Apparatus and method for automatic authorization based on traffic learning

Abstract

The application discloses an automatic authorization device and method based on traffic learning, a data acquisition module is used for capturing network communication data generated by a user in an access process, classifying and processing the network communication data according to a set access control rule, and sending the processed data to a traffic feature analysis module; the traffic feature analysis module is used for filtering the data processed by the data acquisition module to obtain behavior characteristic parameters of the user; an authorization generation module performs model training according to the behavior characteristic parameters to generate an authorization scheme; an authorization execution module receives the authorization scheme, executes an authorization operation according to the authorization scheme, monitors the execution of the authorization operation, and performs audit management after the authorization is successful. The application can more accurately identify characteristic information of network traffic by collecting all service traffic in an access process and combining a machine learning algorithm, and can automatically execute an authorization operation in a data interaction process, thereby improving the speed and efficiency of data interaction.

Description

Technical Field

[0001] This invention relates to the field of authorization control technology, and more specifically to an apparatus and method for automatic authorization based on traffic learning. Background Technology

[0002] Internal application access control is a crucial part of enterprise IT infrastructure development. It is responsible for controlling, auditing, managing, and monitoring various permissions within internal application systems. The quality of application access control directly impacts an enterprise's information security, operational efficiency, and management level.

[0003] Currently, enterprise internal application authorization mainly takes the following forms: 1. Role-based authorization: Users are categorized according to their responsibilities and roles, and authorization is automatically granted in batches based on roles. This method can improve authorization efficiency, reduce authorization error rates, and facilitate permission maintenance and management; 2. Organization-based authorization: Users are categorized according to their department and organizational level, and authorization is automatically granted in batches. This method is typically used to authorize specific departments or organizations, reducing the time and effort required for authorization and permission changes.

[0004] The above methods can be used individually or in combination, and the selection and adjustment should be made according to the actual situation and needs of the enterprise.

[0005] Currently, there are many problems with enterprise internal application access management, mainly the following:

[0006] First, application permissions are unclear; it's impossible to clearly define who should have what permissions to access which applications. Large enterprise IT systems involve numerous applications, each with a large number of permissions, and these permissions are changed and used very frequently. The permission management between applications and users is a many-to-many relationship, and fully clarifying the permission management relationship between each user and application requires significant effort and is extremely complex. This poses a major challenge to the enterprise's security management team.

[0007] Secondly, in the new generation of zero-trust network security architecture, it is necessary to implement fine-grained authorization management for applications based on the least privilege principle. However, access to an application often depends on a large amount of network resource information (which may not be strongly correlated with the application's business logic). Security management departments often cannot fully understand all the resource information related to the application. This can lead to insufficient application authorization affecting users' access to the application. Summary of the Invention

[0008] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies by providing an automatic authorization device and method based on traffic learning. This device and method collect all business traffic during the access process and, combined with machine learning algorithms, can more accurately identify the characteristic information of network traffic and automatically execute authorization operations during data interaction, thereby improving the speed and efficiency of data interaction.

[0009] Technical Solution: The automatic authorization device based on traffic learning according to the present invention includes a data acquisition module, a traffic feature analysis module, an authorization generation module, and an authorization execution module. The data acquisition module is used to capture network traffic data generated by users during access, classify and process the network traffic data according to the set access control rules, and send the processed data to the traffic feature analysis module. The traffic feature analysis module filters the data processed by the data acquisition module based on traffic rules to obtain user behavior feature parameters. The authorization generation module trains a model based on the behavior feature parameters to generate an authorization scheme, which includes authorization time, authorization object, and authorization scope. The authorization execution module receives the authorization scheme generated by the authorization generation module, executes the authorization operation according to the authorization scheme, monitors the execution of the authorization operation, and performs audit management after successful authorization.

[0010] To further improve the above technical solution, the data acquisition module captures data packet information generated during user access through deep packet inspection technology. The data packet information includes header information and application data, and the header information includes quintuple information.

[0011] Furthermore, the traffic feature analysis module determines the type of network communication protocol of the collected data packets based on the data packet format and header information, analyzes the network topology and communication method based on the source address, template address, and protocol port number in the 5-tuple, and forms an application resource and user management information database based on user information and application data.

[0012] Furthermore, the authorization generation module employs cluster analysis in machine learning. Based on the behavioral characteristic parameters of all users obtained, it uses a clustering algorithm to cluster users' access behaviors into similar clusters around the accessed business systems and personnel's organizational information within the enterprise. This identifies users or user groups with similar access behavior characteristics for precise authorization, and also identifies users with special access behaviors to achieve authorization for specific needs.

[0013] Furthermore, the authorization execution module monitors the execution of authorization operations by: monitoring whether the authorization operation is successful during execution, issuing warnings or re-initiating the authorization operation when the authorization operation fails; the audit management after successful authorization includes: after successful authorization, continuously collecting network traffic information generated by the user during access, identifying abnormal authorized access traffic by comparing the access traffic information of personnel with the same organizational background, and pushing the abnormal authorized access traffic to security management personnel.

[0014] This application also provides a method for automatic authorization based on traffic learning, including the following steps:

[0015] S1: Obtain network traffic data generated by the user during the access process;

[0016] S2: Filter network traffic data based on traffic rules to obtain user behavior characteristic parameters;

[0017] S3: Train a model using behavioral feature parameters to generate an authorization scheme;

[0018] S4: Execute authorization operations according to the authorization scheme, monitor the execution process of authorization operations, and audit and manage the access traffic information generated by users after successful authorization.

[0019] Furthermore, the network traffic data collected in S1 includes network data packets, which are parsed using deep packet inspection technology to obtain the format, header information, and quintuple information of the network data packets.

[0020] Furthermore, S2 includes: determining the type of network communication protocol of the collected network data packets based on the format and header information of the network data packets; analyzing the network topology and communication methods based on the five-tuple information of the data packets; and performing traffic and user correlation analysis to obtain an application resource and user correlation information database.

[0021] Furthermore, S3 includes: employing cluster analysis methods in machine learning, and based on the obtained behavioral characteristic parameters of all users, using a clustering algorithm to cluster users' access behaviors into similar clusters around the accessed business systems and personnel's organizational information within the enterprise, identifying users or user groups with similar access behavior characteristics for precise authorization, and identifying users with special access behaviors for authorization to achieve specific needs.

[0022] Furthermore, S4 includes: receiving an authorization scheme from the authorization generation module; performing an appropriate authorization operation according to the authorization scheme; monitoring whether the authorization operation is successful, issuing an early warning or re-initiating the authorization operation when the authorization operation fails; after detecting successful authorization, continuously collecting the user's access network traffic data, identifying abnormal authorized access traffic by comparing the access traffic of personnel with the same organizational background, and informing the security management personnel.

[0023] Beneficial effects: Compared with the prior art, the advantages of the present invention are as follows: The present invention collects all business traffic during the access process by allowing users to access the business system without access restrictions during the data collection phase and without authorization restrictions. Among these traffic, a part is the displayed business traffic directly related to the business system, and another part is auxiliary access traffic to the business system, such as resource information existing in the Internet framework that the business depends on. Access to this information is often hidden in the business access process. By collecting all traffic, it is possible to clearly understand all user behaviors on the terminal and lay the foundation for subsequent user permission analysis and authorization.

[0024] The network traffic data collected by the data acquisition module is classified and processed using access control rules. Access control rules are essentially a method of authorization; after authorization, the access control rules are sent to the user terminal for terminal access control. This allows the system to learn the network resource information required for application access and generate an "application resource and user association information database." After a period of learning, application authorization is performed based on this database, avoiding unclear access permissions for enterprise applications or incomplete authorization of associated resources, which could prevent the achievement of precise application authorization. By comparing the user's access association information database with that of their organization, the similarity of user behavior within the same organizational background is examined, checking the accuracy of audited access authorization. Compared to traditional application access authorization systems that require manual static configuration of authorizations, this invention uses automatic authorization learning based on traffic learning, which can automatically collect this associated network resource access information, achieving more intelligent and faster access authorization.

[0025] This invention is based on traffic-based automatic authorization technology and combines it with machine learning algorithms to achieve the core function of automatic authorization, thereby improving the speed and efficiency of data interaction. Specifically, its advantages are: through the application of machine learning algorithms, it can more accurately identify the characteristic information of network traffic; it can automatically execute authorization operations during data interaction, improving the speed and efficiency of data interaction; and it is more intelligent and flexible, able to adapt to different network environments and changes.

[0026] Therefore, this invention is applicable to various network environments and changes, providing enterprises with suitable application permission management systems or tools. It helps enterprises adopt reasonable measures to improve and refine application permission management, thereby enhancing the security and operational efficiency of information systems, and has broad application prospects and market value. Furthermore, it can be optimized and adjusted for different data interaction scenarios, improving the adaptability and flexibility of the technology. By implementing this invention, more intelligent and automated network data interaction can be achieved, ensuring data security and privacy, and providing a higher level of protection for network data transmission. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the automatic authorization device based on traffic learning according to the present invention.

[0028] Figure 2 This is a block diagram illustrating the principle of the automatic authorization method based on traffic learning in this invention. Detailed Implementation

[0029] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the embodiments described.

[0030] Example 1: As Figure 1 The automatic authorization device based on traffic learning shown includes: a data acquisition module, a traffic feature analysis module, an authorization generation module, and an authorization execution module.

[0031] 1. Data Acquisition Module

[0032] The data acquisition module is a fundamental component, primarily responsible for collecting data from the network and processing it to enable it to proceed to the next step, traffic feature analysis. The data acquisition module must be able to acquire data through network communication protocols and convert it into a readable format for subsequent analysis, processing, and authorization. Different service access protocols will result in different collected and analyzed service access behaviors; therefore, the data acquisition module relies on Deep Packet Inspection (DPI) technology to adapt to different network environments and protocol variations.

[0033] By capturing user network traffic data, including network connections, data transmission, and application interactions, and classifying and processing it according to predefined access control rules, this process is implemented without traffic access control during the traffic collection phase to ensure that all application traffic is collected. The data collection module uses deep packet inspection technology to capture raw data packets containing protocols such as TCP, UDP, and ICMP, while also capturing and parsing upper-layer protocols (such as HTTP, HTTPS, and DNS) to obtain more detailed network behavior data.

[0034] The data acquisition module is mainly implemented through the following steps:

[0035] (1) Acquire the data to be collected, which may be network data packets, files, signals, etc.;

[0036] (2) Process the collected data, parse the network data packets, and use DPI technology to obtain the protocol characteristics (five-tuple) of the data packets.

[0037] (3) Send the processed data to the traffic feature analysis module for analysis and processing.

[0038] The data acquisition module provides a data source for subsequent data analysis.

[0039] 2. Traffic Feature Analysis Module

[0040] The traffic feature analysis module is a core component for automated authorization. It is responsible for in-depth analysis and processing of collected traffic data, identifying user access behaviors and habits. After initially processing the traffic output from the traffic collection module using rules (including but not limited to invalid ports and IP addresses), the traffic feature analysis module filters and outputs user behavioral characteristics, such as the target host accessed, the protocol type used, the amount of data, and the access frequency. These parameters can be used for subsequent model training, thereby automatically constructing an access authorization system based on traffic learning.

[0041] Based on the five-tuple information (source address, source port, destination address, destination port, protocol), user access behavior is categorized into non-functional services.

[0042] The analysis process of the traffic characteristic analysis module mainly includes the following three aspects:

[0043] (1) Network communication protocol analysis: Based on the format and header information of the data packets, determine which type of network communication protocol the collected data packets belong to, including HTTP, TCP, UDP, etc.;

[0044] (2) Network structure analysis: Analyze the network topology and communication methods based on information such as the source address, destination address, and protocol port number of the data packets;

[0045] (3) Traffic and User Association Analysis: Search for user traffic characteristics to determine when, where, and how they use system resources. The traffic analyzer manages IP address associations, port associations, and other means to automatically associate with enterprise applications, thereby mapping network traffic accessed by applications to user accounts, ultimately forming a database of application resource and user association information. If the traffic analysis reaches a certain time depth, common traffic patterns can be identified, thus more accurately judging the traffic differences between users and corresponding to different access authorization schemes.

[0046] Through the above steps, user information can be linked to the enterprise's organizational structure, ultimately forming a complete network traffic information database for user access applications, encompassing "network traffic - enterprise applications - user access behavior - user organizational structure".

[0047] 3. Authorization Generation Module

[0048] The authorization generation module is another core module in this invention. It mainly generates automated authorization schemes based on the feature information obtained from the traffic feature analysis module. The authorization scheme includes specific authorization information, such as authorization time, authorization object, authorization scope, etc.

[0049] Machine learning algorithms, primarily cluster analysis, are used to achieve traffic-based access control. Specifically, based on collected user traffic behavior data, clustering algorithms are employed to group user access behaviors into similar clusters based on the accessed business systems (e.g., triplet information including protocol, destination address, and destination port) and the user's organizational information within the enterprise (organizational structure tree). This identifies users or user groups with similar access behavior characteristics and users with special access behaviors (e.g., those deviating from organizational-level access behavior characteristics), enabling precise authorization and authorization for specific needs.

[0050] It can dynamically generate more accurate and reliable automated authorization schemes based on the continuous identification of feature information based on traffic learning.

[0051] The authorization generation module is mainly implemented through the following steps:

[0052] (1) Automatically generate authorization schemes based on the feature information provided by the traffic feature analysis module;

[0053] (2) Manage rules and strategies for specific needs to ensure the legality and effectiveness of the authorization scheme;

[0054] (3) Pass the generated authorization scheme to the authorization execution module for execution.

[0055] The authorization schemes automatically generated by the authorization generation module can more accurately identify and avoid network attacks and vulnerabilities, thereby improving the security of data transmission.

[0056] 4. Authorization Execution Module

[0057] The authorization execution module is a key module in this invention for implementing automatic authorization operations. It primarily executes authorization operations according to the authorization scheme to ensure the legality of data transmission. When the automatic authorization mode is enabled, the authorization execution module will execute authorization operations during data interaction based on the authorization scheme generated by the authorization generation module.

[0058] The workflow of the authorization execution module mainly includes the following four aspects:

[0059] (1) Receive authorization scheme: Receive authorization scheme from the authorization generation module;

[0060] (2) Perform authorization operations: According to the authorization scheme, perform appropriate authorization operations, including access permissions, modification permissions, etc.;

[0061] (3) Monitor authorization operations: Monitor whether the authorization operation is successful, and issue an early warning or re-initiate the authorization operation when the authorization operation fails.

[0062] (4) Authorization audit: After successful authorization detection, the system can continuously collect user access traffic information. By comparing the access traffic of personnel with the same organizational background, abnormal authorized access traffic can be identified and the security management personnel can be notified through alarms, message pushes, etc.

[0063] The authorization execution module ensures the automated execution of authorization operations, thereby accelerating the speed and efficiency of data interaction, while also improving the security of data interaction.

[0064] In summary, the data acquisition module, traffic feature analysis module, authorization generation module, and authorization execution module each have their own characteristics and play important roles in the automated authorization process. Through the synergistic effect of these components, the automated authorization device can perform more accurate and refined user authorization analysis, achieving zero-trust, precise, and automated authorization, greatly improving authorization efficiency and system security.

[0065] Example 2: As Figure 2 As shown, the automatic authorization method based on the traffic learning-based automatic authorization device provided in Embodiment 1 includes the following steps:

[0066] S1: Obtain network traffic data generated by the user during the access process;

[0067] S2: Filter network traffic data based on traffic rules to obtain user behavior characteristic parameters;

[0068] S3: Train a model using behavioral feature parameters to generate an authorization scheme;

[0069] S4: Execute authorization operations according to the authorization scheme, monitor the execution process of authorization operations, and audit and manage the access traffic information generated by users after successful authorization.

[0070] As described above, although the invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the invention itself. Various changes in form and detail may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A device for automatic authorization based on traffic learning, characterized in that: It includes a data acquisition module, a traffic feature analysis module, an authorization generation module, and an authorization execution module; The data acquisition module is used to capture network traffic data generated by users during access, classify and process the network traffic data according to the set access control rules, and send the processed data to the traffic feature analysis module. The traffic feature analysis module filters the data processed by the data acquisition module based on traffic rules to obtain user behavior feature parameters. The authorization generation module trains a model based on the behavioral feature parameters to generate an authorization scheme, including: using cluster analysis methods in machine learning, based on the obtained behavioral feature parameters of all users, using a clustering algorithm to cluster users' access behaviors into similar clusters around the accessed business systems and personnel's organizational information within the enterprise, identifying users or user groups with similar access behavior characteristics for precise authorization, and identifying users with special access behaviors to achieve authorization for specific needs; the authorization scheme includes authorization time, authorization object, and authorization scope; The authorization execution module receives the authorization scheme generated by the authorization generation module, executes the authorization operation according to the authorization scheme, monitors the execution of the authorization operation, and performs audit management after successful authorization.

2. The automatic authorization device based on traffic learning according to claim 1, characterized in that: The data acquisition module captures data packet information generated during user access using deep packet inspection technology. The data packet information includes header information and application data, and the header information includes 5-tuple information.

3. The automatic authorization device based on traffic learning according to claim 2, characterized in that: The traffic feature analysis module determines the type of network communication protocol of the collected data packets based on the format and header information of the data packets. It analyzes the network topology and communication method based on the source address, template address, and protocol port number in the 5-tuple. It also forms an application resource and user management information database based on user information and application data.

4. The automatic authorization device based on traffic learning according to claim 1, characterized in that: The authorization execution module monitors the execution of authorization operations, including: monitoring whether the authorization operation is successful during execution, issuing warnings or re-initiating the authorization operation when the authorization operation fails; the audit management after successful authorization includes: after successful authorization, continuously collecting network traffic information generated by the user during access, identifying abnormal authorized access traffic by comparing the access traffic information of personnel with the same organizational background, and pushing the abnormal authorized access traffic to security management personnel.

5. An automatic authorization method based on traffic learning, characterized in that, Includes the following steps: S1: Obtain network traffic data generated by the user during the access process; S2: Filter network traffic data based on traffic rules to obtain user behavior characteristic parameters; S3: Train a model to generate an authorization scheme by analyzing behavioral feature parameters, including: using cluster analysis in machine learning, based on the behavioral feature parameters of all users, using a clustering algorithm to cluster users’ access behaviors into similar clusters around the accessed business systems and personnel’s organizational information in the enterprise, identifying users or user groups with similar access behavior characteristics for accurate authorization, and identifying users with special access behaviors for authorization to achieve specific needs. S4: Execute authorization operations according to the authorization scheme, monitor the execution process of authorization operations, and audit and manage the access traffic information generated by users after successful authorization.

6. The automatic authorization method based on traffic learning according to claim 5, characterized in that, The network traffic data collected in S1 includes network data packets. Deep packet inspection technology is used to parse the network data packets to obtain the format, header information, and quintuple information in the network data packets.

7. The automatic authorization method based on traffic learning according to claim 6, characterized in that, S2 includes: determining the type of network communication protocol of the collected network data packets based on the format and header information of the network data packets; analyzing the network topology and communication methods based on the five-tuple information of the data packets; and performing traffic and user correlation analysis to obtain an application resource and user correlation information database.

8. The automatic authorization method based on traffic learning according to claim 7, characterized in that, The S4 includes: receiving an authorization scheme from the authorization generation module; performing appropriate authorization operations according to the authorization scheme; monitoring whether the authorization operation is successful, issuing an early warning or re-initiating the authorization operation when the authorization operation fails; after detecting successful authorization, continuously collecting the user's access network traffic data, identifying abnormal authorized access traffic by comparing the access traffic of people with the same organizational background, and informing the security management personnel.

Images