Cloud resource security access control method based on big data processing

Abstract

The invention belongs to the technical field of data processing, and particularly relates to a cloud resource security access control method based on big data processing, which comprises the following steps: S1, constructing a real-time behavior calculation engine; s2, establishing a multi-modal risk assessment model; s3, generating and optimizing a self-adaptive strategy; according to the cloud resource security access control method based on big data processing, millisecond-level behavior data acquisition is realized by adopting Apache Flink, and a user-resource-behavior sequential relation network is constructed in combination with a Neo4j graph database, so that the static role limitation of the traditional RBAC is broken through, for example, when it is detected that a certain account accesses non-common resources in non-working time, the user-resource-behavior sequential relation network is not influenced, and the user-resource-behavior sequential relation network is not influenced. The system automatically triggers secondary authentication, so that the safety is improved; secondly, constructing an access graph through a sliding window, and calculating a node centrality index, namely, when a certain user node is suddenly connected with a plurality of high-sensitivity resources, namely deviating from a baseline by more than 3 sigma, immediately marking as a potential transverse unauthorized attack, thereby improving the intelligent level of identification and avoiding data leakage.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and specifically relates to a cloud resource security access control method based on big data processing. Background Art

[0002] The core purpose of cloud resource security access control methods is to ensure that only authorized users and systems can access sensitive information.

[0003] The Chinese invention patent publication number is CN102984252A, a cloud resource access control method based on dynamic cross-domain security tokens. This method is as follows: 1) An access agent is preset at the cloud resource service provider; after the agent authenticates the dynamic temporary user's identity, it requests a dynamic security token from the cloud resource provider for each dynamic temporary user; 2) The cloud resource provider generates a dynamic security token and sets its access policy, which is then sent to the dynamic temporary user; 3) A shared key is set between each dynamic temporary user and the cloud resource provider; 4) The dynamic temporary user signs the access request with the shared key and sends an authentication request message to the cloud resource provider; 5) The cloud resource provider signs the authentication request message with the shared key. If the signatures are the same, the authentication is successful; the access policy of the dynamic security token and its access agent is determined, and the access request of the dynamic temporary user is responded to based on the determination result. The key points of its technical solution are: an efficient cross-domain authentication mechanism is implemented, and the determination efficiency is high.

[0004] However, the above technologies often have the following defects: Traditional cloud resource security access control methods mainly adopt static access control policies, which rely on predefined role permissions and cannot adapt to new attacks in real time. For example, intruders can exploit the defects of static permission allocation to invade employee accounts through phishing emails and other means, use their fixed permissions to scan the database horizontally, steal relevant confidential information, and thus cause data leakage.

[0005] To this end, the present invention provides a cloud resource security access control method based on big data processing. Summary of the Invention

[0006] In order to make up for the deficiencies of the prior art, at least one technical problem raised in the background technology is solved.

[0007] The technical solution adopted by the present invention to solve the technical problem is: a cloud resource security access control method based on big data processing described in the present invention includes the following steps:

[0008] S1. Real-time behavior computing engine construction: Adopting a stream-graph hybrid computing architecture, the Apache Flink stream computing engine is used to collect user access behavior data in real time, and combined with the Neo4j graph database to build a dynamic relationship network among users, resources, and behaviors;

[0009] Use timing graph algorithms to detect abnormal access paths and identify lateral unauthorized access or APT attack chains;

[0010] S2. Multimodal risk assessment model: This model integrates structured and unstructured data, extracts semantic features from log text using the BERT-wwm model, and analyzes device environment image features using the ResNet-50 model. The combined data is then fed into an XGBoost classifier to generate a comprehensive risk score.

[0011] S3, Adaptive Policy Generation and Optimization: Construct a Markov decision process model with the dual-objective function of minimizing security risk score and operation delay as the optimization goal, and use a proximal policy optimization algorithm to generate access control policies in real time;

[0012] Injecting Laplace noise during the policy release phase to achieve differential privacy protection;

[0013] S4, Zero Trust Enhanced Verification Mechanism: Based on the Intel SGX trusted execution environment, hardware encryption is used to store user behavior fingerprint characteristics, including keyboard stroke rhythm, mouse movement trajectory, and device sensor data;

[0014] Combined with the service grid, the Envoy WASM plug-in is integrated to implement dynamic authentication at the microservice API path parameter level.

[0015] Furthermore, the real-time behavior calculation engine also includes:

[0016] Use the River library to implement online machine learning, continuously update user behavior baselines through a sliding window mechanism, and adapt to new attack patterns;

[0017] For ≥10 6 The quantum annealing algorithm is used to solve the optimal access control matrix.

[0018] Furthermore, the multimodal risk assessment model also includes:

[0019] The semantic vector is concatenated with the image features and then input into the XGBoost classifier to generate a comprehensive risk score R∈[0,1]. The scoring formula is:

[0020]

[0021] Among them, R is the output result, σ is the activation function, ω i is the weight of the i-th feature, f i (x) is the i-th feature function, which transforms the input x, b is the bias term, and m is the number of features;

[0022] Adversarial sample defense training module, which generates adversarial access request samples through a generative adversarial network to enhance the model's robustness against privilege escalation attacks;

[0023] Cross-domain feature fusion module, using Transformer architecture to achieve self-attention weighted fusion of multimodal features, attention weight α ij The calculation method is:

[0024]

[0025] where α ij is the attention degree of the i-th element to the j-th element, e ij is the unnormalized attention score, q i is the i-th query vector, k j is the jth key vector, d is the dimension of the vector, attention weight, and N is the number of elements.

[0026] Furthermore, the adaptive strategy generation and optimization also includes:

[0027] Deploy TensorFlow Lite lightweight models on the edge for real-time behavior analysis;

[0028] Build a digital twin of cloud resource access, use reinforcement learning to preview the effectiveness of strategies in a simulation environment, and then synchronize them to the production environment;

[0029] In the policy release phase, Laplace noise is injected to achieve differential privacy protection, and the noise scale ∈ satisfies:

[0030] Where Δf is the sensitivity and δ is the probability of privacy leakage.

[0031] The zero-trust enhanced verification mechanism also includes:

[0032] The FATE framework is used to implement a multi-tenant joint training access control model. The original data of each tenant does not leave the domain, and only the gradient parameters are exchanged;

[0033] Implements policy evaluation in encrypted state based on the Microsoft SEAL library.

[0034] Furthermore, the timing diagram algorithm for detecting abnormal paths includes the following steps:

[0035] Construct a user-resource access graph G = (V, E) within the sliding time window, where V is the user / resource node, E is the access edge, and the edge weight is the access frequency;

[0036] Calculate the characteristic indicators of node degree centrality, betweenness centrality, and closeness centrality graphs, and set dynamic thresholds. The thresholds are determined based on the 3σ principle of historical data distribution.

[0037] The GraphSAGE graph neural network model is used to detect abnormal subgraph structures whose deviation from the normal behavior baseline exceeds a threshold. The deviation is calculated as follows:

[0038]

[0039] Among them, Deviation (G) is a measure of some deviation or difference, a i is the weight of the i-th feature, F i is the i-th characteristic function, G is the input data or graph, μ i is the mean of the i-th feature, σ i is the standard deviation of the i-th feature, and n is the number of features.

[0040] Furthermore, the dual objective function formula of the Markov decision process model is:

[0041]

[0042] Among them, R security is the security risk benefit, R latency is the operation delay cost, γ is the discount factor, λ∈[0.1,0.3] is the delay cost weight coefficient, the optimal value is determined by grid search and cross-validation, π is the strategy, and it is decided to take action a in state st, E is the expected value, t is the time step, T is the total number of time steps, Rsecurity is the reward function related to security, st is the state at time step t, and a is the action at time step t.

[0043] Furthermore, the zero-trust enhanced verification mechanism also includes:

[0044] The FATE framework is used to implement multi-tenant joint training. Each tenant's data is sharded and stored locally, and the federated learning round T is configured to be 10-100 rounds.

[0045] Furthermore, the authentication rules of S4 include:

[0046] Parameter type checking;

[0047] Parameter range verification;

[0048] Parameter dependency validation.

[0049] Furthermore, the S4 also includes policy evaluation in an encrypted state based on the Microsoft SEAL library, supporting homomorphic encryption operations.

[0050] The beneficial effects of the present invention are as follows:

[0051] 1. Apache Flink is used to collect millisecond-level behavioral data, combined with the Neo4j graph database to build a temporal relationship network between users, resources, and behaviors, breaking through the static role limitations of traditional RBAC. For example, when an account is detected accessing uncommon resources during off-hours, the system automatically triggers secondary authentication, thereby improving security. Furthermore, a sliding window is used to construct an access graph and calculate node centrality metrics. Specifically, if a user node suddenly connects to multiple highly sensitive resources, deviating by more than 3σ from the baseline, it is immediately flagged as a potential lateral privilege escalation attack. This improves intelligent identification and prevents data leaks.

[0052] 2. Utilizing the Intel SGX trusted execution environment to store biometric features such as keyboard rhythm (e.g., standard deviation of intervals between keystrokes) and mouse trajectory (e.g., variance of movement speed), this prevents attackers from mimicking real user behavior patterns even if an account is compromised, thereby improving security. Secondly, a dual-objective function is constructed to generate policies in real time through proximal policy optimization. For example, when an abnormal login is detected, the system automatically downgrades the account's permissions to read-only while maintaining business continuity. Laplace noise is injected during policy release to prevent attackers from inferring security rules through policy patterns, further minimizing privacy leaks. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The present invention will be further described below with reference to the accompanying drawings.

[0054] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] See also Figure 1 , Example 1:

[0057] This embodiment provides: a cloud resource security access control method based on big data processing, characterized by comprising the following steps:

[0058] S1. Real-time behavior computing engine construction: Adopting a stream-graph hybrid computing architecture, the Apache Flink stream computing engine is used to collect user access behavior data in real time, and combined with the Neo4j graph database to build a dynamic relationship network among users, resources, and behaviors;

[0059] The real-time behavior calculation engine also includes:

[0060] The River library is used to implement online machine learning. Through a sliding window mechanism (default 1,000 records, support dynamic adjustment from 50 to 10,000 records), the user behavior baseline is continuously updated to adapt to new attack patterns.

[0061] For ≥10 6 The quantum annealing algorithm is used to solve the optimal access control matrix M∈{0,1} N×N , where N is the number of user-resource pairs, and the optimization objective is:

[0062]

[0063] Among them, M is a matrix variable to be optimized, representing a certain distribution relationship, connection weight, etc. The optimization goal is to find a suitable M to minimize the objective function value.

[0064] N represents a quantitative scale, which is the number of related elements. For example, in graph theory-related scenarios, it may be the number of nodes in the graph; in resource allocation problems, it may be the number of resource items or task items.

[0065] C ij is an element in the coefficient matrix, i and j are its subscripts, which reflects certain information such as cost and association strength between different elements;

[0066] M ij is an element in the optimization matrix M, and the subscripts i and j are used to locate its position in the matrix. ij The value of will affect the value of the objective function, and the optimization process is to adjust these values.

[0067] λ is a hyperparameter used to balance the weights of the two terms in the objective function. It can be adjusted according to the needs of the specific problem to control the sparsity of the matrix M (measured by ||M||0) and other cost terms (measured by the importance attached to (measurement);

[0068] ||M||0 is the zero norm of the matrix M, that is, the number of non-zero elements in the matrix M. In the optimization problem, minimizing ||M||0 can make the matrix M sparse;

[0069] Use time sequence graph algorithms to detect abnormal access paths and identify lateral unauthorized access (e.g., low-privilege users accessing highly sensitive resources) or APT attack chains (e.g., abnormal paths from external IP to jump server to internal database).

[0070] The timing graph algorithm for detecting abnormal paths includes the following steps:

[0071] Construct a user-resource access graph G = (V, E) within the sliding time window, where V is the user / resource node, E is the access edge, and the edge weight is the access frequency;

[0072] Calculate graph characteristic metrics such as degree centrality, betweenness centrality, and closeness centrality. These metrics describe the importance and connectivity of nodes in the graph from different perspectives. For example, degree centrality reflects the number of directly connected neighbors; betweenness centrality measures the importance of a node as a "bridge" in the network; and closeness centrality represents the average shortest distance from a node to other nodes. Dynamic thresholds are also set, and the thresholds are determined based on the 3σ principle of historical data distribution.

[0073] Furthermore, the dynamic threshold setting process is as follows:

[0074] First, collect the values ​​of these graph feature indicators in historical data and calculate their mean μ and standard deviation σ;

[0075] Then, according to the 3σ principle, the mean plus or minus three times the standard deviation (μ±3σ) is used as the threshold range; for the graph feature indicators calculated for new user-resource access behavior, if its value exceeds this threshold range, it is considered abnormal.

[0076] The GraphSAGE graph neural network model is used to detect abnormal subgraph structures whose deviation from the normal behavior baseline exceeds a threshold. The deviation is calculated as follows:

[0077]

[0078] Among them, Deviation (G) is a measure of some deviation or difference, a i is the weight of the i-th feature, F i is the i-th characteristic function, G is the input data or graph, μ i is the mean of the i-th feature, σ i is the standard deviation of the i-th feature, and n is the number of features.

[0079] S2. Multimodal risk assessment model: This model integrates structured and unstructured data and extracts semantic features of log text using the BERT-wwm model. The input is command line logs or API request parameters, and the output is a 768-dimensional semantic vector.

[0080] The ResNet-50 model analyzes the image features of the device environment. The input is a terminal screenshot or camera image, and the output is a 2048-dimensional image feature:

[0081] The semantic vector is concatenated with the image features and then input into the XGBoost classifier to generate a comprehensive risk score R∈[0,1]. The scoring formula is:

[0082]

[0083] Among them, R is the output result, σ is the activation function, ω i is the weight of the i-th feature, f i (x) is the i-th feature function, which transforms the input x, b is the bias term, and m is the number of features;

[0084] The adversarial sample defense training module generates adversarial access request samples through a generative adversarial network (GAN) to enhance the model's robustness against privilege escalation attacks. The loss functions of the generator G and the discriminator D are:

[0085]

[0086]

[0087] L G =-E z-pz [log(1-D(G(z)))],

[0088] Among them, LG is the loss function of the generator, and the goal of the generator is to generate samples that can deceive the discriminator;

[0089] z is the value from the prior distribution p z The random noise vector sampled in, the generator G takes z as input to generate samples G(z);

[0090] D is the discriminator, which is used to determine whether the input sample comes from the real data distribution or the data generated by the generator;

[0091] D(G(z)) represents the judgment result of the discriminator on the generated sample G(z);

[0092] E represents the expectation operation, is the log D(G(z)) with respect to the distribution p z expectations;

[0093] L D is the loss function of the discriminator, the goal of the discriminator is to accurately distinguish between real samples and generated samples;

[0094] x is the distribution of real data p date Samples sampled in

[0095] D(x) is the judgment result (probability value) of the discriminator on the real sample x;

[0096] 1-D(G(z)) represents the probability that the discriminator judges the generated sample to be false, and E z-pz[log(1-D(G(z)))] is the expectation of the logarithmic probability of the real sample and the generated sample with respect to their respective distributions.

[0097] Cross-domain feature fusion module, using Transformer architecture to achieve self-attention weighted fusion of multimodal features, attention weight α ij The calculation method is:

[0098]

[0099] where α ij is the attention degree of the i-th element to the j-th element, e ij is the unnormalized attention score, q i is the i-th query vector, k j is the jth key vector, d is the dimension of the vector, attention weight, and N is the number of elements.

[0100] S3, Adaptive Policy Generation and Optimization: Construct a Markov decision process model with the dual-objective function of minimizing security risk score and operation delay as the optimization goal, and use a proximal policy optimization algorithm to generate access control policies in real time;

[0101] The dual objective function formula of the Markov decision process model is:

[0102]

[0103] Among them, R security is the security risk benefit, R latency is the operation delay cost, γ is the discount factor, λ is the delay cost weight coefficient, λ∈[0.1,0.3] is determined by grid search, and when λ=0.2, the delay and security cost ratio is optimal. π is the policy, which decides to take action a in state st, E is the expected value, t is the time step, T is the total number of time steps, Rsecurity is the reward function related to security, st is the state at time step t, and a is the action at time step t.

[0104] Adaptive strategy generation and optimization also includes:

[0105] The Proximal Policy Optimization (PPO) algorithm is used to generate access control policies in real time. During the training phase, a TensorFlow Lite lightweight model is deployed on the edge to perform real-time behavior analysis and reduce cloud communication latency. The model parameter size is ≤1MB and the inference latency is ≤50ms.

[0106] Build a digital twin for cloud resource access. Use reinforcement learning (such as the DQN algorithm) to preview the policy effects in a simulation environment (for example, simulating 1,000 concurrent access requests). Then synchronize the model to the production environment. The simulation environment parameters include:

[0107] Number of users: 100-10,000;

[0108] Resource types: 10-100 types;

[0109] Attack mode: DDoS, SQL injection, APT, etc.

[0110] In the policy release phase, Laplace noise is injected to achieve differential privacy protection, and the noise scale ∈ satisfies:

[0111] Where Δf is the sensitivity and δ is the probability of privacy leakage.

[0112] Injecting Laplace noise during the policy release phase to achieve differential privacy protection;

[0113] S4, Zero Trust Enhanced Verification Mechanism: Based on the Intel SGX trusted execution environment, hardware encryption is used to store user behavior fingerprint characteristics, including keyboard stroke rhythm, mouse movement trajectory, and device sensor data;

[0114] Combined with the service grid, the Envoy WASM plug-in is integrated to implement dynamic authentication at the microservice API path parameter level.

[0115] Zero Trust enhanced authentication mechanisms also include:

[0116] The FATE framework is used to implement a multi-tenant joint training access control model. The original data of each tenant does not leave the domain, and only the gradient parameters are exchanged;

[0117] Implements policy evaluation in encrypted state based on the Microsoft SEAL library.

[0118] Zero Trust enhanced authentication mechanisms also include:

[0119] Policy evaluation in encrypted state is implemented based on the Microsoft SEAL library, supporting homomorphic encryption operations (such as Paillier encryption addition and multiplication) with operation latency ≤ 100ms.

[0120] The FATE framework is used to implement multi-tenant joint training. Each tenant's data is sharded and stored locally. The federated learning round T is configured to be 10-100 rounds.

[0121] It should be noted that the original data of each tenant does not leave the domain, only the gradient parameters are exchanged. The gradient aggregation formula is:

[0122]

[0123] in, The aggregated gradient is the total gradient obtained by merging the gradient information of multiple tenants according to certain rules, which is used to update the model parameters of the joint training;

[0124] k is the number of tenants, indicating the total number of tenants participating in joint training, which is a positive integer;

[0125] D k is the dataset of the kth tenant. Each tenant has his or her own dataset, and these datasets do not leave the domain, ensuring data privacy.

[0126] |D k | is the size of the k-th tenant dataset, that is, the number of samples in the dataset, which reflects the scale of the tenant data;

[0127] It is the sum of the sizes of all tenant datasets and is used to calculate the proportion of each tenant dataset in the overall data, which serves as the weight basis for gradient aggregation.

[0128] The gradient of the kth tenant is the gradient information calculated by the kth tenant based on its own data set. It is used to update the model parameters locally, but only the gradient parameters are exchanged, and the original data does not leave the tenant's local area.

[0129] S4 authentication rules include:

[0130] Parameter type checking (e.g., the age field must be an integer);

[0131] Parameter range check (e.g. price field must be between 0-10000);

[0132] Parameter dependency validation.

[0133] Example 1: (Real-time abnormal path detection)

[0134] Application scenario: A bank's cloud platform is attacked by an APT. The attacker obtains the customer service account (permission level 2) through a phishing email, penetrates the order middleware (permission level 4), and attempts to access the customer database (permission level 5).

[0135] Technical implementation details

[0136] Data collection and modeling

[0137] Collect access logs within a 5-minute window in real time and construct a directed graph G = (V, E):

[0138] Node V = 1000 (800 users + 200 resources)

[0139] Edge E = 5000 (weight = access frequency, normalized to)

[0140] Graph feature baseline (historical 30-day data):

[0141] The mean of node degree centrality is 2.3, and the standard deviation is 1.8 (μ±σ=2.3±1.8)

[0142] The dynamic threshold of betweenness centrality is set to μ+3σ=6.2(μ=2.3,σ=1.3)

[0143] Normal path weight range: 0.1 to 0.3 (based on percentiles P5-P95)

[0144] Anomaly Detection

[0145] During the time window 2025-07-10 14:05:00 to 14:10:00:

[0146] The betweenness centrality of user user_902 (customer service role) increased sharply from the baseline of 2.3 to 8.7

[0147] Abnormal path characteristics:

[0148] Path: user_902 → middleware_45 → db_18

[0149] Path weight: 0.91 (normal value < 0.3)

[0150] Frequency of visits:

[0151] 3 consecutive visits within 5 seconds (normal mode is ≤ 1 visit per hour)

[0152] GraphSAGE model configuration:

[0153] Number of layers = 2

[0154] Aggregate function = MEAN

[0155] Hidden layer dimension = 128

[0156] Interception effect:

[0157]

[0158] Conclusion: Through real-time graph computing and the GraphSAGE model, we have achieved:

[0159] Rapid attack response: Attack chain detection and blocking completed within 3.2 seconds (traditional methods take 48 seconds);

[0160] Accurate identification: The false alarm rate is reduced to 1.2%, while 92% of attack paths are restored;

[0161] Adaptive defense: Dynamic threshold mechanism effectively responds to new attack patterns.

[0162] Example 2: (Multimodal Risk Assessment)

[0163] Application scenario: An e-commerce platform encounters transaction fraud. The attacker forges a "large transfer to an unfamiliar account" request and simultaneously runs a screenshot forgery tool on the terminal to conceal the malicious behavior.

[0164] Structured data (API logs):

[0165]

[0166] Semantic feature analysis results:

[0167] High-risk term: "unknown_account" weight = 0.8 (threshold > 0.6)

[0168] Semantic similarity: 87% similarity to historical fraudulent requests (threshold > 70%)

[0169] Abnormal operation flag: Large transfer + unfamiliar account combination (risk factor 0.9)

[0170] Unstructured data (terminal screenshot):

[0171] ResNet-50 input: 224×224 pixel RGB image

[0172] Output features:

[0173] Malicious window detection probability = 0.9 (window position x: 120-300, y: 80-200)

[0174] Image tampering detection score = 0.75 (threshold > 0.5)

[0175] Risk Decision-Making

[0176] XGBoost input features:

[0177] Input feature vector: [0.8, 0.87, 0.9, 0.75]

[0178] The corresponding features are: semantic risk weight (BERT output), historical similarity (cosine similarity), image malicious probability (ResNet output), and image tampering score (LBP algorithm);

[0179] Output:

[0180] Comprehensive risk score R = 0.93 (threshold 0.7)

[0181] Decision: Intercept the transaction and trigger secondary biometric authentication

[0182] Performance comparison:

[0183] Evaluation Metrics Multimodal fusion Pure log analysis Improvement Fraud Detection Recall 94％ 68％ +26％ False positive rate (FP) 4.8％ 12％ -7.2％ Processing delay (P99) 220ms 150ms +46.7％

[0184] Conclusion: This solution achieves multi-modal fusion:

[0185] Improved detection capability: fraud transaction recall rate reaches 94% (single modality only 68%)

[0186] Strong anti-evasion capability: even if the attacker forges the interface, it can still identify risks through image tampering analysis (score 0.75);

[0187] Decision explainable: the composition of risk score 0.93 is traceable (such as semantic weight contribution 35%).

[0188] Example 3: (federated learning strategy optimization)

[0189] Application scenario: three first-class hospitals (A hospital, B hospital, and C hospital) jointly train the access control model, and need to improve the internal system attack detection capability under the premise of protecting patient privacy.

[0190] Technical implementation details

[0191] Federated learning configuration

[0192] Participant data:

[0193] Hospital sample Data volume This ratio Local model accuracy Hospital A 100,000 8％ 82％ Hospital B 80,000 12％ 85％ C Hospital 150,000 5％ 79％

[0194] Training parameters:

[0195] Federated rounds = 50

[0196] Aggregation algorithm = FedProx (μ = 0.1)

[0197] Local epoch = 3, batch_size = 32

[0198] Gradient aggregation

[0199] Weighted aggregation formula:

[0200]

[0201] Get

[0202] Each round of communication data volume ≤ 1 MB (gradient compression rate 90%)

[0203] Verification results:

[0204] index Federal Model Best unilateral model Improvement Test set AUC 0.85 +8.2％ New attack detection rate 89％ 73％ +16％ Data leakage risk 0 - 100% protection

[0205] Conclusion:

[0206] This solution achieves:

[0207] Privacy-performance balance: Model AUC increased to 0.92 with zero transmission of original data

[0208] Cross-institutional collaboration: The joint model has a significantly higher detection rate (89%) for new attacks than the single-party model (73%).

[0209] Compliance assurance: Meet HIPAA's "minimum necessary" use principle for patient data.

[0210] The above-mentioned front, back, left, right, up and down are all based on the Figure 1 As a benchmark, according to the person's observation perspective, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0211] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the scope of protection of the present invention.

[0212] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A cloud resource security access control method based on big data processing, characterized by: The following steps are involved: S1. Real-time behavior computing engine construction: Adopting a stream-graph hybrid computing architecture, the Apache Flink stream computing engine is used to collect user access behavior data in real time, and combined with the Neo4j graph database to build a dynamic relationship network among users, resources, and behaviors; Use timing graph algorithms to detect abnormal access paths and identify lateral unauthorized access or APT attack chains; S2. Multimodal risk assessment model: This model integrates structured and unstructured data, extracts semantic features from log text using the BERT-wwm model, and analyzes device environment image features using the ResNet-50 model. The combined data is then fed into an XGBoost classifier to generate a comprehensive risk score. S3, Adaptive Policy Generation and Optimization: Construct a Markov decision process model with the dual objective of minimizing security risk score and operation delay as the optimization goal, and use a proximal policy optimization algorithm to generate access control policies in real time; Injecting Laplace noise during the policy release phase to achieve differential privacy protection; S4, Zero Trust Enhanced Verification Mechanism: Based on the Intel SGX trusted execution environment, hardware encryption is used to store user behavior fingerprint characteristics, including keyboard stroke rhythm, mouse movement trajectory, and device sensor data; Combined with the service grid, the Envoy WASM plug-in is integrated to implement dynamic authentication at the microservice API path parameter level.

2. A cloud resource security access control method based on big data processing according to claim 1, characterized in that: The real-time behavior calculation engine also includes: Use the River library to implement online machine learning, continuously updating user behavior baselines through a sliding window mechanism to adapt to attack patterns; For ≥10 6 The quantum annealing algorithm is used to solve the optimal access control matrix.

3. The cloud resource security access control method based on big data processing according to claim 1 is characterized by: The multimodal risk assessment model further includes: The semantic vector and image features are concatenated and input into the XGBoost classifier to generate a comprehensive risk score R∈[0,1]. The scoring formula is: Among them, R is the output result, σ is the activation function, ω i is the weight of the i-th feature, f i (x) is the i-th feature function, which transforms the input x, b is the bias term, and m is the number of features; Adversarial sample defense training module, which generates adversarial access request samples through a generative adversarial network to enhance the model's robustness against privilege escalation attacks; Cross-domain feature fusion module, using Transformer architecture to achieve self-attention weighted fusion of multimodal features, attention weight α ij The calculation method is: where α ij is the attention degree of the i-th element to the j-th element, e ij is the unnormalized attention score, q i is the i-th query vector, k j is the jth key vector, d is the dimension of the vector, attention weight, and N is the number of elements.

4. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The adaptive strategy generation and optimization also includes: Deploy TensorFlow Lite lightweight models on the edge for real-time behavior analysis; Build a digital twin of cloud resource access, use reinforcement learning to preview the effectiveness of strategies in a simulation environment, and then synchronize them to the production environment; In the policy release phase, Laplace noise is injected to achieve differential privacy protection, and the noise scale ∈ satisfies: Where Δf is the sensitivity and δ is the probability of privacy leakage.

5. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The zero-trust enhanced verification mechanism also includes: The FATE framework is used to implement a multi-tenant joint training access control model. The original data of each tenant does not leave the domain, and only the gradient parameters are exchanged; Implements policy evaluation in encrypted state based on the Microsoft SEAL library.

6. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The timing diagram algorithm for detecting abnormal paths includes the following steps: Construct a user-resource access graph G = (V, E) within the sliding time window, where V is the user / resource node, E is the access edge, and the edge weight is the access frequency; Calculate the characteristic indicators of node degree centrality, betweenness centrality, and closeness centrality graphs, and set dynamic thresholds. The thresholds are determined based on the 3σ principle of historical data distribution. The GraphSAGE graph neural network model is used to detect abnormal subgraph structures whose deviation from the normal behavior baseline exceeds a threshold. The deviation is calculated as follows: Among them, Deviation (G) is a measure of some deviation or difference, a i is the weight of the i-th feature, F i is the i-th characteristic function, G is the input data or graph, μ i is the mean of the i-th feature, σ i is the standard deviation of the i-th feature, and n is the number of features.

7. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The dual objective function formula of the Markov decision process model is: Among them, R security is the security risk benefit, R latency is the operation delay cost, γ is the discount factor, λ∈[0.1,0.3] is the delay cost weight coefficient, the optimal value is determined by grid search and cross-validation, π is the strategy, and it is decided to take action a in state st, E is the expected value, t is the time step, T is the total number of time steps, Rsecurity is the reward function related to security, st is the state at time step t, and a is the action at time step t.

8. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The zero-trust enhanced verification mechanism also includes: The FATE framework is used to implement multi-tenant joint training. Each tenant's data is sharded and stored locally, and the federated learning round T is configured to be 10-100 rounds.

9. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The authentication rules of S4 include: Parameter type checking; Parameter range verification; Parameter dependency validation.

10. The cloud resource security access control method based on big data processing according to claim 1 is characterized in that: The S4 also includes policy evaluation in an encrypted state based on the Microsoft SEAL library, supporting homomorphic encryption operations.

Images