Operation authority regulation and control method and device, equipment and medium

Abstract

The invention belongs to the field of artificial intelligence, and relates to an operation authority regulation and control method and device, equipment and a medium, and the method comprises the steps: obtaining the operation behavior data, spatial-temporal feature data and service context data of a user terminal when the target operation of the user terminal on a target system is detected; processing the obtained data to obtain an operation sequence data set; performing anomaly recognition on the operation sequence data set through a long-short-term memory network to obtain an operation sequence anomaly recognition result; calculating an operation path deviation degree of the user terminal through a graph neural network based on the operation sequence data set and the standard operation and maintenance knowledge graph; generating a dynamic risk scoring result based on the operation sequence anomaly recognition result and the operation path deviation degree; and regulating and controlling the operation authority of the user terminal based on the dynamic risk scoring result and the hierarchical authority control strategy. The method can be applied to the business field of financial insurance and the like, and the accuracy and real-time performance of safety operation and maintenance of the target system can be improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology and is applied to online processing business scenarios such as finance and insurance. In particular, it relates to a method, device, equipment and medium for controlling operation permissions. Background Technology

[0002] In the wave of digital transformation for insurance companies, core business systems, as key pillars of enterprise operations, encompass core areas such as claims processing, underwriting, and fund management, placing unprecedentedly stringent demands on security operations and maintenance. These systems not only carry massive amounts of sensitive data but also directly relate to the company's business continuity and customer trust. Therefore, building an efficient, flexible, and reliable security protection system is of paramount importance.

[0003] Traditionally, insurance companies have mostly used static Role-Based Access Control (RBAC) models for access control. However, this model relies heavily on manually preset rules for permission allocation, making it difficult to cope with today's complex and ever-changing business scenarios. Especially when operations and maintenance personnel need to perform temporary cross-system operations, the static model proves inadequate, unable to flexibly adjust permissions according to actual needs. This can either restrict operations and impact work efficiency, or lead to unauthorized access risks that threaten system security. Furthermore, this model exhibits a significant lag in identifying abnormal operational behavior, making it difficult to promptly prevent potential risks, thus exacerbating the problem of permission abuse.

[0004] To address these challenges, existing technologies have begun to incorporate user behavior analysis for anomaly detection, attempting to improve security capabilities by uncovering user behavior patterns. However, this approach still has several shortcomings. First, it relies too heavily on historical operation frequency thresholds as a basis for judgment, making it difficult to accurately distinguish between normal business innovation and malicious operations, easily leading to false positives or false negatives, and failing to achieve precise risk control. Second, the permission control mechanism is lagging behind; even if abnormal behavior is detected, a manual approval process is required to modify role permissions, making it impossible to block risks in real time. Summary of the Invention

[0005] The purpose of this application is to propose an operation permission control method, device, computer equipment and storage medium to solve the problems of existing technologies for security operation and maintenance of insurance core business systems, which introduce user behavior analysis and anomaly detection, but suffer from misjudgment and missed judgment due to over-reliance on historical thresholds, and the problem of slow manual approval for permission control making it difficult to prevent risks in real time.

[0006] Firstly, a method for controlling operation permissions is provided, which adopts the following technical solution:

[0007] When a user terminal's operation on the target system is detected, the system acquires the user terminal's operation behavior data, spatiotemporal feature data, and business context data. This data is then processed to obtain an operation sequence dataset. Anomalies in the operation sequence dataset are identified using a pre-defined long short-term memory network, yielding anomaly identification results. Based on the operation sequence dataset and a pre-defined standard operation and maintenance knowledge graph, the system calculates the user terminal's operation path deviation using a pre-defined graph neural network. Based on the operation sequence anomaly identification results and the operation path deviation, a dynamic risk score for the target operation is generated. Finally, based on the dynamic risk score and a pre-defined hierarchical access control strategy, the system regulates the user terminal's operation permissions.

[0008] Secondly, an operation permission control device is provided, which adopts the following technical solution:

[0009] The acquisition module is used to acquire user terminal operation behavior data, spatiotemporal feature data and business context data when a user terminal's target operation on the target system is detected.

[0010] The processing module is used to process operational behavior data, spatiotemporal feature data, and business context data to obtain an operational sequence dataset;

[0011] The identification module is used to identify anomalies in the operation sequence dataset through a preset long short-term memory network and obtain operation sequence anomaly identification results.

[0012] The calculation module is used to calculate the deviation of the user terminal's operation path based on the operation sequence dataset and the preset standard operation and maintenance knowledge graph, through a preset graph neural network.

[0013] The generation module is used to generate dynamic risk scores for the target operation based on the results of operation sequence anomaly identification and operation path deviation.

[0014] The control module is used to control the operation permissions of user terminals based on dynamic risk scoring results and preset hierarchical permission control strategies.

[0015] Thirdly, a computer device is provided, which adopts the following technical solution:

[0016] When a user terminal's operation on the target system is detected, the system acquires the user terminal's operation behavior data, spatiotemporal feature data, and business context data. This data is then processed to obtain an operation sequence dataset. Anomalies in the operation sequence dataset are identified using a pre-defined long short-term memory network, yielding anomaly identification results. Based on the operation sequence dataset and a pre-defined standard operation and maintenance knowledge graph, the system calculates the user terminal's operation path deviation using a pre-defined graph neural network. Based on the operation sequence anomaly identification results and the operation path deviation, a dynamic risk score for the target operation is generated. Finally, based on the dynamic risk score and a pre-defined hierarchical access control strategy, the system regulates the user terminal's operation permissions.

[0017] Fourthly, a computer-readable storage medium is provided, which adopts the following technical solution:

[0018] When a user terminal's operation on the target system is detected, the system acquires the user terminal's operation behavior data, spatiotemporal feature data, and business context data. This data is then processed to obtain an operation sequence dataset. Anomalies in the operation sequence dataset are identified using a pre-defined long short-term memory network, yielding anomaly identification results. Based on the operation sequence dataset and a pre-defined standard operation and maintenance knowledge graph, the system calculates the user terminal's operation path deviation using a pre-defined graph neural network. Based on the operation sequence anomaly identification results and the operation path deviation, a dynamic risk score for the target operation is generated. Finally, based on the dynamic risk score and a pre-defined hierarchical access control strategy, the system regulates the user terminal's operation permissions.

[0019] Compared with existing technologies, the embodiments of this application have the following main advantages: By integrating operational behavior, spatiotemporal features, and business context data, a dataset comprehensively reflecting user operation scenarios is constructed, providing a foundation for accurate risk assessment. Employing a Long Short-Term Memory (LSTM) network for anomaly identification overcomes the limitations of traditional historical threshold-based judgments, dynamically capturing potential threats in operation sequences and significantly reducing false positives and false negatives. Simultaneously, combining standard operational knowledge graphs with graph neural networks to calculate operational path deviations enables real-time perception of unexpected cross-system access behaviors, compensating for the flexibility deficiencies of static permission models. Finally, through the linkage of dynamic risk scoring and hierarchical permission control strategies, real-time adaptive adjustment of permissions is achieved, blocking high-risk operations. While ensuring business continuity, this effectively prevents the risk of permission abuse, significantly improving the accuracy and real-time performance of target system security operations. Attached Figure Description

[0020] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0022] Figure 2 A flowchart of an embodiment of the operation permission control method according to this application;

[0023] Figure 3 This is a schematic diagram of a structure of an embodiment of the operation permission control device according to this application;

[0024] Figure 4 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0026] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0028] like Figure 1As shown, system architecture 100 may include terminal device 101, network 102, and server 103. Terminal device 101 may be a laptop 1011, tablet 1012, or mobile phone 1013. Network 102 is used as a medium to provide a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables.

[0029] Users can use terminal device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0030] Terminal device 101 can be various electronic devices with a display screen and support web browsing. In addition to laptop computer 1011, tablet computer 1012 or mobile phone 1013, terminal device 101 can also be e-book reader, MP3 player (Moving Picture Experts Group Audio Layer III), MP4 player (Moving Picture Experts Group Audio Layer IV), laptop computer and desktop computer, etc.

[0031] Server 103 can be a server that provides various services, such as a backend server that provides support for the pages displayed on terminal device 101.

[0032] It should be noted that the operation permission control method provided in this application embodiment is generally executed by the server / terminal device, and correspondingly, the operation permission control device is generally set in the server / terminal device.

[0033] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0034] Continue to refer to Figure 2 A flowchart of an embodiment of the operation permission control method according to this application is shown. The operation permission control method includes the following steps:

[0035] Step S201: When a user terminal performs a target operation on the target system, the user terminal's operation behavior data, spatiotemporal feature data, and business context data are obtained.

[0036] In this context, a user terminal refers to a client device or software entity that initiates a request to operate on the target system. It carries the input of user operation commands and the output of system responses. Examples include laptops with SSH clients installed used by maintenance personnel and web terminals accessed by business personnel through browsers.

[0037] The target system refers to a specific business platform or information system within the core insurance business system that requires security protection. It represents the core components that store sensitive data and execute business logic, supporting core business processes such as claims processing, underwriting, and fund management. Examples include the policy verification module in a claims system and the payment and settlement subsystem in a fund management system.

[0038] In this context, a target operation refers to a specific business action or system access request initiated by a user terminal against a target system. It represents the specific function or data operation the user intends to perform, used to trigger detection and response mechanisms. Examples include logging into a server via SSH, calling an API interface to query customer policy information, and executing SQL statements to update the balance of a funds account.

[0039] Operational behavior data refers to a set of data reflecting the specific behavioral characteristics of a user terminal when operating a target system. Its sources include network transmission protocol login records, application call chains, and statement syntax structures collected by distributed probes. It characterizes detailed patterns and behavioral trajectories of user operations, used to analyze operational compliance and potential risks. For example, login time and source IP address in SSH login records, interface names and parameter values ​​in API call chains, and keywords and table names in SQL statement syntax structures all fall under the category of operational behavior data.

[0040] Spatiotemporal feature data refers to a set of data describing the spatiotemporal environment in which a user terminal operates the target system. Its sources include access time periods, geographical locations, and device fingerprints collected by distributed probes. This data characterizes the spatiotemporal context in which the operation occurs and helps determine the rationality and anomalies of the operation. For example, system login requests at 3 AM, device access from a different geographical location, and terminal access with device fingerprints that do not match historical records are all typical characteristics of spatiotemporal feature data.

[0041] Business context data refers to a set of data reflecting the business background and permission association when a user terminal operates on the target system. Its sources include information such as sensitivity levels and work order types recorded by the system. It characterizes the correlation between the operation and the business scenario and is used to assess the operation's risk level and permission requirements. Examples include customer data query operations with a "high" sensitivity level and system maintenance tasks with an "urgent" work order type.

[0042] Step S202: Process the operation behavior data, spatiotemporal feature data, and business context data to obtain the operation sequence dataset.

[0043] Processing refers to the technical processes of cleaning, transforming, associating, and extracting features from operational behavior data, spatiotemporal feature data, and business context data. Representation involves methods that transform raw data into structured feature sets, used to construct operational sequence datasets that can be analyzed by models.

[0044] Operation sequence datasets refer to a set of user operation features arranged chronologically after processing. They represent the complete behavioral trajectory and contextual information of user operations on the target system, supporting anomaly identification and path deviation calculation. Examples include time-series data containing the full process features of "login time - API call - SQL execution - system exit," and sets of operation records incorporating multi-dimensional information such as "geographical location - device fingerprint - sensitivity level," all of which are specific forms of operation sequence datasets.

[0045] Step S203: Anomaly identification is performed on the operation sequence dataset using a preset long short-term memory network to obtain operation sequence anomaly identification results.

[0046] Long Short-Term Memory (LSTM) networks refer to a deep learning model based on recurrent neural networks. They represent the ability to capture long-term dependencies through gating mechanisms and are used for anomaly pattern recognition on datasets of operational sequences.

[0047] Anomaly identification refers to the technical process of using Long Short-Term Memory (LSTM) networks to perform pattern matching and deviation detection on operation sequence datasets. It characterizes and determines whether the current operation conforms to the expected behavioral pattern, and is used to generate anomaly identification results for operation sequences.

[0048] The anomaly identification result of the operation sequence refers to the indicators or labels output during the anomaly identification stage that quantify the degree of anomaly in the operation sequence. It characterizes the degree of deviation between the operation sequence and the normal pattern and is used for subsequent risk scoring calculations. For example, the "anomaly confidence level" output as a probability value, or the "normal / suspicious / malicious" level output as a classification label, are specific manifestations of the anomaly identification result of the operation sequence.

[0049] Step S204: Based on the operation sequence dataset and the preset standard operation and maintenance knowledge graph, the deviation of the user terminal's operation path is calculated through the preset graph neural network.

[0050] The standard operations and maintenance knowledge graph refers to a pre-built knowledge graph that describes the standard operations and maintenance processes and permission dependencies of the core insurance business system. It represents the compliance paths and permission constraints of operations and maintenance operations and is used to calculate the deviation degree of the operation path.

[0051] Graph neural networks (GNNs) refer to a deep learning model that performs feature learning and inference based on graph-structured data. They represent the ability to capture graph-structure dependencies through information transmission between nodes and edges, and are used to calculate the deviation between user terminal operation paths and standard operational knowledge graphs.

[0052] Among them, the operation path deviation refers to the indicator output by the graph neural network, which quantitatively describes the degree of deviation between the user terminal operation path and the standard operation and maintenance knowledge graph.

[0053] Step S205: Based on the operation sequence anomaly identification results and operation path deviation, generate a dynamic risk score result for the target operation.

[0054] Among them, the dynamic risk score result refers to the score value generated by combining the anomaly identification result of the comprehensive operation sequence with the deviation of the operation path, which quantitatively describes the risk level of the target operation.

[0055] Step S206: Based on the dynamic risk scoring results and the preset hierarchical permission control strategy, adjust the operation permissions of the user terminal.

[0056] Among them, the hierarchical access control strategy refers to a predefined set of rules that automatically adjust the user terminal operation permissions based on the dynamic risk scoring results.

[0057] Operation permissions refer to the scope of operations and resource access capabilities that a user terminal is authorized to perform in the target system.

[0058] In this context, "control" refers to the technical process of modifying user terminal operation permissions in real time based on dynamic risk scoring results and tiered access control strategies. This is used to block high-risk operations and ensure business continuity. Examples include revoking login sessions of high-risk accounts and temporarily restricting API call permissions for suspicious devices.

[0059] This application's embodiments integrate operational behavior, spatiotemporal characteristics, and business context data to construct a dataset that comprehensively reflects user operation scenarios, providing fundamental support for accurate risk assessment. Employing a Long Short-Term Memory (LSTM) network for anomaly identification overcomes the limitations of traditional historical threshold-based judgments, dynamically capturing potential threats in operation sequences and significantly reducing false positives and false negatives. Simultaneously, combining standard operational knowledge graphs with graph neural networks to calculate operational path deviations enables real-time detection of unexpected cross-system access behaviors, compensating for the flexibility deficiencies of static permission models. Finally, through the linkage of dynamic risk scoring and hierarchical permission control strategies, real-time adaptive adjustment of permissions is achieved, blocking high-risk operations. While ensuring business continuity, this effectively prevents the risk of permission abuse, significantly improving the accuracy and real-time performance of target system security operations.

[0060] In some optional implementations of this embodiment, step 201, obtaining user terminal operation behavior data, spatiotemporal feature data, and business context data, specifically includes the following steps:

[0061] By using pre-set distributed probes, the system collects user terminal network transmission protocol login records, application call chains, and statement syntax structures as operational behavior data; it also collects user terminal access time periods, geographical locations, and device fingerprints as spatiotemporal feature data; and it collects user terminal sensitivity levels and work order types as business context data.

[0062] Distributed probes refer to software or hardware components deployed at network boundaries or within systems to collect user terminal operation behavior data and spatiotemporal characteristic data. For example, network probes deployed on switches can capture SSH login traffic, while host probes deployed on servers can record application call chains.

[0063] Network protocol login records refer to connection logs generated when a user terminal accesses a target system via a specific network protocol (such as SSH, RDP, HTTPS). For example, SSH login records contain information such as the source IP, target port, and authentication method (password / key).

[0064] The application call chain refers to a sequence of application programming interfaces (APIs) or function calls triggered when a user terminal operates the target system. It represents the execution path and dependencies of business logic and is used to analyze operational compliance and performance issues. For example, the API call sequence corresponding to the "submit application - risk control review - policy generation" process in a claims system.

[0065] Among them, statement syntax structure refers to the syntax composition of structured query language or command line statements sent by the user terminal to the target system.

[0066] The access period refers to the time range during which the user terminal operates the target system, and its source is the system clock or log timestamp. The geographic location refers to the physical location of the user terminal when operating the target system, and is used to detect logins from other locations or abnormal locations.

[0067] Among them, device fingerprint refers to a digital signature that uniquely identifies the characteristics of a user terminal device, representing the uniqueness of the terminal device and used to prevent device forgery or account sharing.

[0068] Sensitivity level refers to the risk sensitivity classification of data or operations in the target system, used to dynamically adjust the granularity of access control. Work order type refers to the category of business tasks associated with user terminal operations on the target system, representing the business background and compliance requirements of the operation, used to assist in risk assessment and access control allocation.

[0069] In one example, within the security operation and maintenance scenario of a core business system of an insurance company, the technical solution of this embodiment can be adopted to enhance security protection capabilities. Specifically, when a user terminal's target operation on the claims system is detected, a pre-set distributed probe can be used to collect the user terminal's network transmission protocol login records, application call chains, and statement syntax structures, using these as operation behavior data. The network transmission protocol login records include information such as the protocol type and encryption method used for login. The application call chain clearly presents the order of application calls involved in the operation. The statement syntax structure can determine whether the operation statement conforms to specifications. Simultaneously, access time, geographical location, and device fingerprint are collected. The access time determines whether it occurred during peak business hours or non-working hours. The geographical location determines whether it is a frequently used office location or a remote login. The device fingerprint identifies the uniqueness of the device. Additionally, the sensitivity level and work order type of the user terminal are collected, including sensitivity levels such as senior administrator or ordinary operator, and work order types such as claims application work orders or review work orders. By comprehensively collecting this data, we can gain a complete understanding of user operations, accurately identify abnormal behaviors, effectively avoid unreasonable permission allocation caused by the reliance on manually preset rules in traditional models, reduce the risk of unauthorized access, and improve system security and operational efficiency.

[0070] This application's embodiments utilize distributed probes to collect multi-faceted data, enabling comprehensive and accurate information gathering. Collecting network transmission protocol login records, application call chains, and statement syntax structures as operational behavior data meticulously records user operation details, providing a basis for accurate analysis of operational intent. Collecting access time periods, geographical locations, and device fingerprints as spatiotemporal feature data clarifies the temporal and spatial context of operations, aiding in determining their rationality. Collecting sensitivity levels and work order types as business context data allows for the assessment of operational risks within the context of business scenarios. This multi-dimensional data collection lays a solid foundation for subsequent accurate anomaly identification, risk scoring, and access control.

[0071] In some optional implementations, step 204, based on the operation sequence dataset and a preset standard operation and maintenance knowledge graph, calculates the operation path deviation of the user terminal through a preset graph neural network, specifically including the following steps:

[0072] Obtain a standard operation and maintenance knowledge graph, which includes standard operation and maintenance process paths; encode the operation sequence dataset into a graph structure using a pre-defined graph neural network to generate a behavioral feature graph for the user terminal; extract the graph structure features of the standard operation and maintenance process paths from the standard operation and maintenance knowledge graph; and calculate the path deviation score between the behavioral feature graph and the graph structure features using a graph neural network to obtain the operation path deviation of the user terminal.

[0073] The standard operation and maintenance process path is derived from a set of pre-built operation processes that conform to the security operation and maintenance specifications of the target system. It represents the standardized steps and sequence that user terminals should follow when performing normal operations in the target system under different business scenarios, and is used as a benchmark to judge whether user operations are compliant.

[0074] Graph structure encoding refers to the technique of transforming operation sequence datasets using graph neural networks. It encodes and represents various operational relationships and information in the operation sequence dataset in the form of a graph structure. This encoding method transforms complex relationships and operational sequences in the operation sequence into graph structure data that computers can understand and process, enabling accurate extraction and analysis of user operation behavior features.

[0075] Among them, the behavioral feature map is a graph-structured data generated by encoding the operation sequence dataset into a graph structure using a graph neural network. It represents the unique behavioral characteristics exhibited by the user terminal when operating on the target system. These characteristics cover multiple aspects such as operation steps, operation sequence, and operation relationships. Through the behavioral feature map, the patterns and characteristics of user operation behavior can be intuitively displayed, which can be used to compare and analyze with standard operation and maintenance process paths to determine whether there are any anomalies in user operations.

[0076] Among them, graph structure features are the structured features of standard operation and maintenance process paths extracted from the standard operation and maintenance knowledge graph. They represent the connection relationships, hierarchical structure, and path direction among various nodes (operation steps) in the standard operation and maintenance process path. These features reflect the standard patterns and rules of normal business operations and are used as a basis for judging whether the user's actual operation path deviates from the normal standard.

[0077] The path deviation score is a quantitative score obtained by calculating the degree of difference between the user terminal's behavioral feature map and the graph structure features extracted from the standard operation and maintenance knowledge graph using a pre-set graph neural network. It represents the degree to which the user's actual operation path deviates from the normal standard operation and maintenance process path.

[0078] In one example, within a claims system operation and maintenance scenario, a pre-constructed standard operation and maintenance knowledge graph is first acquired. This graph covers standard operation and maintenance process paths, from claim acceptance and damage assessment to claims review and payment. When a user terminal initiates a target operation on the claims system, such as skipping damage assessment and directly submitting a claim application, the corresponding operation sequence dataset is obtained. Using a pre-defined graph neural network, the operation sequence dataset is encoded with a graph structure, transforming the operation steps and their sequence into a behavioral feature map of the user terminal. Next, graph structure features of the standard operation and maintenance process paths are extracted from the standard operation and maintenance knowledge graph. Then, a graph neural network is used to calculate the path deviation score between the behavioral feature map and the graph structure features. The calculation shows that this operation, due to skipping a key step, has a high path deviation score. Based on this, a dynamic risk score is generated by combining the operation sequence anomaly identification results, and then, according to a tiered access control strategy, the user terminal's subsequent operation permissions are restricted. This method can accurately identify abnormal operations, reduce the risk of permission abuse, and ensure the safe and stable operation of the claims system.

[0079] This application's embodiments acquire a standard operations and maintenance (O&M) knowledge graph containing standard O&M process paths, and utilize graph neural networks to encode the operation sequence dataset to generate behavioral feature graphs. This accurately characterizes the inherent relationships and structural features of user terminal operation behaviors. The graph structure features extracted from the standard O&M knowledge graph provide a standard reference for judging operational compliance. Furthermore, by using graph neural networks to calculate the path deviation score between the behavioral feature graph and the graph structure features, the degree of deviation between the user terminal operation path and the standard O&M process path can be quantified, thereby more intuitively and accurately identifying abnormal operation paths and effectively improving the accuracy and reliability of O&M operation risk assessment.

[0080] In some optional implementations, the step "calculating the path deviation score between the behavioral feature map and the graph structure features using a graph neural network to obtain the user terminal's operation path deviation" specifically includes the following steps:

[0081] The graph neural network is used to aggregate the features of nodes and edges in the behavioral feature graph to generate aggregated feature vectors. The graph neural network is also used to aggregate the features of graph structure to generate standard feature vectors. A pre-set cosine similarity algorithm is used to calculate the deviation between the aggregated feature vectors and the standard feature vectors to obtain a path deviation score and determine the deviation of the user terminal's operation path.

[0082] The nodes are derived from the graph structure constructed after encoding the operation sequence dataset into a graph structure. They represent the basic elements in the graph structure, and each node corresponds to a specific operation step or state in the user terminal operation process.

[0083] The edges are also based on the graph structure constructed from the operation sequence dataset. They represent the connection relationship between nodes in the graph structure and reflect the sequence and association logic between user operation steps.

[0084] Feature aggregation refers to the technique of integrating the feature information contained in nodes and edges in a behavioral feature graph using graph neural networks. Representation aggregates the local feature information scattered across various nodes and edges into more representative global feature information.

[0085] Among them, the aggregated feature vector is a vector-like data generated after feature aggregation processing. It represents the integrated feature information of user terminal operation behavior, and is digitally represented in vector form.

[0086] The standard feature vector is a vector-like data generated from the graph structure features of standard operation and maintenance process paths extracted from the standard operation and maintenance knowledge graph and then aggregated. It represents the standard feature patterns of normal operation and maintenance in the target system and is presented digitally in vector form.

[0087] The cosine similarity algorithm is a mathematical algorithm used to calculate the degree of similarity between two vectors. It calculates the deviation between an aggregated feature vector and a standard feature vector. This algorithm quantifies the similarity between vectors into a value between -1 and 1. The closer the value is to 1, the more similar the two vectors are; that is, the closer the user's operation path is to the standard operation and maintenance process path. The closer the value is to -1, the greater the difference.

[0088] The deviation is a quantitative indicator obtained by calculating the similarity between the aggregated feature vector and the standard feature vector using the cosine similarity algorithm.

[0089] In one example, within a financial insurance claims system operation and maintenance scenario, a standard operation and maintenance knowledge graph is first acquired. This graph contains the standard claims operation and maintenance process paths, such as reporting, investigation, damage assessment, review, and payment. Using a pre-defined graph neural network, the user terminal operation sequence dataset is encoded into a graph structure to generate a behavioral feature graph. This graph represents the nodes (e.g., reporting, skipping investigation and directly proceeding to damage assessment) and edges (operation sequence relationships) of the user's actual operations. The graph neural network is then used to aggregate the nodes and edges of the behavioral feature graph, generating an aggregated feature vector. This vector integrates various feature information from the user's actual operations. Simultaneously, the graph structure features of the standard operation and maintenance process paths are aggregated to generate a standard feature vector. A cosine similarity algorithm is used to calculate the deviation between the aggregated feature vector and the standard feature vector, obtaining a path deviation score. The calculation shows that the user's operation of skipping investigation and directly proceeding to damage assessment has a high path deviation score. Based on this, deviations from the standard process in the user terminal operation path can be accurately determined, abnormal operations can be identified in a timely manner, effectively reducing the risks caused by abnormal operations in the claims system and ensuring the safe and stable operation of the system and business compliance.

[0090] This application embodiment uses a graph neural network to aggregate features of nodes and edges in a behavioral feature graph, generating aggregated feature vectors. This comprehensively and accurately captures the complex features of each node and the relationships between nodes in the user terminal operation path, resulting in a more complete feature representation. Aggregating graph structure features to generate standard feature vectors efficiently extracts key features from standard operation and maintenance process paths. Using a cosine similarity algorithm to calculate the deviation between two vectors yields a path deviation score, which quantifies the degree of difference between the user operation path and the standard operation and maintenance process path. This accurately and objectively determines the deviation of the user terminal operation path, providing a reliable basis for operation and maintenance management and anomaly detection.

[0091] In some optional implementations, step 205, based on the operation sequence anomaly identification results and operation path deviation, generates a dynamic risk score result for the target operation, specifically including the following steps:

[0092] By using a pre-set spatiotemporal attention mechanism, the results of abnormal operation sequence identification and operation path deviation are weighted and fused to generate a risk score for the target operation. If the risk score is greater than or equal to a pre-set threshold, the permission review process is triggered to generate a dynamic risk score result for the target operation. If the risk score is less than the threshold, the risk score is determined as the dynamic risk score result for the target operation.

[0093] Among them, the spatiotemporal attention mechanism represents a computational model that can simultaneously capture the temporal dynamics and spatial correlation of operational behavior, and is used to perform differentiated weight allocation on data of different dimensions.

[0094] Among them, weighted fusion is a composite calculation method based on weight allocation, which is used to comprehensively process the results output by different evaluation models.

[0095] The risk score quantifies the level of security threats that a target operation may pose. This score is obtained by normalizing a weighted risk value fused using a spatiotemporal attention mechanism; its magnitude reflects the degree of deviation between the operational behavior and the normal operational pattern.

[0096] The threshold represents a pre-defined risk scoring threshold, used to delineate the boundary between normal operations and suspicious operations.

[0097] The permission review process represents an automated permission control mechanism based on risk scoring, which is used to adjust user permissions in real time when high-risk operations are detected.

[0098] In one example, within a financial insurance claims system maintenance scenario, an operations and maintenance personnel initiates data modification operations on the claims system via a user terminal. The system first acquires the user's operational behavior data (e.g., frequent modifications to compensation amounts), spatiotemporal feature data (login from a different location outside of working hours), and business context data (currently during peak claims review periods), processing this data to obtain an operation sequence dataset. A Long Short-Term Memory (LSTM) network identifies anomalies in this operation sequence, such as frequent modifications to key fields within a short period, and outputs an anomaly identification result. A Graph Neural Network, based on a standard operations and maintenance knowledge graph, calculates the degree to which this operation path deviates from the normal review process, obtaining the operation path deviation degree. A spatiotemporal attention mechanism weights and fuses these two factors; due to the non-working-hour, location-based login and the abnormal operation, a higher weight is assigned, generating a risk score of 85. A preset threshold of 70 points is set; if the score exceeds the threshold, a permission review process is triggered, with security experts intervening for verification, generating a dynamic risk score result of high risk. Finally, based on a tiered permission control strategy, some sensitive operation permissions on the user terminal are frozen. This approach enables precise risk assessment and real-time permission control, effectively reducing system security risks.

[0099] This application's embodiments utilize a spatiotemporal attention mechanism to precisely weight and fuse the anomaly identification results and operational path deviations of operational behavior data based on their varying importance across time and space dimensions. This fusion method fully considers the characteristics of operations in different scenarios, making the generated target operational risk score more accurate and comprehensive. Based on a comparison of this risk score with a preset threshold, the permission review process can be flexibly triggered to generate dynamic risk score results or directly determine the risk score. This achieves hierarchical, dynamic, and precise control of user terminal operation permissions, effectively improving system security and risk prevention capabilities.

[0100] In some optional implementations, the step "using a pre-defined spatiotemporal attention mechanism to weightedly fuse the anomaly identification results of the operation sequence and the deviation of the operation path to generate a risk score for the target operation" specifically includes the following steps:

[0101] By using a pre-defined spatiotemporal attention mechanism, a first weight for abnormal operation sequence results and a second weight for operation path deviation are determined. Based on the first and second weights, the abnormal operation sequence identification results and operation path deviation are weighted and fused to generate a risk score for the target operation.

[0102] The first weight represents the relative importance of the anomaly identification result in the risk score calculation. This weight can be obtained by analyzing the temporal distribution and spatial correlation characteristics of the operational behavior data, combined with data patterns of historical normal operations and known attack behaviors.

[0103] The second weight represents the relative importance of the deviation between the operation path and the standard operation and maintenance knowledge graph in risk assessment. This weight can be dynamically calculated by comparing the graph structure characteristics of the actual operation path of the user terminal and the standard operation and maintenance process path, combined with business context data.

[0104] In one example, within the operation and maintenance scenario of a customer information management system for financial insurance, an operations and maintenance personnel initiated a batch data modification operation. The system first identified the anomaly in the operation sequence, showing that the operation modified a large amount of sensitive customer information within a short period, indicating an anomaly. Simultaneously, the operation path deviation was calculated, revealing that it bypassed the regular data review process. Next, a spatiotemporal attention mechanism came into play. Considering that this operation occurred during a peak business period and involved a remote login (spatiotemporal characteristic), the mechanism determined the first weight of the operation sequence anomaly result to be 0.6, and the second weight of the operation path deviation to be 0.4. Then, based on these two weights, a weighted fusion was performed, resulting in a risk score of 78 for the target operation. By dynamically allocating weights through the spatiotemporal attention mechanism, both the degree of operation anomaly and path deviation were comprehensively considered, avoiding the bias of judging based on a single factor.

[0105] This application's embodiments utilize a spatiotemporal attention mechanism to accurately capture feature changes in operation sequences across different spatiotemporal dimensions. This allows for the scientific and rational determination of the first weight for abnormal operation sequence results, while simultaneously considering the dynamic characteristics of operation path deviation to determine the second weight. This weight determination method fully considers multidimensional factors during the operation process, making weight allocation more targeted and reasonable. Based on the determined first and second weights, the abnormal operation sequence identification results and operation path deviation are weighted and fused, comprehensively integrating multiple information aspects to generate a comprehensive and accurate risk score for the target operation.

[0106] In some optional implementations, step 205, based on the dynamic risk scoring results and the preset hierarchical permission control strategy, regulates the user terminal's operation permissions, specifically including the following steps:

[0107] If the dynamic risk score is at the first risk level, a secondary verification process for the user terminal is triggered based on the preset hierarchical access control policy, and the user terminal's operation permissions are adjusted to a temporary access level after successful verification. If the dynamic risk score is at the second risk level, the user terminal's access mode is adjusted to the target access mode based on the hierarchical access control policy, and the execution of all operation instructions corresponding to the target data is prohibited. If the dynamic risk score is at the third risk level, the execution of the target operation is stopped based on the hierarchical access control policy, the user terminal is prohibited from accessing the target system for a preset time period, and a security alarm containing risk details is sent to the preset monitoring terminal. If the dynamic risk score is at the fourth risk level, the user terminal is isolated using preset isolation tools based on the hierarchical access control policy.

[0108] The first risk level represents a state where the target operation has certain potential risks, but the degree of risk is relatively low. It is used to distinguish different levels of risk in the risk assessment system so as to take differentiated response measures.

[0109] The secondary verification process represents an additional verification step added on top of the regular verification. This step further confirms the legitimacy of the user's terminal operations and the authenticity of the user's identity, thereby enhancing system security. For example, after the user enters their regular password, they are required to perform secondary verification via mobile verification code, fingerprint recognition, or facial recognition. Only after successful secondary verification can the user's terminal continue with subsequent operations.

[0110] Temporary permission level represents a limited operating permission granted to a user terminal under specific conditions, which is used to allow the user terminal to complete necessary operations while ensuring system security.

[0111] The second risk level is derived from the classification of the dynamic risk score results of the target operation. It represents the state of the target operation having a high potential risk and is used to clarify the risk level that requires stricter control measures in the risk assessment system.

[0112] The target permission mode originates from the adjustment settings of the second-risk-level operation permissions in the hierarchical permission control strategy. It is used to restrict the scope and permissions of user terminals to reduce the impact of risks on the system.

[0113] Among them, target data represents the specific data content involved in the target operation by the user terminal, which is used to clarify the data scope targeted by the operation and the basis for subsequent access control and risk assessment.

[0114] Among them, operation instructions represent commands issued by the user terminal to the target system to perform specific operations, which drive the target system to complete corresponding functions and are an important way for users to interact with the system.

[0115] The third risk level represents a state where the target operation has serious potential risks. It is used in the risk assessment system to identify the risk level that requires immediate emergency measures to prevent the risks from escalating further.

[0116] The preset time period represents the specific duration set when the target operation is stopped and user terminal access to the target system is prohibited. It is used to clarify the effective period of security control measures so as to ensure system security while avoiding excessive restriction on normal user use.

[0117] Among them, the monitoring terminal represents the equipment or system used to receive and process system security alarm information and to monitor the system's operating status in real time, so as to promptly detect and handle security events in the system and ensure the stable operation of the system.

[0118] Among them, the risk details represent a specific description and detailed situation of the target operational risk, which is used to provide comprehensive and accurate risk information to the monitoring terminal so that safety managers can gain a deeper understanding of the nature and source of the risk and take targeted countermeasures.

[0119] Among them, the security alarm characterization system sends warning messages to the monitoring terminal when it detects a risk in the target operation. This is used to promptly notify security management personnel of potential security issues in the system so that they can take swift action to address them.

[0120] The fourth risk level is derived from the classification of the dynamic risk score results of the target operation. It represents the state of the target operation having extremely serious potential risks and is used to identify the risk level in the risk assessment system that requires the most severe measures to prevent the system from suffering a devastating blow.

[0121] Isolation tools are software or hardware devices used to isolate user terminals with serious risks from target systems, thereby preventing the risks from spreading further and protecting the security of the target system.

[0122] Isolation characterization is the operation of physically or logically separating the user terminal with risk from the target system. It is used to cut off the risk propagation path, prevent the risk from causing further damage to the target system, and ensure the normal operation of the system.

[0123] In one example, within a user operation security management scenario in the financial insurance field, the technical solution of this embodiment can effectively ensure system security. The following is an illustration using a specific case. A large insurance company's core business system stores a large amount of sensitive customer information and key business data. In daily operations, there are instances where user terminals operate on the target system. When a user terminal initiates a claim application operation (target operation) on the insurance claims system, the system acquires the user terminal's operational behavior data, such as operation frequency and operation step sequence; spatiotemporal characteristic data, such as the geographical location and time of the operation; and business context data, such as the current status of the claim case and the types of insurance involved. This data is processed to obtain an operation sequence dataset. Anomaly identification is performed using a preset long short-term memory network to obtain operation sequence anomaly identification results. Simultaneously, based on the operation sequence dataset and a preset standard operation and maintenance knowledge graph, a preset graph neural network is used to calculate the operation path deviation. A dynamic risk score result is generated by combining both. If the risk score result is at the first risk level, indicating that the user's operation behavior is somewhat abnormal but the risk is low, the system triggers a secondary verification process, such as SMS verification code verification. After successful verification, the user terminal's operation permissions are adjusted to a temporary level, allowing only the user to complete the current claim application portion of the operation. If the risk level is second-tier, and abnormal operations are detected that may affect the accuracy of claim data, the system will adjust the permission mode to the target permission mode, prohibiting the execution of all operation instructions corresponding to target data such as claim amount modification. If the risk level is third-tier, and a malicious attack is suspected, the system will stop the execution of claim application operations, prohibit the user terminal from accessing the system for 24 hours, and send a security alert containing details of the abnormal operation to the monitoring terminal. If the risk level is fourth-tier, and malicious intrusion is confirmed, the system will isolate the user terminal using preset isolation tools. This technical solution effectively reduces the operational risks of the financial insurance system, ensuring business data security and stable system operation.

[0124] This application's embodiments achieve a multi-layered, differentiated security protection mechanism through the linkage design of dynamic risk scoring results and hierarchical access control strategies. When the risk score is at level one, the system triggers a secondary verification process and grants temporary permissions. This reduces the impact of false positives through dynamic identity verification and limits the scope of potentially risky operations through permission downgrading, balancing security and business continuity. When the risk score is at level two, the system directly switches the permission mode and blocks operations on the target data, quickly curbing abnormal behavior targeting core data and preventing the leakage of sensitive information. When the risk score is at level three, a combination of forced operation termination, access blocking, and security alarms forms a closed-loop control system of in-process blocking and post-event tracing, which is particularly suitable for high-risk operation scenarios. When the risk score is at level four, the terminal isolation mechanism provides the ultimate protection for extreme risk situations, preventing malicious terminals from causing continuous damage to the system. The response strategies for each level are precisely matched with the risk score, and the hierarchical access control strategy achieves standardized handling procedures, significantly improving the system's resilience and response efficiency against diverse attack methods.

[0125] It should be emphasized that, to further ensure the privacy and security of the aforementioned operational behavior data, spatiotemporal feature data, business context data, operation sequence datasets, operation sequence anomaly identification results, standard operation and maintenance knowledge graphs, operation path deviations, and dynamic risk scoring results, these data can also be stored in a node of a blockchain.

[0126] The blockchain referred to in this application is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0127] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0128] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0129] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0130] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0131] Further reference Figure 3 As a response to the above Figure 2 To implement the method shown, this application provides an embodiment of an operation permission control device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0132] like Figure 3 As shown, the operation permission control device 400 in this embodiment includes: an acquisition module 401, a processing module 402, an identification module 403, a calculation module 404, a generation module 405, and a control module 406. Wherein:

[0133] The acquisition module 401 is used to acquire the user terminal's operation behavior data, spatiotemporal feature data, and business context data when a target operation of a user terminal on a target system is detected.

[0134] Processing module 402 is used to process operation behavior data, spatiotemporal feature data and business context data to obtain operation sequence dataset;

[0135] The identification module 403 is used to identify anomalies in the operation sequence dataset through a preset long short-term memory network and obtain operation sequence anomaly identification results.

[0136] The calculation module 404 is used to calculate the deviation of the user terminal's operation path based on the operation sequence dataset and the preset standard operation and maintenance knowledge graph through a preset graph neural network.

[0137] The generation module 405 is used to generate a dynamic risk score result for the target operation based on the operation sequence anomaly identification result and the operation path deviation.

[0138] The control module 406 is used to control the operation permissions of user terminals based on dynamic risk scoring results and preset hierarchical permission control strategies.

[0139] This embodiment integrates operational behavior, spatiotemporal features, and business context data to construct a dataset that comprehensively reflects user operation scenarios, providing fundamental support for accurate risk assessment. It employs a Long Short-Term Memory (LSTM) network for anomaly identification, overcoming the limitations of traditional historical threshold-based judgments. This dynamically captures potential threats in operation sequences, significantly reducing false positives and false negatives. Simultaneously, by combining standard operational knowledge graphs with graph neural networks to calculate operational path deviations, it can detect unexpected cross-system access behaviors in real time, compensating for the flexibility deficiencies of static permission models. Finally, through the linkage of dynamic risk scoring and hierarchical permission control strategies, it achieves real-time adaptive adjustment of permissions, blocking high-risk operations. While ensuring business continuity, it effectively prevents the risk of permission abuse, significantly improving the accuracy and real-time performance of target system security operations.

[0140] In one embodiment, the acquisition module 401 includes:

[0141] The first data collection submodule is used to collect user terminal network transmission protocol login records, application call chains, and statement syntax structures through preset distributed probes, as operational behavior data.

[0142] The second data acquisition submodule is used to collect the user terminal's access time period, geographical location, and device fingerprint as spatiotemporal feature data.

[0143] The third data collection submodule is used to collect the sensitivity level and work order type of the user terminal as business context data.

[0144] This application's embodiments utilize distributed probes to collect multi-faceted data, enabling comprehensive and accurate information gathering. Collecting network transmission protocol login records, application call chains, and statement syntax structures as operational behavior data meticulously records user operation details, providing a basis for accurate analysis of operational intent. Collecting access time periods, geographical locations, and device fingerprints as spatiotemporal feature data clarifies the temporal and spatial context of operations, aiding in determining their rationality. Collecting sensitivity levels and work order types as business context data allows for the assessment of operational risks within the context of business scenarios. This multi-dimensional data collection lays a solid foundation for subsequent accurate anomaly identification, risk scoring, and access control.

[0145] In one embodiment, the calculation module 404 includes:

[0146] The acquisition submodule is used to acquire the standard operation and maintenance knowledge graph, which includes standard operation and maintenance process paths;

[0147] The encoding submodule is used to encode the operation sequence dataset into a graph structure using a pre-defined graph neural network, thereby generating a behavioral feature map of the user terminal.

[0148] The extraction submodule is used to extract the graph structure features of standard operation and maintenance process paths from the standard operation and maintenance knowledge graph;

[0149] The computation submodule is used to calculate the path deviation score between the behavioral feature map and the graph structure features through a graph neural network, so as to obtain the operation path deviation of the user terminal.

[0150] This application's embodiments acquire a standard operations and maintenance (O&M) knowledge graph containing standard O&M process paths, and utilize graph neural networks to encode the operation sequence dataset to generate behavioral feature graphs. This accurately characterizes the inherent relationships and structural features of user terminal operation behaviors. The graph structure features extracted from the standard O&M knowledge graph provide a standard reference for judging operational compliance. Furthermore, by using graph neural networks to calculate the path deviation score between the behavioral feature graph and the graph structure features, the degree of deviation between the user terminal operation path and the standard O&M process path can be quantified, thereby more intuitively and accurately identifying abnormal operation paths and effectively improving the accuracy and reliability of O&M operation risk assessment.

[0151] In one embodiment, the computation submodule is further configured to perform feature aggregation on nodes and edges of the behavioral feature graph through a graph neural network to generate an aggregated feature vector; perform feature aggregation on graph structure features through a graph neural network to generate a standard feature vector; and use a preset cosine similarity algorithm to calculate the deviation between the aggregated feature vector and the standard feature vector to obtain a path deviation score and determine the operation path deviation of the user terminal.

[0152] This application embodiment uses a graph neural network to aggregate features of nodes and edges in a behavioral feature graph, generating aggregated feature vectors. This comprehensively and accurately captures the complex features of each node and the relationships between nodes in the user terminal operation path, resulting in a more complete feature representation. Aggregating graph structure features to generate standard feature vectors efficiently extracts key features from standard operation and maintenance process paths. Using a cosine similarity algorithm to calculate the deviation between two vectors yields a path deviation score, which quantifies the degree of difference between the user operation path and the standard operation and maintenance process path. This accurately and objectively determines the deviation of the user terminal operation path, providing a reliable basis for operation and maintenance management and anomaly detection.

[0153] In one embodiment, the generation module 405 includes:

[0154] The fusion submodule is used to perform weighted fusion of the operation sequence anomaly identification results and operation path deviation through a preset spatiotemporal attention mechanism to generate a risk score for the target operation.

[0155] The generation submodule is used to trigger the permission review process and generate a dynamic risk score result for the target operation if the risk score is greater than or equal to a preset threshold.

[0156] The determination submodule is used to determine the risk score as the dynamic risk score result of the target operation if the risk score is less than the threshold.

[0157] This application's embodiments utilize a spatiotemporal attention mechanism to precisely weight and fuse the anomaly identification results and operational path deviations of operational behavior data based on their varying importance across time and space dimensions. This fusion method fully considers the characteristics of operations in different scenarios, making the generated target operational risk score more accurate and comprehensive. Based on a comparison of this risk score with a preset threshold, the permission review process can be flexibly triggered to generate dynamic risk score results or directly determine the risk score. This achieves hierarchical, dynamic, and precise control of user terminal operation permissions, effectively improving system security and risk prevention capabilities.

[0158] In one embodiment, the fusion submodule is further configured to determine a first weight of the abnormal result of the operation sequence and a second weight of the deviation of the operation path through a preset spatiotemporal attention mechanism; and to perform weighted fusion of the abnormal result of the operation sequence and the deviation of the operation path according to the first weight and the second weight to generate a risk score for the target operation.

[0159] This application's embodiments utilize a spatiotemporal attention mechanism to accurately capture feature changes in operation sequences across different spatiotemporal dimensions. This allows for the scientific and rational determination of the first weight for abnormal operation sequence results, while simultaneously considering the dynamic characteristics of operation path deviation to determine the second weight. This weight determination method fully considers multidimensional factors during the operation process, making weight allocation more targeted and reasonable. Based on the determined first and second weights, the abnormal operation sequence identification results and operation path deviation are weighted and fused, comprehensively integrating multiple information aspects to generate a comprehensive and accurate risk score for the target operation.

[0160] In one embodiment, the control module 406 includes:

[0161] The verification submodule is used to trigger a secondary verification process for the user terminal based on a preset hierarchical permission control strategy if the dynamic risk score result is the first risk level, and adjust the user terminal's operation permission to a temporary permission level after the verification is passed.

[0162] The control submodule is used to adjust the user terminal's permission mode to the target permission mode based on the hierarchical permission control strategy if the dynamic risk score result is the second risk level, and to prohibit the execution of all operation instructions corresponding to the target data.

[0163] The sending submodule is used to stop the execution of the target operation based on the hierarchical access control policy if the dynamic risk score result is the third risk level, prohibit the user terminal from accessing the target system within a preset time period, and send a security alarm containing risk details to the preset monitoring terminal.

[0164] The isolation submodule is used to isolate user terminals based on a hierarchical access control strategy and a preset isolation tool if the dynamic risk score result is the fourth risk level.

[0165] This application's embodiments achieve a multi-layered, differentiated security protection mechanism through the linkage design of dynamic risk scoring results and hierarchical access control strategies. When the risk score is at level one, the system triggers a secondary verification process and grants temporary permissions. This reduces the impact of false positives through dynamic identity verification and limits the scope of potentially risky operations through permission downgrading, balancing security and business continuity. When the risk score is at level two, the system directly switches the permission mode and blocks operations on the target data, quickly curbing abnormal behavior targeting core data and preventing the leakage of sensitive information. When the risk score is at level three, a combination of forced operation termination, access blocking, and security alarms forms a closed-loop control system of in-process blocking and post-event tracing, which is particularly suitable for high-risk operation scenarios. When the risk score is at level four, the terminal isolation mechanism provides the ultimate protection for extreme risk situations, preventing malicious terminals from causing continuous damage to the system. The response strategies for each level are precisely matched with the risk score, and the hierarchical access control strategy achieves standardized handling procedures, significantly improving the system's resilience and response efficiency against diverse attack methods.

[0166] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0167] Computer device 6 includes a memory 61, a processor 62, and a network interface 63 that are interconnected via a system bus. It should be noted that only computer device 6 with memory 61, processor 62, and network interface 63 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0168] Computer devices can include desktop computers, laptops, handheld computers, and cloud servers. These devices allow for human-computer interaction with users through methods such as keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0169] The memory 61 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 61 may be an internal storage unit of the computer device 6, such as the hard disk or memory of the computer device 6. In other embodiments, the memory 61 may also be an external storage device of the computer device 6, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 6. Of course, the memory 61 may include both the internal storage unit and the external storage device of the computer device 6. In this embodiment, the memory 61 is typically used to store the operating system and various application software installed on the computer device 6, such as computer-readable instructions for operation permission control methods. In addition, the memory 61 may also be used to temporarily store various types of data that have been output or will be output.

[0170] In some embodiments, processor 62 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 62 is typically used to control the overall operation of the computer device 6. In this embodiment, processor 62 is used to execute computer-readable instructions stored in memory 61 or to process data, such as computer-readable instructions for executing operation permission control methods.

[0171] The network interface 63 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 6 and other electronic devices.

[0172] This application's embodiments integrate operational behavior, spatiotemporal characteristics, and business context data to construct a dataset that comprehensively reflects user operation scenarios, providing fundamental support for accurate risk assessment. Employing a Long Short-Term Memory (LSTM) network for anomaly identification overcomes the limitations of traditional historical threshold-based judgments, dynamically capturing potential threats in operation sequences and significantly reducing false positives and false negatives. Simultaneously, combining standard operational knowledge graphs with graph neural networks to calculate operational path deviations enables real-time detection of unexpected cross-system access behaviors, compensating for the flexibility deficiencies of static permission models. Finally, through the linkage of dynamic risk scoring and hierarchical permission control strategies, real-time adaptive adjustment of permissions is achieved, blocking high-risk operations. While ensuring business continuity, this effectively prevents the risk of permission abuse, significantly improving the accuracy and real-time performance of target system security operations.

[0173] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the operation permission control method described above.

[0174] This application's embodiments integrate operational behavior, spatiotemporal characteristics, and business context data to construct a dataset that comprehensively reflects user operation scenarios, providing fundamental support for accurate risk assessment. Employing a Long Short-Term Memory (LSTM) network for anomaly identification overcomes the limitations of traditional historical threshold-based judgments, dynamically capturing potential threats in operation sequences and significantly reducing false positives and false negatives. Simultaneously, combining standard operational knowledge graphs with graph neural networks to calculate operational path deviations enables real-time detection of unexpected cross-system access behaviors, compensating for the flexibility deficiencies of static permission models. Finally, through the linkage of dynamic risk scoring and hierarchical permission control strategies, real-time adaptive adjustment of permissions is achieved, blocking high-risk operations. While ensuring business continuity, this effectively prevents the risk of permission abuse, significantly improving the accuracy and real-time performance of target system security operations.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of this application.

[0176] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

[0177] The software tools or components not belonging to our company that appear in the embodiments of this application are merely examples and do not represent actual use.

Claims

1. An operating authority regulation method, characterized by, The method comprises the following steps: When a target operation of a user terminal on a target system is detected, operation behavior data, spatio-temporal feature data and service context data of the user terminal are acquired; The operation behavior data, the spatio-temporal feature data and the service context data are processed to obtain an operation sequence data set; An operation sequence anomaly recognition result is obtained by performing anomaly recognition on the operation sequence data set through a preset long short-term memory network; An operation path deviation degree of the user terminal is calculated based on the operation sequence data set and a preset standard operation and maintenance knowledge graph through a preset graph neural network; A dynamic risk score result of the target operation is generated based on the operation sequence anomaly recognition result and the operation path deviation degree; The operation permission of the user terminal is regulated based on the dynamic risk score result and a preset hierarchical permission control strategy.

2. The method of claim 1, wherein, The step of acquiring the operation behavior data, the spatio-temporal feature data and the service context data of the user terminal specifically comprises: The network transmission protocol login record, the application program call chain and the statement syntax structure of the user terminal are collected as the operation behavior data through a preset distributed probe; The access period, the geographic location and the device fingerprint of the user terminal are collected as the spatio-temporal feature data; The sensitive level and the work order type of the user terminal are collected as the service context data.

3. The method of claim 1, wherein, The step of calculating the operation path deviation degree of the user terminal based on the operation sequence data set and the preset standard operation and maintenance knowledge graph through the preset graph neural network specifically comprises: A standard operation and maintenance knowledge graph is acquired, and the standard operation and maintenance knowledge graph comprises a standard operation and maintenance process path; The operation sequence data set is graph structure coded through the preset graph neural network to generate a behavior feature graph of the user terminal; The graph structure features of the standard operation and maintenance process path are extracted from the standard operation and maintenance knowledge graph; The path deviation degree score between the behavior feature graph and the graph structure features is calculated through the graph neural network to obtain the operation path deviation degree of the user terminal.

4. The method of claim 3, wherein, The step of calculating the path deviation degree score between the behavior feature graph and the graph structure features through the graph neural network to obtain the operation path deviation degree of the user terminal specifically comprises: The nodes and edges of the behavior feature graph are feature aggregated through the graph neural network to generate an aggregated feature vector; The graph structure features are feature aggregated through the graph neural network to generate a standard feature vector; The deviation degree between the aggregated feature vector and the standard feature vector is calculated through a preset cosine similarity algorithm to obtain the path deviation degree score and determine the operation path deviation degree of the user terminal.

5. The method of claim 1, wherein, The step of generating the dynamic risk score result of the target operation based on the operation sequence anomaly recognition result and the operation path deviation degree specifically comprises: The operation sequence anomaly recognition result and the operation path deviation degree are weighted and fused through a preset spatio-temporal attention mechanism to generate a risk score of the target operation. If the risk score is greater than or equal to a preset threshold, a permission review process is triggered, and a dynamic risk score result of the target operation is generated. If the risk score is less than the threshold, the risk score is determined as the dynamic risk score result of the target operation.

6. The method of claim 5, wherein, The step of generating the risk score of the target operation by weighting and fusing the operation sequence anomaly recognition result and the operation path deviation degree through the preset spatio-temporal attention mechanism specifically includes: Determine a first weight of the operation sequence anomaly result and a second weight of the operation path deviation degree through the preset spatio-temporal attention mechanism. According to the first weight and the second weight, the operation sequence anomaly recognition result and the operation path deviation degree are weighted and fused to generate the risk score of the target operation.

7. The method of claim 1, wherein, The step of regulating the operation permission of the user terminal based on the dynamic risk score result and a preset hierarchical permission control strategy specifically includes: If the dynamic risk score result is a first risk level, a secondary verification process for the user terminal is triggered based on the preset hierarchical permission control strategy, and the operation permission of the user terminal is regulated to a temporary permission level after verification; If the dynamic risk score result is a second risk level, the permission mode of the user terminal is regulated to a target permission mode based on the hierarchical permission control strategy, and the execution of all operation instructions corresponding to the target data is prohibited; If the dynamic risk score result is a third risk level, the execution of the target operation is stopped based on the hierarchical permission control strategy, the user terminal is prohibited from accessing the target system within a preset time period, and a security alarm containing risk details is sent to a preset monitoring terminal; If the dynamic risk score result is a fourth risk level, the user terminal is isolated by a preset isolation tool based on the hierarchical permission control strategy.

8. An operation authority regulating apparatus characterized by comprising: It includes: The acquisition module is configured to acquire operation behavior data, spatio-temporal feature data, and business context data of a user terminal when detecting a target operation of the user terminal on a target system. The processing module is configured to process the operation behavior data, the spatio-temporal feature data, and the business context data to obtain an operation sequence data set. The identification module is configured to perform anomaly identification on the operation sequence data set through a preset long short-term memory network to obtain an operation sequence anomaly recognition result. The calculation module is configured to calculate an operation path deviation degree of the user terminal based on the operation sequence data set and a preset standard operation and maintenance knowledge graph through a preset graph neural network. The generation module is configured to generate a dynamic risk score result of the target operation based on the operation sequence anomaly recognition result and the operation path deviation degree. The regulation module is configured to regulate the operation permission of the user terminal based on the dynamic risk score result and a preset hierarchical permission control strategy.

9. A computer device, comprising: An apparatus comprising a memory having computer readable instructions stored therein and a processor that implements the steps of the method of claim 1-7 when executing the computer readable instructions.

10. A computer-readable storage medium, characterized in that, A computer readable storage medium having computer readable instructions stored thereon that, when executed by a processor, implement the steps of the method of claim 1-7.

Images