Business access method and device based on dynamic trust evaluation and computer equipment

Abstract

The invention relates to a service access method and device based on dynamic trust evaluation and computer equipment. The method comprises the following steps: determining an initial trust level according to attribute information under the condition that the attribute information is legal information and a user terminal passes identity verification; analyzing the access traffic data to determine traffic behavior information, and determining traffic behavior trust information according to the traffic behavior information; determining vulnerability information in the attribute information and generating security portrait information according to the access behavior log information, the vulnerability information and the access traffic data; inputting the traffic behavior trust information and the security portrait information into a trust evaluation model to obtain a trust evaluation value; and adjusting the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determining access permission information according to the adjusted trust level. By adopting the method, the trust level of the user terminal can be dynamically evaluated and adjusted, so that accurate access authority is given to the user terminal, and the security of service access is further improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a service access method, apparatus, computer equipment, computer-readable storage medium and computer program product based on dynamic trust evaluation. Background Art

[0002] During the operation of the business system, terminal devices can connect through the network and interactively use the functions and services of the business system to realize functions such as data exchange, functional operations and service requests. Terminal users can access the various services provided by the system through the above operations and complete their work tasks efficiently and conveniently. Since there are a large number of terminals accessing the business system and other operations, it is particularly important to ensure the security and stability of the business system.

[0003] In traditional technologies, the trust level of access subjects (such as user terminals) is often static, that is, after the initial confirmation of the trust level of the access subject and the granting of access rights, no trust assessment is performed. However, the access rights granted to access subjects using traditional technologies cannot timely and accurately reflect the threat level of the access subject to the business system, which will pose a threat to the safe and stable operation of the business system and is not conducive to improving the security of business access. Summary of the invention

[0004] Based on this, it is necessary to provide a business access method, apparatus, computer device, computer-readable storage medium and computer program product based on dynamic trust evaluation that can improve the security of business access in response to the above technical problems.

[0005] In a first aspect, the present application provides a service access method based on dynamic trust evaluation, comprising:

[0006] If the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, determining the initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information;

[0007] Analyzing the access traffic data of the user terminal to determine traffic behavior information, and determining traffic behavior trust information based on the traffic behavior information;

[0008] Based on a preset vulnerability information database, determine the vulnerability information in the attribute information, and generate security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access traffic data;

[0009] Inputting the traffic behavior trust information and the security profile information into a pre-trained trust assessment model to obtain a trust assessment value;

[0010] The initial trust level is adjusted according to the trust evaluation value to obtain an adjusted trust level, and access permission information of the user terminal for the business system is determined according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal for the business system.

[0011] In one of the embodiments, determining the traffic behavior trust information according to the traffic behavior information includes:

[0012] Obtaining behavior parameter indicator information corresponding to the traffic behavior information;

[0013] Constructing a fuzzy consistency matrix according to the behavior parameter index information, and obtaining weight information of each element in the fuzzy consistency matrix;

[0014] An evaluation value of the traffic behavior information is determined according to a preset evaluation rule, and the traffic behavior trust information is determined according to the evaluation value and the weight information.

[0015] In one embodiment, constructing a fuzzy consistency matrix according to the behavior parameter indicator information includes:

[0016] Determine evaluation hierarchy information based on the behavior parameter indicator information based on the hierarchical analysis method;

[0017] generating an initial judgment matrix according to the evaluation hierarchy information;

[0018] When the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check, the fuzzy consistent matrix is ​​generated according to the initial judgment matrix.

[0019] In one embodiment, generating security profile information based on the access behavior log information of the user terminal, the vulnerability information and the access traffic data includes:

[0020] Generate traffic vector information according to the message in the access traffic data, and generate access traffic feature information according to the message and the traffic vector information;

[0021] Generate threat level attribute label information according to the access behavior log information and the vulnerability information;

[0022] The security portrait information is generated according to the access traffic characteristic information and the threat level attribute label information.

[0023] In one embodiment, generating threat level attribute label information according to the access behavior log information and the vulnerability information includes:

[0024] Determine historical access behavior information according to the access behavior log information, and determine access attribute tag information based on the historical access behavior information;

[0025] Analyze the access behavior log information according to preset situation awareness analysis strategy information to determine access behavior tag information;

[0026] The threat level attribute label information is generated according to the access attribute label information, the access behavior label information and the vulnerability information.

[0027] In one of the embodiments, generating access traffic characteristic information according to the message and the traffic vector information includes:

[0028] Dividing the message into at least one message segment, and obtaining grammatical keywords in the message segment;

[0029] Acquire a keyword matching the grammatical keyword in a preset keyword database;

[0030] The access traffic characteristic information is generated according to the traffic vector information, the keyword, the number of occurrences of each field in the message and the quantity information of the message.

[0031] In a second aspect, the present application also provides a service access device based on dynamic trust evaluation, comprising:

[0032] An attribute information analysis module, configured to determine an initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information when the attribute information of the user terminal is legal information and the user terminal passes identity authentication;

[0033] An access traffic analysis module, used to analyze the access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information based on the traffic behavior information;

[0034] A portrait generation module, used to determine vulnerability information in the attribute information based on a preset vulnerability information library, and generate security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access flow data;

[0035] A trust evaluation module, used to input the traffic behavior trust information and the security profile information into a pre-trained trust evaluation model to obtain a trust evaluation value;

[0036] The permission determination module is used to adjust the initial trust level according to the trust evaluation value to obtain the adjusted trust level, and determine the access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system.

[0037] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the above method are implemented.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0039] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0040] The above-mentioned business access method, device, computer equipment, computer-readable storage medium and computer program product based on dynamic trust assessment, by determining the initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information when the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, thereby obtaining the initial trust level of the user terminal that has passed the legal attribute verification and identity authentication, and providing a data basis for subsequent trust level adjustment and access permission determination; analyzing the access traffic data of the user terminal, determining the traffic behavior information, and determining the traffic behavior trust information according to the traffic behavior information, thereby analyzing the access traffic data of the user terminal, accurately obtaining the traffic behavior trust information used to characterize the degree of trust in the user terminal, so as to provide a data basis for subsequent adjustment of the trust level in combination with the traffic behavior trust information; based on the preset vulnerability information database, determining the vulnerability information in the attribute information, and generating security portrait information according to the access behavior log information, vulnerability information and access traffic data of the user terminal, thereby analyzing the attribute information, access behavior log information and access traffic data, accurately generating a security portrait of the user terminal, and providing a data basis for subsequent adjustment of the trust level based on security The full portrait provides a data basis for determining the trust assessment value; the traffic behavior trust information and security portrait information are input into the pre-trained trust assessment model to obtain the trust assessment value, and then the pre-trained trust assessment model is used to process and analyze the traffic behavior trust information and security portrait information to obtain an accurate trust assessment value; the initial trust level is adjusted according to the trust assessment value to obtain the adjusted trust level, and the access permission information of the user terminal for the business system is determined according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system, and when the user terminal passes the attribute legality verification and identity authentication, the attribute information, access traffic data and access behavior log information corresponding to the user terminal can be analyzed to accurately obtain the security portrait corresponding to the user terminal, and the trust assessment value output by the pre-trained trust assessment model to process the security portrait is used to adjust the initial trust level of the user terminal, and the access permission information used to control the business access operation of the user terminal is determined in combination with the adjusted trust level, so as to dynamically evaluate and adjust the trust level of the user terminal, so as to grant accurate access permissions to the user terminal, thereby improving the security of business access. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1An application environment diagram of a service access method based on dynamic trust evaluation in one embodiment;

[0043] Figure 2 A schematic diagram of a process of a service access method based on dynamic trust evaluation in an embodiment;

[0044] Figure 3 A schematic diagram of a process for obtaining initial access rights in one embodiment;

[0045] Figure 4 A schematic diagram of a process for determining traffic behavior trust information in an embodiment;

[0046] Figure 5 A schematic diagram of a process for generating security portrait information in one embodiment;

[0047] Figure 6 A schematic diagram of a process for obtaining access rights in one embodiment;

[0048] Figure 7 is a structural block diagram of a service access device based on dynamic trust evaluation in one embodiment;

[0049] Figure 8 The figure is a diagram of the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] The service access method based on dynamic trust evaluation provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. When the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, the server 104 determines the initial trust level corresponding to the user terminal in the preset trust level database according to the attribute information; the server 104 analyzes the access flow data of the user terminal, determines the flow behavior information, and determines the flow behavior trust information according to the flow behavior information; the server 104 determines the vulnerability information in the attribute information based on the preset vulnerability information library, and generates security portrait information according to the access behavior log information, vulnerability information and access flow data of the user terminal; the server 104 inputs the flow behavior trust information and the security portrait information into the pre-trained trust assessment model to obtain the trust assessment value; the server 104 adjusts the initial trust level according to the trust assessment value to obtain the adjusted trust level, and determines the access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0052] In an exemplary embodiment, Figure 2 As shown, a service access method based on dynamic trust evaluation is provided, and the method is applied to a server as an example for explanation, including the following steps S202 to S210. Among them:

[0053] Step S202: when the attribute information of the user terminal is legal information and the user terminal passes identity authentication, an initial trust level corresponding to the user terminal is determined in a preset trust level database according to the attribute information.

[0054] The user terminal may refer to a terminal used by a user to perform a business operation (such as an access operation) on a business system.

[0055] The attribute information may refer to information used to distinguish terminals. In practical applications, the attribute information may include but is not limited to hardware information, system configuration information, physical address information, account information, and network address information of the terminal.

[0056] The legal information may refer to information that meets the preset terminal verification requirements. In actual applications, the preset information management library may include the legal information.

[0057] The preset trust level database may refer to a pre-set database for recording the trust level of the terminal.

[0058] The initial trust level may refer to information representing the security of the user terminal. In practical applications, when the trust level of the user terminal at the current moment needs to be determined, the trust level of the user terminal before the current moment may be used as the initial trust level.

[0059] As an example, in order to ensure the security of the access operation when the user terminal accesses the business system, the server can perform a dynamic trust evaluation on the user terminal. First, the server can obtain the attribute information, access traffic data and access behavior log information of the user terminal. Then, the server can search for legal information identical to the attribute information of the user terminal in the preset information management library based on the attribute information. Since there is no illegal information (i.e., illegal information) in the information management library, if legal information identical to the attribute information of the user terminal is found in the preset information management library, the server can determine that the attribute information of the user terminal is legal information. After that, the server can obtain the access request sent by the user terminal to the application of the business system, analyze the authorization token carried in the access request, and the server can compare the authorization token with the authorization token pre-stored in the token database. If there is an authorization token consistent with the authorization token carried in the access request in the token database, the authorization token verification is passed at this time, and the server can determine that the user terminal has passed the identity authentication, and the identity authentication of the user terminal is completed. The server can determine the trust level that matches the attribute information of the user terminal in the preset trust level database based on the attribute information of the user terminal (the attribute information can be used as an identity information) as the initial trust level of the user terminal. In actual applications, the trust level has corresponding access rights, and the initial access rights corresponding to the initial trust level can be used to control the access operation of the user terminal to the business system.

[0060] Step S204, analyzing the access traffic data of the user terminal, determining traffic behavior information, and determining traffic behavior trust information according to the traffic behavior information.

[0061] Among them, access traffic data may refer to data that characterizes the traffic generated when a user uses the business services provided by the business system through a user terminal. In actual applications, access traffic data may include user business access traffic data, and access traffic data may be data packets transmitted in network communications.

[0062] Among them, traffic behavior information may refer to information that characterizes user behaviors such as data transmission between the user terminal and the business system. In actual applications, traffic behavior information may include but is not limited to source address, destination address, source port, destination port, and return packet response information as well as data packet characteristic data and load content.

[0063] The traffic behavior trust information may refer to information characterizing the security of behaviors such as data transmission between users and business systems represented by access traffic data.

[0064] As an example, the server can perform traffic behavior analysis on access traffic data through deep flow detection technology. Deep flow detection technology uses application identification technology based on traffic behavior, that is, different application types are reflected in different states on session connections or data flows, and the source address, destination address, source port, destination port and return packet response information of the access traffic data are analyzed. Among them, deep flow detection technology can refer to data analysis technology based on traffic behavior. In actual applications, deep flow detection technology can take flow as the basic research object, where flow can refer to a group of ordered data packets from a source address to a destination address. Deep packet inspection technology can refer to data analysis technology based on data packet content.

[0065] The server can also perform deep packet inspection and analysis on the access traffic data based on deep packet inspection technology to obtain data packet feature data and load content. The load content is a data packet with code payload. Deep packet inspection technology is a traffic detection and control technology based on the application layer. The data packet feature data is matched with the preset attack behavior feature data. If the data packet feature data successfully matches the preset attack behavior feature data, a trust level mark is added to the access traffic data. The trust level mark here can include but is not limited to medium. Then the server can form the source address, destination address, source port, destination port and return packet response information corresponding to the access traffic data, as well as the data packet feature data and load content into traffic behavior information. Then the server can use the preset behavior indicators and combine the traffic behavior information to determine the traffic behavior trust information.

[0066] Step S206, based on a preset vulnerability information library, determines the vulnerability information in the attribute information, and generates security portrait information according to the access behavior log information, vulnerability information and access traffic data of the user terminal.

[0067] The preset vulnerability information database may refer to a pre-set database storing a number of vulnerability information. In actual applications, the preset vulnerability information database may include but is not limited to information such as the type of vulnerability information and the threat level of vulnerability information.

[0068] Among them, vulnerability information may refer to information that threatens or affects the safe and stable operation of the business system.

[0069] Among them, access behavior log information may refer to information recording user behaviors such as accessing services in a business system through a user terminal. In actual applications, access behavior log information may include the total number of times the terminal accesses applications in the business system, the number of attempts to unauthorized access, the number of successful accesses, etc.

[0070] Among them, security portrait information may refer to information describing the security risk level of the user terminal.

[0071] As an example, the server can use a preset vulnerability information database to search for vulnerability information in the attribute information. The server can then analyze the access behavior log information, access traffic data, and vulnerability information of the user terminal, as well as the vulnerability information type and vulnerability information threat level. The server can also use the reference portrait in the preset portrait database as a template to generate security portrait information of the user terminal through data visualization.

[0072] Step S208, input the traffic behavior trust information and security profile information into the pre-trained trust assessment model to obtain a trust assessment value.

[0073] The pre-trained trust assessment model may refer to a model used to generate a trust assessment value. In practical applications, the trust assessment model may include an entity extraction and intent classification model (Dual Intent and EntityTransformer, DIET).

[0074] The trust evaluation value may refer to information characterizing the security of a service and / or application of a user accessing a service system through a user terminal.

[0075] As an example, the server can input the traffic behavior trust information and security portrait information into a pre-trained trust assessment model, and the trust assessment model can calculate the trust assessment value of the user terminal based on the traffic behavior trust information and security portrait information.

[0076] Step S210, adjusting the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determining access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal for the business system.

[0077] The adjusted trust level may refer to a trust level obtained after adjusting the initial trust level.

[0078] The access permission information may refer to information representing the operations or behaviors that a user can perform on a business system through a user terminal. In practical applications, the access permission information is used to control the access operations of the user terminal on the business system.

[0079] Among them, the business system may include but is not limited to the power business system.

[0080] The access operation may refer to a data transmission operation between a user and a service / application in a service system through a user terminal.

[0081] As an example, the server can adjust the initial trust level according to the trust evaluation value to obtain an adjusted trust level. The server can then use the access rights corresponding to the adjusted trust level as the access rights information of the user terminal for the business system. The access rights information can be used for access control when the user accesses the business system and / or business applications in the business system through the user terminal.

[0082] In the above-mentioned service access method based on dynamic trust assessment, when the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, the initial trust level corresponding to the user terminal is determined in the preset trust level database according to the attribute information, thereby obtaining the initial trust level of the user terminal that has passed the legal attribute verification and identity authentication, and providing a data basis for subsequent trust level adjustment and access permission determination; analyzing the access traffic data of the user terminal, determining the traffic behavior information, and determining the traffic behavior trust information according to the traffic behavior information, thereby analyzing the access traffic data of the user terminal, accurately obtaining the traffic behavior trust information used to characterize the degree of trust in the user terminal, so as to provide a data basis for subsequent adjustment of the trust level in combination with the traffic behavior trust information; based on the preset vulnerability information database, determining the vulnerability information in the attribute information, and generating security portrait information according to the access behavior log information, vulnerability information and access traffic data of the user terminal, thereby analyzing the attribute information, access behavior log information and access traffic data, accurately generating a security portrait of the user terminal, and providing data for subsequent determination of the trust assessment value based on the security portrait The trust evaluation value of the traffic behavior and the security profile information are input into the pre-trained trust evaluation model to obtain the trust evaluation value, and then the pre-trained trust evaluation model is used to process and analyze the traffic behavior trust information and the security profile information to obtain an accurate trust evaluation value; the initial trust level is adjusted according to the trust evaluation value to obtain the adjusted trust level, and the access permission information of the user terminal for the business system is determined according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system, and when the user terminal passes the attribute legality verification and identity authentication, the attribute information, access traffic data and access behavior log information corresponding to the user terminal can be analyzed to accurately obtain the security profile corresponding to the user terminal, and the trust evaluation value output by the pre-trained trust evaluation model to process the security profile is used to adjust the initial trust level of the user terminal, and the access permission information used to control the business access operation of the user terminal is determined in combination with the adjusted trust level, so as to dynamically evaluate and adjust the trust level of the user terminal, so as to grant accurate access permissions to the user terminal, thereby improving the security of business access.

[0083] In an exemplary embodiment, traffic behavior trust information is determined based on traffic behavior information, including: obtaining behavior parameter indicator information corresponding to the traffic behavior information; constructing a fuzzy consistency matrix based on the behavior parameter indicator information, and obtaining weight information of each element in the fuzzy consistency matrix; determining an evaluation value of the traffic behavior information according to preset evaluation rules, and determining the traffic behavior trust information based on the evaluation value and the weight information.

[0084] Among them, behavior parameter indicator information may refer to information from the analysis perspective of the business access operation represented by the traffic behavior information. In actual applications, behavior parameter indicators may include network behavior indicators and attack behavior indicators. Network behavior indicators may include the complexity of changes in the terminal source address, destination address, source port, and destination port. Attack behavior indicators may include the number of historical attack behaviors that have occurred when the terminal accesses the business system.

[0085] Here, the element may refer to data constituting the fuzzy consistent matrix.

[0086] The weight information may refer to information characterizing the importance of an element in the fuzzy consistent matrix relative to each element in the fuzzy consistent matrix.

[0087] The preset evaluation rules may refer to information used to analyze the threat level of traffic behavior information to the business system. In practical applications, the preset evaluation rules may be determined by preset expert rules.

[0088] The evaluation value of the traffic behavior information may refer to information characterizing the threat level of the traffic behavior information to the business system.

[0089] As an example, the server can obtain the behavior parameter indicator information corresponding to the traffic behavior information, and construct a fuzzy consistency matrix based on the behavior parameter indicator information. The server can then determine the weight information of each element in the fuzzy consistency matrix based on the data value of each element in the fuzzy consistency matrix. The server can also determine the evaluation value of the traffic behavior information based on preset evaluation rules. The server can then calculate the traffic behavior trust information based on the trust evaluation value and weight information.

[0090] In this embodiment, by obtaining behavior parameter indicator information corresponding to the traffic behavior information; constructing a fuzzy consistency matrix based on the behavior parameter indicator information, and obtaining weight information of each element in the fuzzy consistency matrix; determining the evaluation value of the traffic behavior information according to a preset evaluation rule, and determining the traffic behavior trust information based on the evaluation value and the weight information, the behavior parameter indicator information corresponding to the traffic behavior information can be used to construct a fuzzy consistency matrix, and accurate traffic behavior trust information can be calculated based on the weight information of each element in the fuzzy consistency matrix and the evaluation value of the traffic behavior information, so as to adjust the initial trust level based on the trust evaluation value generated by the traffic behavior trust information and the security portrait, thereby obtaining access rights for controlling business access operations and improving the security of business access.

[0091] In some embodiments, a fuzzy consistent matrix is ​​constructed based on the behavior parameter indicator information, including: determining evaluation hierarchy information based on the behavior parameter indicator information based on the hierarchical analysis method; generating an initial judgment matrix based on the evaluation hierarchy information; and generating a fuzzy consistent matrix based on the initial judgment matrix when the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check.

[0092] The evaluation hierarchy information may refer to information used to analyze behavior parameter indicator information.

[0093] The initial judgment matrix may refer to information about the relative importance of each layer in the evaluation hierarchy information for the behavior parameter indicator information.

[0094] The maximum eigenvalue may refer to the maximum value among the eigenvalues ​​corresponding to the initial judgment matrix.

[0095] As an example, the server can determine the evaluation hierarchy information based on the behavioral parameter indicator information based on the hierarchical analysis method, and then the server can determine the form of the initial judgment matrix based on the evaluation hierarchy information, and establish the initial judgment matrix based on the form of the initial judgment matrix and the behavioral parameter indicator information. Then the server can use a preset verification coefficient to verify the consistency of the initial judgment matrix. When the maximum eigenvalue corresponding to the initial judgment matrix fails to pass the consistency check, the server can correct the initial judgment matrix and perform consistency verification on the corrected initial judgment matrix until the maximum eigenvalue corresponding to the judgment matrix passes the consistency check. When the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check, the server can use the initial judgment matrix as the final judgment matrix, and construct a fuzzy consistency matrix based on the final judgment matrix.

[0096] In this embodiment, the evaluation hierarchy information is determined based on the behavior parameter indicator information based on the hierarchical analysis method; an initial judgment matrix is ​​generated based on the evaluation hierarchy information; and a fuzzy consistent matrix is ​​generated based on the initial judgment matrix when the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check. The initial judgment matrix can be generated based on the hierarchical analysis method and the evaluation hierarchy information on the basis of the behavior parameter indicator information, and when the generated initial judgment matrix passes the consistency check, an accurate fuzzy consistent matrix is ​​generated based on the initial judgment matrix, so as to determine the traffic behavior trust information based on the weight information of each element in the fuzzy consistent matrix, thereby improving the accuracy of the traffic behavior trust information.

[0097] In some embodiments, security portrait information is generated based on the access behavior log information, vulnerability information and access traffic data of the user terminal, including: generating traffic vector information based on the messages in the access traffic data, and generating access traffic feature information based on the messages and traffic vector information; generating threat level attribute label information based on the access behavior log information and vulnerability information; generating security portrait information based on the access traffic feature information and threat level attribute label information.

[0098] The message in the access traffic data may refer to the message carried by the access traffic data.

[0099] Among them, traffic vector information can refer to information that characterizes the basic attributes of a message. In actual applications, the basic attributes of a message may include the source IP, destination IP, traffic type, message length and message frequency of the message. The traffic vector information can be used as a basic traffic vector.

[0100] As an example, the server can extract basic attribute information of the message carried by the access traffic data from the access traffic data, and generate traffic vector information based on the basic attribute information. The server can then generate access traffic feature information based on the message and traffic vector information. The server can also generate threat level attribute label information based on the access behavior log information and vulnerability information. The server can then generate security portrait information based on the access traffic feature information and threat level attribute label information, using the reference portrait in the preset portrait database as a template. In a specific implementation, the security portrait information can be displayed in the form of lists, entries, and charts, and the specific display form is not limited here.

[0101] In this embodiment, traffic vector information is generated according to the messages in the access traffic data, and access traffic characteristic information is generated according to the messages and traffic vector information; threat degree attribute label information is generated according to the access behavior log information and vulnerability information; security portrait information is generated according to the access traffic characteristic information and threat degree attribute label information. It is possible to analyze the messages carried in the access traffic data to generate access traffic characteristic information, and obtain accurate security portrait information in combination with the threat degree attribute label information generated by the access behavior log information and vulnerability information, so as to adjust the initial trust level based on the traffic behavior trust information and the trust assessment value generated by the security portrait, thereby obtaining access rights for controlling business access operations and improving the security of business access.

[0102] In some embodiments, threat level attribute label information is generated based on access behavior log information and vulnerability information, including: determining historical access behavior information based on the access behavior log information, and determining access attribute label information based on the historical access behavior information; analyzing the access behavior log information based on preset situational awareness analysis strategy information to determine the access behavior label information; generating threat level attribute label information based on the access attribute label information, the access behavior label information, and the vulnerability information.

[0103] The historical access behavior information may refer to information representing access operations that the user has performed on the business system through the user terminal.

[0104] The access attribute label information may refer to information on the ratio of the number of access operations of the user terminal to the business system and / or specific business applications in the business system to the total number of access operations to the business system and / or specific business applications in the business system.

[0105] Among them, the preset situational awareness analysis strategy information may refer to the information of the strategy used to analyze the security threat level of the terminal to the accessed business. In actual applications, the analysis dimensions represented by the preset situational awareness analysis strategy information may include but are not limited to whether there is a source of abnormal behavior.

[0106] The access behavior tag information may refer to information indicating whether there is any abnormality in the access operation / access behavior of the user terminal to the business system and / or business application.

[0107] As an example, the server can count the historical access behavior of user terminals based on access behavior log information, such as total resource access statistics, ranking of total resource access among all access terminals, number of authorized and unauthorized access to business system resources, and other statistical dimensions, to obtain historical access behavior information, and determine access attribute label information based on the historical access behavior information. The server can also analyze whether there are abnormal behavior sources and / or abnormal operations in the access behavior log information based on preset situational awareness analysis strategy information to obtain access behavior label information, and then the server can generate threat level attribute label information based on the access attribute label information, access behavior label information and vulnerability information.

[0108] In this embodiment, historical access behavior information is determined based on access behavior log information, and access attribute label information is determined based on the historical access behavior information; access behavior log information is analyzed according to preset situational awareness analysis strategy information to determine access behavior label information; threat level attribute label information is generated based on access attribute label information, access behavior label information and vulnerability information, so as to fully analyze the number and results of access behaviors and whether there are any abnormalities in the access behaviors, and obtain accurate threat level attribute label information, so as to generate accurate security portrait information in combination with access traffic feature information, thereby improving the accuracy of security portrait information.

[0109] In some embodiments, access traffic characteristic information is generated based on the message and traffic vector information, including: dividing the message into at least one message segment, and obtaining grammatical keywords in the message segment; obtaining keywords that match the grammatical keywords in a preset keyword database; and generating access traffic characteristic information based on the traffic vector information, keywords, the number of occurrences of each field in the message, and the number of messages.

[0110] The message fragment may refer to information obtained by dividing a message into several fragments.

[0111] Among them, grammatical keywords can refer to text and / or data with specific meanings. In actual applications, grammatical keywords can compare the text and / or data in the message with the preset grammatical keyword database one by one, and the text and / or data existing in the preset grammatical keyword database can be used as grammatical keywords.

[0112] The preset keyword database may refer to a pre-set database used to determine keywords. In actual applications, the preset keyword database may include several keywords.

[0113] The keyword may refer to text / data that matches the grammatical keyword in a preset keyword database.

[0114] The number of occurrences of each field in the message may refer to information representing the number of occurrences of each field in the message.

[0115] The message quantity information may refer to information representing the total number of messages.

[0116] As an example, the server may divide the message into several message segments, and parse each message segment to obtain grammatical keywords in the message segments, and then perform keyword feature changes on the grammatical keywords to obtain several keywords whose keyword features are identical to each other and constitute semantics. The server may match the several keywords whose keyword features are identical to each other and constitute semantics with (valid) keywords stored in a preset keyword database to obtain keywords. The server may then generate access traffic feature information based on traffic vector information, the matched keywords, the number of occurrences of each field in the message, and the number of messages.

[0117] In this embodiment, by dividing the message into at least one message segment, and obtaining the grammatical keywords in the message segment; obtaining the keywords matching the grammatical keywords in the preset keyword database; generating access traffic feature information based on the traffic vector information, keywords, the number of occurrences of each field in the message and the number of messages, the message content can be fully analyzed, and accurate access traffic feature information can be obtained in combination with the keywords in the message and the number of messages, so as to generate accurate security portrait information in combination with the threat level attribute label information, thereby improving the accuracy of the security portrait information.

[0118] In some embodiments, the server can read the behavior log information, access traffic data and attribute information of the user terminal through a preset program. The attribute information includes the terminal's hardware information, system configuration information, physical address information, account information, and network address information, etc. The access traffic data is the user's business access traffic data, and the access behavior log information includes the total number of times the terminal accesses the power system business application, the number of attempts at unauthorized access, the number of successful accesses, etc.

[0119] like Figure 3As shown, a flow chart of obtaining initial access rights is provided, and the server can perform identity authentication of the terminal based on the attribute information, determine the initial trust level based on the identity authentication, and determine the initial access rights of the terminal to the business system based on the initial trust level. Specifically, the server can search for legal information identical to the terminal attribute information in the information management library based on the attribute information. The legal information belonging to the terminal attribute information only exists in the information management library, and the illegal information does not exist in the information management library. If legal information is found, it means that the terminal attribute information is legal information. After determining the legal information, an access request is sent to the power system business application, the authorization token carried in the access request is analyzed, and the authorization domain is compared with the stored authorization token of the terminal. If they are consistent, the authorization token verification is passed. After the authorization token verification is passed, the terminal identity authentication is completed, the terminal identity information is determined, and the corresponding initial trust level is matched in the database according to the terminal identity information. The initial access rights of the terminal to the business system can be determined according to the initial trust level, and the initial access rights match the corresponding access rights in the rights management library through the initial trust level.

[0120] like Figure 4As shown, a flow chart for determining traffic behavior trust information is provided. The server can perform traffic behavior analysis based on access traffic data, obtain traffic behavior information, construct a fuzzy consistency matrix, perform traffic behavior trust calculation based on the fuzzy consistency matrix combined with traffic behavior information, and obtain traffic behavior trust value (traffic behavior trust information). Specifically, the server can perform traffic behavior analysis on access traffic data through deep flow detection technology. Deep flow detection technology adopts application identification technology based on traffic behavior, that is, different application types are reflected in different states on session connections or data flows, and analyze the source address, destination address, source port, destination port and return packet response information of access traffic data. Then the server can perform deep packet detection analysis on access traffic data based on deep packet detection technology to obtain data packet feature data and load content. The load content is a data packet with code payload. Deep packet detection technology is a traffic detection and control technology based on the application layer. The data packet feature data is matched with the preset attack behavior feature data. If the data packet feature data successfully matches the preset attack behavior feature data, a trust level mark is added to the access traffic data. The trust level mark here is intermediate. After that, the server can construct the traffic behavior information by combining the source address, destination address, source port, destination port, and packet response information of the access traffic data, as well as the data packet feature data and load content. Configure the behavior parameter indicators, which are network behavior indicators and attack behavior indicators. The network behavior indicators include the complexity of the changes in the terminal source address, destination address, source port, and destination port. The attack behavior indicators are the number of historical attack behaviors that occurred when the terminal accessed the business system. Then the server can construct a judgment matrix through the behavior parameter indicators, and use the behavior parameter indicators to construct an evaluation hierarchy through the hierarchical analysis method. According to the evaluation hierarchy, the initial judgment matrix form is an n*n-order square matrix, where n is the behavior parameter indicator in the evaluation hierarchy. According to the determined initial judgment matrix form, an initial judgment matrix is ​​established, the consistency of the initial judgment matrix is ​​checked by the preset check coefficient, the maximum eigenvalue of the initial judgment matrix is ​​calculated, and the maximum eigenvalue is checked for consistency according to the preset check coefficient. The calculation expression of the consistency check index (Consistency Index, CI) can be expressed as:

[0121] .

[0122] in, It may refer to the maximum eigenvalue of the judgment matrix, and n may refer to the order of the judgment matrix.

[0123] The random consistency index (RI) is a formula calculated based on the random matrix, which can be replaced by the preset verification coefficient. The calculation expression of the consistency ratio (CR) can be expressed as: CR=CI / RI. The preset verification coefficient can be obtained from the preset database. If the consistency check fails, the initial judgment matrix is ​​corrected. If the consistency check passes, there is no need to correct the initial judgment matrix. After completing the consistency check of the initial judgment matrix, the final judgment matrix can be obtained, and the fuzzy consistency matrix is ​​constructed based on the judgment matrix. The calculation expression of each element in the fuzzy consistency matrix can be expressed as:

[0124] .

[0125] Among them, a ij is the element in the i-th row and j-th column of the fuzzy consistent matrix, a ii is the sum of the elements in the i-th row of the judgment matrix, a jj is the sum of the elements in the jth row of the judgment matrix, n is the total number of behavioral parameter indicators, and σ is the correction coefficient.

[0126] The server can normalize the fuzzy consistency matrix to obtain the weight vector (weight information) corresponding to each element. The calculation expression of the weight vector can be expressed as:

[0127] .

[0128] Among them, w i It can refer to the weight of the i-th element.

[0129] The server can obtain a trust evaluation value for the traffic behavior information according to a preset evaluation rule, which is determined by an expert rule. The trust evaluation value of the traffic behavior information and the weight vector are calculated to obtain a traffic behavior trust value. If the data packet feature data successfully matches the preset attack behavior feature data, a correction coefficient is obtained according to the trust level mark, and the traffic behavior trust value is corrected according to the correction coefficient to obtain a final traffic behavior trust value.

[0130] like Figure 5As shown, a flow chart for generating security portrait information is provided. The server can obtain access traffic features based on access traffic data, obtain threat level attribute labels based on access behavior log information and attribute information, and generate a target security portrait based on access traffic features and threat level attribute labels. Specifically, the server can extract basic attribute information of the message from the access traffic data. The basic attribute information of the message includes the source IP, destination IP, traffic type, message length and message frequency of the message. The basic traffic vector is represented according to the basic attributes of the message. The access traffic data is semantically parsed with the protocol. The protocol message is cut into several segments using a synchronous parsing method. Several segments of the message are parsed to extract grammatical key fields (keywords). The keyword features of the grammatical key fields are changed to obtain several keywords whose keyword features are the same and constitute semantics. The keywords whose keyword features are the same and constitute semantics are matched with the valid keywords stored in the database to obtain the target key fields. The grammatical key fields are matched according to the target key fields using prior knowledge to obtain semantic keyword features. The high-frequency keywords in the message segments of the access traffic data are statistically analyzed. The number of times a segment appears. Since most power business systems are proprietary protocols, the location and frequency of specific fields in the protocol are generally fixed. Therefore, the number of field occurrences can be counted by scanning the protocol. The total number of messages in the access flow data is counted, and the basic flow vector, the number of high-frequency field occurrences, the semantic keyword features and the total number of messages constitute the access flow features. Then the server can count multiple historical access behaviors of the terminal based on the access behavior log information, that is, analyze and count through the information flow task. The dimension information of the analysis and statistics may include the total resource access statistics, the ranking of the total resource access among all access terminals, the number of authorized and unauthorized access to business system resources, etc. The access attribute label is obtained according to the historical access behavior. If the total resource access is ranked higher among all access terminals, the access attribute label is a high resource access terminal. After that, the server can analyze whether there is an abnormal behavior source in the access behavior log information according to the preset situation awareness analysis strategy. The abnormal behavior source may include multiple unauthorized access to the business system by the terminal. The preset situation awareness analysis strategy refers to the strategy for detecting and analyzing the security threat level of the terminal to the accessed business. The situational awareness analysis strategy can be a function of the server itself or a service provided by a third party. The server can determine the access behavior label based on whether there is an abnormal behavior source. The server can detect vulnerability information based on attribute information. The vulnerability information database detects the vulnerability information in the attribute information of the terminal. The vulnerability information database contains the types of vulnerability information and the threat level of vulnerability information. The vulnerability threat label is determined based on the type and threat level of the existing vulnerability information. The vulnerability threat label is such as a large number of vulnerabilities. The vulnerability threat label, access attribute label and access behavior label together constitute the threat level attribute label.The server can generate a target security portrait through data visualization methods based on access traffic characteristics and threat level attribute labels. It can use similar portraits in the portrait model library as templates based on access traffic characteristics and threat level attribute labels, and use the templates to quickly generate a target security portrait.

[0131] like Figure 6 As shown, a flowchart of obtaining access rights is provided. The server can use the trust assessment model to perform trust assessment calculation based on the traffic behavior trust value and the target security portrait to obtain the trust assessment value. Specifically, the server can build a DIET model as the initial trust assessment model. The DIET (Dual Intent and EntityTransformer) model is a multi-task architecture that can simultaneously perform intent classification and entity recognition. The DIET model includes a characterization pipeline module, a Transformer layer, a named entity recognition module, a mask layer, and a classification module. The characterization pipeline module includes a sparse feature layer and a fully connected layer. The sparse feature layer helps to reduce the dimension of the data, thereby achieving faster and more efficient training and reasoning. The sparse feature layer includes three EmbeddingBag modules. The EmbeddingBag module is optimized on the Embedding layer. The first EmbeddingBag module consists of 5 one-hot lengths, and the second EmbeddingBag module consists of 5 one-hot lengths. The ingBag module has a one-hot length of 4, and the third EmbeddingBag module has a one-hot length of 3. The feature pipeline module is used to match the dimensions of dense features. The Transformer layer is used to enhance the model's ability to extract higher-dimensional features. The named entity recognition module is used to correspond to the input sequence of the Transformer layer. The mask layer plays a regularization role and learns more features from the text. The classification module is used to perform label embedding calculations; the initial trust assessment model is trained to obtain a trained trust assessment model, and the traffic behavior trust value and the target security portrait are input into the trained trust assessment model. The trust assessment calculation is performed through the model and the trust assessment value is output. Then the server can adjust the initial trust level according to the trust assessment value to obtain the target trust level, and determine the terminal's final access rights to the business system based on the target trust level. The server can rematch the trust level in the database according to the trust evaluation value to obtain the final target trust level, adjust the terminal's initial access rights to the business system according to the target trust level, and determine the terminal's final access rights to the business system (access rights information). The server can perform access control on the terminal's access to the power business system or business application based on the final access rights, and further determine the operations that are allowed and not allowed after the terminal device accesses the power business system or business application.

[0132] In this embodiment, traffic behavior analysis is performed based on access traffic data to obtain traffic behavior information, and a specific and comprehensive analysis of access traffic data is achieved. Then, traffic behavior trust calculation is performed based on the fuzzy consistency matrix combined with traffic behavior information to obtain traffic behavior trust value, so that the obtained traffic behavior trust value is more accurate and the traffic behavior trust calculation is more comprehensive. Access traffic characteristics are obtained based on access traffic data, threat level attribute labels are obtained based on access behavior log information and attribute information, and target security portraits are generated based on access traffic characteristics and threat level attribute labels. Through the target security portrait, the risks that may arise when terminal devices access the power business system can be more comprehensively and accurately assessed. At the same time, the target security portrait is generated in combination with the threat level attribute label, which can ensure the comprehensiveness of the information generated by the portrait while improving the rate of portrait generation. Trust evaluation calculation is performed based on the traffic behavior trust value and the target security portrait using a trust evaluation model. The trust evaluation model adopts the DIET model, which can more accurately calculate the trust evaluation value. At the same time, the trust evaluation value is calculated through the traffic behavior trust value and the target security portrait, so that the obtained trust evaluation value is more reliable. The final access rights are made more accurate and reliable. Based on the access rights, the terminal access to the business system can be better controlled, the security of the access system can be improved, the system can be protected from threats, and the security of business access can be improved.

[0133] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0134] Based on the same inventive concept, the embodiment of the present application also provides a service access device based on dynamic trust evaluation for implementing the service access method based on dynamic trust evaluation involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more service access device embodiments based on dynamic trust evaluation provided below can refer to the limitations on the service access method based on dynamic trust evaluation above, and will not be repeated here.

[0135] In an exemplary embodiment, Figure 7 As shown, a service access device based on dynamic trust evaluation is provided, including: an attribute information analysis module 702, an access traffic analysis module 704, a portrait generation module 706, a trust evaluation module 708 and an authority determination module 710, wherein:

[0136] The attribute information analysis module 702 is used to determine the initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information when the attribute information of the user terminal is legal information and the user terminal passes the identity authentication.

[0137] The access traffic analysis module 704 is used to analyze the access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information based on the traffic behavior information.

[0138] The portrait generation module 706 is used to determine the vulnerability information in the attribute information based on a preset vulnerability information library, and generate security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access traffic data.

[0139] The trust assessment module 708 is used to input the traffic behavior trust information and the security profile information into a pre-trained trust assessment model to obtain a trust assessment value.

[0140] The permission determination module 710 is used to adjust the initial trust level according to the trust evaluation value to obtain the adjusted trust level, and determine the access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system.

[0141] In one of the exemplary embodiments, the access traffic analysis module 704 is specifically used to obtain the behavior parameter index information corresponding to the traffic behavior information; construct a fuzzy consistency matrix based on the behavior parameter index information, and obtain the weight information of each element in the fuzzy consistency matrix; determine the evaluation value of the traffic behavior information according to preset evaluation rules, and determine the traffic behavior trust information based on the trust evaluation value and the weight information.

[0142] In one of the exemplary embodiments, the access traffic analysis module 704 is also specifically used to determine the evaluation hierarchy information based on the behavioral parameter indicator information based on the hierarchical analysis method; generate an initial judgment matrix based on the evaluation hierarchy information; and generate the fuzzy consistency matrix based on the initial judgment matrix when the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check.

[0143] In one of the exemplary embodiments, the above-mentioned portrait generation module 706 is also specifically used to generate traffic vector information based on the messages in the access traffic data, and generate access traffic feature information based on the messages and the traffic vector information; generate threat level attribute label information based on the access behavior log information and the vulnerability information; and generate the security portrait information based on the access traffic feature information and the threat level attribute label information.

[0144] In one of the exemplary embodiments, the above-mentioned portrait generation module 706 is specifically used to determine historical access behavior information based on the access behavior log information, and determine access attribute label information based on the historical access behavior information; analyze the access behavior log information according to preset situational awareness analysis strategy information to determine the access behavior label information; generate the threat level attribute label information based on the access attribute label information, the access behavior label information and the vulnerability information.

[0145] In one of the exemplary embodiments, the above-mentioned portrait generation module 706 is specifically used to divide the message into at least one message segment and obtain keywords in the message segment; obtain grammatical keywords matching the keywords in a preset grammatical keyword database; and generate the access traffic characteristic information according to the traffic vector information, the grammatical keywords, the number of occurrences of each field in the message and the quantity information of the message.

[0146] Each module in the above-mentioned service access device based on dynamic trust evaluation can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0147] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as attribute information, access traffic data and access behavior log information. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a service access method based on dynamic trust evaluation is implemented.

[0148] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0149] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0150] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0151] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0152] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0153] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0154] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0155] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A service access method based on dynamic trust evaluation, characterized in that: The method comprises: If the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, determining the initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information; Analyzing the access traffic data of the user terminal to determine traffic behavior information, and determining traffic behavior trust information based on the traffic behavior information; Based on a preset vulnerability information database, determine the vulnerability information in the attribute information, and generate security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access traffic data; Inputting the traffic behavior trust information and the security profile information into a pre-trained trust assessment model to obtain a trust assessment value; The initial trust level is adjusted according to the trust evaluation value to obtain an adjusted trust level, and access permission information of the user terminal for the business system is determined according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal for the business system.

2. The method according to claim 1, characterized in that The determining the traffic behavior trust information according to the traffic behavior information includes: Obtaining behavior parameter indicator information corresponding to the traffic behavior information; Constructing a fuzzy consistency matrix according to the behavior parameter index information, and obtaining weight information of each element in the fuzzy consistency matrix; An evaluation value of the traffic behavior information is determined according to a preset evaluation rule, and the traffic behavior trust information is determined according to the evaluation value and the weight information.

3. The method according to claim 2, characterized in that The step of constructing a fuzzy consistency matrix according to the behavior parameter index information includes: Determine evaluation hierarchy information based on the behavior parameter indicator information based on the hierarchical analysis method; generating an initial judgment matrix according to the evaluation hierarchy information; When the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency check, the fuzzy consistent matrix is ​​generated according to the initial judgment matrix.

4. The method according to claim 1, characterized in that: The generating of security profile information according to the access behavior log information of the user terminal, the vulnerability information and the access flow data includes: Generate traffic vector information according to the message in the access traffic data, and generate access traffic feature information according to the message and the traffic vector information; Generate threat level attribute label information according to the access behavior log information and the vulnerability information; The security portrait information is generated according to the access traffic characteristic information and the threat level attribute label information.

5. The method according to claim 4, characterized in that The generating threat level attribute label information according to the access behavior log information and the vulnerability information includes: Determine historical access behavior information according to the access behavior log information, and determine access attribute tag information based on the historical access behavior information; Analyze the access behavior log information according to preset situation awareness analysis strategy information to determine access behavior tag information; The threat level attribute label information is generated according to the access attribute label information, the access behavior label information and the vulnerability information.

6. The method according to claim 4, characterized in that The generating access traffic characteristic information according to the message and the traffic vector information includes: Dividing the message into at least one message segment, and obtaining grammatical keywords in the message segment; Acquire a keyword matching the grammatical keyword in a preset keyword database; The access traffic characteristic information is generated according to the traffic vector information, the keyword, the number of occurrences of each field in the message and the quantity information of the message.

7. A service access device based on dynamic trust evaluation, characterized in that: The device comprises: An attribute information analysis module, configured to determine an initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information when the attribute information of the user terminal is legal information and the user terminal passes identity authentication; An access traffic analysis module, used to analyze the access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information based on the traffic behavior information; A portrait generation module, used to determine vulnerability information in the attribute information based on a preset vulnerability information library, and generate security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access flow data; A trust evaluation module, used to input the traffic behavior trust information and the security profile information into a pre-trained trust evaluation model to obtain a trust evaluation value; The permission determination module is used to adjust the initial trust level according to the trust evaluation value to obtain the adjusted trust level, and determine the access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control the access operation of the user terminal to the business system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images