Access control method, device, storage medium and electronic device

Abstract

The embodiments of the present invention disclose an access control method, device, storage medium and electronic device. When an access request is received, a security model is used to determine whether the access request is a normal access request; if the access request is not a normal access request, the access request is intercepted, wherein the security model is obtained by unsupervised learning and supervised learning based on traffic sample data, so that the detection of access requests is more sensitive, thereby improving the detection accuracy and data security, and there is no need to configure a feature library, thereby avoiding frequent upgrades and updates of the feature library.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an access control method, device, storage medium and electronic device. Background Art

[0002] With the development of the times, computer technology has penetrated into every aspect of people's lives, and the competition in the Internet industry has become increasingly fierce. While some institutions and departments benefit from the Internet to speed up business operations, their online data has also been attacked and damaged to varying degrees. Therefore, it is necessary to use firewalls to provide special protection for online data to prevent it from being obtained by attackers. However, existing firewalls use feature libraries to detect malicious access, and the detection accuracy is low, thereby reducing data security. Summary of the invention

[0003] In view of this, the embodiments of the present invention provide an access control method, device, storage medium and electronic device, which mainly solve the problem that the existing firewall uses a feature library to detect malicious access, the detection accuracy is low, and thus the security of data is reduced.

[0004] In a first aspect, an embodiment of the present invention provides an access control method, including:

[0005] Get traffic sample data;

[0006] Based on the traffic sample data, extracting Http / Https protocol traffic data;

[0007] Perform supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model;

[0008] When an access request is received, the security model is used to determine whether the access request is a normal access request; if the access request is not a normal access request, the access request is intercepted.

[0009] In a possible manner, the using the security model to determine whether the access request is a normal access request includes:

[0010] According to the access request, parsing and obtaining request parameters carried in the access request;

[0011] The request parameter is matched with the normal access data in the security model. If the match succeeds, it is determined that the access request is a normal access request. If the match fails, it is determined that the access request is not a normal access request.

[0012] In one possible embodiment, the method further includes:

[0013] Get dynamic parameters;

[0014] The security model is used to determine whether the dynamic parameter contains an attacking character. If the dynamic parameter contains an attacking character, the attacking character is deleted or an alarm message is issued.

[0015] In one possible embodiment, the method further includes:

[0016] Get a valid URL;

[0017] The legal URL is marked.

[0018] In a possible manner, the performing supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model includes:

[0019] When performing unsupervised learning, the Http / Https protocol traffic data is classified;

[0020] Performing dimensionality reduction processing on the classified data using a first preset algorithm;

[0021] Adjust the data after dimensionality reduction to obtain normal access data and attack access data;

[0022] When conducting supervised learning, obtain calibrated business sample data and attack sample data;

[0023] Using a second preset algorithm to perform dimension reduction processing on the calibrated business sample data and attack sample data to obtain dimension-reduced data;

[0024] Based on the data after dimensionality reduction, the normal access data and attack access data are optimized to obtain a security model.

[0025] In a possible manner, before the dimensionality reduction processing and adjustment of the classified data, the following steps are further included:

[0026] The classified data are preprocessed, and the preprocessing includes linear transformation, and removal of noise and redundant data.

[0027] In a possible manner, the first preset algorithm is a PCA algorithm, and the second preset algorithm is an LDA algorithm.

[0028] In a second aspect, an embodiment of the present invention provides an access control device, including:

[0029] An acquisition module is used to obtain traffic sample data;

[0030] An extraction module, used for extracting Http / Https protocol traffic data based on the traffic sample data;

[0031] A generation module, used for performing supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model;

[0032] The judgment module is used to, when receiving an access request, use the security model to judge whether the access request is a normal access request; if the access request is not a normal access request, intercept the access request.

[0033] In a third aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a processor to execute operations corresponding to the access control method of any of the above-mentioned schemes.

[0034] In a fourth aspect, an embodiment of the present invention provides an electronic device, characterized in that it includes: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

[0035] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the access control method of any of the above solutions.

[0036] According to an access control method, device, storage medium and electronic device provided by an embodiment of the present invention, when an access request is received, a security model is used to determine whether the access request is a normal access request; if the access request is not a normal access request, the access request is intercepted, wherein the security model is obtained by unsupervised learning and supervised learning based on traffic sample data, so that the detection of access requests is more sensitive, thereby improving the detection accuracy and data security, and there is no need to configure a feature library, thereby avoiding frequent upgrades and updates of the feature library. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The following drawings of the present invention are used as part of the embodiments of the present invention for understanding the present invention. The embodiments of the present invention are shown in the drawings and the description thereof is used to explain the principle of the present invention.

[0038] In the attached figure:

[0039] Figure 1 is a flow chart of an access control method according to an optional embodiment of the present invention;

[0040] Figure 2 is a flowchart of step S104 according to an optional embodiment of the present invention;

[0041] Figure 3 is a flowchart of step S103 according to an optional embodiment of the present invention;

[0042] Figure 4 is a flow chart of an access control method according to another optional embodiment of the present invention;

[0043] Figure 5 is a flow chart of an access control method according to yet another optional embodiment of the present invention;

[0044] Figure 6 FIG. 4 is a schematic diagram of the structure of an access control device according to an optional embodiment of the present invention. DETAILED DESCRIPTION

[0045] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0046] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of the features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0047] Now, exemplary embodiments according to the present invention will be described in more detail with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in a variety of different forms and should not be interpreted as being limited to the embodiments set forth herein. It should be understood that these embodiments are provided to make the disclosure of the present invention thorough and complete, and to fully convey the concept of these exemplary embodiments to those of ordinary skill in the art.

[0048] In a first aspect, an embodiment of the present invention provides an access control method, the execution subject of which may be a network device or server in a network, or a module or chip integrated in the network device or server. Specifically, Figure 1 As shown, an access control method includes:

[0049] Step S101: Obtain flow sample data.

[0050] The flow sample data may be information related to the flow of traffic flowing through a certain network element in the existing network architecture, such as a radio network controller (Radio Network Controller, RNC), a serving GPRS support node (Serving GPRS Support Node, SGSN), and a gateway GPRS support node (Gateway GPRS Support Node GGSN). The flow sample data may be obtained by the above-mentioned execution subject periodically collecting data from the network element, that is, obtaining the flow within a preset time period to form the flow sample data.

[0051] Step S102: extracting Http / Https protocol traffic data based on the traffic sample data.

[0052] Among them, Http / Https protocol traffic data includes http header information and payload information of access requests and responses, including but not limited to packet header parameters and parameter values, time, event classification, request and response context, source and destination information.

[0053] Step S103: Perform supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model.

[0054] Unsupervised learning and supervised learning are a training method / learning method in machine learning. Among them, unsupervised learning is a training method for machine learning. It is essentially a statistical method that can discover potential structures in unlabeled data.

[0055] Supervised learning refers to the process of training a model by letting the machine learn a large amount of labeled sample data, so that the model can get the corresponding output according to the input. Through the correspondence between the existing part of the input data and the output data, a function is generated to map the output to the appropriate output, such as classification.

[0056] The security model is obtained through unsupervised and supervised learning based on traffic sample data, making it more sensitive to access request detection, thereby improving detection accuracy and data security, and does not require the configuration of a feature library, thus avoiding frequent upgrades and updates to the feature library.

[0057] Step S104: when an access request is received, the security model is used to determine whether the access request is a normal access request; if the access request is not a normal access request, step S105 is executed.

[0058] Step S105: intercepting the access request.

[0059] The security model is used to determine whether the access request is a normal access request. If the access request is a normal access request, the access can be performed normally; if the access request is not a normal access request, it is intercepted to protect the data to be accessed.

[0060] An access control method provided in this embodiment, when receiving an access request, uses a security model to determine whether the access request is a normal access request; if the access request is not a normal access request, the access request is intercepted, wherein the security model is obtained by unsupervised learning and supervised learning based on traffic sample data, so that the detection of access requests is more sensitive, thereby improving the detection accuracy and data security, and there is no need to configure a feature library, thereby avoiding frequent upgrades and updates of the feature library.

[0061] Specifically, Figure 2 As shown, step S104 in the above embodiment specifically includes:

[0062] Step S201: according to the access request, parse and obtain the request parameters carried in the access request.

[0063] The request parameters include but are not limited to packet header parameters and parameter values, time, event classification, request and response context, source and destination information.

[0064] Step S202: Match the request parameters with normal access data in the security model.

[0065] Step S203a: If the match is successful, it is determined that the access request is a normal access request.

[0066] Step S203b: If the match fails, it is determined that the access request is not a normal access request.

[0067] The request parameters are matched with the normal access data in the security model, and the access requests that are successfully matched are determined to be normal access requests, and the access requests that fail to match are determined not to be normal access requests, that is, they are determined to be access requests of malicious attacks. This method of matching the request parameters with normal access data to determine whether it is a normal access is more accurate in detection than matching with attack access data in the prior art.

[0068] Specifically, Figure 3 As shown, step S103 in the above embodiment includes:

[0069] Step S301: When performing unsupervised learning, classify the Http / Https protocol traffic data.

[0070] In this step, the Http / Https protocol traffic data is firstly upgraded and then classified.

[0071] Step S302: preprocessing the classified data, including linear transformation, and removing noise and redundant data.

[0072] Perform linear transformation on the classified data and remove noise and redundant data, thereby reducing the interference of redundant data and noise and reducing the amount of computation required for subsequent processing.

[0073] Step S303: using a first preset algorithm to perform dimensionality reduction processing on the classified data.

[0074] Among them, the first preset algorithm is the PCA algorithm. PCA, namely principal component analysis, is also called principal component analysis. It aims to use the idea of ​​dimensionality reduction to transform multiple indicators into a few comprehensive indicators. In statistics, principal component analysis PCA is a technique for simplifying data sets, which is a linear transformation. This transformation transforms the data into a new coordinate system so that the first largest variance of any data projection is on the first coordinate (called the first principal component), the second largest variance is on the second coordinate (the second principal component), and so on. Principal component analysis is often used to reduce the dimensionality of a data set while maintaining the features of the data set that contribute the most to the variance. In this step, the PCA algorithm is used to project high-dimensional data to low latitudes.

[0075] Step S304: Adjust the data after dimensionality reduction to obtain normal access data and attack access data.

[0076] Step S305: When performing supervised learning, obtain calibrated business sample data and attack sample data.

[0077] Step S306: Use a second preset algorithm to perform dimension reduction processing on the calibrated business sample data and attack sample data to obtain dimension-reduced data.

[0078] The second preset algorithm is the LDA algorithm. The LDA algorithm is a method for projecting into a space with a lower dimension so that the projected points are classified into clusters, and points of the same category are closer in the projected space.

[0079] Step S307: Based on the data after dimensionality reduction, the normal access data and the attack access data are optimized to obtain a security model.

[0080] In this embodiment, supervised learning is used to optimize the normal access data and attack access data obtained by unsupervised learning, so that the normal access data and attack access data are more accurate, thereby improving the accuracy of the security model.

[0081] In other embodiments, Figure 4 As shown, the method also includes:

[0082] Step S401: Acquire dynamic parameters, where the dynamic parameters are parameters input by the visitor.

[0083] Step S402: using the security model to determine whether the dynamic parameter contains attacking characters, if the dynamic parameter contains attacking characters, the attacking characters are deleted or an alarm message is issued.

[0084] Specifically, the dynamic parameters are matched with the normal access data in the security model. If some characters in the dynamic parameters do not match the normal access data, it is determined that the dynamic parameters contain attack characters, and the unmatched characters are determined to be attack characters. The attack characters are then deleted to ensure that the content after submission will not form a cross-site scripting attack, further improving the security of access.

[0085] In some practicable manners, after the attacking character is determined, the attacking character is not deleted, but an alarm message is sent to an administrator, who then determines whether to delete the character, so as to improve the accuracy of the attacking character determination.

[0086] In some other embodiments, Figure 5 As shown, the method also includes:

[0087] Step S501: Obtain a legal URL.

[0088] The process of determining a legal URL is as follows: matching the URL with normal access data in the security model, and if the match succeeds, determining that the URL is a legal URL.

[0089] Step S502: Mark the legal URL.

[0090] After the legal URL is marked, the legal URL can be distinguished from other URLs, thereby facilitating identification of whether the URL is legal.

[0091] Second, as Figure 6 As shown, an embodiment of the present invention provides an access control device, including:

[0092] An acquisition module 601 is used to acquire flow sample data;

[0093] An extraction module 602 is used to extract Http / Https protocol traffic data based on traffic sample data;

[0094] A generation module 603 is used to perform supervised learning and unsupervised learning on Http / Https protocol traffic data to generate a security model;

[0095] The judgment module 604 is used to judge whether the access request is a normal access request by using the security model when receiving an access request; if the access request is not a normal access request, intercept the access request.

[0096] According to an access control device provided by an embodiment of the present invention, when receiving an access request, a security model is used to determine whether the access request is a normal access request; if the access request is not a normal access request, the access request is intercepted, wherein the security model is obtained by unsupervised learning and supervised learning based on traffic sample data, so that the detection of access requests is more sensitive, thereby improving the detection accuracy and data security, and there is no need to configure a feature library, thereby avoiding frequent upgrades and updates of the feature library.

[0097] In a third aspect, an embodiment of the present invention provides a storage medium, in which at least one executable instruction is stored, and the executable instruction enables a processor to execute operations corresponding to the access control method of any of the above schemes.

[0098] In a fourth aspect, an embodiment of the present invention provides an electronic device, characterized in that it includes: a processor, a memory, a communication interface and a communication bus, and the processor, the memory and the communication interface communicate with each other through the communication bus;

[0099] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the access control method of any of the above solutions.

[0100] Specifically, the program may include program codes including computer operation instructions.

[0101] The processor may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured as an embodiment of the present invention. The one or more processors included in the computer device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0102] The memory is used to store programs. The memory may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0103] The present invention has been described by the above embodiments, but it should be understood that the above embodiments are only for the purpose of example and description, and are not intended to limit the present invention to the described embodiments. In addition, it can be understood by those skilled in the art that the present invention is not limited to the above embodiments, and more variations and modifications can be made according to the teachings of the present invention, and these variations and modifications all fall within the scope of the protection claimed by the present invention. The protection scope of the present invention is defined by the attached claims and their equivalents.

Claims

1. An access control method, characterized in that: include: Get traffic sample data; Based on the traffic sample data, extracting Http / Https protocol traffic data; Perform supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model; When receiving an access request, determining whether the access request is a normal access request using the security model; If the access request is not a normal access request, intercepting the access request; The using the security model to determine whether the access request is a normal access request includes: According to the access request, parsing and obtaining request parameters carried in the access request; Matching the request parameter with the normal access data in the security model, and if the match succeeds, determining that the access request is a normal access request; if the match fails, determining that the access request is not a normal access request; The step of performing supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model includes: When performing unsupervised learning, the Http / Https protocol traffic data is classified. Specifically, the Http / Https protocol traffic data is subjected to dimensionality-upgrading processing and then subjected to classification processing; Performing dimensionality reduction processing on the classified data using a first preset algorithm; Adjust the data after dimensionality reduction to obtain normal access data and attack access data; When conducting supervised learning, obtain calibrated business sample data and attack sample data; Using a second preset algorithm to perform dimension reduction processing on the calibrated business sample data and attack sample data to obtain dimension-reduced data; Based on the data after dimensionality reduction, the normal access data and the attack access data are optimized to obtain a security model; Obtaining dynamic parameters, wherein the dynamic parameters are parameters input by the visitor; The dynamic parameter is matched with the normal access data in the security model. If some characters in the dynamic parameter do not match the normal access data, it is determined that the dynamic parameter contains attack characters, and the unmatched characters are determined to be the attack characters; if the dynamic parameter contains the attack characters, the attack characters are deleted or an alarm message is issued.

2. The method according to claim 1, characterized in that The method further comprises: Get a valid URL; The legal URL is marked.

3. The method according to claim 1, characterized in that Before the dimensionality reduction processing and adjustment of the classified data, the following steps are also included: The classified data are preprocessed, and the preprocessing includes linear transformation, and removal of noise and redundant data.

4. The method according to claim 1, characterized in that The first preset algorithm is the PCA algorithm, and the second preset algorithm is the LDA algorithm.

5. An access control device, characterized in that: include: An acquisition module is used to obtain traffic sample data; An extraction module, used for extracting Http / Https protocol traffic data based on the traffic sample data; A generation module, used for performing supervised learning and unsupervised learning on the Http / Https protocol traffic data to generate a security model; A judgment module, configured to, when receiving an access request, use the security model to judge whether the access request is a normal access request; if the access request is not a normal access request, intercept the access request; The determination module is further configured to parse and obtain request parameters carried by the access request according to the access request; Matching the request parameter with the normal access data in the security model, and if the match succeeds, determining that the access request is a normal access request; if the match fails, determining that the access request is not a normal access request; The generating module is further used to classify the Http / Https protocol traffic data when performing unsupervised learning. Specifically, the Http / Https protocol traffic data is subjected to dimensionality-upgrading processing and then subjected to classification processing; Performing dimensionality reduction processing on the classified data using a first preset algorithm; Adjust the data after dimensionality reduction to obtain normal access data and attack access data; When conducting supervised learning, obtain calibrated business sample data and attack sample data; Using a second preset algorithm to perform dimension reduction processing on the calibrated business sample data and attack sample data to obtain dimension-reduced data; Based on the data after dimensionality reduction, the normal access data and the attack access data are optimized to obtain a security model; The acquisition module is further used to acquire dynamic parameters, wherein the dynamic parameters are parameters input by the visitor; The judgment module is further used to match the dynamic parameter with normal access data in the security model. If some characters in the dynamic parameter do not match the normal access data, it is determined that the dynamic parameter contains attack characters, and the unmatched characters are determined to be the attack characters; if the dynamic parameter contains the attack characters, the attack characters are deleted or an alarm message is issued.

6. A storage medium, characterized in that: The storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the access control method according to any one of claims 1 to 4.

7. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the access control method according to any one of claims 1 to 4.

Images