## 2 Related Work and Comparison  
[PERSON] et al. [14] pointed out that companies using cloud services should take measures to prevent the abuse of privileged access. [PERSON] et al. [15] conducted a detailed analysis of cloud platform security incidents, and their views showed that the lack of privileged account management and user behavior audits were the culprits of these problems. Moreover, [PERSON] [16] analyzed the reasons for the failure of certain privileged access management systems, and pointed out that a privileged access management system should include two functions: privileged account management and user behavior audits. In recent years, many researchers have started their work from these two aspects. User Behavior Audit. A number of studies [5; 6; 7; 8] prevented dangerous operations by auditing privileged user behaviors. They mainly captured videos and manually audited user behaviors. [PERSON] et al. [5] designed an audit system based on the RDP proxy, which aimed to prevent malicious users from tampering with audit information. [PERSON] et al. [6] also provided a similar audit system with the proxy-based structure. As manual audits find it difficult to handle large-scale privileged user operations, researchers have applied machine learning models to mitigate the heavy task of large-scale behavior audit. [PERSON] et al. [7] first used statistical classification to analyze the network traffic that is generated from user behaviors. It can determine what applications are used during the user's access. On this basis, [PERSON] et al. [8] adopted decision trees to analyze the network traffic and improve the classification accuracy. [PERSON] et al. [17] collected and analyzed the user's operation logs (such as system logs, application logs, etc.) to obtain ongoing user activities. [PERSON] and [PERSON] [18; 19] used sense text reading to extract the text information from the video. However, existing studies cannot easily automatically audit the fine-grained privileged behaviors for graphical operating systems. In contrast, our system can automatically recognize fine-grained user behavior audit for graphical operating systems. The User Behavior Audit subsystem designed in this paper can audit privileged behaviors in a fine-grained way for graphical operating systems. We applied deep-learning-based text reading to extract text information from images. In particular, we improved the deep learning models in processing text detection and recognition, so that the complex background and small icons of graphical operating systems can be well handled. Finally, the SA-UBA matches extracted text information to specific user behaviors. Thus, SA-UBA can automatically achieve a fine-grained user behavior audit for graphical operating systems. Privileged Account Management. To mitigate the security problems caused by privileged accounts, a number of privileged account management systems are proposed [9; 10; 11; 12; 13]. [PERSON] [9] designed a system deployed on the user side for managing the remote desktop access of privileged accounts. [PERSON] et al. [10] provided a proxy-based privileged account management system to manage privileged identities in enterprises. Secure Proxied Database Connectivity (SPDC) [11; 12] is a security access system for managing database accounts on the cloud. It can realize the secure connection from applications to cloud-storage data. [PERSON] et al. [13] employed the database connection API when the application requested to access the database. [PERSON] et al. [20] designed a package solution combining privileged access management, and identity and access management. However, no specific technical details were provided. The existing solutions achieve diversified management functionalities. However, they fail to consider preventing the leakage of privileged accounts when privileged account management systems are compromised. Our system named SA-UBA applies several techniques to enhance the security of managing privileged accounts.