Access strategy detection method and system based on security intention perception and access behavior recognition

Abstract

The invention relates to the technical field of data security access control, in particular to an access strategy detection method and system based on security intention perception and access behavior recognition, which decomposes an access control strategy analysis problem into three tasks of security intention recognition, access behavior perception and SMT security analysis. Using LLM to identify an initial security intention constraint from a natural language document describing security requirements; dynamically sensing the evolution security intention constraint at the current moment from the access control log through a clustering algorithm; a standard ABAC strategy is converted into a formalized predicate logic expression, SMT solution is carried out in combination with initial security intention constraints, evolution security intention constraints and security principle constraints, a conclusion of security analysis of the access control strategy to be analyzed is obtained, and guidance suggestions can be given. According to the method, security analysis of the access control policy in different dimensions and from different angles can be realized, and the labor cost of a policy analysis task is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data security access control, and particularly to an access policy detection method and system based on security intention perception and access behavior recognition. Background Art

[0002] Access control is an indispensable security protection means in various information systems, which is used to restrict that only legitimate users can obtain the necessary access permissions to complete the required tasks. In a distributed multi-user and multi-device infrastructure environment, there are a large number of sensitive resources (data, services, interfaces, processes, etc.) that need to be protected. Simply relying on subject trust will bring unnecessary high security risks, and an access control system is required to control access to system resources. Existing access control strategies can be regulated and implemented using a variety of different access control models. Among these models, the attribute-based access control model uses attributes as the basic elements of access control, can flexibly use the set of attributes owned by entities to determine whether to grant them access permissions, has strong semantic expression capabilities, is compatible with multiple access control mechanisms, and is suitable for solving the problems of fine-grained access control and large-scale dynamic authorization in open computing environments such as big data and cloud computing.

[0003] However, due to the rich semantic expression capabilities of the ABAC model, the complex syntax of actual policy execution, and the frequent dynamic changes in business security requirements and application scenarios, the setting of attribute-based access control policies is considered difficult and error-prone. An access control policy is a normative expression that describes which resources can be accessed by whom and under what conditions. Incorrect policy settings will directly lead to the inability of the access control system to operate correctly, and it is difficult to effectively guarantee the security attributes such as resource security and availability in the system. For example, when it is necessary to update the policy to meet new business requirements, it is difficult to determine whether the modified policy can complete the work according to the expected security intention. In current multi-user and multi-device infrastructures such as big data and cloud computing, the scale and diversity of resources for different distributed application scenarios (computing, storage, sharing) are constantly increasing. Organizations may need to configure different access control policies for different business service resources, which also makes policy configuration become increasingly complex. With the increase in the complexity of access control policies, it is becoming increasingly difficult for security administrators to understand the impact of a set of access control policies on protected resources. Even a small policy configuration error may lead to large-scale data leakage problems. Therefore, ensuring the correctness of attribute-based access control policy configuration is crucial for implementing access control.

[0004] Therefore, security administrators need to use automated policy security verification tools to assist the system in policy security analysis, timely detect and correct policy configuration errors, avoid major legal and economic consequences caused by data leakage and privacy violations, and provide strong support for building a correct access control policy set for the system. Currently, it is used to help security administrators verify whether access control policies meet certain properties, such as checking policy consistency, completeness, and redundancy. However, due to the limited expressiveness of the policy description method used, existing tools can only analyze a restricted set of security properties. At the same time, existing tools lack the detection of whether access control policies truly implement the system's security intentions and whether access behaviors strictly implement policy constraints, resulting in the security deviation problem of updated access control policies. Moreover, existing policy analysis tools usually do not support reasoning about non-boolean variables and functions, and non-boolean variables and functions also appear in attribute-based access control policies. Therefore, it is difficult to comprehensively analyze access control policies at a fine-grained level, or the analysis performance will quickly decline. For this reason, there is an urgent need for a means to dynamically detect whether access control policies violate different security principles to meet the application function requirements of multi-class information system security protection. Summary of the Invention

[0005] Therefore, the present invention provides an access policy detection method and system based on security intention perception and access behavior recognition, which solves the problem that it is difficult for existing access control policy security verification tools to achieve fine-grained and comprehensive analysis and evaluation. It realizes the automated analysis and verification of violations of different security principles by decomposing the access control policy analysis problem into three tasks: security intention recognition, access behavior perception, and SMT security analysis.

[0006] According to the design solution provided by the present invention, on the one hand, an access policy detection method based on security intention perception and access behavior recognition is provided, including:

[0007] Extract security intention constraints from a security document containing access control information, and obtain access behavior constraints from access control logs. The security intention constraints are used to describe the restrictions on subjects, objects, and corresponding operations under each attribute constraint in the security document, and the access behavior constraints are used to describe the restrictions on the access behaviors and decision results of subjects to objects in the access control logs;

[0008] Based on the Satisfiability Modulo Theories (SMT) and combined with security intention constraints and access behavior constraints, transform the access control policy security analysis into a security principle constraint satisfiability problem, and use an SMT solver to solve the security principle constraint satisfiability problem of the access control policy to be analyzed, so as to evaluate whether the access control policy to be analyzed meets the security principle constraints.

[0009] As the access policy detection method based on security intention perception and access behavior recognition of the present invention, further, extracting security intention constraints from a security document containing access control information, including:

[0010] Obtain a specification document containing access control information, and use a large model to perform data augmentation on the specification document to generate augmented sample examples. The access control elements are marked in the specification document, and the augmented sample examples are composed of the subject attributes, object attributes, and operation attributes in the access control information statements of both the specification document and the data augmentation results;

[0011] Traverse the sample examples and obtain the security intention recognition rules corresponding to the sample examples through feedback-based scenario learning. Combine the security intention recognition task instructions and the security intention recognition rules, and use question clustering and example sampling to enable the large model to generate a security intention recognition thought chain template;

[0012] Input the security document containing access control information into multiple large models, and extract the security intention constraints in the security document through model consensus based on the security intention recognition thought chain template and using multiple large models.

[0013] As the access policy detection method based on security intention perception and access behavior recognition of the present invention, further, obtaining the security intention recognition rules corresponding to the sample examples through feedback-based scenario learning, including:

[0014] Set a security intention recognition rule set and a temporary set for storing feedback results;

[0015] Traverse the sample examples in the specification document, retrieve each sample in the security intention recognition rule set and the augmented sample examples respectively to obtain several rules and examples most relevant to the sample. Create a security intention query based on the security intention recognition task instructions, the sample, the examples, and the several rules. The security intention query is used to ask the LLM thruster whether the instance contains access control semantic information; and based on the security intention query, enable the LLM inference engine to predict and output a security intention recognition answer and a subset of retrieved rule references;

[0016] Calculate the corresponding rule task scores according to the number of rule retrievals, rule references, correctly predicted outputs, references, and the number of example numbers corresponding to incorrect predicted outputs. Delete the rules in the security intention recognition rule set whose task scores are lower than the preset threshold. For the case of incorrect predicted outputs, use the large model to infer the correct rules based on the examples, the incorrect predicted outputs, and the security intention recognition labels and add them to the security intention recognition rule set.

[0017] As the access policy detection method based on security intention perception and access behavior recognition of the present invention, further, based on the security intention recognition thought chain template and using multiple large models to extract the security intention constraints in the security document through model consensus, including:

[0018] Collect multiple open-source large models and set up a target model and a review model, and pre-train the target model and the review model respectively for the security intention recognition task;

[0019] Input the security document containing access control information into the target model and the review model. If the proportion of the output of the review model that is inconsistent with the output of the target model exceeds the consensus threshold, the target model performs output inference correction according to the inconsistent output of the review model so that the proportion of the inconsistent output meets the requirements of the consensus threshold, and takes the model consensus output that meets the requirements of the consensus threshold as the security intention constraint extracted from the security document.

[0020] As the access policy detection method based on security intention perception and access behavior recognition of the present invention, further, obtain the access behavior constraints from the access control logs, including:

[0021] Obtain the access behavior logs from the access control system, and based on the specific operation behavior of the subject on the object obtained from the access behavior logs, combine the specific operation behavior of the subject on the object with the attribute relationship to generate ABAC behavior log data;

[0022] Cluster the ABAC behavior log data to cluster the behavior information into several behavior data clusters according to semantic similarity. Each behavior data cluster consists of different numbers of ABAC behavior logs. Extract the entity attribute relationship and the relationship between attributes in each behavior data cluster respectively according to the occurrence frequency of the attribute value and the consistent frequency of the attribute values of the attributes, and form the access behavior constraint set of each behavior data cluster;

[0023] Use the Jaccard similarity to calculate the similarity of the access behavior constraint sets between the behavior data clusters. If the similarity exceeds the specified threshold, optimize the access behavior constraint set by comparing and adding or deleting the tuples of the access behavior constraint sets of one of the behavior data clusters to obtain the optimized final access behavior constraint set.

[0024] As the access policy detection method based on security intention perception and access behavior recognition of the present invention, further, based on the satisfiability modulo theory and combining the security intention constraints and the access behavior constraints, transform the security analysis of the access control policy into a satisfiability problem of security principle constraints, including:

[0025] Encode the statements related to security intent constraints, access behavior constraints, and access control policies into SMT predicate logic formulas, and the SMT predicate logic expressions are implemented using one or more of strings, regular expressions, bit vectors, and integer comparisons;

[0026] Construct multi-dimensional security principle constraints based on the mandatory security principle, optional security principle, and user-defined security principle in the security analysis of access control policies, and encode the multi-dimensional security principle constraints into STM predicate logic formulas.

[0027] As the access policy detection method based on security intent perception and access behavior recognition of the present invention, further, use the satisfiability modulo theory solver to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, including:

[0028] Unify the access control policy to be analyzed, security principle constraints, security intent constraints, and access behavior constraints into STM predicate logic formulas, and use the SMT solver Z3 to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, so as to evaluate and judge whether the access control policy to be analyzed meets the security principle.

[0029] On the other hand, the present invention also provides an access policy detection system based on security intent perception and access behavior recognition, including: a data extraction module and a policy detection module, where,

[0030] The data extraction module is used to extract security intent constraints from the security document containing access control information, and obtain access behavior constraints from the access control log. The security intent constraints are used to describe the restrictions on the subject, object, and corresponding operations under each attribute constraint in the security document, and the access behavior constraints are used to describe the restrictions on the access behavior of the subject to the object and the decision result in the access control log;

[0031] The policy detection module is used to transform the security analysis of the access control policy into a satisfiability problem of security principle constraints based on the satisfiability modulo theory and in combination with security intent constraints and access behavior constraints, and use the satisfiability modulo theory solver to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, so as to evaluate whether the access control policy to be analyzed meets the security principle constraints.

[0032] The beneficial effects of the present invention:

[0033] The present invention uses an LLM to identify initial security intention constraints from natural language documents describing security requirements, dynamically perceives the evolving security intention constraints at the current moment from access control logs through a clustering algorithm, transforms the standard ABAC policy into a formal predicate logic expression, combines the initial security intention constraints, the evolving security intention constraints, and the security principle constraints for SMT solving, and obtains the conclusion of the security analysis of the access control policy to be analyzed and can give guiding suggestions. Experiments prove that the solution of this case can achieve security analysis of access control policies from different dimensions and perspectives, greatly reducing the labor cost of the policy analysis task. Among them, combined with experimental data, the security intention recognition of the solution of this case has a security intention coverage rate of more than 85%, and the access behavior perception has an F-score of more than 95%. It can effectively detect violations of different security principles and can provide effective support for the policy security analysis task. Description of the Drawings

[0034] Figure 1 Schematic diagram of the access policy detection and analysis architecture based on security intention perception and access behavior recognition in the embodiment;

[0035] Figure 2 Schematic diagram of the full life cycle management of the attribute-based access control policy in the embodiment;

[0036] Figure 3 Schematic diagram of the security intention recognition process in the embodiment;

[0037] Figure 4 Schematic diagram of the access behavior perception process in the embodiment;

[0038] Figure 5 Schematic diagram of the experimental results of security intention recognition in the embodiment;

[0039] Figure 6 Schematic diagram of the experimental results of access behavior perception in the embodiment;

[0040] Figure 7 Schematic diagram of the time overhead for solving each security principle constraint in the embodiment. Detailed Embodiment

[0041] To make the purpose, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the drawings and technical solutions.

[0042] Most of the current research on the security analysis of access control policies only focuses on the policies themselves, lacking the perception of the system's security intentions. It is difficult to ensure that the policies always follow the system's security intentions during the evolving policy management process. The cost of policy security analysis will increase significantly with the increase in the scale and complexity of the policies, and it is difficult to achieve a balance between security and availability. Therefore, to address the security analysis problem of dynamically evolving policies in complex information systems, the embodiments of the present invention provide an access policy detection method based on security intention perception and access behavior recognition, which includes the following content:

[0043] S101. Extract security intention constraints from a security document containing access control information, and obtain access behavior constraints from access control logs. The security intention constraints are used to describe the restrictions on the subject, object, and corresponding operations under each attribute constraint in the security document, and the access behavior constraints are used to describe the restrictions on the access behavior of the subject to the object and the decision result in the access control log;

[0044] S102. Based on the Satisfiability Modulo Theories (SMT) and combined with the security intention constraints and access behavior constraints, transform the security analysis of access control policies into a problem of the satisfiability of security principle constraints, and use an SMT solver to solve the problem of the satisfiability of the security principle constraints of the access control policy to be analyzed, so as to evaluate whether the access control policy to be analyzed meets the security principle constraints.

[0045] Attribute-Based Access Control (ABAC) is a powerful and flexible tool that can help organizations and enterprises achieve precise and dynamic access control in an open computing environment. This model does not directly define authorization between the subject and the object, but uses the attributes of the subject, object, and operation as the authorization basis to determine whether to grant the user the corresponding access permission, and has strong policy semantic expression ability. Therefore, S, O, and OP can be set to represent the sets of subjects, objects, and operations in the model, respectively. A S 、A O 、A OP are the mappings of subject attributes, object attributes, and operation attributes respectively. Entity = S ∪ O and A SET = A S ∪ A O ∪ A OP represent the set of all entities and the set of attributes respectively.

[0046] Among them, the entity-attribute relationship represents the assignment relationship between the subject, object, and specific attribute values, that is, which attributes and attribute values are possessed, including the subject-attribute relationship and the object-attribute relationship. For the attribute a in the attribute set A SET , V a represents the set of attribute values. Set F = {(a, v|!v)|a ∈ ASET ∧ v ∈ V a} is the set of entity - attribute relationships, F S is the set of subject - attribute relationships, F O is the set of object - attribute relationships. For example, an entity - attribute relationship f=(a, v) means that the attribute a has the attribute value v, and f=(a,!v) means that the attribute a does not have the attribute value v.

[0047] The relationship between attributes represents the relationship between attribute values of different attributes. For the attributes a1 and a2 in the set A SET , v a1 and v a2 respectively represent the attribute values of attributes a1 and a2, and V ={(a1, a2|!a2)|a1, a2 ∈ A SET ∧ a1 ≠ a2} is the description of the relationship between different attributes, called the set of relationships between attributes. For example, a relationship between attributes v=(a1, a2) means that two different attributes have the same attribute value, that is, v a1 = v a2 , and v=(a1,!a2) means that two different attributes have different attribute values.

[0048] The access - control request relationship represents the operation relationship that the subject requests to perform on the object, and is represented by the triple r =<s, o, op> indicating that the subject s ∈ S requests to access the object o ∈ O under the operation attribute op. The access - control policy represents which subjects can perform which operations on which objects under what conditions, which is the core part of the ABAC model. It can be represented by p =<F S , F O , V, op, AD> indicating that the judgment result of the subject S performing the operation op on the object O is AD (allowed or denied). Multiple policies p can form the ABAC policy set π.

[0049] Set z =<F S , F O， , op> to represent the security - intention constraint tuple, and Z is the corresponding set of security - intention constraints, which implies the security intention of the security document regarding which subjects of what attributes can perform operations on which objects of what attributes. In addition, set |T| to represent the number of manually set tuples, and |Z+| and |Z - | respectively correspond to the positive and negative tuples. Z R represents the randomly generated corresponding tuples, which are completely randomly generated from the attribute set and attribute values, |V| represents the scale of security attributes in the document, |Z R | represents its quantity, |Z R+ | and |Z R -| also respectively correspond to the positive and negative tuples.

[0050] Set l =<F S , FO， V, op, AD, TS, IP> represents an access behavior constraint tuple, and L is its corresponding access behavior constraint set, representing the access behavior and decision result under specific attribute conditions. Among them, TS represents the access time recorded by the system, and IP represents the organizational IP at the time of access. In addition, L+ and L- are set to represent the access behavior sets allowed and denied by the decision respectively, that is, AD = Allow and AD = Deny.

[0051] In the embodiments of this case, as Figure 1 shown, it includes three core parts: security intention recognition, access behavior perception, and satisfiability modulo theories strategy analysis. In the security intention recognition part, the large language model (LLM) is used to parse the to-be-processed security document containing access control information, extract the sentences containing access control information, and extract the subject attributes, operation attributes, and object attributes contained in the sentences to expand the intention structure and generate security intention constraints. In the access behavior perception part, the log containing user access behavior is dynamically obtained, and its attribute-based log record is expanded to obtain the attribute-based access control log. Then, the clustering algorithm is used to extract behavior characteristics and generate access behavior constraints. In the satisfiability modulo theories strategy analysis part, the strategy is formally transformed into a strategy proposition, and the access control strategy in the form of a proposition is SMT encoded. Then, based on the security analysis principle, multi-dimensional security principle constraints are constructed, combined with the security intention constraints and access behavior constraints, to detect and evaluate whether the current access control strategy meets the security principle, and generate the strategy security analysis result and disposal suggestions. The large language model and unsupervised learning algorithm are comprehensively used to respectively obtain the initial security intention and evolutionary security intention in the access control system, and then the satisfiability modulo theories (SMT) is used as the underlying reasoning method for the formal analysis of the attribute-based access control strategy. In fact, within most information systems, there are system project specification documents (such as requirement documents, design documents, user manuals, etc.) described in natural language. These documents contain the policy information related to access control preset in the system, which can reflect the initial design security intention of the system, and this intention Figure 1 generally does not change over time. When setting new access control policies or modifying and updating the policies, it is also necessary to ensure that the new policies can meet the initial security intention. At the same time, the access control log contains the actual policy execution results, which can check whether the access requests that should be allowed (or denied) by the policy have been effectively executed according to the requirements of the policy, and are used to judge the actual response relationship between the access requests and the policy.

[0052] As Figure 2As shown, the security administrator within the organization is responsible for defining access control protection use cases. Before implementing the attribute-based access control policy, conduct an in-depth analysis of the organization's business requirements, security requirements, and compliance requirements around the access control protection use cases to help the security administrator understand the organization's needs and expectations for access control and provide a basis for subsequent policy design. According to the results of the requirements analysis, the designer designs an appropriate access control policy. This includes determining the attributes of the subject, object, and operation, as well as the corresponding access permissions. The policy design needs to consider the organization's business processes to ensure that the policy can effectively support the organization's business requirements. Subsequently, encode the policy into a computer-executable format. This usually involves converting the policy into a specific data structure or format so that the access control engine can understand and execute it. After the policy encoding is completed, it is necessary to fully test and evaluate the generated access control policy, analyze and identify the permission vulnerabilities and security risks existing in the policy set. Deploy the complete and consistent access control policy after evaluation to the access control engine to implement the access control policy to protect the target resources. By auditing and monitoring the execution of the access control policy, dynamically detect potential security problems and abnormal behaviors, help the administrator discover and solve possible security and privacy issues in a timely manner, and adjust and update the access control policy in a timely manner according to the audit and monitoring results to ensure that the access control policy always remains consistent with the actual needs of the organization.

[0053] Among them, extracting security intent constraints from the security document containing access control information can be designed to include:

[0054] Obtain a specification document containing access control information, and use a large model to perform data augmentation on the specification document to generate an augmented sample example. The access control elements are marked in the specification document, and the augmented sample example consists of the subject attributes, object attributes, and operation attributes in the access control information statements of both the specification document and the data augmentation result;

[0055] Traverse the sample examples and obtain the security intent recognition rules corresponding to the sample examples through feedback-based situational learning. Combine the security intent recognition task instructions and the security intent recognition rules, and use question clustering and example sampling to enable the large model to generate a security intent recognition thought chain template;

[0056] Input the security document containing access control information into multiple large models, and extract the security intent constraints in the security document through model consensus based on the security intent recognition thought chain template and using multiple large models.

[0057] Large Language Models (LLMs), represented by GPT-4, Llama 2, and Deepseek, have demonstrated powerful comprehensive capabilities in fields such as Natural Language Processing (NLP) and information security. The excellent understanding and interaction capabilities of LLMs make them ideal tools for handling complex natural language tasks, especially in scenarios where structured information needs to be extracted from unstructured text. In the field of information security, formulating access control policies is a core task for ensuring system security and usually relies on the original security intentions in security requirement documents. However, the manual analysis process is not only time-consuming and laborious but also prone to omissions or errors when dealing with complex system project specification documents. Therefore, how to automatically identify security intentions from natural language documents and transform them into security intention constraints for constructing accurate access control policies has become an important research direction in the field of information security. In the embodiments of this case, by leveraging the powerful capabilities of LLMs, the task of extracting security intention constraints is transformed into an information extraction task, integrating few-shot data augmentation, feedback-based context learning, and other large model technical mechanisms, improving its performance in information extraction tasks. Generally speaking, combining the advanced capabilities of LLMs with the specific requirements of the information security field not only significantly improves the efficiency of security intention recognition but also maintains high accuracy and robustness in complex scenarios.

[0058] As Figure 3 shown, in the few-shot data augmentation stage, natural language documents containing access control policy information in different information systems can be collected in advance. The large semantic model (LLM) is used to learn the expression patterns of the security intentions described in the few-shot annotated natural language documents, providing training data examples to enable the model to quickly adapt to a specific domain and learn to follow the format of the task, avoiding the manual creation of sample examples by experts. Data augmentation is achieved by using the few-shot annotated training data, without the need for a large number of updates to the model parameters. In the feedback-based context learning stage, it is assumed that a set of inference criteria and the input sample instances after data augmentation have been collected in advance for the security intention recognition task, and a set of relevant rules are retrieved from the guidelines. By combining the task instructions with the retrieved inference rules, an answer is generated and can be forwarded to the LLM agent for inference reflection to update the inference criteria for the existing perception task. In the self-generated chain of thought stage, the LLM model is allowed to generate a series of intermediate inference steps to achieve a more fine-grained step-by-step inference logic and improve the security intention recognition ability. In the multi-model collaborative discussion stage, since different LLM models have different internal knowledge and reasoning abilities, multiple LLMs are required to discuss and reach a consensus to obtain a better response, and the consistency of multiple LLMs is checked to reduce output hallucinations.

[0059] Among them, few-shot data augmentation is a data preprocessing technique that generates new training data samples by performing various transformations and modifications on the original data. In the embodiments of this case, a large model is combined with data augmentation to achieve LLMs Data Augmentation. Briefly speaking, in the way of using prompt template questions and answers, LLMs are required to generate semantically similar augmented data with reference to the system project specification documents within the information system. Taking LLMs as annotators, the security intention recognition ability of LLMs is trained by using a small number of example documents that have already marked access control elements, so as to realize the automatic marking of augmented data. The few-shot examples for specific task prompts are usually fixed, so there are relatively high requirements for the representativeness and universality of the examples. A previous method was to let domain experts manually create examples, but even so, it cannot be guaranteed that the fixed few-shot examples planned by experts are representative in each task. Therefore, through a small number of labeled sample data, the text generation ability of the LLM model is used to expand the sample data set, and more sample data is used to guide the model's analysis and reasoning process, so as to improve the training effect and reasoning generalization ability of the model and enable the model to quickly adapt to the security intention recognition task.

[0060] Among them, the security intention recognition rules corresponding to the sample examples can be obtained through feedback-based scenario learning, and can be designed to include:

[0061] Set a security intention recognition rule set and a temporary set for storing feedback results;

[0062] Traverse the sample examples in the specification document, retrieve each sample in the security intention recognition rule set and the augmented sample examples respectively, obtain several rules and examples that are most relevant to the sample, create a security intention query based on the security intention recognition task instruction, the sample, the example and several rules, and the security intention query is used to ask the LLM thruster whether the instance contains access control semantic information; and based on the security intention query, make the LLM reasoner predict and output the security intention recognition answer and the retrieved rule reference subset;

[0063] Calculate the corresponding rule task scores according to the number of the corresponding rule task scores retrieved by the rules, the rule references, the correctly predicted outputs, the references and the number of example numbers of the wrongly predicted outputs, delete the rules in the security intention recognition rule set whose task scores are lower than the preset threshold, and for the case of wrongly predicted outputs, based on the example, the wrongly predicted output and the security intention recognition label, and use the large model to reason to obtain the correct rules and add them to the security intention recognition rule set.

[0064] Use feedback-based scenario learning to predict the security intention answer corresponding to the natural language document instance d. The full-process pseudocode is shown in Algorithm 1.

[0065]

[0066]

[0067] Suppose the guidelines G = {r i | 0 < i < |G|} are collected and formulated. G is a set of rules that support read, write, and retrieval operations. Each rule is expressed in the form of a natural language description, clarifying an aspect of the security intention recognition task. The feedback-based scenario learning process is as follows.

[0068] First, retrieve the k rules R that are most relevant to d from G. Among them, Similarly, some examples N can also be retrieved from the training dataset D.

[0069] R = Retrieve(d, G)

[0070] Subsequently, integrate the task instruction T, the instance d, the few-shot samples N, and the retrieved rules R to create a query q for asking the LLM reasoner whether the instance contains access control semantic information. The reasoning is performed by an LLM agent with the ability of In-Context Learning, and y’ is the predicted answer for security intention recognition, :is the returned subset of the retrieved rules that the LLM agent considers helpful in the reasoning process. R* is used to evaluate the rule quality.

[0071] q = ICL(T, d, N, R)

[0072] y’, R * = Reason(q)

[0073] Traverse all instances to complete the security intention recognition task, obtaining a response containing the answer y’ and the reference R * If the answer is incorrect, the LLM agent will update the reasoning rules and append them to the cache for update after iteration. In addition, task scoring is performed according to whether each reasoning rule corresponds to the correct answer, and the reasoning rules with scores lower than the threshold are considered harmful to the security intention recognition task and are deleted. Specifically, when the predicted result is incorrect, let the large model reflect based on the input x, the predicted y’ and y, and summarize a correct reasoning rule.

[0074] r = Reflect(x, y’, y)

[0075] The scoring method for a rule is as follows. For a rule r ∈ G, calculate its prior score according to its statistics:

[0076]

[0077] where N retrieve , Nhit , N wrong is the number of instances of model retrieval r (r ∈ R), correct prediction of reference r (r ∈ R*), and incorrect prediction of reference r. The closer the score is to 1, the more effective this rule can be understood to be.

[0078] Chain of Thought can improve the reasoning ability of large language models by providing step-by-step examples, but manually creating a Chain of Thought requires a large amount of human effort. In the embodiments of this case, a self-generated Chain of Thought with questions and reasoning chain demonstrations is automatically constructed to improve the performance of the safety intention recognition task. It includes two main stages: question clustering and demonstration sampling. Question clustering divides the given data set into several clustering clusters, and demonstration sampling selects representative questions from each clustering cluster and generates their reasoning chains using a simple heuristic Zero-Shot-CoT. The algorithm pseudocode is shown in Algorithm 2.

[0079]

[0080]

[0081] In the first stage, cluster analysis is performed on the given set of safety intention recognition questions Q. First, the vector representation of each question in Q is calculated through language patterns, and then, through the K-means clustering algorithm, k question clusters are generated. For the questions in each cluster i, they are sorted into a list q (i) = [q (i,1) , q (i,2) , …], sorted in ascending order of the distance to the center of cluster i. In the second stage, it is necessary to generate reasoning chains for these sampled questions and sample the examples that meet the selection criteria. A demonstration d(i) (the connection of questions, rationale, and answers) is constructed for each cluster i. For cluster i, the sorted list q (i) is iterated until the selection criteria are met. Questions closer to the center of cluster i are considered earlier. Suppose the j-th closest question being considered is q (i,j) , then the formula for the prompt input is [Q: q (i,j) . A: [P]], where [P] is a prompt "Let's think step by step". The formed prompt is input into the LLM using Zero-Shot-CoT to output a reasoning chain composed of a rationale r (i,j) and an extracted answer a (i,j) . Then, by connecting the question, rationale, and answer, the candidate demonstration d (i,j) for the i-th cluster is constructed: [Q: q (i,j) , A: r (i,j) . a (i,j) , which is applicable to the safety intention recognition task.

[0082] Use multiple open-source large language models (LLMs) to analyze the security intent in the target document. Specifically, by collecting multiple open-source large models and setting up a target model and a review model, pre-train the target model and the review model respectively for the security intent recognition task; input the security document containing access control information into the target model and the review model. If the proportion of the output of the review model that is inconsistent with the output of the target model exceeds the consensus threshold, the target model performs output inference correction based on the inconsistent output of the review model to make the proportion of the inconsistent output meet the consensus threshold requirement, and use the model consensus output that meets the consensus threshold requirement as the security intent constraint extracted from the security document.

[0083] Each model will independently consider the security intent contained in the document and the potential scenarios related to the security intent. Since different LLMs may have different knowledge and reasoning abilities, integrating the outputs of multiple LLMs can improve the comprehensiveness of problem analysis. The target LLM will summarize the problem analysis of all models to ensure consistency and comprehensiveness. The full-process pseudocode is shown in Algorithm 3, and this process is divided into two stages: problem analysis and evidence response.

[0084]

[0085] In the problem analysis stage, assume there are n accessible LLMs, denoted as M1, ···, M n . For a given problem q and the retrieved evidence D q , the goal is to generate a security intent recognition response using the target LLM M k with the help of the remaining LLMs. First, instruct the LLMs to perform security intent recognition and observe that models without pre-training or supervised fine-tuning on specific domain data perform poorly. Therefore, establish a potential association relationship between the evidence D q and q, and prompt each LLM M i to generate where are the model parameters of the LLM M i .

[0086]

[0087] Then, use the target LLM M k to summarize the consistency and comprehensiveness of the problem analysis of all models. Consistency means that if most LLMs provide similar analyses of the facts or potential scenarios in the problem, then it is likely to be correct. Comprehensiveness means that if a few LLMs have reasons to hold a specific view in the analysis, it does not mean it is unreliable. These contents should be carefully examined to evaluate logical consistency and relevance to the problem. Finally, summarize the result of the problem analysis as

[0088]

[0089] In the evidence response stage, the target model determines whether each retrieved evidence can be used as an answer for security intention recognition. However, a single LLM may produce incorrect outputs and misevaluate the security intentions in the documents. Therefore, a multi-party discussion mechanism is introduced. Besides the target model, other LLMs will criticize the target model and explicitly point out whether there are opposing opinions to the target model. If the proportion of opposing opinions in the criticism exceeds the set threshold, the target model will be corrected according to the criticism results. Specifically, for evidence d j ∈D q , each LLM (excluding M k ) is guided to make a criticism. Each critic model M i should explicitly output whether it holds an opposing view to d j , denoted as c(d j , i). A correction threshold δ can be adopted. If the proportion of opposing opinions in the criticism exceeds δ, the target model needs to modify its evidence analysis. The specific process is as follows:

[0090]

[0091]

[0092] Assume that a criticism that needs to be modified is reliable only when most critic models reach a consensus. Otherwise, the original analysis is retained.

[0093] Access behavior perception includes three stages: access behavior augmentation, behavior feature extraction, and behavior structure construction. First, access behavior logs are obtained from the access control system, and ABAC logs are generated by combining entity attribute values. Subsequently, clustering algorithms are used for clustering, and behavior information with high semantic similarity is aggregated into a specified number of clusters. Behavior feature extraction is performed based on the frequency difference between the occurrences in the clusters and in all behaviors, converting the access behavior logs into access behavior constraints, and the quality of the constraint set is improved through an optimization process. The extracted access behavior constraints can reflect the execution situation when the system makes access control decisions.

[0094] Specifically, obtaining access behavior constraints from the access control logs can be designed to include:

[0095] Obtain access behavior logs from the access control system, and based on the specific operation behaviors of the subject on the object obtained from the access behavior logs, combine the specific operation behaviors of the subject on the object with the attribute relationships to generate ABAC behavior log data;

[0096] Cluster the ABAC behavior log data to aggregate the behavior information into several behavior data clusters according to semantic similarity. Each behavior data cluster consists of different numbers of ABAC behavior logs. Extract the entity-attribute relationships and inter-attribute relationships in each behavior data cluster based on the occurrence frequency of attribute values and the consistent frequency of attribute values of attributes respectively, and form the access behavior constraint set of each behavior data cluster;

[0097] Use the Jaccard similarity to calculate the similarity of the access behavior constraint sets between behavior data clusters. If the similarity exceeds the specified threshold, optimize the access behavior constraint set by comparing and adding or deleting tuples in the access behavior constraint set of one of the behavior data clusters to obtain the final optimized access behavior constraint set.

[0098] As Figure 4 shown, the access behavior perception method first expands the access behavior. By obtaining the access behavior of the system, the user-permission relationship, that is, the specific operation of the subject on the object, can be obtained. Subsequently, the user-permission relationship is combined with the specific attribute relationship and processed into the ABAC behavior log Log ABAC as the data set, and the part with the decision result being allowed is used as the input for behavior feature extraction.

[0099] Cluster all behavior data through the k-modes algorithm and extract attribute relationships in each cluster. It divides the behavior data into a certain number of clusters, and each cluster consists of different numbers of ABAC behavior logs. If the frequency of a certain attribute in the cluster is significantly higher than its frequency in all behavior data, it is extracted. Define the frequency difference as the threshold η. For access control requests, if the original judgment result gives an allow decision, the extracted security constraints should have the same decision. Based on this, use the F-score clustering algorithm under different clustering numbers and the threshold η as the evaluation index for selecting the clustering number to realize the automatic determination of the clustering number. The full-process pseudocode is shown in Algorithm 4.

[0100]

[0101]

[0102] Extract the entity-attribute relationships and inter-attribute relationships through Algorithm 4. Let C i be a certain clustering cluster. For the entity-attribute relationships (a, v Ci ) and (a,!v i ) in F i , when the frequency of v i appears significantly higher or lower than its frequency in the ABAC behavior log, this entity-attribute relationship is extracted. For V CiThe inter-attribute relationships (a1, a2) and (a1,!a2) in it are extracted when the frequency of equal attribute values of a1 and a2 is significantly higher or lower than their frequencies in the ABAC behavior log. The specific frequency difference depends on the threshold η a and η d .

[0103] For the behavior constraints extracted from different clusters, an access behavior constraint set L can be initially formed. However, when the similarity of the attribute relationships extracted from two clusters during the clustering process is high and two similar constraint tuples are extracted, the overall quality will decline. To optimize this situation, the Jaccard similarity is used to calculate the similarity between two constraint tuples l. When the similarity exceeds 0.5, the redundant tuples are deleted by comparing the F-score after deleting one of the tuples. The pseudo-code of the whole process is shown in Algorithm 5

[0104] In addition, the parts that are inconsistent with the original access behavior are processed. Taking the FN record, that is, when the access control request is wrongly rejected, it may be because a certain tuple is missing in the mined constraint set L or the attributes contained in the existing tuples are too strict. Feature extraction is performed again in the FN record to generate the set L FN . Subsequently, the tuples with a similarity higher than 0.5 to the original set are selected and optimized according to the above two possible situations, that is, adding a certain tuple or deleting the attribute relationship in a certain tuple for relaxation processing. For the FP record, that is, when the access control request is wrongly permitted, similar operations are taken to construct the optimized final access behavior set L optimized .

[0105]

[0106]

[0107] The satisfiability modulo theory is for multiple data types and the corresponding predicate logic theories, enabling the determination of the satisfiability of predicate logic formulas under specific background theories. Further, it can solve the satisfiability determination problem of mixed logic formulas covering multiple theories and can achieve complete automation of logical reasoning

[0108] In the embodiments of this case, statements related to security intention constraints, access behavior constraints, and access control policies are encoded into SMT predicate logic formulas, and the SMT predicate logic expressions are implemented using one or more of strings, regular expressions, bit vectors, and integer comparisons; based on the mandatory security principle, optional security principle, and user-defined security principle in access control policy security analysis, multi-dimensional security principle constraints are constructed, and the multi-dimensional security principle constraints are encoded into STM predicate logic formulas. The access control policy to be analyzed, security principle constraints, security intention constraints, and access behavior constraints are uniformly converted into STM predicate logic formulas, and the SMT solver Z3 is used to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, so as to evaluate and judge whether the access control policy to be analyzed meets the security principle.

[0109] The security analysis of the access control policy is exactly transformed into the satisfiability problem of the security principle constraints, and an efficient security analysis is realized by means of the Z3 SMT solver. The PAFSA policy elements are SMT encoded. The encoding uses the theories of strings, regular expressions, bit vectors, and integer comparisons. The policy language is declarative and has no programming constructs such as loops or dynamically allocated arrays. The semantics of the policy language are encoded as SMT formulas. The permissions granted by the policy are encoded as all the permissions granted by the Allow statements and revoked by the Deny statements. The access control policy model will be encoded using SMT below.

[0110]

[0111] Allow and Deny here are the sets of Allow and Deny statements in the policy. The semantic meaning [S] of each statement is the set of permissions granted by the Allow statement or the set of permissions revoked by the Deny statement. Each statement in the policy encodes the subject, operation, and resource:

[0112]

[0113] The function P(S) returns all the string values specified for the subject. Similarly, O(S) and OP(S) return the string values of the resource and operation in the statement. The variables s, o, and op are respectively mapped to the subject, resource, and operation. The permissions in the statement are granted as the disjunction of the string values of the subject, operation, and resource, and the conjunction of the conditions shown above.

[0114] The security analysis of policies is divided into mandatory security principle constraints, optional security principle constraints, and user-defined security principle constraints. Mandatory security principle constraints include security, separation of duties, and consistency. Optional security principle constraints include availability, completeness, and redundancy. Specific security principles include organizational security, attribute hiding, and other user-defined security principle constraints. For the security analysis of access control policies, mandatory security principle constraints are mandatory, and optional security principle constraints and specific security principles can be flexibly selected according to actual security requirements. Each security principle constraint can be formally expressed in a formal way.

[0115] The security constraint means checking whether the access control policy leaks access rights to unauthorized or unintended subjects. Detecting whether there is an infinite public write operation on a specific resource. It can be formally expressed as:

[0116]

[0117] The separation of duties constraint means whether there are mutually exclusive permissions assigned to the same subject. The separation of duties constraint covers the subject attribute level, the object attribute level, and the operation level. It can be formally expressed as:

[0118]

[0119] The consistency constraint means whether there are policies with different judgment results for the same access request. Whether there are different policy judgment results for the same subject, the same action, and the same object at the same time, resulting in the access control policy set being unable to make a consistent permission judgment result. For example, if there are inconsistent response results for the same access request, it is a typical case of explicit policy inconsistency. At the same time, there will also be other complex policy conflict situations caused by the inheritance relationship between attributes. It can be formally expressed as:

[0120]

[0121] The availability constraint means detecting whether there are resources that are unavailable under any conditions, that is, no subject has the operation permission for this resource, or no user can perform a specific operation on a certain resource. It can be formally expressed as:

[0122]

[0123] The completeness constraint means detecting whether there are control policies for all resource permissions to ensure that the access control policy should accept or reject each access request. The redundancy constraint means detecting whether there are policies with the same semantics, and deleting a specific policy does not affect the judgment result. It can be formally expressed as:

[0124]

[0125] Redundancy constraints are divided into two cases: one is a simple repetition strategy, and the other is an inclusion relationship in terms of strategy semantics, where for the same request, two strategies will lead to the same permission judgment result. It can be formally expressed as:

[0126]

[0127] Organizational security constraints refer to detecting whether the access rights to a certain resource are within a certain organizational IP range. Subjects set as wildcards may cause unauthorized access to objects by users who are not members of the organization. As a protection measure, assuming that the organizational administrator hopes to ensure that there is no unauthorized access to the data in the system, the SMT string theory and bit vector theory can be used to express the constraints. It can be formally expressed as:

[0128]

[0129] Attribute hiding constraints refer to detecting whether for a certain policy, unauthorized access can be achieved through attribute hiding. When there is a violation of the attribute hiding constraint, it is necessary to remind the security management personnel to adopt targeted security protection measures (such as attribute calibration) for this problem, so as to avoid the occurrence of security vulnerabilities. It can be formally expressed as:

[0130]

[0131] Similar to the policy, various security constraints can be encoded in SMT form and security detection can be performed. Table 1 gives the definitions, examples, and SMT encodings of different constraints to increase readability.

[0132] Table 1 Security Rule Constraints

[0133]

[0134]

[0135] In specific implementation, the popular SMT-lib constraint solver Microsoft Z3 can be used, and the overall process is like the pseudocode shown in Algorithm 6 and Algorithm 7.

[0136]

[0137]

[0138] In the above algorithm, first perform policy encoding, converting each policy p in the policy set π into an SMT encoding. Similarly, uniformly convert the original security intention, actual access behavior, and security principle constraint set into SMT encodings to achieve formal expression. Finally, use the SMT solver to solve the access control policy security analysis problem with the policy encoding Psmt , the original security intention B smt , the actual access behavior B smt , the security principle constraint set C smt As the input of the algorithm, execute SMT solving to output the security analysis result R.

[0139] Furthermore, based on the above method, an access policy detection system based on security intention perception and access behavior recognition provided by an embodiment of the present invention includes: a data extraction module and a policy detection module, where

[0140] The data extraction module is used to extract security intention constraints from a security document containing access control information and obtain access behavior constraints from access control logs. The security intention constraints are used to describe the restrictions on the subject, object, and corresponding operations under each attribute constraint in the security document. The access behavior constraints are used to describe the restrictions on the access behavior of the subject to the object and the decision result in the access control log;

[0141] The policy detection module is used to convert the security analysis of the access control policy into a security principle constraint satisfiability problem based on the satisfiability modulo theory and in combination with the security intention constraints and access behavior constraints, and use a satisfiability modulo theory solver to solve the security principle constraint satisfiability problem of the access control policy to be analyzed, so as to evaluate whether the access control policy to be analyzed meets the security principle constraints.

[0142] To verify the effectiveness of the solution in this case, further explanation will be made below in combination with experimental data:

[0143] Experiments were conducted on multiple publicly available real datasets listed in Table 2. The datasets were sourced from 4 different types of datasets: iTrust, IBMApp, Cyberchair, and Collected ACP, covering a total of 1998 manually labeled natural language text data. Among them, 969 pieces of data contain access control policy information, and 1029 pieces of data do not contain access control policy information. Among them, iTrust is an application for the medical system to maintain patients' electronic health data information. Through this application, doctors can obtain and share basic patient information and view aggregated patient data. IBMApp is a course management system for universities, providing course management services for teachers and students; Cyberchair is a paper review system for journals and conferences to improve the efficiency of paper review; Collected ACP is a dataset composed of collected access control policy statements. Since a single dataset may have data bias, leading to bias in the experimental evaluation of the scheme, the 4 types of datasets were aggregated in the experiment to enhance the robustness and reliability of the experimental evaluation. Among them, the scale of security attributes |A| is 1877, and the manually set policy attribute tuples |Z| total 3299 items, among which the positive authorization attribute tuples |Z+| have 3231 items, and the negative authorization attribute tuples |Z-| have 68 items. Randomly generated attribute tuples |Z R | total 5200 items, the positive authorization attribute tuples |Z R +| have 3450 items, the negative authorization attribute tuples |Z R -| have 1750 items.

[0144] Table 2 Dataset Description

[0145]

[0146] For the access control policy dataset, it was also constructed according to the access control information contained in the four datasets of iTrust, IBM App, Cyberchair, and Collected ACP, which is consistent with the actual application of formulating system policies manually through security document analysis. However, the experiment requires the analysis of security policies and the proposal of improvement suggestions. Based on this, manual policy modification was carried out to violate the corresponding security principle constraints, and the detection results were verified to help the experiment. Specific modification methods are given as examples in the subsequent experimental session. It should be noted that for the part of the extracted security intention that violates the security principle constraints, no changes were made. Therefore, the detection results may also stem from the initial security intention problem rather than manual annotation, and relevant analyses were carried out in the subsequent part of the policy security analysis experiment.

[0147] For the access behavior log dataset, the access control policies of the four datasets are extended to the log record format to generate the access behavior log dataset. Similarly, partial modifications are made based on the access control policy set to reflect the inconsistency in the execution of the system access control policy, which is consistent with the actual application. To more comprehensively evaluate the access behavior perception ability provided by the method and test its robustness, based on the four constructed access behavior log datasets, each dataset is randomly sampled four times to generate 16 sub-datasets, and experiments are conducted on this basis to evaluate its extraction effect.

[0148] The software and hardware experimental environments in the experimental evaluation are as follows: The operating system is Win11 64bit, the CPU is Intel(R) Core(TM) i9-13900HX 2.20GHz, the GPU is NVIDIA GeForce RTX 4090 GPU, the memory is DDR5 32GB, Python 3.9, and Z3 solver v4.8. The large model experiment calls the famous DeepSeek-R1 model through the API interface. The DeepSeek-R1 has 67.1 billion parameters and is composed of a Transformer based on the multi-head attention mechanism and the feed-forward neural network, which can adapt to the experimental requirements. On this basis, the definitions and calculation methods of the evaluation metrics used in the experiment are as follows:

[0149] Evaluation metric 1 (Coverage): The security intent coverage rate Coverage is an indicator to measure whether the security intent recognition is comprehensive and can effectively cover all relevant resources and user operations. Specifically, it refers to the ratio of the actual access patterns covered after the security intent extraction to all possible access patterns:

[0150]

[0151] Among them, Num true (d k ) represents the number of attribute combinations for which the generated security intent policy makes a correct permission judgment on all attribute combinations in document d k ; Num total (d k ) represents the total number of attribute combinations in document d k .

[0152] Evaluation metric 2 (F-score): Use TP, FP, TN, and FN to represent the relative true positive rate, relative false positive rate, relative true negative rate, and relative false negative rate respectively, which are used to represent the relationship between the extracted access behavior constraints and the original access behaviors. On this basis, Precision, Recall, Accuracy, and F-score are calculated, and their calculation methods are as follows:

[0153]

[0154] Generally speaking, the evaluation metric F-score can be used to evaluate the consistency between the access behavior constraints and the original access behaviors. The higher the F-score value, the more effective the access behavior constraints extracted in the solution of this case.

[0155] Based on the above evaluation metrics, three experiments are conducted to evaluate the solution of this case and its implementation in PAFSA. The first experiment tests the security intention recognition performance of PAFSA to determine the ability to extract security intentions from natural language texts containing policy information. The second experiment evaluates the effectiveness of PAFSA in extracting real user access behaviors from access control logs. The third experiment evaluates the performance of policy security analysis using SMT.

[0156] 1. Evaluation of Security Intention Recognition Performance

[0157] In the part of evaluating the performance of security intention recognition, an ablation experiment is used to evaluate the contribution degree of each method to security intention recognition. The four methods of few-shot data augmentation, feedback-based scenario learning, self-generated thought chain, and multi-model collaboration are denoted as A, B, C, and D respectively. The experiment is repeated 10 times, and the average security intention coverage rate and average security intention complexity of the four datasets are calculated. The experimental results are as Figure 5 shown.

[0158] Analyzing the experimental results, it can be seen that the experimental results of repeated tests are all stable within a certain range and have strong robustness. There are significant differences in the experimental effects of using different methods alone. Feedback-based scenario learning has the greatest effect on improving the security intention coverage rate. The self-generated thought chain also has a large improvement in the performance of the baseline, which indicates that it is crucial to prompt the model to think correctly and guide the reasoning steps of the model. At the same time, the experimental results of using all methods are not the best, and there is a phenomenon of reduced policy coverage rate. The experiment proves that combining few-shot data augmentation, feedback-based scenario learning with the self-generated thought chain or multi-model collaboration has good experimental performance, and the security intention coverage rate of the extraction results can reach more than 85%. Based on this, it can be considered that the powerful learning and generalization ability of LLM can be applied to the security intention recognition task.

[0159] 2. Evaluation of Access Behavior Perception Performance

[0160] In the evaluation part of the access behavior perception performance, security intents are extracted and their effectiveness is evaluated on 16 sub-datasets. Using the ABAC logs in the dataset as the input of the algorithm, and taking F-score as the objective function for automatic selection of the number of clusters, the mean values of the experimental results of Recall, Precision, Accuracy, and F-score for different datasets are recorded, as shown in Table 3 and Figure 6 as follows.

[0161] Table 3 Experimental Results of Access Behavior Perception

[0162]

[0163]

[0164] The access behavior perception method uses a clustering algorithm to extract security intents, gradually merging each log sample into larger and larger clusters, and then extracting access behaviors from them for subsequent policy security checks. In this process, each sample can be assigned to a cluster, and the security intents with higher frequencies will be extracted and verified by comparing with the original security intents. 16 sub-datasets are constructed by random selection, and good experimental results are obtained on different datasets, reflecting a high consistency between the extraction results and the original security intents. Analyzing the experimental results, it can be seen that the F-score can reach more than 95% under different datasets, and most of the Precision, Recall, and Accuracy indicators are stable above 90% with a small floating range, proving the effectiveness and robustness of the method.

[0165] 3. Performance Evaluation of Policy Security Analysis

[0166] In the performance evaluation part of policy security analysis, the security constraints proposed in Table 1 are detected. The experimental work mainly focuses on the eight constraints shown in Table 1, and conducts a full-process analysis of the policy implementation security from three different perspectives: initial intent, execution policy, and access behavior. To demonstrate the function of policy security analysis, some of the security constraints extracted from the execution policy and access behavior are manually changed to artificially create security conflicts to test the security analysis ability. Table 4 shows a simple example of making policy conflicts for different security constraints.

[0167] Table 4 Simple Examples of Security Constraint Violations

[0168]

[0169] For example, in Example 1, assuming the original policy's security intent only allows data reading, a policy granting data access would violate the security constraint. Operations on resources by the same subject cannot be mutually exclusive. If the collect and test operations are set as mutually exclusive, two policies targeting the same subject that perform these mutually exclusive operations would be considered a violation of the separation of duties constraint. Policy decisions must be consistent; policies with both "Allow" and "Deny" decisions cannot exist simultaneously, otherwise a consistency constraint is violated. Resources that are inaccessible to all subjects cannot exist, otherwise an availability constraint is violated. Policies that lack access control capabilities for specific resources cannot exist, otherwise a completeness constraint is violated. Two identical policies violate the redundancy constraint and must be adjusted and deleted. The organization's IP range must be within a specified range, otherwise an organizational constraint is violated. Policies that result in different decisions when a particular attribute is hidden cannot exist, otherwise an attribute hiding constraint is violated. Security intents from different sources are encoded into SMT form and tested using a solver. Experimental results on different datasets are shown in Table 5, where the number in parentheses indicates the number of detected constraint violations.

[0170] Table 5 Safety analysis experiment results

[0171]

[0172] Experimental results show that a certain number of policies in different datasets violated corresponding security constraints. Manual analysis of the causes of security constraint violations was conducted. For example, the completeness constraint violation in the iTrust, IBM App, and Collected ACP datasets was caused by the failure to extract the corresponding resource constraints during the security intent identification process, resulting in the same issue in subsequent policy and behavior datasets. This demonstrates the impact of initial security intent on policy formulation and access behavior. The separation of duties constraint violation in the iTrust dataset was caused by the setting of mutually exclusive operations during policy formulation, which also led to deviations in access behavior. The attribute hiding constraint scope violation in the Collected ACP dataset was caused by policy execution issues during system execution, resulting in anomalous access behavior. Based on this, policy modification recommendations were provided. For example, for redundancy constraint violations, the relevant policies can be identified and manually optimized. For security, consistency, organizational security, and attribute hiding constraint violations, the corresponding access control policies can be manually modified. For separation of duties constraint violations, specific policies can be deleted. For availability and completeness constraint violations, the corresponding policies can be manually added.

[0173] Through manual analysis, it is found that the initial security intention constraint violations detected by the SMT solver are actually consistent with the extracted constraints. In addition, all the pre-set constraint violations in different datasets can be detected, which is consistent with the actual characteristics of SMT solving. To verify the performance of the SMT solver, the policy scales of four datasets are manually modified, and the detection time of each constraint is tested separately. The experimental results are as Figure 7 shown.

[0174] Analyzing the experimental results, it can be seen that there are certain differences in the detection times of different security principle constraints. The detection times of each security principle constraint increase with the growth of the policy scale, which is consistent with the increase in the scale of SMT solving. Among them, the time overheads of the separation of duties constraint, consistency constraint, redundancy constraint, and attribute hiding constraint are relatively large, approaching 500 ms, which is caused by the increase in internal comparisons within the policy and the increase in the scale of SMT solving. The time overheads of the remaining security principle constraints are below 100 ms, which obviously has a great advantage compared with the huge overhead of manual verification. By performing a security analysis on the policy, the solution in this case can accurately describe the formulation and execution of the access control policy; targeted modifications are made according to the unsatisfied constraints, greatly reducing the huge cost brought by manual verification.

[0175] Unless otherwise specifically stated, the relative steps, numerical expressions, and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0176] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts among the various embodiments can be referred to each other. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0177] The units and method steps of the various examples described in connection with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation is not considered to exceed the scope of the present invention.

[0178] Those of ordinary skill in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disc, etc. Optionally, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits. Correspondingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software functional module. The present invention is not limited to any specific form of combination of hardware and software.

[0179] Finally, it should be noted that the above embodiments are only specific embodiments of the present invention, used to illustrate the technical solutions of the present invention, rather than limiting it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. An access policy detection method based on security intention perception and access behavior recognition, characterized in that Including: Extract security intent constraints from a security document containing access control information, and obtain access behavior constraints from access control logs. The security intent constraints are used to describe the restrictions on subjects, objects, and corresponding operations under various attribute constraints in the security document, and the access behavior constraints are used to describe the restrictions on the access behavior of subjects to objects and the decision results in the access control logs; Based on the Satisfiability Modulo Theories (SMT) and combined with the security intent constraints and access behavior constraints, transform the security analysis of access control policies into a problem of the satisfiability of security principle constraints, and use an SMT solver to solve the problem of the satisfiability of security principle constraints for the access control policies to be analyzed, so as to evaluate whether the access control policies to be analyzed meet the security principle constraints.

2. The access policy detection method based on security intention perception and access behavior recognition according to claim 1, wherein Extract security intent constraints from a security document containing access control information, including: Obtain a specification document containing access control information, and use a large model to perform data augmentation on the specification document to generate augmented sample examples. The access control elements are marked in the specification document, and the augmented sample examples are composed of the subject attributes, object attributes, and operation attributes in the access control information statements of both the specification document and the data augmentation results; Traverse the sample examples and obtain the security intent recognition rules corresponding to the sample examples through feedback-based scenario learning. Combine the security intent recognition task instructions and the security intent recognition rules, and use problem clustering and example sampling to enable the large model to generate a security intent recognition thought chain template; Input the security document containing access control information into multiple large models, and based on the security intent recognition thought chain template and using multiple large models, extract the security intent constraints in the security document through model consensus.

3. The access policy detection method based on security intention perception and access behavior recognition according to claim 2, wherein Obtain the security intent recognition rules corresponding to the sample examples through feedback-based scenario learning, including: Set a security intent recognition rule set and a temporary set for storing feedback results; Traverse the sample examples in the specification document, retrieve each sample in the security intent recognition rule set and the augmented sample examples respectively, obtain several rules and examples most relevant to the sample, create a security intent query based on the security intent recognition task instructions, the sample, the examples, and the several rules. The security intent query is used to ask the LLM thruster whether the instance contains access control semantic information; and based on the security intent query, enable the LLM inference engine to predict and output the security intent recognition answer and the retrieved rule reference subset; Calculate the corresponding rule task scores according to the number of correct rule retrievals, rule references, correct prediction outputs, reference and incorrect prediction output corresponding example numbers, delete the rules in the security intent recognition rule set with task scores lower than the preset threshold, and for the case of incorrect prediction output, based on the examples, the incorrect prediction output, and the security intent recognition label, use the large model inference to obtain the correct rules and add them to the security intent recognition rule set.

4. The access policy detection method based on security intention perception and access behavior recognition according to claim 2, characterized in that Extract the security intent constraints in the security document through model consensus based on the security intent recognition thought chain template and using multiple large models, including: Collect multiple open-source large models and set a target model and a review model, and perform pre-training on the security intent recognition tasks for the target model and the review model respectively. Input a security document containing access control information into the target model and the review model. If the proportion of inconsistent outputs between the review model and the target model exceeds the consensus threshold, the target model performs output inference correction based on the inconsistent outputs of the review model to make the proportion of inconsistent outputs meet the requirements of the consensus threshold, and uses the model consensus output that meets the requirements of the consensus threshold as the security intention constraint extracted from the security document.

5. The access policy detection method based on security intention perception and access behavior recognition according to claim 1, wherein Obtain access behavior constraints from the access control log, including: Obtain the access behavior log from the access control system, and based on the specific operation behavior of the subject on the object obtained from the access behavior log, combine the specific operation behavior of the subject on the object with the attribute relationship to generate ABAC behavior log data; Cluster the ABAC behavior log data to cluster the behavior information into several behavior data clusters according to semantic similarity. Each behavior data cluster consists of different numbers of ABAC behavior logs. Extract the entity attribute relationship and the relationship between attributes in each behavior data cluster respectively according to the occurrence frequency of the attribute value and the consistent frequency of the attribute values of the attributes, and form the access behavior constraint set of each behavior data cluster; Use the Jaccard similarity to calculate the similarity of the access behavior constraint sets between the behavior data clusters. If the similarity exceeds the specified threshold, optimize the access behavior constraint set by comparing and adding or deleting the tuples of the access behavior constraint sets of one of the behavior data clusters to obtain the final optimized access behavior constraint set.

6. The access policy detection method based on security intention perception and access behavior recognition according to claim 1, characterized in that Based on the Satisfiability Modulo Theories and combined with the security intention constraint and the access behavior constraint, transform the security analysis of the access control policy into a satisfiability problem of security principle constraints, including: Encode the security intention constraint, the access behavior constraint, and the statements related to the access control policy into an SMT predicate logic formula, and the SMT predicate logic expression is implemented using one or more of strings, regular expressions, bit vectors, and integer comparisons; Construct multi-dimensional security principle constraints based on the mandatory security principle, the optional security principle, and the user-defined security principle in the security analysis of the access control policy, and encode the multi-dimensional security principle constraints into an STM predicate logic formula.

7. The access policy detection method based on security intention perception and access behavior recognition according to claim 1, wherein Use the Satisfiability Modulo Theories solver to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, including: Unify the access control policy to be analyzed, the security principle constraint, the security intention constraint, and the access behavior constraint into an STM predicate logic formula, and use the SMT solver Z3 to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed to evaluate and determine whether the access control policy to be analyzed meets the security principle.

8. An access policy detection system based on security intention perception and access behavior recognition, characterized in that, Include: a data extraction module and a policy detection module, where The data extraction module is used to extract the security intention constraint from the security document containing access control information and obtain the access behavior constraint from the access control log. The security intention constraint is used to describe the restrictions on the subject, object, and corresponding operations under each attribute constraint in the security document, and the access behavior constraint is used to describe the restrictions on the access behavior of the subject to the object and the decision result in the access control log; A policy detection module, which is used to transform the security analysis of access control policies into a satisfiability problem of security principle constraints based on the theory of satisfiability modulo theories and in combination with security intention constraints and access behavior constraints, and use a satisfiability modulo theories solver to solve the satisfiability problem of the security principle constraints of the access control policy to be analyzed, so as to evaluate whether the access control policy to be analyzed meets the security principle constraints.

9. An electronic device, characterized in that, It includes: At least one processor, and a memory coupled to the at least one processor; Wherein, the memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images