper. The process is shown in Figure 3a: 1. The image input to the Text Information Extraction module will be divided into multiple sub-level proposals. The main idea of the CTPN model is to determine whether each proposal contains text, and which connect proposals are most likely to contain texts. 2. At the same time, the image will be input into the first Convolutional Neural Network (CNN) to extract the feature map. 3. Considering the sequence and locality of the text, the Recurrent Neural Network (RNN) is used for connectionist prediction on the feature map. To fully analyze the relationship between the adjacent proposals, the Bi-directional Long Short-Term Memory network (BiLSTM) is used to replace traditional RNN. 4. According to the prediction for each proposal given by BiLSTM, the text detection model will find out the proposals containing texts and connect the adjacent proposals into text regions according to the algorithm proposed in [21]. Targeted modification of CTPN: During the text detection process in the user behavior audit scene, it is difficult for the CTPN model to distinguish between the text-like graphics (such as small icons in the Windows system) and text areas. In this article, we tried to solve this problem by modifying the predicted value of the RNN model. The original CTPN model predicts five variables for each proposal. Among these variables, the text and non-text scores are used to determine whether a proposal contains text and the other three variables are used to adjust this proposal to make it more likely to contain text. This adjustment will only change the size and vertical position of the proposals, not the horizontal position. This design may cause the text-like graphics to be mistakenly framed into text regions when the width of the proposals increases. The modified model predicts four different variables for the adjustment of proposals, so that as the width of a proposal increases, its horizontal position will also change. The mathematical expression of modified CTPN is shown as follows:  
\[t_{x}=\frac{G_{x}-A_{x}}{A_{w}},\ \ t_{x}^{*}=\frac{G_{x}^{*}-A_{x}}{A_{w}} \tag{1}\]  
\[t_{y}=\frac{G_{y}-A_{y}}{A_{h}},\ \ t_{y}^{*}=\frac{G_{y}^{*}-A_{y}}{A_{h}} \tag{2}\]  
\[t_{w}=log(G_{w}/A_{w}),\ \ t_{w}^{*}=log(G_{w}^{*}/A_{w}) \tag{3}\]  
\[t_{h}=log(G_{h}/A_{h}),\ \ t_{h}^{*}=log(G_{h}^{*}/A_{h}) \tag{4}\]  
where T = (\(t_{x}\),\(t_{y}\),\(t_{w}\),\(t_{h}\)) and T* = (\(t_{x}^{*}\),\(t_{y}^{*}\),\(t_{w}^{*}\),\(t_{h}^{*}\)) are the ground truth coordinates and the predicted coordinates, respectively. G = (G\({}_{x}\), G\({}_{y}\), G\({}_{w}\), \(G_{h}\)) and G* = (\(G_{x}^{*}\), \(G_{y}^{*}\), \(G_{w}^{*}\), \(G_{h}^{*}\)) are the ground truth box and the predicted box, respectively. G\({}_{x}\),\({}_{y}\),\({}_{Gw}\),\(G_{h}\) are the \(x\)-axis, \(y\)-axis of the center and the width, height of the ground truth text box, respectively. \(A_{x}\), \(A_{y}\), \(A_{w}\), and \(A_{h}\) are the \(x\)-axis, \(y\)-axis of the center, and the width, height of the text proposal. The overall objective function (\(L\)) contains two loss functions \(L_{cls}\) and \(L_{reg}\), which compute errors of text/non-text scores and proposal coordinates, respectively.