Computer network security access control management method based on big data

Abstract

The invention relates to the technical field of computer network security, and discloses a computer network security access control management method based on big data. The method comprises the following steps: constructing a network security situation knowledge graph, collecting a real-time access behavior sequence through a probe, and synchronizing the real-time access behavior sequence to the knowledge graph; simulating a network entity interaction state in the knowledge graph, and predicting a threat propagation path and a potential intrusion behavior; setting a dynamic access control strategy, constructing a multi-dimensional feature matrix in combination with a real-time access behavior sequence association influence degree and a strategy execution priority constraint condition, calculating a strategy conflict risk score by using a deep learning model, comparing with a preset threshold to judge whether a conflict exists or not, and if yes, reconstructing the strategy; and automatically executing access blocking, session termination and data encryption operations according to the reconstructed strategy, recording an execution log and security feedback data, and updating the knowledge graph in real time. According to the method, the dynamic property and the security of access control are improved, and security threats in a complex network environment can be effectively handled.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a computer network security access control management method based on big data. Background Technology

[0002] With the rapid development of information technology, computer networks have become a core infrastructure for social operation and economic development, and various organizations and individuals are increasingly reliant on networks. However, the openness and complexity of the network environment have led to increasingly diverse security threats, with frequent security incidents such as illegal intrusions, data breaches, and malicious attacks, posing serious challenges to the confidentiality, integrity, and availability of network information.

[0003] Traditional network security access control methods are mostly based on static rules, such as Access Control Lists (ACLs) and Role-Based Access Control (RBAC). These methods are difficult to cope with dynamically changing network environments and complex attack methods. For example, when new attack patterns or abnormal behaviors emerge in the network, static rules cannot be adjusted in time, which can easily lead to security vulnerabilities. At the same time, as the network scales up and the number of users increases, the management of static rules becomes increasingly difficult, and conflicts between rules are hard to avoid, further reducing the effectiveness of access control.

[0004] Existing methods have significant shortcomings in threat prediction and response. They often focus on passive defense against events that have already occurred, lacking the ability to proactively identify and predict potential threats, and failing to block possible intrusion paths in advance. When processing access behavior, they also struggle to fully consider the correlations between different behaviors, resulting in low accuracy in identifying complex attack behaviors. Furthermore, when faced with a large number of concurrent access requests, the processing efficiency of existing methods is insufficient to meet practical needs, easily leading to response delays and impacting normal network operation.

[0005] With the development of big data technology, how to utilize massive amounts of network access data to achieve more intelligent and dynamic access control has become a research hotspot. However, current access control methods based on big data still have many problems in knowledge representation, threat prediction model construction, and dynamic policy adjustment. For example, it is difficult to effectively integrate multi-source heterogeneous network data, it is impossible to accurately simulate the interaction relationships between network entities, and the conflict detection and reconstruction mechanism of dynamic policies is not perfect. These problems limit the security and adaptability of access control methods. Summary of the Invention

[0006] The purpose of this invention is to provide a computer network security access control management method based on big data to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides a computer network security access control management method based on big data, the method comprising:

[0008] A network security situation knowledge graph is constructed by collecting real-time access behavior sequences through probes deployed at network boundaries and internal nodes, and synchronizing the real-time access behavior sequences to the network security situation knowledge graph.

[0009] Simulate network entity interaction states in the network security situation knowledge graph to predict threat propagation paths and potential intrusion behaviors;

[0010] A dynamic access control policy is set up. This policy combines the correlation between real-time access behavior sequences and policy execution priority constraints to determine whether there are policy conflicts in the rule engine. If so, the dynamic access control policy is restructured, specifically as follows:

[0011] The dynamic access control policy constructs a multi-dimensional feature matrix based on the correlation mapping between the predicted value of the identity anomaly index and the estimated value of the data flow sensitivity. Combined with the preset policy execution priority, the policy conflict risk score is generated by the rule engine through a deep learning model. The risk score is then compared with the preset conflict threshold to determine whether a policy conflict exists.

[0012] The system automatically executes access blocking, session termination, and data encryption operations based on the reconstructed dynamic access control policy, and continuously records policy execution logs and security feedback data. The network security situation knowledge graph is updated in real time based on the security feedback data.

[0013] Preferably, the probe is used to collect real-time access behavior sequences including user authentication records, protocol type distribution, data packet payload characteristics, session duration and access frequency distribution, which are used to construct a multi-level, regional knowledge graph input feature set.

[0014] Preferably, a spatiotemporal graph convolutional network is used to predict threat propagation paths and potential intrusion behaviors, specifically including:

[0015] The entire network topology is divided into multiple security domains, each corresponding to a super node in the graph structure; the connection relationship between super nodes is established based on network traffic paths, permission inheritance relationships, or vulnerability dependency chains; each super node is associated with real-time access behavior sequences collected by multiple probes, forming the spatiotemporal feature tensor of the node; an initial network security graph structure is constructed, which includes a set of nodes, a set of edges, and a node feature cube;

[0016] The network state of each collection cycle is represented as a dynamic graph sequence, and continuous time windows form a spatiotemporal graph evolution sequence; combining the changes in node features in each graph with the network topology invariance, a spatiotemporal graph neural network input is constructed; the labeled data are threat level labels or intrusion behavior markers for each supernode within a preset time period in the future;

[0017] Temporal graph convolutional networks are used to extract the spatiotemporal correlation features of super nodes; the spatiotemporal graph convolutional network performs convolution operations on the dynamic graph at each time slice and outputs the threat embedding vector of the node;

[0018] The threat embedding vector is input into the multi-step prediction module; the future time window traffic anomaly index or permission change frequency of each supernode is predicted; the prediction results are analyzed for anomalies in conjunction with the historical security event database; if the predicted value of a supernode deviates from the baseline behavior model, it is marked as a potential intrusion behavior.

[0019] Preferably, the method for obtaining the predicted value of the identity anomaly index is as follows: construct a causal reasoning graph for identity authentication, determine the variable nodes related to the identity anomaly index, including authentication failure frequency, session geographical offset, permission change frequency and access time anomaly degree, establish causal dependency chains between variables, form a directed acyclic reasoning graph, and set the predicted value of the identity anomaly index as the target variable node.

[0020] Collect real-time monitoring data from historical cybersecurity incidents and train a Bayesian inference network.

[0021] During access control, real-time observations of authentication failure frequency, session geographic offset, permission change frequency, and access time anomaly are acquired; these observations are input into the Bayesian inference network as known nodes; the probability distribution of network nodes is updated through the evidence propagation algorithm; and the probability distribution result of the predicted identity anomaly index is output as the current predicted identity anomaly index value.

[0022] The preferred method for obtaining data flow sensitivity estimation is as follows:

[0023] A deep packet inspection engine is deployed at the core switching node of the network to collect data stream features in fixed time windows; each data stream feature sequence represents the trajectory of changes in data transmission sensitivity within a specific time window, forming a sensitivity time series sample;

[0024] A temporal variational autoencoder is used to extract features from the sensitivity time series: the encoder network automatically learns the feature vector of the sensitivity change pattern in each time series; the decoder network attempts to reconstruct the original sensitivity curve; after training, the encoder compresses the newly acquired data stream sensitivity sequence into a low-dimensional feature representation.

[0025] Density clustering algorithm is used to classify feature vectors into patterns; each cluster represents a typical data sensitivity evolution pattern; after clustering, a preset sensitivity level label is assigned to each pattern.

[0026] During access control operation, the system continuously collects the current data stream sensitivity time series; extracts the current feature vector using a trained temporal variational autoencoder; performs similarity matching between the feature vector and cluster centers to determine the sensitivity pattern category to which the current sequence belongs; and outputs the current data stream sensitivity estimate based on the matching results.

[0027] Preferably, the predicted value of the identity anomaly index and the estimated value of data flow sensitivity are fused into a multi-dimensional feature matrix. The multi-dimensional feature matrix is ​​used as the input of a deep learning model. Combined with the currently configured policy execution priority, the deep learning model uses the predicted policy conflict risk value of each set of feature matrices as the training objective and the minimization of the prediction error of all policy conflict risk values ​​as the optimization objective. The deep learning model is continuously trained until the error converges. The policy conflict risk value of the rule engine is determined based on the model output value. The deep learning model adopts a spatiotemporal convolutional neural network architecture.

[0028] Preferably, the obtained rule engine policy conflict risk value is compared with a preset conflict threshold. If the rule engine policy conflict risk value reaches or exceeds the conflict threshold, it is determined that there is a policy conflict in the rule engine. At this time, a policy reconstruction instruction is triggered and the dynamic access control policy is optimized. If the rule engine policy conflict risk value is lower than the conflict threshold, it is determined that there is no policy conflict in the rule engine. At this time, the current policy execution state is maintained.

[0029] Preferably, the network security situation knowledge graph is updated in real time based on security feedback data, specifically including: constructing the basic structure of the network security situation knowledge graph during the initialization phase, synchronously establishing a feedback data repository, and associating the correspondence between each policy execution record, system response result, and knowledge graph output; constructing an incremental learning task set using historical security feedback data, with each task corresponding to a specific network attack scenario, including a training sample set and a validation sample set; fine-tuning the parameters of the network security situation knowledge graph in each task; iteratively optimizing the embedding representation of the knowledge graph through multi-tasks, in actual operation, the real-time feedback data collected after each policy execution is used to construct new tasks; inputting the new tasks into the meta-learning optimizer for incremental training, updating the local parameters of the current knowledge graph, and retaining the updated sub-graph model; the system periodically verifies the prediction accuracy of the sub-graph model; if the error decreases to a preset threshold, the fine-tuned parameters are synchronized to the main knowledge graph, and the global graph parameters are updated or stored in the scenario model library.

[0030] Preferably, the reconstructing process of the dynamic access control policy further includes: when a policy conflict is detected, extracting the key dimensions from the current multidimensional feature matrix and generating a policy adjustment suggestion vector; co-optimizing the access blocking rules, session termination conditions, and data encryption strength based on the policy adjustment suggestion vector; and synchronizing the optimized policy parameters to all execution nodes through a security policy distribution channel.

[0031] Preferably, the prediction of the future time window traffic anomaly index or permission change frequency for each supernode includes:

[0032] If the similarity between the threat embedding vector of the current supernode and the known threat patterns in the historical security event database reaches a preset matching threshold, the fast response analysis channel is activated, and an access blocking instruction is directly generated based on the threat feature matching results.

[0033] If the similarity is lower than the preset matching threshold, the traffic protocol distribution features and permission change trajectory features in the spatiotemporal feature tensor are extracted, and the unidentified threat behaviors are analyzed through a multi-level anomaly detection model to generate incremental threat feature vectors and update the historical security event database.

[0034] Compared with the prior art, the beneficial effects of the present invention are:

[0035] By constructing a network security posture knowledge graph, it is possible to effectively integrate real-time access behavior sequences of network boundaries and internal nodes, achieving a comprehensive and dynamic characterization of network security status. As a powerful form of knowledge representation, knowledge graphs can clearly present the relationships between network entities, providing a solid foundation for subsequent threat prediction and access control strategy formulation.

[0036] Simulating network entity interactions within a cybersecurity posture knowledge graph helps to gain a deeper understanding of the inherent patterns in network behavior, thereby enabling more accurate predictions of threat propagation paths and potential intrusion behaviors. This proactive predictive capability changes the traditional passive defense approach, allowing for preemptive action to reduce the likelihood of security incidents. Early identification of potential threats buys more time for cybersecurity protection, minimizing losses caused by attacks.

[0037] The dynamic access control policy settings fully consider the correlation between real-time access behavior sequences and policy execution priority constraints, making access control more flexible and adaptable. A multi-dimensional feature matrix is ​​constructed based on the correlation mapping between the predicted identity anomaly index and the estimated data flow sensitivity. Combined with a deep learning model, a risk score for policy conflicts is calculated by the rule engine, enabling more accurate determination of policy conflicts. When conflicts exist, the dynamic access control policy is reconstructed, avoiding security vulnerabilities caused by policy conflicts and ensuring the consistency and effectiveness of the access control policy. This conflict detection and reconstruction mechanism improves the policy's adaptability and can cope with complex and ever-changing network environments.

[0038] The restructured dynamic access control policy automatically executes access blocking, session termination, and data encryption operations, enabling rapid response to security incidents. Simultaneously, it continuously records policy execution logs and security feedback data, and updates the network security posture knowledge graph in real time based on this data, forming a closed-loop adaptive system. The accumulation of logs and feedback data continuously optimizes the accuracy and completeness of the knowledge graph, thereby improving the accuracy of threat prediction and the adaptability of dynamic policies. This continuous iterative update mechanism allows the access control method to evolve with changes in the network environment, maintaining good security protection performance in the long term. Attached Figure Description

[0039] Figure 1 This is a schematic diagram illustrating the working principle of the big data-based computer network security access control management method described in this invention.

[0040] Figure 2 This is a flowchart for predicting threat propagation paths and potential intrusion behaviors based on spatiotemporal graph convolutional networks;

[0041] Figure 3 A flowchart illustrating the method for obtaining the predicted value of the identity anomaly index;

[0042] Figure 4 A flowchart for updating the cybersecurity posture knowledge graph based on security feedback data;

[0043] Figure 5 This is a flowchart of the process for refactoring dynamic access control policies. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Please see Figure 1 This invention provides a computer network security access control management method based on big data, the method comprising:

[0046] A dynamically evolving cybersecurity posture knowledge graph is constructed, forming a closed-loop control system through real-time behavior acquisition, threat prediction, and policy self-optimization. The cybersecurity posture knowledge graph is stored in a distributed graph database, containing network entity nodes, access relationship edges, and dynamic attribute sets. The probe module is deployed as an SDN controller plugin, capturing OSI seven-layer protocol data at a preset sampling frequency. Real-time access behavior sequences are converted into spatiotemporal attributes of the knowledge graph after feature extraction, and attack propagation paths are simulated using graph traversal algorithms. Dynamic access control policies adopt a reinforcement learning-based policy tree structure, with policy nodes containing conditional predicates and operation sets. Policy conflict detection is achieved by calculating the cosine similarity of the policy graph embedding vectors using a graph neural network. The policy reconstruction process uses a genetic algorithm to generate candidate policy sets, which are then verified in a sandbox environment before being distributed to execution nodes.

[0047] Example 1: See Figure 2 The project involves the construction of a cybersecurity situational awareness knowledge graph, the collection and analysis of real-time access behavior sequences, and a threat prediction method based on spatiotemporal graph convolutional networks. The entire implementation process adopts a modular design, with each component working collaboratively to form a dynamic monitoring and prediction system.

[0048] The probe acquisition module adopts a lightweight architecture and is deployed on the network boundary firewall and core switching nodes. Each probe instance contains three functional units: a packet sniffer that captures raw traffic based on the libpcap library and sets a BPF filter to exclude known legitimate traffic; a protocol parser that supports deep parsing of the SNI field in the TLS / SSL handshake protocol, HTTP / 2 frame header features, and DNS query records; and a feature extractor that uses a sliding window mechanism to generate a set of feature vectors containing 28-dimensional statistics every 5 minutes. User authentication records are obtained by listening to the Radius and TACACS+ protocol ports, and the record fields include authentication method, credential hash value, and response latency. Protocol type distribution statistics use an adaptive window algorithm to dynamically adjust the statistical period to balance real-time performance and computational overhead.

[0049] Packet payload characteristic analysis employs a layered processing strategy: the link layer focuses on MAC address flipping anomalies, the network layer detects IP fragmentation attack characteristics, the transport layer analyzes SYN flood behavior patterns, and the application layer constructs a regular expression rule base to match malicious payloads. Session duration monitoring introduces a TCP state tracker to record the establishment time, data transmission stage, and termination reason for each session. Access frequency distribution statistics combine Bloom filters and counting sketches to achieve high-frequency IP detection within limited memory. Collected real-time behavioral data is transmitted to the central node via an encrypted channel, and Apache Kafka is used for data buffering and asynchronous processing.

[0050] The construction process of spatiotemporal graph convolutional networks is divided into two stages: topology modeling and dynamic graph sequence generation. Network topology partitioning is based on enterprise security policies, dividing each VLAN into an independent security domain, with core business systems in separate domains. Connections between supernodes are automatically established by analyzing cross-domain traffic in firewall logs, with edge weights reflecting historical communication frequencies. The node feature cube uses a fixed 5-minute interval for its time dimension, records the physical location and logical area of ​​probe deployments for its spatial dimension, and includes traffic statistics, protocol distribution entropy values, and abnormal behavior counts for its feature dimensions. The dynamic graph sequence generator maintains a circular buffer of 64 time slices, each slice containing a complete network topology snapshot and node feature matrix.

[0051] The spatiotemporal graph neural network employs a three-stage processing architecture. The preprocessing layer standardizes node features and fills in missing values, using linear interpolation to handle probe packet loss. The spatiotemporal convolutional layer contains parallel temporal and spatial convolutional modules. The temporal convolution uses causal kernels to capture historical dependencies, while the spatial convolution uses learnable filters designed based on spectral graph theory. The feature fusion layer dynamically adjusts the spatiotemporal feature weights through a gating mechanism, outputting node-level threat embedding vectors. The threat level labeling system interfaces with the SIEM platform, mapping security events to three-level threat labels based on CVSS scores. The multi-step prediction module uses an encoder-decoder structure. The encoder uses stacked GRU layers to compress historical sequence features, and the decoder combines an attention mechanism to generate predicted outputs for the next three time slices.

[0052] The anomaly correlation analysis system comprises online matching and offline modeling. The online channel employs an improved dynamic time warping algorithm to calculate the similarity between the predicted sequence and known attack patterns in the CVE database, setting adaptive thresholds to trigger alarms. The offline channel runs an attack scenario reconstruction engine, generating novel threat feature templates through causal reasoning. The prediction result visualization system uses a force-directed graph layout, with red gradient edges representing threat propagation paths and node sizes reflecting risk levels.

[0053] The storage of real-time behavioral data and prediction results adopts a layered architecture. Raw traffic packets are stored in a distributed file system, feature data is stored in a time-series database, and graph relationships are managed using a graph database. For system performance optimization, the probe acquisition module employs zero-copy technology to reduce CPU load, and the graph neural network inference process is accelerated using TensorRT. Fault tolerance mechanisms include modules for data verification and retransmission, model hot standby switching, and rollback in abnormal states.

[0054] Emphasis is placed on the timing consistency between components, and global clock synchronization ensures the coordinated operation of behavior collection, graph updates, and threat prediction. A graph reconstruction process is triggered when the network topology changes, automatically identifying new nodes and failed connections. The system maintenance module continuously monitors resource utilization and dynamically adjusts computing task scheduling strategies to ensure real-time requirements.

[0055] It is important to ensure the interpretability of feature engineering and to establish manual verification interfaces for key features. The spatiotemporal graph convolutional network is trained using a transfer learning strategy, first pre-trained on a large-scale simulation dataset, and then fine-tuned using actual network data. The confidence assessment of threat prediction results employs an ensemble method, combining the prediction variances of multiple sub-models to calculate an uncertainty index.

[0056] The system deployment phase employs a canary release strategy, first verifying functional integrity in non-core areas before gradually expanding coverage. Operation and maintenance include automated testing suites to regularly verify the integrity of data collection, the accuracy of model predictions, and the effectiveness of strategy execution. Version upgrades utilize a rolling update mechanism to ensure uninterrupted service while completing component iterations.

[0057] By employing fine-grained behavior acquisition, precise topology modeling, and efficient neural network computation, an intelligent system for dynamically perceiving network security posture is constructed. The data flow design between modules fully considers real-time processing requirements, ensuring both analytical depth and enterprise-level performance. The system possesses excellent scalability, supporting adaptation to network environments of varying sizes by adding probe nodes or expanding the neural network layers.

[0058] Example 2: See Figure 3 This study employs a collaborative analysis method involving identity anomaly index prediction and data flow sensitivity estimation. It achieves fine-grained security risk assessment by constructing a causal inference model and a temporal feature extraction system. The implementation process integrates probabilistic graphical models and deep learning techniques to form a dynamically evolving security analysis system.

[0059] The core of the identity anomaly index prediction system lies in constructing an interpretable causal reasoning network. During the system initialization phase, four types of observation nodes and their probability distributions are defined. The authentication failure frequency node uses a truncated Poisson distribution to process the count data, setting a maximum threshold of 20 times per hour to avoid outlier interference. The session geographic offset node calculates the great circle distance between two consecutive login locations by fusing GPS positioning and IP geographic database information. The permission change frequency node monitors RBAC policy additions, deletions, and modifications, distinguishing between normal operational activities and suspicious privilege escalation behaviors. The access time anomaly node establishes a user behavior baseline model, comparing the statistical differences between current operation times and historical patterns.

[0060] The causal graph is constructed using a combination of expert knowledge and data-driven methods. Directed edges are established based on two types of evidence: temporal correlation patterns in security event logs and causal chains of typical attack scenarios annotated by domain experts. The system pre-defines three main influencing paths while retaining an adaptive adjustment mechanism to allow the discovery of new causal relationships during operation. The Bayesian network structure learning employs a scoring search algorithm to optimize model fit while maintaining the sparsity of the graph structure.

[0061] The preprocessing of historical training data includes a multi-step cleaning process. Raw security event logs are de-identified, and personal privacy information is removed to generate an anonymized dataset. Continuous variables are binned and discretized, while categorical variables are represented using embeddings. During model training, variational inference methods are used to approximate the posterior distribution, and stochastic gradient descent is used to optimize network parameters. The inference process implements real-time incremental updates; when new observations arrive, the system completes evidence propagation and probability recalculation within milliseconds.

[0062] During the online prediction phase, the system maintains statistics on sliding time windows. Authentication failure frequency statistics track abnormal login attempts within the last 15 minutes, distinguishing between different types such as incorrect passwords and expired tokens. Session geographic offset detection, combined with user-reported travel plans, performs context-aware assessments of behaviors such as cross-border logins. The permission change monitor tracks permission propagation paths and identifies abnormal role inheritance relationships. The access time analysis module considers different patterns for weekdays and holidays, dynamically adjusting normal time intervals.

[0063] The data flow sensitivity assessment system adopts a layered processing architecture. The network sniffing layer is deployed at the core switching node, acquiring full traffic data through port mirroring. The protocol identification engine includes dual channels of feature matching and behavioral analysis, accurately distinguishing between encrypted business traffic and potential data leaks. The deep packet inspection module implements application layer protocol parsing, supporting semantic analysis of HTTP headers, SQL queries, and other content.

[0064] The temporal feature extraction system employs a dedicated sampling strategy. A fixed time window of 30 seconds is set, and six core features are statistically analyzed within each window: payload byte entropy reflects the degree of data randomness; transmission direction indicates a tendency for monitored data to be transmitted outwards; byte distribution moments characterize the occurrence pattern of specific values; protocol nesting depth detects tunnel encapsulation behavior; encryption flags identify unconventional encryption modes; and stream duration correlates with the duration of sensitive operations. A robust scaling method is used in the feature standardization process to reduce interference from abnormal traffic.

[0065] The architecture of the temporal variational autoencoder considers both computational efficiency and feature representation capability. The encoder employs a causal convolutional network to capture local temporal patterns, combined with an attention mechanism to highlight key time points. The latent space is modeled using a diagonal Gaussian distribution, and end-to-end training is achieved through reparameterization techniques. The decoder uses gated recurrent units to progressively reconstruct the input sequence, and the output layer employs a hybrid density network to handle multimodal distributions. Regularization constraints are introduced during model training to prevent excessive shrinkage of the latent space.

[0066] The clustering analysis phase employs a hierarchical density clustering algorithm. The preprocessing step uses principal component analysis for dimensionality reduction, retaining 90% of the original information. The clustering process automatically determines the optimal number of clusters, naturally forming groups based on data distribution density. Each cluster center represents a typical data flow pattern, and after manual review, it is labeled with a predefined sensitivity level. The online matching phase implements approximate nearest neighbor search, using product quantization to compress feature vectors, improving query speed while maintaining recall.

[0067] In terms of system implementation, identity anomaly prediction and data flow analysis are deployed using a microservice architecture. The message bus uses a publish-subscribe pattern to deliver real-time events, ensuring decoupling between components. A caching layer stores recent calculation results and supports fast historical queries. Monitoring dashboards visualize key indicators, including anomaly index trend charts and sensitive traffic heatmaps. A configuration management interface allows security administrators to adjust threshold parameters to adapt to different business scenario requirements.

[0068] The fault tolerance mechanism includes multiple safeguards. During data acquisition, it enables breakpoint resumption and automatically caches local data in case of network interruptions. Multiple replicas of the model service are deployed, and failover is achieved through heartbeat detection. Regular snapshots save the system state, allowing rollback to a stable version in case of anomalies. For performance optimization, in-memory computing is used for critical paths to reduce disk I / O overhead. Batch processing operations are executed in parallel, fully utilizing multi-core CPU resources.

[0069] By integrating probabilistic reasoning and deep learning technologies, a security risk assessment system adapted to dynamic network environments is constructed. The identity anomaly index prediction module provides interpretable analysis results, while the data flow sensitivity estimation system achieves fine-grained content awareness. The two subsystems generate a comprehensive security posture judgment through feature-level fusion. The system design emphasizes a balance between real-time performance and computational efficiency, enabling stable operation in enterprise-level network environments.

[0070] Example 3: See Figure 4 This approach focuses on constructing a multi-dimensional feature matrix and predicting policy conflict risks, using a deep learning model to intelligently optimize dynamic access control policies. The implementation process is based on a deep correlation analysis of identity anomaly indices and data flow sensitivity, resulting in an adaptive policy management system.

[0071] The construction of the multidimensional feature matrix employs a spatiotemporal alignment mechanism to fuse two types of security indicators into a unified representation. The feature fusion window T is defined as 8 consecutive sampling periods, with each period containing observations in four dimensions: the logarithmic transformation of authentication failure frequency, the normalized distance of geographical offset, the cumulative number of permission changes, and the KL divergence of temporal anomalies. The data stream sensitivity estimate outputs 5-level discrete labels, which are converted into a 3D continuous vector representation through an embedding layer. The matrix construction process follows these calculation rules:

[0072]

[0073] in This represents the element in the i-th row and j-th column of the generated feature matrix. Let be the attenuation coefficient for the k-th time slice. This represents the value of the i-th dimension of identity feature in the k-th period. The value of the j-th dimension sensitivity feature in the k-th period, This represents element-wise multiplication. This formula ensures that features from different time scales are reasonably weighted and integrated while maintaining numerical stability.

[0074] The deep learning model employs a dual-branch heterogeneous network architecture. The identity feature branch consists of three one-dimensional convolutional networks, each with 64 filters of width 3, using causal padding to preserve temporal positional information. The sensitivity feature branch uses bidirectional LSTM layers with 32 hidden units; the forward and backward states are concatenated before being fed into the attention layer. Policy priority encoding uses a 7-dimensional one-hot vector, projected onto the same embedding space as the feature branches through a fully connected layer. A gated crossover mechanism is designed in the feature fusion stage to dynamically adjust the contribution weights of the two feature classes.

[0075] The quantitative definition of conflict risk prediction objectives considers the coverage relationships of policy rules. For a given set of policies... Define conflict risk value for:

[0076]

[0077] in This represents the sigmoid function. Calculate the cardinality of the intersection of the conditional predicates of strategies p and q. This indicates the number of objects to which strategy p applies. This is the priority weight of strategy q. This definition considers both the degree of logical conflict between strategies and the impact of execution priority, and obtains a risk score between 0 and 1 through normalization.

[0078] The model training process employs a phased optimization strategy. In the pre-training phase, a large-scale dataset is constructed using historical policy decision records, and a mean squared error loss function is used to initially fit the mapping relationship between features and risk. In the fine-tuning phase, policy importance weighting is introduced, increasing the loss weight for samples corresponding to high-priority policies. The optimizer is configured with an adaptive learning rate, initially set to 0.001, decaying by 50% every 10 epochs. Regularization measures include Dropout layers and L2 weight decay to prevent overfitting.

[0079] The dynamic adjustment mechanism for conflict thresholds is implemented based on sliding window statistics. It maintains the moving average and standard deviation of the most recent 100 predictions and sets three levels of warning thresholds: the baseline threshold is the moving average plus 1.5 times the standard deviation, the severe threshold is 3 times the standard deviation, and the emergency threshold is 5 times the standard deviation. The comparison module implements multi-granularity responses: when an instantaneous risk value exceeds the emergency threshold, it immediately triggers strategy reconstruction; when three consecutive predictions exceed the severe threshold, it initiates preventative analysis; the baseline threshold is used for daily monitoring and trend warnings.

[0080] The policy reconstruction process employs a genetic algorithm-based optimization method. The initial population contains multiple variants of the current policy set, with each individual encoding a set of policy parameters. The fitness function comprehensively considers three factors: the reduction in conflict risk, the preservation of policy coverage, and execution overhead. A tournament-style selection operation is used, with a crossover probability of 0.8 and a mutation probability of 0.05. The optimization process is run in a sandbox environment, and the policy effectiveness is verified through traffic replay before deployment to the production environment.

[0081] The system implementation employs a distributed architecture. The feature matrix builder is deployed on edge nodes, close to the data source to reduce transmission latency. The model inference service runs on a GPU-accelerated cluster, supporting high-concurrency prediction requests. The policy management module implements version control, generating a new policy snapshot with each refactoring and retaining a complete change history. The monitoring system visualizes key metrics, including risk trend charts, policy coverage heatmaps, and resource consumption dashboards.

[0082] Performance optimization measures include a multi-level caching design. Raw feature data is cached in an in-memory database, while calculation results from the most recent 10 minutes are retained in a local cache. Model parameters are compressed using quantization techniques, and accuracy is dynamically restored during inference. The parallel computing framework processes the feature matrix in blocks, fully utilizing multi-core processor resources. A fault-tolerance mechanism enables automatic fault detection and recovery, automatically switching to a backup model copy when the prediction service times out.

[0083] Through rigorous feature engineering and advanced deep learning techniques, an intelligent system capable of dynamically perceiving policy conflict risks is constructed. A multi-dimensional feature matrix effectively integrates heterogeneous security indicators, and a dual-branch network architecture fully explores the deep correlations between features. The quantitative definition of conflict risk accurately reflects the complex interactions between policies, and genetic algorithm optimization ensures the quality of policy reconstruction. The system design balances computational efficiency and decision accuracy, meeting the real-time requirements of enterprise-level network security management.

[0084] Example 4: See Figure 5 The paper discusses the incremental updates of the network security posture knowledge graph and the reconstruction and optimization of dynamic access control policies, demonstrating the system's operational mechanism in a real-world network environment through specific examples. Taking a targeted attack on a financial institution's network as an example, the paper details the collaborative working process of the system's various modules.

[0085] The financial institution's network comprises three security domains: a core transaction system, a customer management system, and an internal office system. During the initial construction of the network security posture knowledge graph, three types of nodes were defined: terminal device nodes recording IP-MAC binding information, user nodes associating AD accounts with department attributes, and application nodes labeling service ports and access permissions. Edge relationships included four types: device-user login relationships, user-application access relationships, device-network zone affiliation relationships, and application-data flow dependency relationships. Probes were deployed at the core switches, DMZ zone boundaries, and in front of the database server, with a sampling frequency set to one sampling cycle per minute.

[0086] One day, the security operations center received an anomaly alert, detecting suspicious behavior on multiple terminal devices within the customer management system domain. Policy enforcement module logs showed that dynamic access control policies had triggered three session blocking operations: targeting an abnormal connection on TCP port 445, a database query during an abnormal time period, and a lateral movement attempt. The system response table recorded that these operations successfully blocked the suspicious sessions, but it was subsequently discovered that the attacker switched to TCP port 3389 to continue penetration. In the security feedback data repository, this event was marked as a "lateral movement-credential theft" attack pattern, associated with 5 terminal nodes, 2 user accounts, and 3 application service nodes in the knowledge graph.

[0087] The incremental learning task generator analyzes the characteristics of this event and creates a specialized training task package. This task contains 1200 positive samples extracted from network behavior sequences in actual attack traffic; and 800 negative samples from normal business traffic during the same period. The meta-learning optimizer adopts a model-independent meta-learning framework. The inner loop quickly adapts to the task package data with a learning rate of 0.01 and performs 5 gradient updates. The outer loop adjusts the global parameters of the knowledge graph with a learning rate of 0.001. Differential privacy protection is implemented during the update process by adding random noise conforming to a Gaussian distribution during gradient calculation.

[0088] During the knowledge graph update phase, the system first creates a subgraph copy in an isolated environment, containing the affected network regions and their three-hop neighbor nodes. The subgraph model fine-tunes the node embedding representation, focusing on optimizing the edge type weights representing lateral movement behavior. In the validation phase, 200 retained samples are used for testing. Once the subgraph confirms improved detection accuracy against similar attacks, the updated parameters are synchronized to the main knowledge graph. A new "Remote Desktop Protocol Abuse" attack mode has been added to the scenario model library, recording the RDP connection characteristics, time distribution, and target selection patterns used by attackers.

[0089] The policy restructuring process analyzed the control blind spots exposed by this attack. The policy adjustment suggestion vector generation module output six optimization directions: downgrading the default RDP protocol permission from "allow" to "approval-based release"; adding time constraints to database query operations; increasing the encryption strength requirements for cross-security domain access; limiting the number of concurrent sessions per account; implementing two-factor authentication for management terminals; and narrowing the range of usable IPs for privileged accounts. The security policy distribution channel pushes updates via the blockchain network, and each execution node loads the new policy after verifying the digital signature.

[0090] In subsequent operation, the system continuously monitored the effectiveness of the policy implementation. Within the first hour after the new policy was implemented, four RDP connection approval requests were recorded, one of which was rejected due to an unusual country of origin. The optimized session termination conditions effectively prevented attackers from maintaining persistent connections, and the increased data encryption strength made network sniffing attacks more difficult. Security feedback data recorded these operational results in real time, forming new incremental learning tasks to begin the next round of knowledge graph optimization.

[0091] The system architecture is designed to support deployment requirements in large-scale network environments. Feedback data processing utilizes a streaming computing framework, completing feature extraction and task classification within 5 seconds of event logs entering the system. The model update service is deployed on a Kubernetes cluster, automatically scaling computing resources based on load. The version control system retains all policy change history, supporting backtracking to specific versions of policy rules by time point. A visual interface displays the evolution of the knowledge graph, using different colors to mark newly added nodes, modified edges, and deleted components.

[0092] Through a closed-loop feedback learning mechanism, the network security protection system possesses the ability to continuously evolve. Knowledge graph updates driven by specific attack events ensure the system can quickly adapt to new threats. The policy refactoring process not only resolves currently detected conflicts but also prevents potential risks through proactive adjustments. Feedback data accumulated during system operation forms a virtuous cycle, continuously improving the ability to identify and handle complex attack scenarios.

[0093] Example 5: Focusing on rapid response to cybersecurity threats and analysis of unknown attack behaviors, this example utilizes a multi-level analysis pipeline to achieve timely handling and feature learning of emerging threats. The implementation process demonstrated its technical characteristics in the actual operating environment of a large cloud service provider, which includes over 5,000 virtual hosts and 200 business microservices.

[0094] When the threat embedding vector of a supernode in a business cluster exhibits abnormal fluctuations, the system initiates a three-level matching analysis process. The first level calculates the Euclidean distance between the current threat vector and 300 known attack patterns in the historical feature database. These patterns cover various threats, ranging from port scanning to zero-day exploits. On a certain weekday morning, the system detected that the distance between the threat vector of a certain group of web servers and a historical SQL injection attack pattern reached 0.82, exceeding the preset matching threshold of 0.8. The system immediately activated a rapid response channel. The response engine queried the asset criticality tags of the business cluster and, combined with the characteristic parameters of the attack pattern, generated access blocking instructions containing specific rules: immediately terminating all HTTP sessions containing suspicious SQL fragments, limiting the number of concurrent connections from the source IP to three, and mandating human verification for subsequent requests.

[0095] When the behavioral characteristics of an edge computing node fail to match a known pattern, the system transitions to a deep analysis process. During a security inspection, an anomaly was discovered in the traffic protocol distribution of a group of IoT gateway devices. The proportion of CoAP protocol traffic suddenly increased from the usual 15% to 62%, but the similarity to any documented attack pattern was less than 0.7. The protocol layer analyzer extracted TCP flag combination features, discovering a large number of unconventional URG flag uses; the application layer parser identified abnormal resource request frequencies; and the behavior layer tracker reconstructed the communication topology changes between devices. These features were combined into an incremental threat feature vector, containing 27 dimensions of behavioral indicators, and stored in a feature library awaiting review by security experts. After confirmation, this feature vector was marked as a new attack pattern of "IoT device botnets," updated to the historical security event database, and corresponding detection rules were generated.

[0096] The analysis of permission change trajectories employed process mining techniques. During an internal audit, the system detected 17 permission changes for a certain operations and maintenance account within 8 hours, far exceeding the normal operational frequency for this role. The behavior reconstruction engine transformed this operation sequence into a state transition graph, visually displaying the entire process of the account's abnormal escalation from ordinary operations and maintenance privileges to domain administrator privileges. The analysis model identified two key transitions: the first was obtaining temporary escalation of privileges through an API vulnerability in a configuration management system, and the second was solidifying privileges using a group policy modification tool. This abnormal trajectory pattern was abstracted as a characteristic template for privilege escalation attacks, used for the early identification of similar subsequent behaviors.

[0097] The multi-level anomaly detection model employs a weighted fusion strategy for its output. For a suspected data breach, the system simultaneously outputs evaluation results across three dimensions: the protocol deviation score, reflecting abnormal modifications to SSL handshake parameters, reaches 78 points; the privilege escalation probability is calculated at 0.43, exceeding the baseline value by more than double; and the time-series anomaly density indicator shows periodic abrupt changes in the data outflow rate. The comprehensive evaluation engine combines these indicators with business sensitivity weights to ultimately generate a threat confidence score of 87, triggering data encryption and backup isolation operations.

[0098] The system implementation adopts a modular design. The rapid response channel is implemented as an independent microservice cluster, ensuring instruction generation and distribution within 100 milliseconds. The deep analysis engine is deployed on GPU-accelerated computing nodes, with an average processing time of 2.3 seconds for complex analysis tasks. The signature database update service implements version control and rollback mechanisms, generating complete audit logs for each change. The visualization interface presents the analysis results according to the network topology, using gradient colors to indicate threat propagation paths and dynamically displaying the attacker's lateral movement trajectory.

[0099] By employing a layered and progressive analysis approach, the conflicting demands for response speed and detection depth are effectively balanced. Rapid matching of known threats ensures immediate blocking of common attacks, while deep behavioral analysis provides the technical means to identify emerging threats. Visual reconstruction of permission change trajectories helps understand complex attack chains, and multi-indicator fusion assessment enhances decision-making reliability. The threat signature database is continuously enriched during system operation, resulting in the synchronous evolution of defensive capabilities and attack methods.

[0100] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0101] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A big data based computer network security access control management method, characterized in that, The method comprises the following steps: Constructing a network security situation knowledge graph, collecting real-time access behavior sequences through probes deployed at network boundaries and internal nodes, and synchronizing the real-time access behavior sequences to the network security situation knowledge graph; Simulating network entity interaction states in the network security situation knowledge graph, predicting threat propagation paths and potential intrusion behaviors; Setting a dynamic access control policy, which combines the correlation influence degree between real-time access behavior sequences and the policy execution priority constraint condition to determine whether there is a policy conflict in the rule engine, and if there is, reconstructing the dynamic access control policy, specifically: The dynamic access control policy constructs a multi-dimensional feature matrix based on the correlation mapping between the identity anomaly index prediction value and the data flow sensitivity estimate, combines the preset policy execution priority, calculates the risk score of the policy conflict generated by the rule engine through a deep learning model, and compares the risk score with the preset conflict threshold to determine whether there is a policy conflict; According to the reconstructed dynamic access control policy, automatically performing access blocking, session termination and data encryption operations, and continuously recording policy execution logs and security feedback data, and updating the network security situation knowledge graph in real time based on the security feedback data.

2. The big data based computer network security access control management method of claim 1, wherein, The real-time access behavior sequences collected by the probe include user identity authentication records, protocol type distribution, data packet payload features, session duration and access frequency distribution, which are used to construct a multi-level, regional knowledge graph input feature set.

3. The big data based computer network security access control management method of claim 1, wherein, The threat propagation path and potential intrusion behavior are predicted by using a spatio-temporal graph convolution network, specifically including: Divide the entire network topology into multiple security domains, each security domain corresponding to a super node in the graph structure; the connection relationship between super nodes is established based on network traffic paths, permission inheritance relationships or vulnerability dependency chains; each super node is associated with multiple real-time access behavior sequences collected by probes, forming a spatio-temporal feature tensor of the node; an initial network security graph structure is constructed, which includes a node set, an edge set and a node feature cube; Express the network state of each collection period as a dynamic graph sequence, and form a spatio-temporal graph evolution sequence in a continuous time window; combine the node feature changes in each graph with the network topology invariance to construct a spatio-temporal graph neural network input; the data is labeled as the threat level label or intrusion behavior mark of each super node within a preset future time; Use a time series graph convolution network to extract the spatio-temporal correlation features of the super node; the spatio-temporal graph convolution network performs convolution operation on the dynamic graph at each time slice, and outputs the threat embedding vector of the node; Input the threat embedding vector into a multi-step prediction module; predict the future time window traffic anomaly index or permission change frequency of each super node; combine the historical security event library to perform abnormal correlation analysis on the prediction results; if the prediction value of a super node deviates from the baseline behavior model, it is marked as a potential intrusion behavior.

4. The big data based computer network security access control management method of claim 3, wherein, The method for obtaining the identity anomaly index prediction value comprises the following steps: constructing a causal reasoning graph for identity authentication, determining variable nodes related to the identity anomaly index, including authentication failure frequency, session geographic offset, permission change frequency and access time anomaly degree, establishing causal dependency chains between the variables, forming a directed acyclic reasoning graph, and setting the identity anomaly index prediction value as a target variable node; Real-time monitoring data in historical network security events is collected to train the Bayesian inference network; During the access control process, the observation values of the authentication failure frequency, session geographic offset, permission change frequency and access time anomaly degree are obtained in real time; the observation values are input into the Bayesian inference network as known nodes; the network node probability distribution is updated through an evidence propagation algorithm; and a probability distribution result of the identity anomaly index prediction value is output as the current identity anomaly index prediction value.

5. The big data based computer network security access control management method of claim 4, wherein, The method for obtaining the data flow sensitivity estimate value comprises the following steps: A deep packet inspection engine is deployed at a network core switching node to collect data flow features in fixed time windows; each data flow feature sequence represents the change trajectory of data transmission sensitivity in a specific time window, forming a sensitivity time sequence sample; A time sequence variational autoencoder is used to extract features from the sensitivity time sequence: the encoder network automatically learns the sensitivity change mode feature vector in each time sequence; the decoder network attempts to reconstruct the original sensitivity curve; after training, the encoder compresses the newly collected data flow sensitivity sequence into a low-dimensional feature representation; A density clustering algorithm is used to classify the feature vectors; each clustering cluster represents a typical data sensitivity evolution mode; after clustering, each mode is assigned a preset sensitivity level label; During the access control operation, the system continuously collects the current data flow sensitivity time sequence; the trained time sequence variational autoencoder is used to extract the current feature vector; The feature vector is matched with the clustering center in terms of similarity to determine the sensitivity mode category to which the current sequence belongs; according to the matching result, the current data flow sensitivity estimate value is output.

6. The big data based computer network security access control management method of claim 5, wherein, The identity anomaly index prediction value and the data flow sensitivity estimate value are fused into a multi-dimensional feature matrix, which is input into a deep learning model; the deep learning model uses the rule engine policy conflict risk value predicted from each group of feature matrices as the training target, minimizes the prediction error of all policy conflict risk values as the optimization target, and continuously trains the deep learning model until the error converges; the rule engine policy conflict risk value is determined according to the model output value, wherein the deep learning model adopts a spatio-temporal convolutional neural network architecture.

7. The big data based computer network security access control management method of claim 6, wherein, The obtained rule engine policy conflict risk value is compared with a preset conflict threshold; if the rule engine policy conflict risk value reaches or exceeds the conflict threshold, it is determined that the rule engine has a policy conflict, and a policy reconstruction instruction is triggered to optimize the dynamic access control policy; If the rule engine policy conflict risk value is lower than the conflict threshold, it is determined that the rule engine does not have a policy conflict, and the current policy execution state is maintained.

8. The big data based computer network security access control management method of claim 1, wherein, The network security posture knowledge graph is updated in real time based on security feedback data, specifically including: in the initialization stage, a network security posture knowledge graph infrastructure is constructed, a feedback data repository is synchronously established, and the correspondence between each policy execution record, system response result and knowledge graph output is associated; historical security feedback data is used to construct an incremental learning task set, each task corresponding to a specific network attack scenario and containing a training sample set and a verification sample set; the network security posture knowledge graph is fine-tuned in each task; the embedding representation of the knowledge graph is optimized through multi-task iteration, in actual operation, real-time feedback data collected after each policy execution is constructed into a new task; the new task is input into a meta-learning optimizer for incremental training, the current knowledge graph is updated locally, and the updated sub-graph model is retained; the system regularly verifies the prediction accuracy of the sub-graph model; if the error decreases to a preset threshold, the fine-tuned parameters are synchronized to the main knowledge graph, the global graph parameters are updated or stored in the scene model library.

9. The big data based computer network security access control management method of claim 8, wherein, The reconstruction process of the dynamic access control strategy further includes: when a policy conflict is detected, extracting key dimensions in the current multi-dimensional feature matrix to generate a policy adjustment suggestion vector; according to the policy adjustment suggestion vector, the access blocking rule, the session termination condition and the data encryption strength are optimized; the optimized policy parameters are synchronized to all execution nodes through a security policy distribution channel.

10. The big data based computer network security access control management method of claim 3, wherein, The prediction of the future time window traffic anomaly index or permission change frequency of each super node includes: If the similarity between the threat embedding vector of the current super node and the known threat pattern in the historical security event library reaches a preset matching threshold, the rapid response analysis channel is activated, and an access blocking instruction is directly generated based on the threat feature matching result; If the similarity is lower than the preset matching threshold, the traffic protocol distribution feature and the permission change trajectory feature in the spatio-temporal feature tensor are extracted, the unidentified threat behavior is analyzed through a multi-level anomaly detection model, an incremental threat feature vector is generated, and the historical security event library is updated.

Images