Self-adaptive authority management method of intelligent seal management system

Abstract

The invention provides a self-adaptive authority management method of an intelligent seal management system, and relates to the technical field of information, and the method comprises the steps: obtaining seal use operation sequence data, including seal use time, application batch, file type and seal use purpose information, of a user in different time periods, constructing a user seal use behavior feature vector, and obtaining a seal use behavior feature vector; grouping all users through a clustering algorithm to obtain a plurality of user groups with different seal using behavior modes; for each user group, analyzing historical seal application data of the user group, calculating a mean value and a standard deviation of seal application frequencies of the user group under different time scales through a sliding window, and according to a preset threshold value, when the real-time seal application frequency of a certain user exceeds a normal fluctuation range of the group to which the user belongs, sending the seal application frequency to the user group; and judging that the seal using behavior of the user is abnormal. The intelligent level of seal management is improved, and the abnormal behavior identification and risk prevention and control capabilities are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a self-adaptive authority management method for an intelligent seal management system. Background Art

[0002] In the intelligent seal management system, the user's seal operation sequence characteristics in different time periods can reflect their seal use behavior patterns. When the user's seal application has a continuous deviation, the correlation between the application document type and the purpose of the seal will change. This change in correlation will affect the system's dynamic adjustment of the user's authority level. However, the current intelligent seal management system has technical contradictions when dealing with this situation: on the one hand, the system needs to adjust the user's authority level in a timely manner according to the user's seal behavior characteristics to ensure the safety of seal use; on the other hand, frequent authority level adjustments may affect the user's normal seal use needs and reduce user experience. At the same time, how to accurately identify user behavior deviations in massive seal log data and quantitatively evaluate the changes in the correlation between the application document type and the purpose of the seal is also a technical problem that needs to be solved urgently. In addition, the existing authority level dynamic adjustment mechanism usually adopts a simple threshold comparison method, lacks in-depth mining and modeling of the influence rules between user behavior deviations and authority adjustments, resulting in insufficient accuracy and timeliness of the adjustment. Therefore, there is an urgent need for a new technical solution that can accurately identify user behavior deviations in real time without affecting the user's normal seal needs, quantitatively evaluate the changes in the correlation between the application document type and the purpose of seal use, and realize accurate and dynamic user authority level adjustment based on the influence law model, thereby comprehensively improving the security and user experience of the intelligent seal management system. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides an adaptive authority management method for an intelligent seal management system, which mainly includes: The user's seal operation sequence data in different time periods are obtained, including seal usage time, file type, and seal usage purpose information, and the user seal usage behavior feature vector is constructed. All users are grouped through a clustering algorithm to obtain several user groups with different seal usage behavior patterns; for each user group, its historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated through a sliding window. When a user's real-time seal application frequency exceeds the normal fluctuation range of the group to which it belongs, the user's seal usage behavior is determined to be abnormal; when a user is determined to have abnormal seal usage behavior, the user's seal application data during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different file type and seal usage purpose combinations, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal usage behavior; based on the mined strong association rules, the key features in the strong association rules are extracted, including the associated file type, the associated seal usage purpose information, and the association strength, and the historical records similar to the key features are searched in the risk assessment knowledge base through feature matching. Risk cases: According to the risk level labels of similar cases, the current user's abnormal seal usage behavior is divided into high-risk behavior or low-risk behavior. For high-risk behavior, the user's seal usage authority is automatically reduced and an early warning is sent to the administrator. For low-risk behavior, the system temporarily maintains the user's authority unchanged, but increases the monitoring frequency; regularly collect follow-up tracking data of all abnormal users over a period of time, including user authority change records and behavioral performance change trends after abnormal behavior occurs, to form a strategy optimization training sample set, and use factor analysis to automatically extract key factors that affect the authority adjustment effect from the sample data of the training sample set, including the association rule characteristics of abnormal behavior and the behavior patterns of the user group, and establish an authority adjustment strategy optimization model based on key influencing factors; the authority adjustment strategy optimization model based on key influencing factors, by mining the behavior change patterns of user groups before and after authority adjustment, automatically learns and filters patterns with confidence higher than the preset confidence threshold and influence higher than the preset influence threshold as new rules, and continuously feeds new rules back to the authority adjustment strategy optimization model to achieve dynamic updates, and build an adaptive authority management mechanism in the intelligent seal management system that can evolve autonomously according to user behavior.

[0004] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: The present invention discloses an adaptive authority management method for an intelligent seal management system. The method clusters and groups users by constructing a user seal usage behavior feature vector, and analyzes the historical seal application data of each group. When the user's real-time seal application frequency exceeds the normal fluctuation range of the group to which it belongs, it is determined to be an abnormal behavior. Subsequently, the present invention uses an association rule mining algorithm to analyze the characteristics of abnormal seal usage behavior, and matches them with historical cases in a risk assessment knowledge base to achieve risk level classification. For high-risk behaviors, user permissions are automatically reduced and an early warning is sent; for low-risk behaviors, the monitoring frequency is strengthened. The present invention also continuously collects follow-up data of abnormal users, establishes an authority adjustment strategy optimization model, and realizes an adaptive authority management mechanism that can evolve autonomously according to user behavior. This method effectively improves the intelligence level of seal management and enhances the ability to identify abnormal behaviors and prevent and control risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 The present invention is a flowchart of the adaptive authority management method of the intelligent seal management system. DETAILED DESCRIPTION

[0006] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0007] like Figure 1 The adaptive authority management method of the smart seal management system in this embodiment may specifically include: Step S101, obtain the user's seal operation sequence data in different time periods, including seal usage time, file type, and seal usage purpose information, construct the user's seal usage behavior feature vector, group all users through a clustering algorithm, and obtain several user groups with different seal usage behavior patterns.

[0008] The user's seal operation sequence data in the seal management database is obtained, and the proportion of application times is counted according to the time period according to the seal operation sequence data to obtain the user time period distribution vector; the Jieba word segmenter is used to perform word segmentation processing on the file type and seal purpose fields in the seal operation sequence data, and the word frequency of the word segmentation result is calculated and normalized to obtain the seal document feature vector; a time window is set according to the seal operation sequence data for sliding statistics, and the application number sequence in the window is discrete Fourier transformed, and the application behavior feature is obtained by taking the frequency component with the maximum amplitude after the Fourier transform; the user time period distribution vector, the seal document feature vector and the application behavior feature are spliced ​​to construct a user seal usage behavior feature vector, and the maximum spanning tree algorithm is used to perform clustering operation on the user seal usage behavior feature vector, and the user groups are divided according to the Euclidean distance.

[0009] Specifically, the timestamp, batch number, file type, and purpose of use fields in the basic data table of the user's use of seals within 30 days are obtained from the seal management database. The application period and applicant information in the associated document data table are read through the batch number. The user's use of seals is divided into 24-hour periods according to the timestamp, and the proportion of applications in each time period is calculated to obtain the time period distribution vector. According to the file type field and the purpose of use field in the basic data table of the use of seals, a general industry vocabulary is constructed, and the file type and the purpose of use of seals are segmented using the Jieba word segmenter. The word frequency of the segmentation results is calculated to generate a document vector. Each vector dimension corresponds to the number of occurrences of a single word in the vocabulary. The document vector is normalized to obtain the feature vector of the use of seal documents. Based on the basic data table of the use of seals, a fixed time window of 6 hours is set, and the user's application number data sequence is subjected to sliding statistics to obtain the application number sequence within the window. The discrete Fourier transform is used to process the sequence data, and the three frequency components with the largest amplitude after the transformation are taken as the user's application behavior characteristics. The user time distribution vector, the feature vector of the seal document, and the application behavior feature are spliced ​​to construct the user seal usage behavior feature vector. The Euclidean distance is used to measure the similarity between the feature vectors. The maximum spanning tree algorithm is used to cluster all the user seal usage behavior feature vectors, and the user groups are divided by the Euclidean distance of the cluster center greater than 0.6. The seal management database records all the user's seal application operation information. The seal time is reflected as a specific timestamp, such as 2024-03-1509:23:45. The batch number is unique and uses the year, month, and day plus a serial number, such as 202403150023. The file types include labor contracts, project contracts, official letters, financial statements, etc. The purpose of seal usage involves business scenarios such as external cooperation, personnel recruitment, project bidding, and reimbursement approval. According to the batch number associated document table, you can query the application department, applicant position, application reason and other supplementary information. After dividing the time periods into 24 hours, statistics show that the highest proportion is from 8 am to 12 pm, reaching 45%, followed by 2 pm to 6 pm, accounting for 30%, reflecting that the application for seal use is mainly concentrated in normal office hours. The industry general vocabulary should be constructed for the enterprise's seal use scenarios, including document type words such as contracts, official letters, and reports, as well as business use words such as procurement, sales, and personnel. The document type business contract is segmented to obtain the two words business and contract. The number of times they appear in all the documents using the seal is calculated to be 25 and 38 times respectively. After normalization, the weight values ​​are 0.3 and 0.45. The purpose of the seal is recruitment and employment. After segmentation, the two words recruitment and employment are obtained. The number of times they appear is 15 and 12 times respectively. The weights are 0.2 and 0.15 after normalization.A 6-hour fixed window is set to perform sliding statistics on the application data. For example, a user applies 3 times in the 9:00-15:00 window, 2 times in the 12:00-18:00 window, and 1 time in the 15:00-21:00 window. Through Fourier transform, it is found that the user's application behavior shows obvious periodicity, and the main frequency components correspond to the three periods of 24 hours, 72 hours and 168 hours. After the feature vectors are spliced, the proportion of a user from 8 am to 12 pm is 0.45, the proportion of afternoon is 0.3, the proportion of contract documents is 0.4, and the proportion of official letters is 0.25. The 24-hour cycle intensity is 0.8 and the weekly cycle intensity is 0.4. The Euclidean distance is calculated with other user feature vectors. Those with a distance less than 0.6 are divided into the same user group, reflecting similar seal usage rules. Users in this group mainly process seal applications in the morning every day, mainly contract documents, and their application behavior has a strong 24-hour periodicity.

[0010] Step S102: for each user group, analyze its historical seal application data, calculate the mean and standard deviation of the seal application frequency of the user group at different time scales through a sliding window, and when the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which he belongs, it is determined that the seal usage behavior of the user is abnormal.

[0011] A multi-scale sliding window is established according to the application timestamp of the user group, and the total application amount is counted through the multi-scale sliding window to obtain the application frequency sequence of the user group, and the multi-scale sliding window includes a twenty-four-hour scale, a forty-eight-hour scale and a seventy-two-hour scale; the application frequency mean and standard deviation are calculated for the application frequency sequence of the user group, and the standard deviation multiple is determined by the ratio of the standard deviation to the mean, if the ratio of the standard deviation to the mean is less than or equal to one-fourth, two times the standard deviation is used to calculate the application frequency threshold, and if the ratio of the standard deviation to the mean is greater than one-fourth of the mean, four times the standard deviation is used to calculate the application frequency threshold; the real-time application record of the user is counted through the multi-scale sliding window to obtain the real-time application total amount, and the real-time application frequency is converted by the real-time application total amount; it is determined whether the real-time application frequency exceeds the application frequency threshold, and if the real-time application frequency of the user exceeds the application frequency threshold for three consecutive sliding windows, it is determined that the user's seal usage behavior is abnormal.

[0012] Specifically, for each user group, the record table of seal application in the past three months is read, and a multi-scale sliding window is established for the application timestamp. The 24-hour scale uses a 4-hour window length, the 48-hour scale uses an 8-hour window length, and the 72-hour scale uses a 12-hour window length. The window slides every 10 minutes, and the total application amount in each window is obtained by counting the seal application timestamp, forming a multi-scale application frequency sequence for the user group. According to the seal application frequency sequence, the mean and standard deviation of the application frequency of the user group at different time scales are calculated, and the standard deviation multiple is dynamically adjusted. If the group standard deviation is less than 25% of the mean, 2 times the standard deviation is used. If the group standard deviation is greater than 25% of the mean, 4 times the standard deviation is used. During holidays, the standard deviation multiple is increased by 1 times to calculate the multi-scale frequency upper and lower limit threshold table. The latest application records of users at the 24-hour, 48-hour, and 72-hour time scales are read from the real-time seal application data table updated every 10 minutes, and the total application amount of users is counted using the same window length as the historical data at the corresponding scale, and the real-time application frequency value is converted according to the time span. The user application record exception table records information such as user number, group number, exception occurrence timestamp, exception duration, application frequency value, application frequency threshold, and exception degree. If the user's real-time application frequency in three consecutive windows exceeds the application frequency threshold interval of the group in the corresponding time scale, the exception degree score is calculated according to the difference with the threshold, and the exception record is written into the exception table. Multi-scale sliding windows play an important role in the monitoring of seal application. By setting different window lengths, the application behavior characteristics under different time spans can be captured. A 4-hour window at a 24-hour scale can reflect the fluctuation law of seal application within a single day, an 8-hour window at 48 hours can reflect the cross-day application trend, and a 12-hour window at 72 hours can show the application changes for multiple consecutive days. The window slides every 10 minutes to ensure the real-time monitoring. For example, at a 24-hour scale, the application volume of a group in the window from 8 am to 12 pm is 12 times, the application volume from 9 am to 13 pm is 15 times, and the application volume from 10 am to 14 pm is 8 times. The total application volume in the window is recorded to form an application frequency sequence. The frequency sequence of seal application reflects the characteristics of group application behavior, the mean reflects the overall application level of the group, and the standard deviation represents the degree of fluctuation of the group. The average daily application volume of the sales contract approval group is 25 times, the standard deviation is 5 times, accounting for 20% of the mean, and the threshold interval is 15-35 times calculated by 2 times the standard deviation. The average daily application volume of the personnel contract approval group is 15 times, the standard deviation is 6 times, accounting for 40% of the mean, and the threshold interval is 9-39 times calculated by 4 times the standard deviation. During holidays, the application volume fluctuates more, and the standard deviation multiple increases by 1 times, making the threshold interval wider. The real-time data table is updated every 10 minutes to read the user's latest application record. For example, the user applies 8 times within a 4-hour window on a 24-hour scale, and the daily application frequency is converted to 48 times. The application volume is 16 times within an 8-hour window on a 48-hour scale, and the daily application frequency is converted to 48 times.The 72-hour scale applied 22 times within a 12-hour window, which translates to a daily application frequency of 44 times. The close values ​​of the three scale frequencies indicate that the application behavior is stable. The abnormal record table records the abnormal application information in detail. User number U001 belongs to the sales contract approval group G001. At 10 am on March 15, 2024, it was detected that the application frequency in three consecutive windows reached 75 times, exceeding the upper limit of the group threshold by 35 times, and the degree of abnormality was 2.14 times. Subsequently, the user's application frequency dropped to 30 times, returning to the normal range of the group. Through three consecutive windows, judgments are made to avoid misjudgments caused by occasional fluctuations, and the degree of abnormality is quantified to reflect the severity of the deviation.

[0013] Step S103, when the user is judged to have abnormal seal usage behavior, the seal application data of the user during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different combinations of file types and seal usage purposes, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal usage behavior.

[0014] When a user is judged to have abnormal seal usage behavior, the seal application data of the user during the abnormal period in the abnormal seal usage record table is obtained, the seal application data includes a batch number and a seal application form, and the file type field and the seal purpose field are obtained by associating the seal application form according to the batch number; the file type field is coded and standardized according to the business type to obtain a file type identifier, and the seal purpose field is segmented and converted according to a preset vocabulary to obtain a seal purpose identifier; an association rule item set is constructed according to the file type identifier and the seal purpose identifier, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different file type and seal purpose combinations, set a minimum support threshold and a minimum confidence threshold, filter the association rule items according to the minimum support threshold, and add the rule items whose rule confidence is greater than the minimum confidence threshold in the filtered association rule items to the strong association rule set, and finally obtain a set of strong association rules reflecting the characteristics of the user's abnormal seal usage behavior.

[0015] Specifically, all application records within the abnormal period of the user are obtained from the abnormal seal record table, and the file type field and the seal purpose field are extracted according to the batch number and associated with the seal application table. The file type field data is coded and standardized according to the business type to obtain the file type identifier, and the seal purpose field is segmented and converted to the seal purpose identifier by comparing with the preset word library, and the null value records and abnormal value records are removed. For each application record, a single file type identifier and a single seal purpose identifier combination are constructed. The association rule item set is constructed for the user application data, and the maximum number of association rule items is limited to 3. The file type identifier plus the seal purpose identifier are used as the rule association item, and the generation time of each rule item is marked. The rule items are sorted in time according to the application batch time, and the ratio of the number of times each combination appears in the user application data to the total number of applications is counted to obtain the support value, and the support threshold of 0.15 is set as the item set screening standard. The confidence value of the rule is calculated for the association rule items with a support threshold greater than 0.15, and the conditional probability is calculated from the file type identifier to the seal purpose identifier. The reverse probability is calculated from the seal purpose identifier to the file type identifier. The rule confidence threshold is set to 0.75, and the rule generation time of the association combination record with a confidence greater than the threshold is added to the strong association rule set. Based on the strong association rule set, the file type identifier with the highest frequency in all rule items is extracted, and the rules are weighted in sequence according to the temporal relationship of the rule items. The records with a rule generation time of more than 24 hours are attenuated. The rule strength score is calculated by multiplying the support of the file type identifier and the seal purpose identifier with the rule confidence, and finally a set of strong association rules reflecting the characteristics of the user's abnormal seal use behavior is obtained. The association rule mining of the seal file type and purpose first requires the standardization of the original data. The file type, such as commercial contract, is marked as T01, the technical contract is marked as T02, and the operating contract is marked as T03. The seal purpose, such as project bidding, is marked as P01, business negotiation is marked as P02, and equipment procurement is marked as P03. For the application record with batch number 2024031501 in the abnormal seal record, the original value of the file type, procurement contract, is converted to T03, and the original value of the seal purpose, bidding document, is converted to P01, forming a standardized T03-P01 combination tag. The maximum number of items in the association rule item set construction limit is 3, reflecting the association relationship between the file type and the seal purpose. For example, the association of T03 file type with P01 purpose forms two rules, and the association of T03 file type with P01 and P02 purposes forms three rules. According to the batch number time sequence, 2024031501 is earlier than 2024031502, and the rule item T03-P01 is generated before T02-P02. In 100 abnormal application records, T03-P01 appears 20 times, with a support of 0.2, which is greater than the threshold of 0.15 and retains the rule item.The rule confidence calculation reflects the directionality of the association. File type T03 appears 50 times, of which 30 are associated with P01 purpose. The confidence from T03 to P01 is 0.6. P01 purpose appears 40 times, of which 30 are associated with T03 type. The confidence from P01 to T03 is 0.75, which meets the threshold requirement. The rule record generation time is 2024031510, and the rule item is marked as T03-P01-0.75-202403151000. In the strong association rule set, the frequency of T03 type occurrence is up to 35 times. The association rule items are sorted in time sequence. The weight of the earliest generated rule item is 1.0, and the weight is reduced by 0.1 after an interval of 1 hour. The weight of the rule item is reduced by 50% after more than 24 hours. The rule item T03-P01 was generated at 10 o'clock with a weight of 1.0, and the rule item T03-P02 was generated at 11 o'clock with a weight of 0.9. The products of support and confidence were 0.15 and 0.12 respectively. The weighted rule strength scores were 0.15 and 0.108.

[0016] Step S104, based on the mined strong association rules, extract the key features in the strong association rules, including the associated file type, the associated seal purpose information, and the association strength. Through feature matching, search for historical risk cases similar to the key features in the risk assessment knowledge base. According to the risk level labels of similar cases, classify the current user's abnormal seal usage behavior as high-risk behavior or low-risk behavior. For high-risk behavior, automatically reduce the user's seal usage authority and send an early warning to the administrator. For low-risk behavior, the system temporarily maintains the user's authority unchanged, but increases the monitoring frequency.

[0017] Receive abnormal seal usage rules of users in the strong association rule set, and extract the file type identifier, seal usage purpose identifier and rule generation time according to the abnormal seal usage rules to obtain key features; use the local sensitive hashing algorithm to bucket map the feature descriptors according to the key features, and obtain risk cases in the risk assessment knowledge base whose similarity is greater than a preset similarity threshold by calculating the cosine similarity of the rule feature descriptors; if the number of risk cases exceeds the preset high-risk case number threshold, it is determined to be a high-risk behavior, and the user's seal usage authority level is reduced in the seal authority table; if the high-risk determination condition is not met and it is determined to be a low-risk behavior, the monitoring time interval value and the monitoring window length value are reduced, and the user behavior change results are obtained through continuous monitoring.

[0018] Specifically, the abnormal seal usage rules of users are obtained from the strong association rule set, and the key features are constructed by extracting the file type identifier, seal usage purpose identifier, and rule generation time sequence in the rule. The rule generation time is converted into a temporal code, and the product of the rule confidence and support is used as the rule strength value. The rule feature descriptor is generated by string concatenation, and the order and association of each feature attribute in the rule are recorded. Based on the rule feature descriptor, the nearest feature matching is performed in the risk case library, and the feature descriptor is bucket-mapped using the local sensitive hashing algorithm. The cosine similarity of the rule feature descriptor is calculated, and the risk cases with a similarity greater than 0.8 are selected as the candidate set. The top 10 historical cases with similarity are taken from the candidate set. Each historical case contains the seal usage rule feature, risk level, and disposal record. For matching historical cases, the weighted sum of case similarities is calculated. The weight of cases with a similarity greater than 0.9 is set to 1.0, and the weight of cases with a similarity between 0.8 and 0.9 is set to 0.8. If the number of high-risk cases exceeds 6 after weighting, the user's contract seal and financial seal permissions are downgraded to pending approval in the seal permission table, and the legal person seal permissions are downgraded to prohibited use. At the same time, the user number, strong association rules, matching cases, and permission change details are written to the early warning message queue. For users who do not meet the high-risk judgment conditions, the seal permissions remain unchanged, and the user monitoring parameter settings are modified. The monitoring time interval is adjusted from 10 minutes to 8 minutes, and the monitoring window length is adjusted from 4 hours to 3 hours. Strengthened monitoring lasts for 72 hours. If no abnormal behavior occurs for 72 consecutive hours, the monitoring parameters will be restored to the initial settings. If an abnormality occurs again during this period, the enhanced monitoring time will be extended by 72 hours. Key features are constructed to describe the seal-using behavior in a standardized manner. For example, a user applies for a seal for a procurement contract at 10 o'clock and for a tender document at 11 o'clock. The file types are identified as T03 and T02 respectively, and the seal-using purposes are identified as P01 and P02. The rule features T03P01-T02P02 are generated according to the time sequence. The rule confidence of 0.85 is multiplied by the support of 0.2 to obtain the rule strength of 0.17. The feature descriptor is recorded as T03P01-T02P02-0.17-1011, where 1011 represents the time sequence relationship between 10 o'clock and 11 o'clock. The local sensitive hashing algorithm improves the matching efficiency by bucketing the features. The rule feature descriptor T03P01-T02P02-0.17-1011 is mapped to the hash bucket numbered 506. The historical risk case RK00125 is stored in the hash bucket. The feature descriptor is T03P01-T02P03-0.16-1012. The cosine similarity of the two feature descriptors is 0.92, which exceeds the similarity threshold of 0.8. The case RK00125 is added to the candidate set. Among all the candidate cases, the top 10 cases in similarity are all from the contract seal risk case library, which contains historical disposal records.The risk level determination comprehensively considers the case similarity weight. The case RK00125 with a similarity of 0.95 has a weight of 1.0 and a final weighted score of 0.95. The case RK00132 with a similarity of 0.85 has a weight of 0.8 and a weighted score of 0.68. Eight of the 10 matching cases are marked as high risk. After weighting, the number of high-risk cases is 7, which exceeds the threshold of 6 high-risk cases. Seal authority adjustment distinguishes different seal types. The application for the contract seal is changed to pending approval status. It can only be used after the administrator approves it. The financial seal is also set to pending approval, and the legal person seal is directly prohibited from use. The early warning message records that user U0023 has strong association rules T03P01-T02P02 on March 15, 2024, which matches case RK00125. The authority change includes 3 seal types. Dynamic adjustment of monitoring parameters realizes differentiated monitoring. The time interval is shortened to 8 minutes to increase the sampling frequency, and the window length is shortened to 3 hours to improve the real-time monitoring. Enhanced monitoring lasts for 72 hours. If the user has an abnormality again after 50 hours, the enhanced monitoring period will be extended by 72 hours, and the monitoring time will be increased to 120 hours. If no abnormality occurs within 120 hours, the monitoring interval will be restored to 10 minutes and the window length will be restored to 4 hours.

[0019] Step S105, regularly collect follow-up tracking data of all abnormal users within a period of time, including user authority change records and behavior performance change trends after abnormal behavior occurs, to form a strategy optimization training sample set, and use factor analysis to automatically extract key factors that affect the authority adjustment effect from the sample data of the training sample set, including the association rule characteristics of abnormal behavior and the behavior pattern of the group to which the user belongs, to establish an authority adjustment strategy optimization model based on key influencing factors.

[0020] Abnormal user data is read from the authority change record table, and a user behavior tracking sample set is obtained through standardization processing. The user behavior tracking sample set includes six dimensional data: total number of seal applications, application frequency, file type distribution, seal purpose distribution, application period distribution, and association rule characteristics. The coefficient of difference is calculated based on the user behavior tracking sample set, and the maximum standard deviation rotation method is used to perform factor analysis to obtain the principal component factors whose eigenvalues ​​are greater than the preset eigenvalue threshold and whose cumulative contribution rate exceeds the load threshold. The principal component factors are key factors affecting the authority adjustment effect, including the association rule characteristics of abnormal behavior and the behavior patterns of the group to which the user belongs. The authority adjustment effect scoring matrix is ​​constructed by fitting the relationship between the principal component factors and the authority adjustment effect through a random forest regressor, and a permission adjustment strategy optimization model based on key influencing factors is established based on the authority adjustment effect scoring matrix.

[0021] Specifically, read the abnormal user data in the last 90 days from the permission change record table, extract the original data of six dimensions, including the total number of seal applications, application frequency, file type distribution, seal purpose distribution, application period distribution, and association rule characteristics, and standardize to the interval of 0 to 1 according to the maximum value of each record. Fill the missing values ​​with the mean of the user group to which they belong, generate a user behavior tracking sample set, and record the user number, group to which they belong, abnormal occurrence time, and performance data before and after the permission change. For the user behavior tracking sample set, calculate the difference coefficient of each user to the benchmark value of the group in six dimensions, set the difference coefficient calculation window to 30 days, use the maximum standard deviation rotation method to perform factor analysis, limit the number of rotation iterations to 50 times, select the principal component factors with eigenvalues ​​greater than 1.0 and cumulative contribution rates exceeding the load threshold of 0.65, and name the factors based on business meaning. The relationship between factor scores and authority adjustment effects is fitted by random forest regressor to construct the authority adjustment effect scoring matrix. The authority effect score is weighted based on the frequency of user anomalies, degree of violation, and rectification time. The weights of the three indicators are determined by the hierarchical analysis method. Based on the authority adjustment effect scoring matrix, an optimization model for the authority adjustment strategy based on key influencing factors is established. The depth of the tree is limited to 8 layers, and the minimum number of sample splits is set to 10. The contribution value of each principal component factor to the adjustment effect is extracted. The user group benchmark value is weighted and updated based on the authority adjustment effect contribution value. The anomaly judgment threshold interval is adjusted according to the contribution value ratio. The seal use restriction rules are added to the user authority table. The restriction rules include four attribute fields: seal type, authority level, time limit, and approval process. The specific values ​​are set according to the rule parameter configuration table. The data collection of seal usage behavior tracking covers multiple business dimensions. For example, the average monthly application volume of sales contract users was 120 times in the 90 days before the adjustment of permissions, which was reduced to 45 times after the adjustment. The application frequency was reduced from 8 times a day to 3 times a day. The file types were changed from concentrated in procurement contracts to dispersed distribution of various types. The purpose of seal usage extended from equipment procurement to business negotiations. The application period changed from fixed morning to uniform throughout the day. The association rule characteristics changed from a single rule to a diverse combination. The original data was mapped to the interval of 0 to 1 after standardization. The normalized value of 120 applications was 1.0, and the normalized value of 45 applications was 0.375. The average application volume of the sales group to which the user belongs was 85 times to fill in the missing values ​​of the records. The calculation of the coefficient of difference reflects the difference between individual and group behaviors of users. The benchmark application volume of the sales group is 85 times per month. The coefficient of difference is 0.41 for 120 applications before the adjustment, and -0.47 for 45 applications after the adjustment. The maximum standard deviation rotation method was used to extract the principal component factors. After 32 iterations, the method converged and obtained three principal components with eigenvalues ​​of 2.8, 1.5, and 1.2, respectively, with a cumulative contribution rate of 0.72. Based on the business meaning, the three principal components were named application intensity factor, rule compliance factor, and time series regularity factor.The score of the authority adjustment effect takes into account multiple indicators. The frequency of user anomalies is reduced from 3 times per month to 1 time, with a score of 0.8. The degree of violation is reduced from 75% to 25%, with a score of 0.7. The rectification time is shortened from an average of 5 days to 2 days, with a score of 0.9. The analytic hierarchy process determines the weights of the three indicators to be 0.4, 0.35, and 0.25 respectively. The random forest regressor is set to 8 layers of depth and the minimum number of split samples is 10. The contribution value of the application intensity factor is 0.45, the contribution value of the rule compliance factor is 0.35, and the contribution value of the time series regularity factor is 0.2. The group benchmark judgment standard is updated based on the factor contribution value. The benchmark value of the sales group application volume is adjusted from 85 times to 75 times, the upper limit of the abnormal judgment is lowered from 120 times to 105 times, and the lower limit is raised from 50 times to 55 times. The restriction rules on seal usage reflect differentiated management. The authority level for contract seal is set at 4 levels, with a daily limit of 5 times, a level 3 approval process, and a validity period of 30 days. The authority level for finance seal is set at 3 levels, with a daily limit of 3 times, a level 2 approval process, and a validity period of 15 days. The authority level for legal person seal is set at 5 levels, with a daily limit of 2 times, a level 4 approval process, and a validity period of 7 days.

[0022] Step S106, based on the permission adjustment strategy optimization model of key influencing factors, by mining the behavioral change patterns of user groups before and after the permission adjustment, automatically learn and filter patterns with confidence higher than a preset confidence threshold and influence higher than a preset influence threshold as new rules, and dynamically update the new rules by continuously feeding them back to the permission adjustment strategy optimization model, to build an adaptive permission management mechanism in the smart seal management system that can evolve autonomously according to user behavior.

[0023] Obtain continuous behavior data of the user group before and after the permission adjustment point from the permission change record table, and obtain a change trend curve based on the behavior data using a sliding window statistical method; determine whether the fluctuation value is less than a preset fluctuation threshold based on the change trend curve, and if the fluctuation value is less than the preset fluctuation threshold, obtain stable interval behavior data; perform sequence clustering on the stable interval behavior data to obtain a behavior pattern, and calculate the confidence and influence index value through the behavior pattern, and if the confidence is higher than a preset confidence threshold and the influence is higher than a preset influence threshold, determine a valid behavior pattern; use the valid behavior pattern as a new rule to construct a permission change rule set, use a decision tree to perform incremental training on the permission change rule set, and determine the accuracy of the new rule through a verification sample set, and if the accuracy exceeds the preset threshold, feed the new rule back to the permission adjustment strategy optimization model for dynamic update.

[0024] Specifically, the user group's behavior data for 90 consecutive days before and after the permission adjustment point is obtained from the user permission change record table. The change trend is calculated based on the four dimensions of application frequency, file type ratio, purpose of use, and time period distribution. The slope of the change curve is recorded using a 6-hour sliding window statistical method. The curve fluctuation measurement index is used to determine that the fluctuation exceeds 0.3 interval data is removed, and the stable interval behavior data is retained. Based on the stable interval behavior data, sequence clustering is used to extract the user group behavior pattern. For each behavior sequence, the three indicators of support, confidence, and promotion are calculated. According to the business rules, the support threshold is set to 0.3, the confidence threshold is set to 0.7, and the promotion threshold is set to 1.5. The sequences exceeding the threshold are selected as valid behavior patterns. The behavior pattern is calculated to include the frequency of event occurrence and the degree of business impact to obtain the confidence level value and impact intensity value. Construct permission change rules for effective behavior patterns. Rule attributes include user group identification, permission type, adjustment direction, change range, effective conditions, approval process, and validity period. The rule strength value is calculated by multiplying the confidence level and the impact strength by the rule effectiveness decay coefficient. Rules with a rule strength lower than 0.5 are eliminated, and the rule priority is established by sorting the rules according to the rule strength value. Incremental training is performed on permission change rules based on decision trees, with a maximum tree depth of 8 layers and a minimum number of split samples of 10. Rules are extracted from newly added permission change data every 12 hours, and the accuracy of new rules is calculated through the rule verification sample set. Rules with an accuracy exceeding 0.8 and a rule strength value exceeding the minimum value of the existing rule set are fed back to the permission adjustment strategy optimization model for dynamic update. Rules with an effective time of more than 90 days in the rule set are eliminated, and rule evaluation indicators are updated regularly. Behavior change trend monitoring reflects user group characteristics through multi-dimensional data. The sales contract approval group applied for 15 times a day on average 90 days before the authority adjustment. Among the file types, procurement contracts accounted for 0.6, tender documents accounted for 0.3, and the purpose of using seals was mainly business negotiations, accounting for 0.5. The application period was concentrated between 9 am and 11 am, accounting for 0.7. A 6-hour sliding window was used to record the change curve. The application volume in the window dropped from 15 times to 8 times, with a slope of -1.17 and a curve fluctuation of 0.25, which was lower than the preset fluctuation threshold of 0.3, and was determined to be stable interval data. The sequence clustering extraction behavior pattern reflects the group behavior law. In the stable interval of the sales group, there were 20 applications for tender documents within 12 hours after the purchase contract was stamped with the contract seal. The support degree was 0.2, the confidence degree was 0.8, and the promotion degree was 1.8 in the total sequence of 100 times, exceeding the preset threshold. The annual frequency of this sequence event is 250 times, involving an amount of 50 million yuan, with a confidence level of 0.75 and an impact intensity of 0.85.The authority change rule structured record control requirements, rule number R001 applies to the sales group, the authority type includes the contract special seal, the adjustment direction is to reduce the quota, the change range is to reduce the daily limit by 5 times, the effective condition is to exceed the limit for 3 consecutive days, the approval process is the double approval of the department head and the person in charge, and the validity period is 30 days. The rule confidence level 0.75 multiplied by the impact strength 0.85 is 0.64, and the rule strength is 0.58 after the 15-day time attenuation coefficient 0.9 correction. Decision tree incremental training realizes dynamic optimization of rules. The newly added authority change data shows that the violation rate of the sales group has dropped by 40% after the quota is tightened. The accuracy of the new rule on the verification sample reaches 0.85, and the rule strength of 0.58 is higher than the minimum value of 0.52 of the existing rule set. Training is done once every 12 hours, and 8 rule updates and iterations are completed within 90 days. The rule evaluation indicators show that the accuracy of violation warning has increased from 0.75 to 0.85, and the false alarm rate has dropped from 0.15 to 0.08. Through continuous iterative verification, inapplicable rules can be adjusted in a timely manner to maintain the timeliness of the rule base.

[0025] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made on the basis of the present invention. Therefore, these modifications or improvements made on the basis of not departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. The adaptive authority management method of the intelligent seal management system is characterized by: The method comprises: Obtain the user's seal operation sequence data in different time periods, including seal usage time, file type, and seal usage purpose information, build the user seal usage behavior feature vector, and group all users through clustering algorithms to obtain several user groups with different seal usage behavior patterns; For each user group, analyze their historical seal application data, calculate the mean and standard deviation of the seal application frequency of the user group at different time scales through a sliding window, and determine that the user's seal application behavior is abnormal when the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which he belongs; When a user is judged to have abnormal seal-use behavior, the seal-use application data of the user during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different combinations of file types and seal-use purposes, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal-use behavior; According to the mined strong association rules, the key features in the strong association rules are extracted, including the associated file type, the associated seal purpose information, and the association strength. Through feature matching, historical risk cases similar to the key features are found in the risk assessment knowledge base. According to the risk level labels of similar cases, the current user's abnormal seal use behavior is divided into high-risk behavior or low-risk behavior. For high-risk behavior, the user's seal use authority is automatically reduced and an early warning is sent to the administrator. For low-risk behavior, the system temporarily maintains the user's authority unchanged, but increases the monitoring frequency; Regularly collect follow-up tracking data of all abnormal users over a period of time, including user permission change records and behavior performance change trends after abnormal behavior occurs, to form a strategy optimization training sample set. Use factor analysis to automatically extract key factors that affect the effect of permission adjustment from the sample data of the training sample set, including the association rule characteristics of abnormal behavior and the behavior patterns of the user group, and establish a permission adjustment strategy optimization model based on key influencing factors; The permission adjustment strategy optimization model based on key influencing factors mines the behavioral change patterns of user groups before and after permission adjustment, automatically learns and filters patterns with confidence levels higher than a preset confidence threshold and influence levels higher than a preset influence threshold as new rules, and dynamically updates the new rules by continuously feeding them back to the permission adjustment strategy optimization model, thus building an adaptive permission management mechanism in the smart seal management system that can evolve autonomously according to user behavior.

2. The method according to claim 1, characterized in that The method obtains the user's seal operation sequence data in different time periods, including seal use time, file type, and seal use purpose information, constructs the user's seal use behavior feature vector, and groups all users through a clustering algorithm to obtain a number of user groups with different seal use behavior patterns, including: Obtain user seal operation sequence data from the seal management database, and calculate the proportion of application times by time period based on the seal operation sequence data to obtain the user time period distribution vector; For the file type and the purpose of printing field in the printing operation sequence data, Jieba word segmenter is used to perform word segmentation processing, and the word frequency of the word segmentation result is calculated and normalized to obtain the feature vector of the printing document; According to the data of the printing operation sequence, a time window is set to perform sliding statistics, a discrete Fourier transform is performed on the application number sequence in the window, and the application behavior characteristics are obtained by taking the frequency component with the maximum amplitude after the Fourier transform; The user time period distribution vector, the seal document feature vector and the application behavior feature are concatenated to construct a user seal usage behavior feature vector, a maximum spanning tree algorithm is used to perform clustering operations on the user seal usage behavior feature vector, and user groups are divided by Euclidean distance.

3. The method according to claim 1, characterized in that For each user group, the historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated through a sliding window. When the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which he belongs, it is determined that the seal application behavior of the user is abnormal, including: Establish a multi-scale sliding window according to the application timestamp of the user group, and obtain the user group application frequency sequence by counting the total number of applications through the multi-scale sliding window, wherein the multi-scale sliding window includes a 24-hour scale, a 48-hour scale, and a 72-hour scale; The application frequency mean and standard deviation are calculated for the application frequency sequence of the user group, and the standard deviation multiple is determined by the ratio of the standard deviation to the mean. If the ratio of the standard deviation to the mean is less than or equal to one quarter, two times the standard deviation is used to calculate the application frequency threshold; if the ratio of the standard deviation to the mean is greater than one quarter of the mean, four times the standard deviation is used to calculate the application frequency threshold; The multi-scale sliding window is used to collect statistics on the real-time application records of users to obtain the total real-time application amount, and the real-time application frequency is obtained by converting the total real-time application amount; It is determined whether the real-time application frequency exceeds the application frequency threshold. If the user's real-time application frequency exceeds the application frequency threshold for three consecutive sliding windows, it is determined that the user's seal usage behavior is abnormal.

4. The method according to claim 1, characterized in that: When a user is determined to have abnormal seal usage behavior, the seal application data of the user during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different combinations of file types and seal usage purposes, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal usage behavior, including: When a user is judged to have abnormal seal usage behavior, obtain the seal application data of the user during the abnormal period in the abnormal seal usage record table, the seal application data includes a batch number and a seal application form, and the file type field and the seal purpose field are obtained by associating the seal application form with the batch number; The file type field is coded and standardized according to the business type to obtain a file type identifier, and the printing purpose field is segmented and converted according to a preset word library to obtain a printing purpose identifier; According to the file type identification and the seal purpose identification, the association rule item set is constructed, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different file type and seal purpose combinations, set the minimum support threshold and the minimum confidence threshold, and filter the association rule items through the minimum support threshold. The rule items with rule confidence greater than the minimum confidence threshold in the filtered association rule items are added to the strong association rule set, and finally a set of strong association rules reflecting the characteristics of the user's abnormal seal usage behavior is obtained.

5. The method according to claim 1, characterized in that According to the mined strong association rules, key features in the strong association rules are extracted, including associated file types, associated seal purpose information, and association strength. Historical risk cases similar to the key features are searched in the risk assessment knowledge base by feature matching. According to the risk level labels of similar cases, the abnormal seal use behavior of the current user is classified as high-risk behavior or low-risk behavior. For high-risk behavior, the user's seal use authority is automatically reduced, and an early warning is sent to the administrator. For low-risk behavior, the system temporarily maintains the user's authority unchanged, but increases the monitoring frequency, including: Receive the abnormal seal usage rules of the user in the strong association rule set, and extract the file type identifier, seal usage purpose identifier and rule generation time according to the abnormal seal usage rules to obtain key features; The feature descriptors are bucket-mapped using a local sensitive hashing algorithm according to the key features, and risk cases in the risk assessment knowledge base whose similarity is greater than a preset similarity threshold are obtained by calculating the cosine similarity of the rule feature descriptors; If the number of risk cases exceeds the preset high-risk case number threshold, it is determined to be a high-risk behavior, and the user's seal usage authority level is reduced in the seal authority table; If the high-risk judgment conditions are not met and it is judged as a low-risk behavior, the monitoring time interval value and the monitoring window length value are reduced, and the user behavior change results are obtained through continuous monitoring.

6. The method according to claim 1, characterized in that The follow-up tracking data of all abnormal users within a period of time is regularly collected, including the user authority change records and behavior performance change trends after the abnormal behavior occurs, to form a strategy optimization training sample set, and the key factors affecting the authority adjustment effect are automatically extracted from the sample data of the training sample set using factor analysis, including the association rule characteristics of the abnormal behavior and the behavior pattern of the group to which the user belongs, and the authority adjustment strategy optimization model based on the key influencing factors is established, including: Abnormal user data is read from the permission change record table, and a user behavior tracking sample set is obtained through standardization processing, wherein the user behavior tracking sample set includes six dimensional data, namely, the total amount of seal application, application frequency, file type distribution, seal purpose distribution, application period distribution and association rule characteristics; Calculate the coefficient of difference based on the user behavior tracking sample set, use the maximum standard deviation rotation method to perform factor analysis, and obtain the principal component factors whose eigenvalues ​​are greater than the preset eigenvalue threshold and whose cumulative contribution rates exceed the load threshold. The principal component factors are key factors that affect the effect of authority adjustment, including the association rule characteristics of abnormal behavior and the behavior patterns of the group to which the user belongs; The relationship between the principal component factors and the authority adjustment effect is fitted by the random forest regressor to construct a authority adjustment effect scoring matrix, and based on the authority adjustment effect scoring matrix, an authority adjustment strategy optimization model based on key influencing factors is established.

7. The method according to claim 6, characterized in that The authority adjustment effect scoring matrix is ​​weighted based on the frequency of user anomalies, degree of violation, and rectification time, and the weights of the three indicators are determined using the hierarchical analysis method.

8. The method according to claim 1, characterized in that The permission adjustment strategy optimization model based on key influencing factors mines the behavior change patterns of user groups before and after permission adjustment, automatically learns and selects patterns with confidence higher than a preset confidence threshold and influence higher than a preset influence threshold as new rules, and continuously feeds the new rules back to the permission adjustment strategy optimization model to achieve dynamic updates, thereby building an adaptive permission management mechanism in the intelligent seal management system that can autonomously evolve according to user behavior, including: Obtaining continuous behavior data of the user group before and after the permission adjustment point from the permission change record table, and obtaining a change trend curve based on the behavior data using a sliding window statistical method; Determining whether the fluctuation value is less than a preset fluctuation threshold value according to the change trend curve, and if the fluctuation value is less than the preset fluctuation threshold value, obtaining stable interval behavior data; Performing sequence clustering on the stable interval behavior data to obtain a behavior pattern, calculating a confidence and an influence index value through the behavior pattern, and determining a valid behavior pattern if the confidence is higher than a preset confidence threshold and the influence is higher than a preset influence threshold; The effective behavior pattern is used as a new rule to construct a permission change rule set, and a decision tree is used to perform incremental training on the permission change rule set. The accuracy of the new rule is judged by verifying the sample set. If the accuracy exceeds a preset threshold, the new rule is fed back to the permission adjustment strategy optimization model for dynamic updating.

9. The method according to claim 8, characterized in that The rule attributes of the permission change rule include user group identification, permission type, adjustment direction, change range, effective conditions, approval process and time limit.

Images