A zero-trust security system based on decision tree model
Through the use of the trust evaluation engine of the decision tree model in the zero -trust security system, continuous trust evaluation and dynamic authorization are performed, and the problem of vulnerability and overly trust in the traditional network security architecture when facing complex network attacks, realizing data resources Effective protection.
Patent Information
- Application Number
- CN202210950162.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-09
- Publication Date
- 2025-01-28
- Estimated Expiration
- 2042-08-09
AI Technical Summary
Traditional network security architectures are easily captured when facing complex network attacks, and have excessive trust problems, making it difficult to effectively protect data resources.
The zero -trust security system based on the decision -making tree model is adopted to conduct continuous trust assessment and dynamic authorization of each access request of the user through the trust evaluation engine to achieve access control of data resources.
Effectively protect data resources, avoid excessive trust in traditional network security architecture, and achieve more powerful defense capabilities for complex network attacks.
Smart Images
Figure CN115296916B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of zero-trust security systems, and in particular to a zero-trust security system based on a decision tree model. Background Art
[0002] The traditional network security architecture divides different networks into different areas. Firewalls, intrusion detection systems and intrusion prevention systems (IDS / IPS), VPN gateways and other security facilities are used to isolate the areas. Different degrees of trust are given to each isolated area. This different degree of trust determines which data resources users with different permissions can access, thus forming a defense-in-depth system with border protection as the core. However, with the continuous improvement of hacker technology and the increasing number of network threats, the defects of the traditional network security architecture are becoming more and more obvious. When faced with complex network attacks, even a complete border security architecture can be easily compromised. In the traditional network security architecture, the firewalls and VPN gateways in the border isolation zone are like the walls built around the city. Once the attacker passes through the wall and enters the city, he can move around the city at will, and the border loses its role in protecting the internal network resources. At the same time, the traditional network security architecture has the problem of excessive trust. In the face of attacks launched from the internal network, the system deployed with the traditional network architecture is powerless. For example, privileged users abuse their permissions to easily cause sensitive information leakage, internal network resources are destroyed, and the system is paralyzed and unable to provide services normally.
[0003] In the face of the endless network security issues, if we continue to use traditional network security architecture to solve new security threats, it will be difficult to achieve the goal of protecting data security. This requires building a more secure network architecture to deal with network security threats, thus giving birth to the zero-trust security architecture. The zero-trust concept of "never trust, always verify" has been widely recognized. Based on the zero-trust concept, the traditional network security protection architecture is improved to better solve the current shortcomings of traditional network security protection technology. At the same time, it provides a safer network security protection technology for the new information environment.
[0004] The essence of zero trust is dynamic trusted access control based on identity, which requires that all devices, users and network traffic must be authenticated and authorized. Trust assessment is a key means for zero trust architecture to build trust from scratch. A trust relationship is a situation where if the subject can meet the expected value assumed by the object, then the object is said to trust the subject. The trust relationship can be measured using the expected value. The scope of establishing a trust relationship between the subject and the object is called the trust domain, which is the collection of the scope of the subject, object and trust relationship.
[0005] In the process of establishing a trust model and implementing access control, it is necessary not only to select a suitable trust model to protect the object's resources, but also to avoid exposing the subject's information resources to attacks and dangers. How to conduct trust assessment on user access in a zero-trust architecture, protect various information resources, and implement zero-trust security architecture technology from various fields has become a technical problem that technicians in this field need to solve urgently. Summary of the invention
[0006] Purpose of the invention: The purpose of the present invention is to address the deficiencies of the prior art and provide a zero-trust security system based on a decision tree model, which performs continuous trust evaluation on each access request of a user in a zero-trust architecture based on a trusted value evaluation and dynamically authorizes access to data resources, thereby achieving the purpose of protecting data resources and providing assistance for the implementation of zero-trust security architecture technology in various fields.
[0007] Technical solution: The zero-trust security system based on the decision tree model described in the present invention includes a trust assessment engine, which is used to obtain the access request initiated by the access subject to the access object, and continuously evaluate the access request of the access subject to obtain a trust value; a dynamic access control engine, which is used to dynamically configure the access subject's control policy for the access object, and output the corresponding control policy according to the trust value obtained by the trust assessment engine; and a trusted agent, which is used to execute the control policy output by the dynamic access control engine, and authorize the access request of the access subject according to the control policy.
[0008] To further improve the above technical solution, the trust assessment engine includes: an empirical trust model, which is used to obtain direct empirical evidence and / or indirect recommendation evidence, obtain direct empirical values based on direct empirical evidence, obtain indirect empirical values based on indirect recommendation evidence, and aggregate direct empirical values and / or indirect empirical values to obtain trust values; a trust-aware decision function, which is used to set a trust value threshold, and when the trust value obtained by the empirical trust model exceeds the trust value threshold, the access subject is authorized to interact with the access object; a result set, which is used to record the results of the interaction between the access subject and the access object; a utility matrix, which is used to evaluate the utility of the results of the interaction between the access subject and the access object selectively authorized based on the trust value, and update the empirical trust model according to the evaluation results.
[0009] Furthermore, the trust assessment engine also includes side information and a stereotyped model. The stereotyped model processes the side information through a decision tree model to obtain a priori trust value. The empirical trust model is used to obtain a priori trust value, direct empirical value, and indirect empirical value to obtain a trust value.
[0010] Furthermore, the direct experience evidence is obtained through the interaction records between the access subject and the access object, and the indirect recommendation evidence is obtained through the interaction records between the access subject and the third-party trusted agent.
[0011] Furthermore, the side information includes profile data associated with the access subject device, context data, and interaction data representing a relationship between an owner of the access subject device and an owner of the access object device.
[0012] Furthermore, the profile data includes one or more of the hardware model, system software version, and firmware information of the access subject device, and the context data includes one or more of network security event logs, vulnerability information, abnormal behavior, recent vulnerability releases, and vulnerability repair logs.
[0013] Beneficial effect: Compared with the prior art, the advantages of the present invention are: the present invention analyzes the defects of traditional network security architecture and typical zero-trust security architecture, and based on the decision tree model of trusted value evaluation, performs continuous trust evaluation and dynamic authorization for each access request of users in the zero-trust architecture to achieve access to data resources, thereby achieving the purpose of protecting data resources and providing assistance for the implementation of zero-trust security architecture technology in various fields. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] Figure 1 is a block diagram of a zero-trust security system of the present invention;
[0015] Figure 2 A block diagram of the trust assessment engine of the present invention. DETAILED DESCRIPTION
[0016] The technical solution of the present invention is described in detail below with reference to the accompanying drawings, but the protection scope of the present invention is not limited to the embodiments.
[0017] Zero-trust security architecture abandons the concept of border protection as the core and proposes a new security architecture model. Zero-trust security architecture no longer relies on network location to protect data resources. Regardless of the network location of the host, it is regarded as an Internet host, and all people, things, and objects are not trusted by default. It is believed that the network is always in an environment full of external or internal security threats. All network communications and business access must be dynamically authorized through identity authentication and continuous trust evaluation before they can be completed.
[0018] The zero-trust security architecture is shown in Figure 1. The three core components of the zero-trust security architecture are the data plane, the control plane, and the identity security infrastructure. The data plane is responsible for high-speed processing of data packets and is the policy execution point for dynamic access control. It is mainly composed of trusted proxy components; the control plane consists of a trust assessment engine and a dynamic access control engine. The data plane's access request to network resources is received by the control plane and authorized to access data resources. The control plane will change with the changes in relevant policies and is responsible for managing and configuring the data plane; the identity security infrastructure implements an identity-based zero-trust security architecture by providing identity management and permission service functions for various access subjects.
[0019] The trust assessment engine is the core component of the zero-trust security architecture that continuously evaluates the requests of access subjects. It collects user data, device data, behavior data, log data, etc. for quantitative evaluation and links with the dynamic access control engine. Then, it authorizes the access subject's request according to the corresponding strategy to achieve dynamic access control of access objects such as applications, interfaces, and data. The trust assessment engine receives the above data and divides it into direct empirical evidence and indirect recommendation evidence.
[0020] exist Figure 2 In the example of FIG. 2 , the trust assessment engine 200 includes side information 202, direct empirical evidence 204, indirect recommendation evidence 206, a training model 208, an empirical trust model 210, a trust-aware decision function 212, a result set 214, and a utility matrix 216. In a real trust management scenario, the trust assessment engine collects evidence from multiple sources to evaluate access subjects. Such sources include direct empirical evidence 204 and indirect recommendation evidence 206, which are provided as input to the empirical trust model.
[0021] Direct experience evidence 204 is provided from the interaction record of the access subject with the object (e.g., the own database of the access object). Direct experience evidence 204 can be processed to determine the direct trust value. If other trusted agents (e.g., third-party trusters) are willing to act as referees, the access subject can request their interaction records (i.e., indirect recommendation evidence 206), which can be processed to provide indirect trust values. The experience trust model 210 aggregates the direct trust value and the indirect trust value to provide a trust assessment.
[0022] Using both direct trust and indirect trust, the empirical trust model 210 generates a trust score that represents the trustworthiness of the access subject. The trust score is processed by the trust-aware decision function 212 to determine whether the access object is to interact with the access subject. The trust-aware decision function 212 sets a threshold, and whenever the trust score exceeds the threshold, the access object determines to interact with the access subject. The above interaction may include transmitting data to / from the access subject and the access object, and generating a result set 214 (e.g., objective results). The result set may also include abnormal behavior, detected malicious intrusions, etc. The utility of the results is evaluated based on the (subjective) utility matrix 216, and the results of the evaluation are provided as updates to the empirical trust model 210.
[0023] The training model 208 provides a priori trust values for processing by the empirical trust model 210 along with the direct and indirect trust values to provide trust values. The priori trust values are determined based on the side information 202 introduced above and any updated trust (eg, provided based on updates from the utility matrix 216).
[0024] The training model 208 can provide direct inference from the pattern (side information) to the empirical trust model 210, while skipping the inference process through behavior. The training model of the present disclosure is provided by supervised machine learning techniques, where the machine learning algorithm learns the target training function through a training process and provides trust estimates in the prediction process. Training data is provided and used to train the machine learning model. Before each interaction, the observed side information data and corresponding labels are provided to the training model.
[0025] Embodiments of the present disclosure include decision trees as core machine learning algorithms. For example, unlike Bayesian methods and logistic / linear regression that assume a specific distribution of data, decision trees are non-parametric algorithms that can be better generalized with unknown context data. Side information associated with an access subject device is received, the side information including profile data and context data, the profile data including one or more of the hardware model, system software version, and firmware information of the service provider device, and the context data including one or more of network security event logs, vulnerability information, abnormal behavior, and recent vulnerability release and vulnerability repair logs. The side information also includes interaction data representing the relationship between the owner of the access subject device and the owner of the access object device.
[0026] The trust assessment engine 200 processes the side information using a computer-executable stereotyped model to determine the trust value, and the trust assessment engine 200 uses a computer-executable empirical trust model and determines the trust value based at least in part on the prior trust value, and selectively interacts between the access subject and the object device. In order to determine such relevant functions, a machine learning algorithm is implemented to learn from the feature data, and an online training process is performed after each interaction. The trained machine learning model is used as a stereotyped model. In the case where a trust estimate is required for the target device, the stereotyped model provides a predicted trust based on the observed side information of the target device. In order to mark the observed side information data for supervised machine learning, an updated trust estimate provided by the empirical trust model can be used. This ensures the semantic consistency of trust and semantic trust.
[0027] In view of the above, an embodiment of the present disclosure provides a fast decision tree (VFDT) algorithm, which can be described as a Hoeffding tree with incremental learning capabilities while limiting the expected error through the Hoeffding inequality. The basic principle of the Hoeffding tree is that in order to find the best attribute to be tested at a given node, it may be sufficient to consider only a small subset of the data set. Then, the strategy for training the Hoeffding tree is to first accumulate enough data to find the best attribute to split on the root node. Once the root node is constructed, subsequent data is passed down to split the corresponding leaf nodes, recursively. The VFDT algorithm of the present disclosure is built based on the Hoeffding tree. For example, in order to reduce computational complexity, the VFDT can be used to wait for a minimum number of new examples before the next update. This is particularly useful for high-speed streaming data.
[0028] The specific operation method of the trust assessment engine 200 disclosed in the present invention includes:
[0029] Receive side information associated with the access subject device. The trust management system receives the side information. For example, the trust assessment engine can receive the side information. The side information includes profile data and context data associated with the access subject device. The profile data includes one or more of the hardware model, system software version, and firmware information of the service provider device, and the context data includes one or more of network security event logs, vulnerability information, abnormal behavior, and recent vulnerability release and vulnerability repair logs. The side information also includes interaction data representing the relationship between the owner of the access subject device and the owner of the access object device.
[0030] The side information is processed using a computer executable training model to determine a priori trust values. The training model includes at least in part a fast decision tree (VFDT) using a computer executable empirical trust model to determine the trust values. The trust management system determines the trust values, the trust values being based at least in part on the priori trust values.
[0031] The access subject and the access object are selectively interacted based on the trust value. The access subject and the access object are selectively interacted based on the trust value, including determining that the trust value exceeds a trust value threshold, and in response, interacting. The interaction includes transmitting data between the access subject and the access object.
[0032] As described above, although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the present invention itself. Various changes in form and details may be made without departing from the spirit and scope of the present invention as defined in the appended claims.
Claims
1. A zero-trust security system based on a decision tree model, characterized in that: include: A trust evaluation engine (200) is used to obtain an access request initiated by an access subject to an access object, and continuously evaluate the access request of the access subject to obtain a trust value; A dynamic access control engine, used to dynamically configure a control policy of an access subject for an access object, and output a corresponding control policy according to the trust value obtained by the trust evaluation engine (200); as well as A trusted agent, used to execute the control policy output by the dynamic access control engine, and authorize the access request of the access subject according to the control policy; The trust assessment engine (200) comprises: An empirical trust model (210) is used to obtain direct empirical evidence (204) and / or indirect recommendation evidence (206), obtain a direct empirical value based on the direct empirical evidence (204), obtain an indirect empirical value based on the indirect recommendation evidence (206), and aggregate the direct empirical value and / or the indirect empirical value to obtain a trust value; A trust-aware decision function (212) is used to set a trust value threshold, and when the trust value obtained by the empirical trust model (210) exceeds the trust value threshold, the authorized access subject interacts with the access object; A result set (214) is used to record the results of the interaction between the access subject and the access object; The utility matrix (216) is used to evaluate the utility of the results of the interaction between the selectively authorized access subject and the access object based on the trust value, and to update the empirical trust model (210) according to the evaluation result.
2. The zero-trust security system based on the decision tree model according to claim 1, characterized in that: The trust assessment engine (200) further includes side information (202) and a training model (208), wherein the training model (208) processes the side information (202) through a decision tree model to obtain a priori trust value, and the empirical trust model (210) is used to obtain a priori trust value, direct empirical value, and indirect empirical value to obtain a trust value.
3. The zero-trust security system based on the decision tree model according to claim 1, characterized in that: The direct experience evidence (204) is obtained through the interaction record between the access subject and the access object, and the indirect recommendation evidence (206) is obtained through the interaction record between the access subject and the third-party trusted agent.
4. The zero-trust security system based on the decision tree model according to claim 2, characterized in that: The side information (202) includes profile data associated with the access subject device, context data, and interaction data representing a relationship between an owner of the access subject device and an owner of the access guest device.
5. The zero-trust security system based on the decision tree model according to claim 4, characterized in that: The profile data includes one or more of the hardware model, system software version, and firmware information of the access subject device, and the context data includes one or more of network security event logs, vulnerability information, abnormal behavior, recent vulnerability releases, and vulnerability repair logs.