Layered permission adaptive access control method and device based on student information system

Abstract

The invention relates to the technical field of information system authority control and access management, and discloses a hierarchical authority adaptive access control method and device based on a student information system, and the method comprises the steps: analyzing a user access log, extracting a daily access record, carrying out the statistics of the number of times of access in each time period, and marking a high-frequency access interval; counting key peak intervals for the high-frequency access intervals to generate a time domain behavior set; comparing the role association data with the time domain behavior set, and determining a personalized behavior feature description set; extracting a time rule to generate a temporary permission rule list; according to the system resource occupation data, dynamically adjusting permission rules, and generating an optimized permission rule combination; sequencing according to a time rule to generate a permission allocation sequence; and updating the permission storage structure and automatically executing permission granting operation. According to the method, self-adaptive permission allocation based on the user behavior mode and the system load can be realized, and the system security and the resource utilization rate are improved.

Description

Technical Field

[0001] This invention relates to the field of information system access control and management technology, and in particular to a hierarchical access control method and apparatus based on a student information system. Background Technology

[0002] Currently, student information systems serve as core platforms in education management, carrying a large amount of sensitive data and diverse business functions. With the increasing number of user roles and the growing complexity of access scenarios, achieving efficient, secure, and flexible access control has become a critical issue that urgently needs to be addressed.

[0003] In a current technology, role-based access control (RBAC) is commonly used in student information systems for permission management. In this model, the system predefines different user roles and assigns fixed access permissions to each role. A user's permissions depend on the assigned role; permission rules are set during system configuration and remain static during runtime, not automatically adjusting with changes in user behavior, access time, or system state.

[0004] However, existing technologies generally employ a role-based static access control model. This model binds predefined roles with fixed permissions, and the permission rules remain unchanged during system operation. This static mechanism cannot perceive the changing patterns of user access behavior over time, nor can it adjust to the real-time load status of the system. This leads to a disconnect between permission allocation and actual needs, low system resource utilization, and difficulty in achieving a dynamic balance between security and convenience. Therefore, existing technologies suffer from the problem of flexibly allocating permissions in dynamic environments. Summary of the Invention

[0005] This invention provides a hierarchical permission adaptive access control method and apparatus based on a student information system to solve the problem of difficulty in flexibly allocating permissions in dynamic environments in the prior art.

[0006] Firstly, to address the aforementioned technical problems, this invention provides a hierarchical, adaptive access control method based on a student information system, comprising: Extract daily access records from user access logs, process them in time segments, count the number of accesses in each time segment, mark those exceeding a preset first frequency threshold as high-frequency access intervals, and obtain preliminary analysis results of user behavior cycles. For the high-frequency access intervals in the preliminary analysis results, those with historical access frequencies exceeding the second frequency threshold are identified as key peak intervals, and then integrated and classified by time period to generate a time-domain behavior set. The acquired role-related data is compared with the time-domain behavior set, and combined with the key peak interval and the high-frequency access interval, a personalized behavior feature description set is determined. Extract time patterns related to permission rule sorting from the personalized behavior feature description set; if the time patterns match the preset permission granting conditions, generate a temporary permission rule list. The system obtains current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, the access scope in the temporary permission rule list is dynamically adjusted to generate an optimized permission rule combination. The optimized permission rule combination is sorted according to the time pattern to generate a permission allocation sequence consistent with the access request verification logic; The permission storage structure is synchronously updated according to the permission allocation sequence. When the received access request meets the permission granting conditions, the permission granting operation is automatically executed to obtain the final permission granting operation instruction.

[0007] Secondly, the present invention provides a hierarchical permission adaptive access control device based on a student information system, comprising: The user behavior cycle analysis module extracts daily access records from user access logs, processes them in segments according to time periods, counts the number of accesses in each time period, marks those exceeding a preset first frequency threshold as high-frequency access intervals, and obtains preliminary analysis results of user behavior cycles. The temporal behavior integration module identifies high-frequency access intervals in the preliminary analysis results, statistically analyzes those with historical access frequencies exceeding a second frequency threshold as key peak intervals, and integrates and classifies them by time period to generate a temporal behavior set. The personalized behavior feature generation module compares the acquired role-related data with the time-domain behavior set, and determines the personalized behavior feature description set by combining the key peak interval and the high-frequency access interval. The temporary permission rule generation module extracts time patterns related to the permission rule sorting from the personalized behavior feature description set. If the time patterns match the preset permission granting conditions, a temporary permission rule list is generated. The permission rule optimization module obtains the current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, it dynamically adjusts the access range in the temporary permission rule list and generates an optimized permission rule combination. The permission allocation sequence generation module sorts the optimized permission rule combination according to the time pattern and generates a permission allocation sequence consistent with the access request verification logic. The adaptive permission response module synchronously updates the permission storage structure according to the permission allocation sequence. When the received access request meets the permission granting conditions, it automatically executes the permission granting operation to obtain the final permission granting operation instruction.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention analyzes user access logs to identify high-frequency access intervals and key peak intervals, establishes a behavior cycle model, and predicts the user's permission requirement time period accordingly. Permissions are dynamically granted before peak access periods, and redundant permissions are automatically revoked during off-peak periods. This behavior prediction-based mechanism ensures that users can quickly obtain permissions when needed, significantly shortens the opening time of unnecessary permissions, effectively reduces the risk of permission abuse, and enhances system security while improving response efficiency.

[0009] (2) This invention generates a personalized behavioral feature description set by combining role data with user time-domain behavioral characteristics. When analyzing user access patterns during specific time periods, the system can break through the limitations of traditional fixed role permissions and tailor temporary permission rules for different users. This method satisfies personalized usage needs while avoiding the problem of excessive permission allocation, achieving the best balance between convenience and security.

[0010] (3) This invention dynamically adjusts the permission allocation strategy by monitoring system resource usage in real time. When the system load is low, the permission scope is appropriately expanded, and when resources are scarce, the permissions are reasonably contracted. This flexible mechanism ensures that permission allocation matches the system's carrying capacity and prevents system overload caused by concentrated use of permissions. At the same time, by optimizing the time distribution of permission granting, it not only ensures the continuity of user experience but also improves resource utilization efficiency and enhances system stability. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the hierarchical permission adaptive access control method based on a student information system provided in the first embodiment of the present invention. Figure 2 This is a schematic diagram of the hierarchical permission adaptive access control device based on a student information system provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1 The first embodiment of the present invention provides a hierarchical permission adaptive access control method based on a student information system, comprising the following steps: S11. Extract daily access records from user access logs, process them in segments according to time periods, count the number of accesses in each time period, mark those exceeding the preset first frequency threshold as high-frequency access intervals, and obtain preliminary analysis results of user behavior cycles. S12, for the high-frequency access intervals in the preliminary analysis results, the intervals with historical access frequencies exceeding the second frequency threshold are counted as key peak intervals, and integrated and classified by time period to generate a time-domain behavior set. S13, compare the acquired role association data with the time domain behavior set, and combine the key peak interval and the high-frequency access interval to determine the personalized behavior feature description set; S14, extract the time pattern related to the permission rule sorting from the personalized behavior feature description set; if the time pattern matches the preset permission granting conditions, generate a temporary permission rule list. S15, obtain the current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, dynamically adjust the access range in the temporary permission rule list and generate an optimized permission rule combination. S16, sort the optimized permission rule combination according to the time pattern to generate a permission allocation sequence consistent with the access request verification logic; S17, the permission storage structure is synchronously updated according to the permission allocation sequence. When the received access request meets the permission granting conditions, the permission granting operation is automatically executed to obtain the final permission granting operation instruction.

[0014] In step S11, daily access records are extracted from the user access logs and processed in segments according to time periods. The number of accesses in each time period is counted, and those exceeding a preset first frequency threshold are marked as high-frequency access intervals. Preliminary analysis results of user behavior cycles are obtained, including: S1101, Extract daily access record data from user access logs and divide it into multiple time intervals, obtain access count statistics for each time interval, and obtain preliminary time interval access distribution data. S1102, compare the number of accesses in each time period in the time period access distribution data with a preset first frequency threshold. If the threshold is exceeded, mark it as a high-frequency access interval to determine the distribution of high-frequency access time periods. S1103, The frequency of function usage in the distribution of high-frequency access time periods is statistically analyzed and arranged to obtain the user's function preference data in the high-frequency time periods. S1104, the distribution of high-frequency access time periods and the functional preference data are correlated and mapped, and the correlation results are saved to a pre-established database to obtain preliminary analysis results of user behavior cycles.

[0015] In step S1101, daily access record data is extracted from the user access log and divided into multiple time intervals. The access count statistics within each time interval are obtained to obtain preliminary time interval access distribution data.

[0016] It's important to note that this step is the foundational data preparation stage for user behavior cycle analysis. Its core lies in transforming continuous, unstructured log data into structured, time-domain distributed data suitable for subsequent analysis. User access logs are stored in a custom JSON format, with each record containing key fields such as timestamp, user ID, user role, and accessed functional modules. Time intervals are divided into equal-length segments, for example, every 4 hours, or using the number of accesses per hour as the baseline unit.

[0017] In one embodiment, user access data from an online education platform is analyzed to extract daily access records. The platform logs show a total of 5000 accesses on a given day. Following a preset time-segmentation rule, the day is divided into three periods: morning (6:00-10:00), noon (10:00-14:00), afternoon (14:00-18:00), and evening (18:00-22:00). Statistical analysis reveals that there are 800 accesses in the morning, 1200 at noon, and 3000 in the evening, providing preliminary data on access distribution across these time periods. Example user access log formats include timestamp, user ID, role, and accessed function.

[0018] In step S1102, the number of accesses in each time period in the time period access distribution data is compared with a preset first frequency threshold. If the number of accesses exceeds the threshold, it is marked as a high-frequency access interval, and the distribution of high-frequency access time periods is determined.

[0019] It should be noted that the preset first frequency threshold is a key system parameter, and its setting is mainly based on historical access data and dynamic calculation of system capacity. Time exceeding the threshold is marked as a high-frequency access interval. The formula for calculating the first frequency threshold is as follows: ; Where p represents the first frequency threshold. The value was calculated by averaging the number of accesses over the past 30 days for each time period, excluding abnormal data such as those during system maintenance. The coefficient K ranged from 1.5 to 2.0. K was set to 2.0 when the number of real-time concurrent connections was below 50% of the system's capacity; 1.75 when the concurrency was between 50% and 80%; and 1.5 when the concurrency was above 80%. This was verified through experiments, and the optimal value can be selected by simulating system performance under different K values.

[0020] In one embodiment, the platform uses historical access data from the past 30 days, with a historical average of 1667 visits per time period. A coefficient K is set to 1.5 based on the system's concurrent processing capacity, and a first frequency threshold of 2500 visits is calculated. Comparison reveals that 800 visits in the morning and 1200 visits at noon do not exceed the threshold, while 3000 visits between 6:00 PM and 10:00 PM far exceed the threshold. Therefore, this time period is marked as a high-frequency access interval. Further analysis of multi-day data confirms that the high-frequency access period is mainly concentrated in the evening. This reflects that users may be more inclined to use the platform for learning after get off work or school.

[0021] In step S1103, the frequency of function usage in the high-frequency access time period distribution is statistically analyzed and arranged to obtain the user's function preference data in the high-frequency time period.

[0022] It should be noted that feature usage frequency refers to the proportion of times a user accesses each function module of the system within a specific time period out of the total number of accesses. This indicator can accurately reflect the user's core needs and behavioral characteristics during that time period. The system analyzes feature usage records, calculates the relative usage frequency of each function, and sorts them from high to low usage rate, thereby forming structured feature preference data.

[0023] In one embodiment, when acquiring feature usage records during high-frequency access periods, the focus is on the evening period from 6:00 PM to 10:00 PM, and the frequency of feature usage during this time period is statistically analyzed. For example, the platform's main functions include course viewing, online quizzes, and forum discussions. The statistical results show that the usage frequency of course viewing is 60%, online quizzes are 25%, and forum discussions are 15%. Arranging the feature usage frequencies from high to low yields user feature preference data during high-frequency time periods, namely, a preference for course viewing. This indicates that users are more inclined to consume core learning content in the evening.

[0024] In step S1104, the distribution of high-frequency access time periods and the functional preference data are correlated and mapped, and the correlation results are saved to a pre-established database to obtain preliminary analysis results of user behavior cycles.

[0025] It should be noted that mapping the distribution of high-frequency access time periods with the function preference data allows for the association of each high-frequency access time period with the most frequently accessed system function within that time period. The strength of this association is quantified by calculating the usage frequency of the function within the corresponding time period (usually converted to a decimal between 0 and 1), which serves as the association weight. The three core elements—time period, function ID, and weight coefficient—are then saved as a single record in the user behavior analysis database.

[0026] In one embodiment, system analysis revealed that users' most frequently used function during the high-frequency period of 6:00 PM to 10:00 PM was course viewing. Calculations showed that course viewing accounted for 60% of all function usage during this time period, therefore its association weight coefficient was 0.6. Consequently, the system stored a record in the database's association table, with the following information: (Time Period: 6:00 PM - 10:00 PM, Function ID: Course Viewing, Weight: 0.6).

[0027] In step S12, for the high-frequency access intervals in the preliminary analysis results, those with historical access frequencies exceeding the second frequency threshold are identified as key peak intervals, and these are integrated and categorized by time period to generate a time-domain behavior set, including: S1201, Obtain the distribution of high-frequency access time periods from the preliminary analysis results and perform classification processing to obtain the classified time period frequency distribution results; S1202, compare the historical access frequency of each time period in the frequency distribution result of the time period with the preset second frequency threshold. If it exceeds the threshold, mark it as a key peak interval and determine the distribution characteristics of the key peak interval. S1203, Obtain user function record data within the corresponding time period in the key peak interval distribution characteristics and classify it to obtain a behavior dataset containing time domain characteristics; S1204, The behavior dataset is associated and mapped with the high-frequency access interval to generate the final time-domain behavior set.

[0028] In step S1201, the distribution of high-frequency access time periods is obtained from the preliminary analysis results and classified to obtain the classified time period frequency distribution results.

[0029] It should be noted that classification processing refers to the process of systematically categorizing high-frequency access time periods based on time cycle characteristics. According to the periodic patterns in user behavior, time series data are grouped according to dimensions with similar behavioral characteristics, such as classification by time cycle (e.g., weekdays or weekends) or by behavioral characteristics (e.g., by access intensity, feature preferences, etc.).

[0030] In one embodiment, high-frequency access time period data marked by tags is extracted from a user behavior analysis database. This data includes records of evenings from 6:00 PM to 10:00 PM marked as high-frequency access over a consecutive 30-day period. The system first categorizes the data according to date type, dividing it into weekdays and weekends. By statistically calculating the number of accesses within each category, the frequency distribution of the time periods after categorization is obtained. For example, the average number of accesses during this time period is 3200 on weekdays and 2500 on weekends, indicating that users' learning activity is significantly higher on weekday evenings than on weekends, thus obtaining the frequency distribution of the time periods after categorization.

[0031] In step S1202, the historical access frequency of each time period in the frequency distribution result of the time period is compared with the preset second frequency threshold. If it exceeds the threshold, it is marked as a key peak interval, and the distribution characteristics of the key peak interval are determined.

[0032] It should be noted that the preset second frequency threshold is dynamically calculated based on historical access data. The 95th quantile of the historical access frequency during the high-frequency access period of the past 30 days is taken as the baseline value, and then multiplied by a stability coefficient to obtain the final threshold. The stability coefficient is determined according to the degree of fluctuation in the historical access frequency: 1.2 for small fluctuations (coefficient of variation less than 0.1), 1.0 for moderate fluctuations (coefficient of variation 0.1-0.2), 1.0 for fluctuations between 0.3 and 0.8 for fluctuations greater than 0.3. Only when the historical access frequency exceeds the threshold and the proportion exceeding the threshold is higher than 80% for five consecutive days is it marked as a key peak interval. This threshold uses a sliding window mechanism and is automatically updated every 24 hours.

[0033] In one embodiment, the system calculates the 95th quantile of historical access frequency based on data from the past 30 days, which is 2727 times per time period. Combining this with a stability coefficient of 1.1, a second frequency threshold of 3000 times per time period is determined. Comparison reveals that the average access volume during the weekday evening period (18:00-22:00) exceeds this threshold (3200 times), and the exceedance rate reaches 100% for five consecutive weekdays. Therefore, this time period is marked as a key peak interval. Analysis shows that the key peak interval is concentrated in the weekday evening period, accurately reflecting the concentrated learning behavior characteristics of users.

[0034] In step S1203, user function record data within the corresponding time period in the key peak interval distribution characteristics are obtained and classified to obtain a behavior dataset containing time-domain features.

[0035] It should be noted that the classification in this step refers to the structured processing of user operation records during key peak periods based on the division of system functional modules and access behavior characteristics. First, primary classification is performed according to the functional modules in the system, such as learning functions, communication functions, and management functions. Then, secondary classification is performed under each primary category according to specific operation types, such as further subdividing learning functions into course viewing, material downloading, and note-taking. Finally, tertiary classification is performed according to the temporal characteristics of access behavior, such as access duration, operation frequency, and interaction depth.

[0036] In one embodiment, the system acquires all user activity records during the peak period of 18:00-22:00 on weekday evenings and processes them through the aforementioned multi-level classification. First, according to the platform's functional architecture, the records are divided into three main categories: core learning functions, auxiliary learning functions, and social functions. Then, under the core learning function category, further subdivisions are made into subcategories such as course viewing, online testing, and assignment submission. Finally, combined with time-domain characteristics, the access percentage and duration of each function during the peak period are statistically analyzed. The classification results show that course viewing accounted for 65% with an average duration of 45 minutes, online testing accounted for 20% with an average duration of 25 minutes, and forum interaction accounted for 15% with an average duration of 15 minutes.

[0037] In step S1204, the behavior dataset is associated with the high-frequency access interval to generate the final time-domain behavior set.

[0038] It should be noted that the association mapping in this step refers to the data fusion process of deeply integrating time-domain features and behavioral domain features by establishing multi-dimensional index relationships. First, a time-behavior association matrix is ​​established, with high-frequency access intervals as the row dimension and functional behavioral features as the column dimension. A unique mapping identifier is generated using composite key technology, typically composed of a time period ID, a functional category ID, and a date type ID. The final time-domain behavioral set should be a data set integrating time periods, access frequencies, and functional preferences.

[0039] In one embodiment, the system maps the high-frequency access period of 18:00-22:00 on weekday evenings to functional preference features extracted from the behavioral dataset, such as course viewing (65%), online quizzes (20%), and forum discussions (15%). The system generates structured records, for example, with the time period and date type as weekday 18:00-22:00 and the functional distribution as course viewing. These associated records are stored in the time-domain behavioral database, forming the final time-domain behavioral set.

[0040] In step S13, the acquired role-related data is compared with the time-domain behavior set, and combined with the key peak intervals and the high-frequency access intervals, a personalized behavior feature description set is determined, including: S1301, Obtain role-related data from the pre-established user profile database and compare it with the time-domain behavior set to filter out features related to the high-frequency access interval and obtain role-behavior matching results; S1302, combine the role behavior matching result with the key peak interval, and associate the role association data with the historical access frequency to determine the role's behavior preference distribution in the peak interval; S1303, obtain the access records of the corresponding role in different time periods through the behavior preference distribution and classify and organize them. If the historical access frequency exceeds the preset personalized behavior key point threshold, it is marked as a personalized behavior key point, and the temporal features of the key point are obtained. S1304, integrate and map the time-domain features with the role-related data to generate a set of personalized behavioral feature descriptions.

[0041] In step S1301, role-related data is obtained from a pre-established user profile database and compared with the time-domain behavior set to filter out features related to the high-frequency access interval and obtain role behavior matching results.

[0042] It should be noted that the user profile database stores feature data for various roles, including basic attributes, historical behavioral characteristics, and permission baselines. Cosine similarity is used to calculate the matching degree between role-related data and the time-domain behavior set, with a value range of [0,1], where a higher value indicates higher similarity. Analysis and testing of historical data showed that when the similarity is higher than 0.8, the matching results between roles and behavioral features achieve a better balance between accuracy and recall. Therefore, this scheme sets a similarity threshold of 0.8 to filter features with similarity higher than this threshold.

[0043] In one embodiment, the system extracts association data for three roles—student, teacher, and parent—from a user profile database and compares this role data with the high-frequency access period of 18:00-22:00 on weekday evenings from the time-domain behavior set. The comparison results show that the student role exhibits a high correlation with course viewing behavior during this time period (similarity 0.92), while the teacher role is more related to homework grading functions (similarity 0.85), and the parent role is mainly associated with grade query functions (similarity 0.81).

[0044] In step S1302, the role behavior matching result is combined with the key peak interval, and the role association data is associated with the historical access frequency to determine the role's behavior preference distribution in the peak interval.

[0045] It should be noted that the core of this step lies in establishing a three-dimensional correlation model of role-time-behavior, revealing the specific behavioral patterns of different roles during peak system periods through quantitative analysis. A role access intensity matrix is ​​established, with roles as rows and time periods as columns, populated with historical access frequency data for each time period; a role behavior preference matrix is ​​constructed, with roles as rows and functional modules as columns, recording the usage ratio of each function; and through matrix multiplication, the behavioral preference distribution of roles within specific peak intervals is generated.

[0046] In one embodiment, the system deeply integrates the student role's behavior matching results with a key peak period of 6:00 PM to 10:00 PM on weekdays. Analysis of historical access frequencies revealed that student roles averaged 2800 accesses during this peak period, significantly exceeding the platform's second frequency threshold of 2000 accesses. The system then correlated the student role's access frequency data with their function usage records, using weighted calculations to derive a behavioral preference distribution: course viewing accounted for 60%, online quizzes for 25%, and forum discussions for 15%. This quantitative distribution not only confirmed the dominant behavioral tendencies of student roles during the peak period but also precisely revealed the relative importance of various behaviors.

[0047] In step S1303, the access records of the corresponding role in different time periods are obtained through the behavior preference distribution and classified and organized. If the historical access frequency exceeds the preset personalized behavior key point threshold, it is marked as a personalized behavior key point, and the temporal features of the key point are obtained.

[0048] It should be noted that the personalized behavior key point threshold is dynamically calculated based on the character's historical access data. The 75th percentile of the character's historical access frequency in various time periods over the past 30 days is taken as the base threshold, and then multiplied by the character adjustment coefficient to obtain the final threshold. The character adjustment coefficient takes into account both the character's permission level and behavioral stability, and its value ranges from 0.8 to 1.5.

[0049] In one embodiment, the base threshold for the student role is 2000 visits per time period. Considering that the student is a low-privilege role with stable behavior, a role adjustment coefficient of 0.9 is used, resulting in a calculated personalized behavior key point threshold of 1800 visits per time period. Analysis of access records revealed that the historical access frequency during weekday evenings from 18:00 to 22:00 reached 2800 visits per time period, exceeding the threshold. Therefore, this time period was marked as a personalized behavior key point. This key point reflects the typical behavioral characteristics of students concentrating on learning during this period.

[0050] In step S1304, the temporal features are integrated and mapped with the role-related data to generate a set of personalized behavioral feature descriptions.

[0051] It should be noted that integrating and mapping the time-domain features with the role-related data refers to the process of deeply fusing time-domain behavioral features with role attribute features by establishing a unified data structure. Using the role ID as the association key, time-domain features such as time-period access patterns and functional preferences are associated with attribute data such as role type and permission level; the features of each dimension are normalized to form standardized feature vectors; and a complete user behavior profile is generated based on the feature weights.

[0052] In one embodiment, the system integrates a student's high-frequency access characteristics (2800 visits, 65% course viewing rate) during weekday evenings from 18:00 to 22:00 with the student's basic attributes (grade, major, learning stage) to generate a personalized behavioral characteristic description. This student primarily studies courses during the evening hours and prefers course content related to their major. Based on this feature set, the system can formulate precise permission policies, such as granting access to advanced course resources in their major field during peak evening study hours, achieving a precise match between permission allocation and personalized learning needs.

[0053] In step S14, a temporal pattern related to the ordering of permission rules is extracted from the personalized behavior feature description set. If the temporal pattern matches the preset permission granting conditions, a temporary permission rule list is generated, including: S1401, Obtain data content related to time patterns from the personalized behavior feature description set and classify and organize it, extract the time patterns associated with the permission rule sorting, and obtain a preliminary set of time patterns; S1402, the preliminary set of time patterns is matched one by one with the preset permission granting conditions. If the time pattern meets the preset time pattern validity threshold, it is marked as a valid time pattern, and a list of valid time patterns is determined. S1403, associate the time patterns in the effective time pattern list with the permission rules to generate a draft temporary permission rule corresponding to the time pattern; S1404, perform a second verification on the draft temporary permission rules and the set of personalized behavioral feature descriptions. If the verification result is consistent with the permission granting conditions, the permission allocation basis is obtained, and the final temporary permission rule list is generated.

[0054] In step S1401, data content related to time patterns is obtained from the personalized behavior feature description set and classified and organized. Time patterns associated with permission rule sorting are extracted to obtain a preliminary set of time patterns.

[0055] It should be noted that the core of this step lies in identifying time-based patterns with permission allocation value from complex user behavior characteristics. The classification process adopts a dual classification standard based on time attributes and behavioral characteristics, including classification by the stability of time patterns (fixed patterns such as weekday evenings, periodic patterns such as specific dates each week, and random patterns); classification by access intensity (high-intensity, medium-intensity, and low-intensity time periods); and classification by behavior type (learning, testing, and communication time periods).

[0056] In one embodiment, the system extracts time-related data from a set of personalized behavioral characteristic descriptions of student roles and discovers the following key pattern: student roles exhibit a stable high-frequency access characteristic between 18:00 and 22:00 on weekday evenings, with an average access volume of 2500 times. Through classification and organization, the system identifies three characteristics of this time period: fixed time, high intensity, and learning-driven, such as fixed time (Monday to Friday), high access intensity, and consistent behavioral patterns (course viewing accounts for 65%). Based on these characteristics, the system extracts time patterns directly related to the permission rule ranking, identifying weekday evenings as the core learning time period and incorporating it into a preliminary set of time patterns.

[0057] In step S1402, the preliminary set of time patterns is matched one by one with the preset permission granting conditions. If the time pattern meets the preset time pattern validity threshold, it is marked as a valid time pattern, and a list of valid time patterns is determined.

[0058] It should be noted that the preset permission granting conditions are based on a comprehensive evaluation system encompassing multi-dimensional security policies and business rules. These conditions include system security policy requirements, business specifications, and resource allocation requirements. The preset time-based validity threshold is a quantitative scoring standard, calculated using the following formula: ; in, The score represents the validity of the time pattern. The frequency score is calculated by dividing the number of days the pattern appears in the last 30 days by 30 and multiplying by 100. The score represents the percentage of dominant behavior, calculated by multiplying the percentage of dominant behavior within that time period by 100. The access intensity score is calculated as the minimum of 100 and the number of visits within a given time period divided by the system's average access volume. The number of visits within a time period is uniformly converted to hourly visits, calculated as the total number of visits within that time period divided by the length of that time period. The system's average access volume is the average of hourly visits over the past 30 days. To avoid any single indicator excessively influencing the overall score, the maximum score for all of the above is 100. The adjustment factor is set based on the system load status and ranges from 0.8 to 1.2. The weighting coefficients are 0.3, 0.4, and 0.3, with a total weight of 1. This weighting is based on the fact that consistency of user behavior is considered the most reliable indicator of stable demand in permission granting decisions, thus receiving the highest weight. Regularity of behavior and access intensity are given equal weight as important supplements. This weighting scheme is a parameter combination that effectively distinguishes between valid and invalid patterns, derived from multiple rounds of regression analysis of historical valid permission rules. The time-based pattern validity threshold is set at 80 points. This benchmark value is the equilibrium point between precision and recall, selected after ROC curve analysis using the actual access success rate and security after permission granting as evaluation indicators, by running the method on the test dataset. This threshold configuration employs a dynamic adjustment mechanism and can be updated periodically based on system operation data and changes in user behavior.

[0059] In one embodiment, the system matches the weekday evening 18:00-22:00 pattern in the initial set of time patterns with preset permission granting conditions. If the number of visits is 2500 (more than 1800), the course viewing behavior accounts for 65% (more than 60%), the frequency of occurrence is 90% (more than 85%), and the requested advanced course access permissions do not exceed the maximum permission range of the student role, do not involve sensitive data operations, and comply with the security policy, then the frequency of occurrence scores 90, the course viewing behavior accounts for 65% (score 65), the number of visits during the time period is 2500, the system average number of visits is 2000, and the adjustment coefficient is 1.0, the final access intensity score is 100. The final calculated comprehensive score is 83, exceeding the threshold of 80. Therefore, the system includes this pattern in the list of valid time patterns.

[0060] In step S1403, the time patterns in the list of effective time patterns are associated with the permission rules to generate a draft temporary permission rule corresponding to the time patterns.

[0061] It should be noted that associating the time patterns in the list of valid time patterns with the permission rules refers to establishing a dynamic binding relationship between the time patterns and the permission rules. The draft temporary permission rules are a structured data object containing permission elements, effective conditions, and security constraints. Its configuration adopts a subject-resource-operation-environment access control model, with particular emphasis on the constraint effect of time environment elements.

[0062] In one embodiment, the system associates the pattern that student roles in the effective time pattern list exhibit high-frequency course learning characteristics on weekday evenings from 18:00 to 22:00. It then generates a draft of temporary permission rules, including pattern matching, rule retrieval, parameter binding, constraint generation, and validity period setting.

[0063] In step S1404, the draft temporary permission rules are verified against the set of personalized behavioral feature descriptions. If the verification result is consistent with the permission granting conditions, the permission allocation basis is obtained, and the final list of temporary permission rules is generated.

[0064] It should be noted that the secondary verification of the draft temporary permission rules and the set of personalized behavioral feature descriptions requires first verifying whether the parameters in the draft permission rules, such as time period, role, and resources, are consistent with the basic data in the set of personalized behavioral feature descriptions to prevent data distortion or rule mismatch; confirming whether the magnitude and scope of permission escalation conform to the business process, for example, temporary permissions should not exceed the highest permission level of the user role; and assessing the potential security risks of temporary permissions to ensure that unauthorized access, data leakage, or other security vulnerabilities will not occur due to temporary permission escalation. The permission allocation is based on a structured decision record, which includes the logical chain of rule generation, verification results, and approval status.

[0065] In one embodiment, a draft rule granting advanced course access to student roles between 18:00 and 22:00 on weekdays is validated to confirm that course viewing during this period is indeed the dominant activity (accounting for 65%), with an access intensity of 2800 times; it is verified that advanced course access does not exceed the student role's permission scope; and it is ensured that the rule does not contain high-risk operations such as data export. After all validations pass, a temporary permission rule list containing this rule is generated.

[0066] In step S15, current system resource usage data is obtained for load analysis. If the resource usage is lower than a preset system resource load threshold, the access scope in the temporary permission rule list is dynamically adjusted to generate an optimized permission rule combination, including: S1501: Obtain the current system resource usage data from the pre-established resource monitoring database and match it with the preset system resource load threshold. If it is lower than the threshold, it is determined that the preliminary conditions for load analysis are met, and an adjustable resource list is obtained. S1502, the system resource usage data is associated with the access range in the temporary permission rule list. If the degree of matching between the permission rule and the resource capacity is high, a feasible set for range expansion is obtained. S1503, The access scope in the temporary permission rule list is dynamically adjusted through the feasibility set, and the adjusted access scope is verified against the load balancing requirements to determine the extended permission rule draft. S1504, the adjusted rule content in the extended permission rule draft is merged with the permission rules. If the fusion result meets the preset dynamic allocation requirements, an optimized permission rule combination is generated.

[0067] In step S1501, the current system resource occupancy data is obtained from the pre-established resource monitoring database and matched with the preset system resource load threshold. If it is lower than the threshold, it is determined that the preliminary conditions for load analysis are met, and an adjustable resource list is obtained.

[0068] It should be noted that the resource monitoring database stores system operational status data, including resource indicators such as CPU utilization, memory usage, and network bandwidth utilization. The preset system resource load thresholds are derived from historical operational data analysis, using a baseline load value multiplied by a dynamic adjustment coefficient. The baseline load value is taken as the 90th quantile of each resource indicator's operational data over the past 30 days, and the dynamic adjustment coefficient is determined based on the characteristics of the business time period. This threshold uses a sliding window mechanism to automatically update every 24 hours to ensure it reflects the system's actual carrying capacity.

[0069] In one embodiment, the system analyzes historical operational data, finding that the 90th percentile of CPU utilization is 65%, the 90th percentile of memory utilization is 70%, and the 90th percentile of network bandwidth utilization is 65%. Currently, during a regular business period, a dynamic adjustment coefficient of 1.0 is used, calculating the system resource load thresholds as follows: CPU 65%, memory 70%, and bandwidth 65%. The system retrieves data from the resource monitoring database showing current CPU utilization at 30%, memory utilization at 45%, and network bandwidth utilization at 40%, all below the thresholds, meeting the preliminary conditions for load analysis. Based on this, the system generates an adjustable resource list.

[0070] In step S1502, the system resource usage data is associated with the access range in the temporary permission rule list. If the degree of matching between the permission rule and the resource capacity is high, a feasible set for range expansion is obtained.

[0071] It should be noted that associating the system resource usage data with the access scope in the temporary permission rule list is a matching analysis process based on resource demand prediction. Its core lies in establishing a mapping model between permission rules and resource demands, and using quantitative analysis to evaluate the feasibility of expanding the permission scope under the current resource conditions. The matching degree is a comprehensive evaluation index, and the specific calculation formula is as follows: ; ; ; ; ; ; in, This indicates the current resource availability, which is obtained by subtracting the current resource utilization rate from the total system resources. This indicates the resources required for extended access permissions, derived from historical data analysis. For example, accessing advanced courses requires an additional 15% of CPU resources. This represents the resource sufficiency score. The higher the value, the more abundant the resources. The minimum value among the three resource sufficiency scores (CPU, memory, and bandwidth) is taken to ensure that all resources meet the expansion requirements. This indicates the resource type matching score, based on the functional modules involved in the permission rules regarding resource types. Such as the demand for CPU, memory, and bandwidth, and the types of current surplus resources. The degree of matching is calculated and quantified by cosine similarity. The score represents the time period matching score, calculated based on the degree of matching between the effective time period of the permission rules and the current resource monitoring time period; The corresponding weight coefficients, summing to 1, are set at 0.5, 0.3, and 0.2 respectively, based on historical operating data and system policies. Resource sufficiency is the foundation for permission extension, hence it receives the highest weight; resource type matching affects extension efficiency, so it receives a medium weight; and time period compatibility ensures the timeliness of permission activation, so it receives a low weight. The weight values ​​are derived through regression analysis of historical effective extension cases to ensure the accuracy of the evaluation. The matching score V ranges from 0 to 100. The preset matching score threshold is 75 points. This threshold is based on statistical analysis of historical successful permission extension cases. In the test dataset, when V is greater than or equal to 75, the success rate of permission extension (i.e., the system runs stably without resource conflicts after extension) exceeds 90%, while the failure rate increases significantly when the score is below 75. The threshold uses a dynamic adjustment mechanism, recalibrating every 30 days based on the latest operating data to ensure it adapts to system changes.

[0072] In one embodiment, the system correlates resource monitoring data (based on total resources, current CPU utilization 30%, memory utilization 25%, and bandwidth utilization 35%) with the rules for student roles accessing advanced courses during weekday evenings from 18:00 to 22:00 in the temporary permission rule list. Analysis of historical data from the past 30 days shows that accessing advanced courses requires an additional 15% of CPU resources, 20% of memory resources, and 25% of bandwidth resources compared to regular courses. The matching degree calculation assesses resource sufficiency: current CPU availability is 70% (greater than demand by 15%), memory availability is 75% (greater than demand by 20%), and bandwidth availability is 65% (greater than demand by 25%). Advanced course access primarily consumes bandwidth resources, and the current bandwidth availability is the most abundant, resulting in a matching degree of 85%. The permission's effective time period (18:00-22:00) perfectly matches the current resource monitoring time period, achieving a 100% compliance. The overall matching degree score reaches 95.5 points (out of 100), exceeding the preset matching degree score threshold of 75 points, thus indicating a high matching degree. This yields a feasible set for scope expansion.

[0073] In step S1503, the access scope in the temporary permission rule list is dynamically adjusted through the feasibility set, and the adjusted access scope is verified against the load balancing requirements to determine the extended permission rule draft.

[0074] It should be noted that dynamically adjusting the access scope in the temporary permission rule list through the feasibility set refers to the process of real-time optimization of the resource access scope in the permission rules based on the feasibility analysis results. The system automatically adjusts the permission boundaries according to the recommended expansion scope and resource guarantee scheme provided in the feasibility set, following a preset expansion strategy. The load balancing requirements are determined based on system stress testing and historical operating data, and verified by real-time monitoring of cluster node resource utilization. This includes real-time collection of resource utilization of each service node using system monitoring tools, calculation of resource request uniformity using load distribution algorithms, and estimation of resource consumption growth after permission expansion through performance testing. Dynamic adjustment must ensure that the resource consumption of each role after permission expansion does not exceed its quota, and priority scheduling is used to avoid conflicts.

[0075] In one embodiment, the system dynamically adjusts the temporary permission rules based on the analysis results of the feasibility set. Based on the remaining resources, the access scope of student roles is expanded from some advanced courses to all advanced courses. At the same time, the load balancing requirements are checked, and it is found that the system can still operate stably.

[0076] In step S1504, the adjusted rule content in the extended permission rule draft is merged with the permission rules. If the fusion result meets the preset dynamic allocation requirements, an optimized permission rule combination is generated.

[0077] It should be noted that, based on the analysis results of the feasibility set, the access scope of the permission rules is dynamically expanded, and the expanded permission allocation is verified to meet the system load balancing requirements to ensure the stable operation of the system.

[0078] In one embodiment, based on the analysis results of the feasibility set, the system expands the student role's access to advanced courses from some courses to all courses. After the expansion, the system verifies the load balancing requirements. If the CPU utilization of each service node is below 75%, the memory utilization is below 70%, and the increase in resource consumption is within 20% of the total system capacity, the load balancing requirements are met. Based on this, the system generates a draft permission rule containing the expanded permission content.

[0079] In step S16, the optimized permission rule combinations are sorted according to the time pattern to generate a permission allocation sequence consistent with the access request verification logic, including: S1601: Obtain permission rules and corresponding time pattern data from the pre-established permission rule database, compare and process them, determine the priority of the rules, and obtain a preliminary sorting sequence; S1602, the preliminary sorting sequence is matched with the access request frequency. If the access request frequency is within the preset request frequency priority threshold range, the priority of the preliminary sorting sequence is adjusted to determine the final allocation sequence. S1603, compare the final allocation sequence with the verification logic for consistency, and dynamically adjust the permission period based on the comparison result to obtain a permission rule combination that meets the access request; S1604, the final allocation sequence and time sequence are fused by the permission rule combination to obtain a permission allocation sequence consistent with the verification logic.

[0080] In step S1601, permission rules and corresponding time pattern data are obtained from the pre-established permission rule database and compared to determine the priority of the rules, thus obtaining a preliminary sorting sequence.

[0081] It should be noted that the pre-established permission rule database is a specially designed structured database for storing and managing system permission rules. The permission rule database table structure includes fields such as rule ID, role, resource, operation, effective time, and expiration time. Permission rules and their corresponding time-based data are extracted from the permission rule database. By comparing the matching degree between the rule's effective time period and the current access time period, the priority order of each rule is determined.

[0082] In one embodiment, the system retrieves rules from the permission rule database that allow student roles to access basic courses between 18:00 and 21:00. The current access request occurred at 19:00, falling within the effective timeframe of this rule, indicating a high degree of matching. Therefore, this rule is assigned a higher priority, and a preliminary sorting sequence containing this rule is generated.

[0083] In step S1602, the preliminary sorting sequence is matched with the access request frequency. If the access request frequency is within the preset request frequency priority threshold range, the priority of the preliminary sorting sequence is adjusted to determine the final allocation sequence.

[0084] It should be noted that the preset request frequency priority threshold is a dynamically adjusted numerical range, and its setting is mainly based on the following quantifications. ; in, This indicates the request frequency priority threshold. The baseline value is derived from statistical analysis of the system's historical access logs, and is the weighted average of the average request frequency of various roles over the past 30 days in the corresponding time period. The elastic range is obtained by multiplying the standard deviation of historical request frequencies by a load adjustment factor. The load adjustment factor is determined based on the real-time system load status: 1.0 for normal load, 0.8-0.9 for high load, and 1.1-1.2 for low load. Priority adjustment uses the following quantification method. ; in, This indicates an increase in priority level. This represents the current request frequency. Indicates the lower limit of the threshold. Indicates the upper limit of the threshold. The maximum escalation level is set based on the importance of the permission rules, ranging from level 1 to 5. This threshold is automatically updated every 4 hours to ensure timely reflection of changes in user access patterns. The threshold setting takes into account both the efficient processing capabilities determined by the system architecture and resource configuration, as well as the differences in the importance of different functional requests in the business scenario.

[0085] In one embodiment, the system analyzes the request frequency of student roles during the evening period (18:00-21:00) based on data from the past 30 days. The average request frequency during this period is 45 times / hour, with a standard deviation of 15 times / hour. The current system load is normal, with a load adjustment coefficient of 1.0 and an elastic range of 15 times / hour. The calculated threshold range is [30, 60] times / hour, and the maximum upgrade level is 3. When the system detects that a student role's access request frequency reaches 50 times / hour during the current time period (19:00-20:00), falling within the preset threshold range of 30-60 times, a priority adjustment is triggered, with a priority upgrade level of 2.0. Based on this upgrade level, the system upgrades the priority of rules corresponding to high-frequency requests such as advanced course access and document download permissions by two levels. The adjusted final allocation sequence ensures that the most urgently needed permission rules are placed at the top of the sequence, while maintaining a reasonable arrangement of other necessary permissions. In step S1603, the final allocation sequence is compared with the verification logic for consistency. The permission period is dynamically adjusted based on the comparison result to obtain a combination of permission rules that meet the access request.

[0086] It should be noted that the verification logic incorporates system security policies and business specification requirements, including constraints such as permission duration limits, role matching conditions, and resource access scope. The dynamic adjustment process automatically optimizes permission parameters based on the verification results to ensure compliance with all system constraints.

[0087] In one embodiment, the system detects that a permission rule in the final allocation sequence has a 48-hour validity period, while the verification logic stipulates that the maximum validity period for temporary permissions is 24 hours. The system automatically adjusts the permission period of this rule to 24 hours, while keeping other permission content unchanged, generating a combination of permission rules that meets all constraints.

[0088] In step S1604, the final allocation sequence and time sequence are fused using the permission rule combination to obtain a permission allocation sequence consistent with the verification logic. Permission conflict resolution can refer to the following priority order: security policy restrictions, business importance, time pattern matching degree, and resource consumption.

[0089] It should be noted that the permission rules in the final allocation sequence are arranged and integrated in chronological order to ensure the continuity and rationality of permission allocation over time. This includes mapping rules to corresponding time periods, resolving rule conflicts, and verifying that all rules meet the validation logic requirements.

[0090] In one embodiment, the system integrates multiple permission rules in the final allocation sequence in chronological order, arranging the rule for student roles to access basic courses from 18:00 to 20:00 and the rule for accessing advanced courses from 20:00 to 22:00 in chronological order. Simultaneously, if the system detects overlap between two rules in the 20:00-21:00 time period, it retains the advanced course access rule based on priority. The final permission allocation sequence is generated in chronological order, and all rules are verified through validation logic to ensure the continuity and compliance of permission allocation.

[0091] In step S17, the permission storage structure is synchronously updated according to the permission allocation sequence. When the received access request meets the permission granting conditions, the permission granting operation is automatically executed to obtain the final permission granting operation instruction, including: S1701: Obtain permission table synchronization data from the pre-established permission repository and compare the permission storage status to obtain priority data for storage structure update. S1702, For the priority data, the permission allocation sequence is associated with the access request frequency. If the preset permission update trigger threshold is exceeded, the permission storage state is dynamically adjusted to determine the updated permission allocation list. S1703, The permission allocation list is matched with the access request verification logic to obtain permission response data that meets the conditions; S1704, The request response time and adaptive response logic are integrated through the permission response data to obtain the final permission granting operation instruction.

[0092] In step S1701, permission table synchronization data is obtained from the pre-established permission repository and the permission storage status is compared to obtain priority data for storage structure update.

[0093] It should be noted that the pre-established permission repository is a distributed database system specifically designed for storing and managing system permission data. Its core structure includes multiple interconnected tables such as a master permission table, a role association table, a time rule table, and a version control table, with relationships established between tables via permission IDs. By comparing the version number, effective time, and other status information of each record in the permission table, the permission data that needs updating is identified, and the update priority is determined based on business importance.

[0094] In one embodiment, in the permission management scenario of an online education platform, the permission repository may contain access permission data for different roles, such as students and teachers, within specific time periods. The repository records the permissions students have to access live courses between 8:00 AM and 12:00 PM on weekdays. This information is periodically extracted from the repository and compared with the current system state to determine if an update is needed. If the system detects that the version number of a student's permission record for accessing live courses between 8:00 AM and 12:00 PM on weekdays is outdated, and this period is a peak access time, the update priority of this permission data is marked as high, ensuring that it is synchronized to the latest state first.

[0095] In step S1702, for the priority data, the permission allocation sequence is associated with the access request frequency. If the frequency exceeds the preset permission update trigger threshold, the permission storage state is dynamically adjusted to determine the updated permission allocation list.

[0096] It should be noted that associating the permission allocation sequence with the access request frequency is a dynamic decision-making process based on real-time access patterns and permission allocation requirements. The permission update trigger threshold is a value calculated based on the baseline request frequency, load adjustment coefficient, and business importance coefficient, and is determined through the following quantification method. ; in, This indicates the threshold for triggering permission updates. This represents the baseline request frequency, which is derived from statistical analysis of historical system log data. It is the 85th percentile of the access frequency of each role over the past 7 days in the corresponding time period. This represents the load adjustment factor, which is determined based on the real-time system load status. It is 1.2 when the system load is less than 50%, 1.0 when it is 50%-70%, 0.9 when it is 70%-90%, and 0.8 when it is greater than 90%. This represents the business importance coefficient, determined based on the business criticality of the functional modules. Core functions such as course access are assigned a coefficient of 1.2, important functions such as testing are assigned a coefficient of 1.0, and auxiliary functions such as forums are assigned a coefficient of 0.8. This threshold uses a sliding window mechanism and is automatically recalculated every 6 hours to ensure timely reflection of changes in system status. The threshold setting also considers the maximum request frequency that the system can withstand, as determined through stress testing and performance monitoring, to ensure that permission updates do not cause system overload.

[0097] In one embodiment, based on historical data analysis from the past 7 days, the 85th quantile of student access frequency during this period is 55 times / hour. The system is currently under normal load, with a load adjustment coefficient of 1.0. Live courses are a core function, with a business importance coefficient of 1.2. The calculated permission update trigger threshold is 66 times / hour. When the system detects that the frequency of student access requests during the current time period (8:00-12:00) reaches 80 times / hour, exceeding the preset permission update trigger threshold of 65 times / hour, the system immediately triggers a dynamic adjustment of the permission storage state. Through correlation analysis, the system identifies live course access as the highest priority, dynamically adjusts the permission storage state, prioritizes allocating more live course resources for this time period, and generates an updated permission allocation list to ensure that the user experience is not affected during peak periods.

[0098] In step S1703, the permission allocation list is matched with the access request verification logic to obtain permission response data that meets the conditions.

[0099] It should be noted that matching the permission allocation list with the access request verification logic is a systematic permission verification and response generation process to ensure that the rules in the permission allocation list fully match the actual access request in terms of security, timeliness, and business logic. The permission response data is a structured authorization result, containing detailed information about the granted permissions, their validity period, usage restrictions, and metadata required for audit trails. The access request verification logic is a multi-layered verification framework, designed based on system security policy requirements, business rule constraints, and system performance considerations. The verification logic verifies whether the rules in the permission allocation list comply with the security requirements and business rules of the current access request, generating structured permission response data.

[0100] In one embodiment, the permission allocation list contains rules for student roles to access live courses between 8:00 and 12:00. If the current access request is made at 9:30, after the system verifies that the request meets the time range, role permissions, and other validation conditions, it generates permission response data containing information such as permission to access the live course, valid until 12:00.

[0101] In step S1704, the request response time and adaptive response logic are integrated using the permission response data to obtain the final permission granting operation instruction.

[0102] It should be noted that the adaptive response logic is a dynamic decision-making mechanism. Its configuration is based on multi-factor weight evaluation, including reducing the resource access scope in the temporary permission rules to 50% when the system load is greater than 80%; and expanding the resource access scope to 150% when the system load is less than 50%. If the request response time is greater than 2 seconds, higher priority requests are processed first. Dynamic adjustments are made based on system load; for example, if the system load is greater than 80%, then the permission scope is reduced; otherwise, the permission scope is maintained.

[0103] In one embodiment, the request response time for student roles needs to be controlled within 2 seconds. Combined with adaptive logic, it is determined whether the permission scope needs to be temporarily expanded during peak periods, and finally a permission granting operation instruction is generated to ensure a balance between response speed and permission allocation.

[0104] It should be noted that when an access request does not meet the permission granting conditions or the permission validity period expires, temporary permissions will be automatically revoked and the permission storage structure will be updated. When user access behavior changes abruptly, such as the access frequency exceeding three times the historical average, temporary permission granting will be suspended and manual review will be triggered. When there is no historical data, a default threshold, such as a first frequency threshold of 100 times / hour, will be used. When the system detects the following abnormal situations, corresponding processing mechanisms will be activated, including: when user access log data loss exceeds a preset threshold (e.g., 30%), the most recently available data will be used and a warning will be issued; when resource monitoring data is abnormal, the permission extension function will be suspended, and the basic permission allocation will be maintained; when permission rules conflict, the more restrictive rule will be selected according to the principle of security priority.

[0105] In summary, this invention discloses a hierarchical adaptive access control method for student information systems. The method first extracts and segments access records from user access logs to identify high-frequency access intervals; then, it analyzes key peak intervals to generate a time-domain behavior set; by comparing role data with behavioral characteristics, it establishes personalized behavioral feature descriptions; it generates temporary permission rules based on time patterns and dynamically optimizes the permission range according to system resource status; finally, it generates a permission allocation sequence according to time patterns to achieve adaptive permission granting operations. This invention, by analyzing user behavior patterns, role characteristics, and system load status, achieves dynamic and adaptive access control, effectively solving the problem of inflexible allocation of static permission models in dynamic environments, and significantly improving the security, resource utilization, and management efficiency of student information systems.

[0106] Reference Figure 2 The second embodiment of the present invention provides a hierarchical permission adaptive access control device based on a student information system, comprising: The user behavior cycle analysis module extracts daily access records from user access logs, processes them in segments according to time periods, counts the number of accesses in each time period, marks those exceeding a preset first frequency threshold as high-frequency access intervals, and obtains preliminary analysis results of user behavior cycles. The temporal behavior integration module identifies high-frequency access intervals in the preliminary analysis results, statistically analyzes those with historical access frequencies exceeding a second frequency threshold as key peak intervals, and integrates and classifies them by time period to generate a temporal behavior set. The personalized behavior feature generation module compares the acquired role-related data with the time-domain behavior set, and determines the personalized behavior feature description set by combining the key peak interval and the high-frequency access interval. The temporary permission rule generation module extracts time patterns related to the permission rule sorting from the personalized behavior feature description set. If the time patterns match the preset permission granting conditions, a temporary permission rule list is generated. The permission rule optimization module obtains the current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, it dynamically adjusts the access range in the temporary permission rule list and generates an optimized permission rule combination. The permission allocation sequence generation module sorts the optimized permission rule combination according to the time pattern and generates a permission allocation sequence consistent with the access request verification logic. The adaptive permission response module synchronously updates the permission storage structure according to the permission allocation sequence. When the received access request meets the permission granting conditions, it automatically executes the permission granting operation to obtain the final permission granting operation instruction.

[0107] It should be noted that the hierarchical permission adaptive access control device based on a student information system provided in this embodiment of the invention is used to execute all the process steps of the hierarchical permission adaptive access control method based on a student information system in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0108] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0109] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A hierarchical adaptive access control method based on a student information system, characterized in that, include: Extract daily access records from user access logs, process them in time segments, count the number of accesses in each time segment, mark those exceeding a preset first frequency threshold as high-frequency access intervals, and obtain preliminary analysis results of user behavior cycles. For the high-frequency access intervals in the preliminary analysis results, those with historical access frequencies exceeding the second frequency threshold are identified as key peak intervals, and then integrated and classified by time period to generate a time-domain behavior set. The acquired role-related data is compared with the time-domain behavior set, and combined with the key peak interval and the high-frequency access interval, a personalized behavior feature description set is determined. Extract time patterns related to permission rule sorting from the personalized behavior feature description set; if the time patterns match the preset permission granting conditions, generate a temporary permission rule list. The system obtains current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, the access scope in the temporary permission rule list is dynamically adjusted to generate an optimized permission rule combination. The optimized permission rule combination is sorted according to the time pattern to generate a permission allocation sequence consistent with the access request verification logic; The permission storage structure is synchronously updated according to the permission allocation sequence. When the received access request meets the permission granting conditions, the permission granting operation is automatically executed to obtain the final permission granting operation instruction.

2. The hierarchical permission adaptive access control method based on a student information system according to claim 1, characterized in that, Daily access records are extracted from user access logs and processed in time segments. The number of accesses in each time segment is counted, and those exceeding a preset first frequency threshold are marked as high-frequency access intervals. Preliminary analysis results of user behavior cycles are obtained, including: Extract daily access record data from user access logs and divide it into multiple time intervals. Obtain access count statistics for each time interval to obtain preliminary time interval access distribution data. The number of accesses in each time period in the access distribution data of the time period is compared with a preset first frequency threshold. If the number of accesses exceeds the threshold, it is marked as a high-frequency access interval to determine the distribution of high-frequency access time periods. The frequency of function usage in the high-frequency access time period distribution is statistically analyzed and arranged to obtain user function preference data in the high-frequency time period. The distribution of high-frequency access time periods and the functional preference data are correlated and mapped, and the correlation results are saved to a pre-established database to obtain preliminary analysis results of user behavior cycles.

3. The hierarchical permission adaptive access control method based on a student information system according to claim 2, characterized in that, For the high-frequency access intervals in the preliminary analysis results, those with historical access frequencies exceeding the second frequency threshold are identified as key peak intervals. These are then integrated and categorized by time period to generate a time-domain behavior set, including: The distribution of high-frequency access time periods is obtained from the preliminary analysis results and classified to obtain the classified time period frequency distribution results. Compare the historical access frequency of each time period in the frequency distribution results of the time period with the preset second frequency threshold. If it exceeds the threshold, it is marked as a key peak interval to determine the distribution characteristics of the key peak interval. The user function record data within the corresponding time period in the key peak interval distribution characteristics are obtained and classified to obtain a behavior dataset containing time-domain features. The behavior dataset is associated and mapped with the high-frequency access interval to generate the final time-domain behavior set.

4. The hierarchical permission adaptive access control method based on a student information system according to claim 1, characterized in that, The acquired role-related data is compared with the time-domain behavior set, and combined with the key peak intervals and the high-frequency access intervals, a personalized behavior feature description set is determined, including: The role-related data is obtained from the pre-established user profile database and compared with the time-domain behavior set. Features related to the high-frequency access interval are filtered out to obtain the role behavior matching result. The role behavior matching results are combined with the key peak intervals, and the role association data is associated with the historical access frequency to determine the role's behavior preference distribution in the peak intervals. The access records of the corresponding roles in different time periods are obtained through the behavioral preference distribution and classified and organized. If the historical access frequency exceeds the preset personalized behavior key point threshold, it is marked as a personalized behavior key point, and the temporal features of the key point are obtained. The time-domain features are integrated and mapped with the role-related data to generate a set of personalized behavioral feature descriptions.

5. The hierarchical permission adaptive access control method based on a student information system according to claim 1, characterized in that, Extract time patterns related to the ordering of permission rules from the personalized behavioral feature description set. If the time patterns match preset permission granting conditions, generate a temporary permission rule list, including: Data related to time patterns are obtained from the personalized behavioral feature description set and classified and organized. Time patterns associated with permission rule sorting are extracted to obtain a preliminary set of time patterns. The initial set of time patterns is matched one by one with the preset permission granting conditions. If the time pattern meets the preset time pattern validity threshold, it is marked as a valid time pattern, and a list of valid time patterns is determined. The time patterns in the list of effective time patterns are associated with the permission rules to generate a draft temporary permission rule corresponding to the time patterns; The draft temporary permission rules are verified against the set of personalized behavioral characteristics. If the verification result is consistent with the permission granting conditions, the permission allocation basis is obtained, and the final list of temporary permission rules is generated.

6. The hierarchical permission adaptive access control method based on a student information system according to claim 1, characterized in that, The system acquires current system resource usage data for load analysis. If the resource usage is lower than a preset system resource load threshold, the access scope in the temporary permission rule list is dynamically adjusted to generate an optimized permission rule combination, including: The system obtains current system resource usage data from a pre-established resource monitoring database and matches it with a preset system resource load threshold. If the threshold is lower, the system is determined to meet the preliminary conditions for load analysis and an adjustable resource list is obtained. The system resource usage data is associated with the access scope in the temporary permission rule list. If the permission rules match the resource capacity well, a feasible set for scope expansion is obtained. The access scope in the temporary permission rule list is dynamically adjusted using the feasibility set, and the adjusted access scope is verified against the load balancing requirements to determine the draft of the expanded permission rules. The adjusted rule content in the extended permission rule draft is merged with the permission rules. If the fusion result meets the preset dynamic allocation requirements, an optimized permission rule combination is generated.

7. The hierarchical permission adaptive access control method based on a student information system according to claim 1, characterized in that, The optimized permission rule combinations are sorted according to the time pattern to generate a permission allocation sequence consistent with the access request verification logic, including: The system retrieves permission rules and corresponding time pattern data from a pre-established permission rule database, compares and processes them, determines the priority of the rules, and obtains a preliminary sorting sequence. The preliminary sorting sequence is matched with the access request frequency. If the access request frequency is within the preset request frequency priority threshold range, the priority of the preliminary sorting sequence is adjusted to determine the final allocation sequence. The final allocation sequence is compared with the verification logic for consistency. The permission period is dynamically adjusted based on the comparison result to obtain a combination of permission rules that meet the access request. The final allocation sequence is fused with the time sequence by combining the permission rules to obtain a permission allocation sequence consistent with the verification logic.

8. The hierarchical permission adaptive access control method based on a student information system according to claim 7, characterized in that, The permission storage structure is synchronously updated according to the permission allocation sequence. When a received access request meets the permission granting conditions, the permission granting operation is automatically executed to obtain the final permission granting operation instruction, including: The system retrieves synchronized permission table data from a pre-established permission repository and compares the permission storage status to obtain priority data for storage structure updates. For the priority data, the permission allocation sequence is associated with the access request frequency. If the frequency exceeds the preset permission update trigger threshold, the permission storage status is dynamically adjusted to determine the updated permission allocation list. The permission allocation list is matched with the access request verification logic to obtain permission response data that meets the conditions; The request response time and adaptive response logic are integrated using the permission response data to obtain the final permission granting operation instruction.

9. A hierarchical permission adaptive access control device based on a student information system, characterized in that, include: The user behavior cycle analysis module extracts daily access records from user access logs, processes them in segments according to time periods, counts the number of accesses in each time period, marks those exceeding a preset first frequency threshold as high-frequency access intervals, and obtains preliminary analysis results of user behavior cycles. The temporal behavior integration module identifies high-frequency access intervals in the preliminary analysis results, statistically analyzes those with historical access frequencies exceeding a second frequency threshold as key peak intervals, and integrates and classifies them by time period to generate a temporal behavior set. The personalized behavior feature generation module compares the acquired role-related data with the time-domain behavior set, and determines the personalized behavior feature description set by combining the key peak interval and the high-frequency access interval. The temporary permission rule generation module extracts time patterns related to the permission rule sorting from the personalized behavior feature description set. If the time patterns match the preset permission granting conditions, a temporary permission rule list is generated. The permission rule optimization module obtains the current system resource usage data for load analysis. If the resource usage is lower than the preset system resource load threshold, it dynamically adjusts the access range in the temporary permission rule list and generates an optimized permission rule combination. The permission allocation sequence generation module sorts the optimized permission rule combination according to the time pattern and generates a permission allocation sequence consistent with the access request verification logic. The adaptive permission response module synchronously updates the permission storage structure according to the permission allocation sequence. When the received access request meets the permission granting conditions, it automatically executes the permission granting operation to obtain the final permission granting operation instruction.

Images