Account authority security control method, device and equipment, and storage medium

Abstract

The application belongs to the technical field of Internet security, and discloses a kind of account authority security control method, device, equipment and storage medium.The method comprises: after supply chain is attacked, based on preset risk rules, the security code level of staff account in target enterprise is determined;According to the security code level of staff account, the authority range of staff account is determined, and the risk staff account in staff account is determined;The corresponding diffusion account of risk staff account is obtained, and the authority range of diffusion account is determined according to the security code level of diffusion account, and the risk diffusion account in diffusion account is determined;Risk scanning is carried out on risk staff account and risk diffusion account, and scanning result is obtained;According to the scanning result, the authority range of the risk staff account and the diffusion risk account is adjusted.Through the above-mentioned mode, the current risk account information is accurately obtained, and the authority dynamic adjustment is realized by layering and grading, the cross-enterprise risk account is quickly identified, and the spread of security risk is avoided.

Description

Technical Field

[0001] This invention relates to the field of internet security technology, and in particular to an account permission security control method, apparatus, device, and storage medium. Background Technology

[0002] When a supply chain security attack occurs, a company's system and data security are threatened. Conventional manual measures are often used, such as suspending all employee accounts of the affected company and disconnecting dedicated network lines. This approach is a crude, "one-size-fits-all" method. Some employees may not have been attacked, but they are still prohibited from accessing system resources and unable to perform routine production maintenance, thus affecting the company's overall operations and potentially causing economic losses. Furthermore, these measures usually only target the company and employees affected by the supply chain attack, but often multiple suppliers share resources, leading to incomplete risk mitigation and the spread of risks, potentially triggering more serious security incidents and impacts. Summary of the Invention

[0003] The main objective of this invention is to provide an account permission security control method, device, equipment, and storage medium, which aims to solve the technical problem that in the event of a supply chain security attack, the traditional approach is to suspend all employee accounts of the company involved, which can easily affect the overall operation of the company and cause the risk to spread.

[0004] To achieve the above objectives, the present invention provides an account permission security control method, the method comprising the following steps:

[0005] After the supply chain is attacked, the risk level coefficient of employee accounts in the target company is determined based on preset risk rules.

[0006] The security code level of the employee account is determined based on the risk level coefficient.

[0007] Based on the security code level of the employee account, determine the scope of permissions for the employee account, and identify high-risk employee accounts within the employee account.

[0008] Obtain the diffusion account corresponding to the risky employee account, determine the permission scope of the diffusion account based on the security code level of the diffusion account, and identify the risky diffusion account in the diffusion account;

[0009] A risk scan was performed on the risky employee account and the risk-spreading account to obtain the scan results;

[0010] Based on the scan results, the permission scope of the risky employee account and the risky account is adjusted.

[0011] Optionally, the preset risk rules include spatiotemporal risk rules, regional risk rules, document risk rules, and operational risk rules; the risk level coefficients include spatiotemporal risk coefficients, regional risk coefficients, document risk coefficients, and operational risk coefficients; and determining the risk level coefficients of employee accounts in the target enterprise based on the preset risk rules includes:

[0012] Based on the account system data of the employee account, determine the resource access time, login location, logout location, uploaded file type, uploaded file content, operation commands, and operation habits;

[0013] Based on the resource attack time and the resource access time, the spatiotemporal overlap of the employee account is determined, and based on the spatiotemporal risk rules, the spatiotemporal risk coefficient corresponding to the spatiotemporal overlap is determined.

[0014] Based on the attack login location and the login location, determine the login overlap; based on the attack logout location and the logout location, determine the logout overlap; based on the login overlap and the logout overlap, determine the regional overlap of the employee account; and based on the regional risk rules, determine the regional risk coefficient corresponding to the regional overlap.

[0015] Based on the uploaded file type and file risk rules, a file risk coefficient corresponding to the uploaded file type is determined. When the file risk coefficient is greater than the file risk threshold, malicious detection is performed on the uploaded file content of the employee account, and the file risk coefficient is adjusted according to the malicious detection result.

[0016] When the operation commands of the employee account do not match the preset high-risk operation commands, the matching degree of operation habits is determined according to the operation habits and operation commands, and the operation risk coefficient corresponding to the matching degree of operation habits is determined according to the operation risk rules.

[0017] Optionally, determining the security code level of the employee account based on the risk level coefficient includes:

[0018] Obtain the information gain corresponding to the preset risk rule;

[0019] A graded decision model is established based on the information gain corresponding to the preset risk rules.

[0020] Based on the aforementioned level decision model and the risk level coefficient of the employee account, the security code level of the employee account is determined.

[0021] Optionally, obtaining the information gain corresponding to the preset risk rule includes:

[0022] Based on the preset risk level in the preset risk rule, simulated sample data is determined, and the simulated sample data includes a preset risk level combination and a preset security code level corresponding to the preset risk level combination.

[0023] Based on the simulated sample data, determine the security code level ratio corresponding to the preset risk level;

[0024] Obtain the first correspondence between the security code level ratio, the number of security code levels, and the root node value;

[0025] Based on the first correspondence, the security code level ratio, and the number of security code levels, determine the root node value corresponding to the preset risk level;

[0026] Obtain the second correspondence between the root node value and the information gain;

[0027] Based on the second correspondence and the root node value, the information gain corresponding to the preset risk rule is determined.

[0028] Optionally, the security code level includes at least a first security level, a second security level, and a third security level, and determining the scope of permissions for the employee account based on the employee account's security code level includes:

[0029] When the security code level of the employee account is the first security level, it is determined that the employee account has no authentication permission;

[0030] When the security code level of the employee account is the second security level, it is determined that the employee account has a preset level of authentication permissions, and the second security level is higher than the first security level;

[0031] When the security code level of the employee account is the third security level, it is determined that the employee account has full authentication permissions, and the third security level is higher than the second security level.

[0032] Optionally, the scan results include at least the scan results of risk characteristics and the scan results of the access environment. Adjusting the permission scope of the risk employee account and the risk-spreading account based on the scan results includes:

[0033] Based on the scanning results of the risk characteristics and the scanning results of the access environment, the risk level of the risky employee account and the risk-spreading account is determined. The risk characteristics include at least malicious file characteristics, abnormal process characteristics, backdoor program characteristics, vulnerability exploitation trace characteristics, and attacked resource characteristics.

[0034] Based on the risk level, low-risk accounts are identified from the risky employee accounts and the risk-spreading accounts.

[0035] The security code level of the low-risk account is downgraded, and the scope of permissions for the low-risk account is determined based on the downgraded security code level.

[0036] Optionally, the account permission security control further includes:

[0037] The system monitors preset targets and determines that the supply chain is under security attack when preset attack keywords appear on the preset targets. The monitored targets include at least media, target supplier websites, target supplier contact emails, and messaging software.

[0038] After the supply chain is subjected to a security attack, attack element data is obtained. The attack element data includes at least the attack time, attack resources, event type, degree of impact, scope of impact, urgency level, and company name.

[0039] Based on the attack element data, the target enterprise is identified, and the account system data corresponding to the employee accounts in the target enterprise is extracted. The account system data includes at least account information, login logs, and operation logs.

[0040] Furthermore, to achieve the above objectives, the present invention also proposes an account access security control device, the account access security control device comprising:

[0041] The analysis module is used to determine the risk level coefficient of employee accounts in the target company based on preset risk rules after the supply chain is subjected to a security attack.

[0042] The analysis module is also used to determine the security code level of the employee account based on the risk level coefficient;

[0043] The scheduling module is used to determine the permission scope of the employee account based on the security code level of the employee account, and to identify high-risk employee accounts among the employee accounts.

[0044] The scheduling module is also used to obtain the diffusion account corresponding to the risk employee account, determine the permission scope of the diffusion account according to the security code level of the diffusion account, and identify the risk diffusion account in the diffusion account.

[0045] The scanning module is used to perform risk scanning on the risky employee accounts and the risk-spreading accounts, and obtain the scanning results;

[0046] The decision-making module is used to adjust the permission scope of the risky employee account and the risk-spreading account based on the scan results.

[0047] Furthermore, to achieve the above objectives, the present invention also proposes an account permission security control device, which includes: a memory, a processor, and an account permission security control program stored in the memory and executable on the processor. The account permission security control program is configured to implement the steps of the account permission security control method described above.

[0048] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing an account access security control program, wherein the account access security control program, when executed by a processor, implements the steps of the account access security control method described above.

[0049] In this invention, after a supply chain is subjected to a security attack, the risk level coefficient of employee accounts in the target company is determined based on preset risk rules. Based on the risk level coefficient, the security code level of the employee account is determined. Based on the security code level, the permission scope of the employee account is determined. Risky employee accounts are identified among the employee accounts, and the corresponding spreading accounts are obtained. Based on the security code level of the spreading accounts, the permission scope of the spreading accounts is determined. Risk spreading accounts are also identified among the spreading accounts. Risk scans are performed on the risky employee accounts and risk spreading accounts to obtain scan results. Based on the scan results, the permission scopes of the risky employee accounts and the spreading risk accounts are adjusted. Compared to the traditional approach of unilaterally suspending all employee accounts of the affected company, which can easily affect the overall operation of the company, this invention assesses account security risks from multiple dimensions, can quickly identify account risks, and defines security codes based on risks, implementing hierarchical and graded access control to dynamically adjust permissions. This ensures the overall operation of the company while preventing further losses. Compared to the long response time and risk spread of traditional methods, this invention can quickly identify cross-company risky accounts, facilitating risk investigation, suppression, and eradication, and preventing the spread of security risks. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the structure of the account permission security control device in the hardware operating environment involved in the embodiments of the present invention;

[0051] Figure 2 This is a flowchart illustrating the first embodiment of the account permission security control method of the present invention;

[0052] Figure 3 This is a schematic diagram of the overall process of an embodiment of the account permission security control method of the present invention;

[0053] Figure 4 This is a flowchart illustrating the second embodiment of the account permission security control method of the present invention;

[0054] Figure 5This is a flowchart illustrating the third embodiment of the account permission security control method of the present invention;

[0055] Figure 6 This is a schematic diagram of simulated sample data for an embodiment of the account permission security control method of the present invention;

[0056] Figure 7 This is a structural block diagram of the first embodiment of the account permission security control device of the present invention.

[0057] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0058] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0059] Reference Figure 1 , Figure 1 This is a schematic diagram of the account permission security control device structure of the hardware operating environment involved in the embodiments of the present invention.

[0060] like Figure 1 As shown, the account access security control device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0061] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the account access security control device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0062] like Figure 1As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and an account permission security control program.

[0063] exist Figure 1 In the account permission security control device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the account permission security control device of the present invention can be set in the account permission security control device, and the account permission security control device calls the account permission security control program stored in the memory 1005 through the processor 1001 and executes the account permission security control method provided in the embodiment of the present invention.

[0064] This invention provides an account permission security control method, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of an account permission security control method according to the present invention.

[0065] In this embodiment, the account permission security control method includes the following steps:

[0066] Step S10: After the supply chain is attacked, determine the risk level coefficient of employee accounts in the target company based on preset risk rules.

[0067] It should be noted that the execution subject in this embodiment is a smart terminal, such as a computer. The smart terminal is equipped with an account permission security control program, which can dynamically control the permissions of risky accounts after the supply chain is subjected to a security attack.

[0068] It is understood that the preset risk rules are the risk level coefficient calculation methods established in this embodiment. These preset risk rules include spatiotemporal risk rules, regional risk rules, document risk rules, and operational risk rules. The risk level coefficients at least include spatiotemporal risk coefficients, regional risk coefficients, document risk coefficients, and operational risk coefficients, i.e., spatiotemporal risk values, regional risk values, document risk values, and operational risk values. The preset risk rules correspond to the risk level coefficients; the spatiotemporal risk rules are used to calculate the spatiotemporal risk coefficient, the regional risk rules are used to calculate the regional risk coefficient, the document risk rules are used to calculate the document risk coefficient, and the operational risk rules are used to calculate the operational risk coefficient.

[0069] It should be understood that, generally speaking, when a supply chain is attacked, certain resources (terminals / servers / network devices, etc.) will be locked, meaning these resources exhibit certain characteristics of an attack (such as newly added accounts, backdoors / abnormal files, abnormal processes, etc.). This resource is defined as "Patient Zero," thus identifying the corresponding enterprise as having suffered a security attack. The target enterprise is the enterprise that has been attacked, and the employee accounts are the accounts in the target enterprise's IT (Information Technology) related systems. These can be accounts of all employees or accounts selected from those most closely related to the attack.

[0070] In practice, after the supply chain is subjected to a security attack, the spatiotemporal risk coefficient, regional risk coefficient, file risk coefficient, and operational risk coefficient of the employee accounts in the target enterprise are calculated respectively.

[0071] Furthermore, before step S10, the method further includes: monitoring a preset monitoring object; determining that the supply chain is under security attack when a preset attack keyword appears on the preset monitoring object; acquiring attack element data after the supply chain is under security attack; determining the target enterprise based on the attack element data; and extracting account system data corresponding to employee accounts in the target enterprise.

[0072] It should be noted that the preset monitoring targets are pre-defined monitoring targets, including at least media, target supplier websites, target supplier contact emails, and messaging software. Media can be Weibo, security communities, etc., and this embodiment does not impose any restrictions on this. Preset attack keywords are set keywords related to supply chain attacks, such as: security attack, supply chain security, vulnerability, malware injection, account leakage, etc. This embodiment does not impose any restrictions on this. Once these keywords appear on the preset monitoring targets, a supply chain attack is considered to have occurred. Attack element data refers to information related to the supply chain attack, including at least the attack time, attack resources, event type, impact level, impact scope, urgency level, and company name.

[0073] It is understandable that account system data refers to the relevant data of each employee account in the system, including at least account information, login logs, and operation logs. Account information includes information such as the organization to which the account belongs, the account list, and the account status. Login logs include information such as login time, logout time, login location, logout location, and source IP. Operation logs include information such as the IP of the target host / database / terminal accessed, the operation execution time, the operation command, the type of uploaded file, and the account permissions.

[0074] In practice, after the account system data is extracted, the risk level coefficient is calculated according to the relevant behavioral data of the account to which "Patient 0" belongs, based on the preset risk rules.

[0075] Step S20: Determine the security code level of the employee account based on the risk level coefficient.

[0076] It should be understood that since different combinations of risk level coefficients may produce different account risk values, there may be cases similar to Case 0. This embodiment introduces Cartesian product and decision tree algorithms to determine the security code level corresponding to the risk level coefficient of each employee account, so as to prevent possible false alarms.

[0077] It is understood that security code levels can be divided into multiple levels. In this embodiment, the security code levels include three levels: the first security level, the second security level, and the third security level. The second security level is higher than the first security level, and the third security level is higher than the second security level. The first security level is R (Red), the second security level is Y (Yellow), and the third security level is G (Green).

[0078] Step S30: Determine the scope of permissions for the employee account based on the security code level of the employee account, and identify high-risk employee accounts within the employee account.

[0079] Further, step S30 includes: when the security code level of the employee account is the first security level, determining that the employee account has no authentication permission; when the security code level of the employee account is the second security level, determining that the employee account has a preset level of authentication permission, wherein the second security level is higher than the first security level; when the security code level of the employee account is the third security level, determining that the employee account has full authentication permission, wherein the third security level is higher than the second security level.

[0080] It should be understood that different security code levels correspond to different preset permission ranges. A preset permission range is a pre-defined range of permissions, which represents the permissions of the employee account. The first security level corresponds to a preset permission range of no authentication permission, meaning the employee account has no authentication privileges and is locked, rejecting all authentication attempts. The second security level corresponds to a preset level of authentication permission, meaning the employee account has partial authentication permissions, typically at the query level. This means the account is allowed to authenticate, but permissions are limited to the query level by default; authorization is required for other levels of operation. The third security level corresponds to a preset permission range of full authentication permission, meaning all authentication permissions are available, and the account is allowed to authenticate, with permissions used normally. The authentication in this embodiment includes network access authentication, 4A (Account, Authentication, Authorization, and Audit) access authentication, cloud desktop login authentication, etc.

[0081] In the specific implementation, based on the security code level and preset permission range, the execution and recording of each employee account are automatically scaled back. Employee accounts with a security code level of R are locked for 3 days by default; employee accounts with a security code level of Y have query permissions by default, and other operations require authorization; for employee accounts with a security code level of G, authentication and use are not affected.

[0082] It should be noted that "risk employee accounts" refers to employee accounts with higher risk. Generally, employee accounts with the highest security level are considered to be risky employee accounts.

[0083] Step S40: Obtain the diffusion account corresponding to the risk employee account, determine the permission scope of the diffusion account based on the security code level of the diffusion account, and identify the risk diffusion account in the diffusion account.

[0084] It is understandable that after identifying the at-risk employee accounts, this embodiment will perform a secondary scheduling, expanding the attacked accounts from "Patient 0" to "Patients" with a security code level of R. The scope of the obtained at-risk accounts will be expanded to include account information from other companies, realizing multi-layered diffusion risk analysis.

[0085] It should be understood that a diffusion account refers to other accounts related to an employee account with a security code level of R, such as accounts of other companies (not the target company's accounts). The method for determining the security code level of a diffusion account is the same as the method for determining the security code level of an employee account, and can be referred to steps S10 to S20. This embodiment will not repeat the details here. Correspondingly, the method for determining the scope of permissions of a diffusion account is also the same as the method for determining the scope of permissions of an employee account, and can be referred to step S30. This embodiment will not repeat the details here.

[0086] It should be noted that the risk diffusion account is the risk account of other companies, which facilitates risk investigation, suppression and eradication, and prevents the spread of risk. The risk diffusion account can be an account with the first security level among the diffusion accounts, or it can be set according to actual needs. This embodiment does not impose any restrictions on this.

[0087] Step S50: Perform a risk scan on the risky employee account and the risk-spreading account to obtain the scan results.

[0088] It is understandable that the scan results, i.e. the results of the risk scan, include at least the scan results of risk features and the scan results of the access environment. The scan results of risk features refer to the scan results of risk features, which are used to determine whether the account has risk features. Risk features include at least malicious file features, abnormal process features, backdoor program features, vulnerability exploitation trace features, and attacked resource features. That is, it is necessary to determine whether the account has malicious files, abnormal processes, backdoor programs, vulnerability exploitation traces, and attacked resources. The scan results of the access environment refer to the scan results of the access environment, which is the terminal environment to which the account belongs.

[0089] Step S60: Based on the scan results, adjust the permission scope of the risk employee account and the spread risk account.

[0090] Further, step S60 includes: determining the risk level of the risky employee account and the risk-spreading account based on the scanning results of the risk characteristics and the scanning results of the access environment; determining a low-risk account among the risky employee account and the risk-spreading account based on the risk level; downgrading the security code level of the low-risk account; and determining the permission scope of the low-risk account based on the downgraded security code level.

[0091] It should be understood that risk levels typically include two categories: high risk and low risk. Based on the scan results, the risky employee accounts and accounts that have spread the risk are determined to be either high-risk or low-risk. Accounts with a low risk level among these risky employee accounts and accounts that have spread the risk are considered low-risk accounts. If a low-risk account's security code level is R, it will be downgraded from R to Y, and its access permissions will be expanded / restored accordingly. If a low-risk account's security code level is Y, it will be downgraded from Y to G, and its access permissions will be expanded / restored accordingly, achieving dynamic adjustment of permissions. Accounts with a high risk level among these risky employee accounts and accounts that have spread the risk retain their security code level and corresponding access permissions.

[0092] like Figure 3 The overall process diagram shown monitors security events from media outlets (Weibo, security communities, etc.), target vendor websites, target vendor contact emails, instant messaging software, etc. It calculates the spatiotemporal risk coefficient, regional risk coefficient, file risk coefficient, and operational risk coefficient for each employee account. Using Cartesian product and decision tree algorithms, it determines the security code level of each employee account. Based on the security code level, it sets the permission range. Employee accounts with a security code level of R are locked for 3 days by default; those with a security code level of Y have query permissions by default, while other levels require authorization; and those with a security code level of G are unaffected by authentication or usage. The system scans risky accounts for malicious files, abnormal processes, backdoors, vulnerability exploitation traces, attacked resources, and accessed terminal environments. Based on the scan results, it adjusts the security code level, thereby adjusting the permission range.

[0093] In this embodiment, after a security attack on the supply chain, based on preset risk rules, the risk level coefficient of employee accounts in the target enterprise is determined. Based on the risk level coefficient, the security code level of the employee account is determined. Based on the security code level, the permission scope of the employee account is determined. Risky employee accounts are identified among the employee accounts, and the corresponding spreading accounts are obtained. Based on the security code level of the spreading accounts, the permission scope of the spreading accounts is determined. Risk spreading accounts are also identified among the spreading accounts. Risk scans are performed on the risky employee accounts and risk spreading accounts to obtain scan results. Based on the scan results, the permission scopes of the risky employee accounts and the spreading risk accounts are adjusted. Compared to the traditional approach of unilaterally suspending all employee accounts of the affected enterprise, which can easily affect the overall operation of the enterprise, this embodiment assesses account security risks from multiple dimensions, can quickly identify account risks, and dynamically adjust permissions according to the security code defined by risk, stratifying and classifying them. This ensures the overall operation of the enterprise while preventing further losses. Compared to the traditional approach, which has a long response time and is prone to risk spread, this embodiment can quickly identify cross-enterprise risky accounts, facilitating risk investigation, suppression, and eradication, and preventing the spread of security risks.

[0094] Reference Figure 4 , Figure 4 This is a flowchart illustrating a second embodiment of an account permission security control method according to the present invention.

[0095] Based on the first embodiment described above, step S10 includes:

[0096] Step S101: Based on the account system data of the employee account, determine the resource access time, login location, logout location, uploaded file type, uploaded file content, operation commands, and operation habits.

[0097] It should be noted that in order to calculate the risk level coefficient, relevant data needs to be obtained from the account system data, such as: resource access time, login location, logout location, uploaded file type, uploaded file content, operation commands and operation habits. The data can also be adjusted according to the actual situation, and this embodiment does not impose any restrictions on this.

[0098] Step S102: Determine the spatiotemporal overlap of the employee account based on the resource attack time and the resource access time, and determine the spatiotemporal risk coefficient corresponding to the spatiotemporal overlap based on the spatiotemporal risk rules.

[0099] Understandably, resource attack time refers to the time during which a resource is attacked in this supply chain security attack. Resource access time refers to the time during which each employee account accesses the attacked resource. Spatiotemporal overlap is the degree of overlap between the employee account's access time and the resource's attack time. The spatiotemporal risk rules include preset spatiotemporal risk levels, as well as preset spatiotemporal overlap and preset spatiotemporal risk coefficients corresponding to each preset spatiotemporal risk level. The spatiotemporal risk rules set multiple risk levels, i.e., preset spatiotemporal risk levels. Each risk level has a corresponding spatiotemporal overlap and spatiotemporal risk coefficient; that is, each preset spatiotemporal risk level corresponds to a preset spatiotemporal overlap and a preset spatiotemporal risk coefficient.

[0100] It should be understood that in this embodiment, the preset spatiotemporal risk levels are divided into K1, K2, K3 and K4, and the preset spatiotemporal overlap is divided into overlap within 3 hours, overlap within 12 hours, overlap within 24 hours and overlap within 48 hours, corresponding to levels K1, K2, K3 and K4 respectively. Among them, overlap includes overlap within a set time before the resource attack time and overlap within a set time after the resource attack time. That is to say, overlap within 3 hours means overlap within 3 hours before the resource attack time or overlap within 3 hours after the resource attack time. Overlap within 12 hours, overlap within 24 hours and overlap within 48 hours are similar, and will not be elaborated here. The preset spatiotemporal risk coefficients are set to levels K1, K2, K3, and K4, with values ​​of 1.0, 0.7, 0.4, and 0.1 respectively. For example, if host A1 is attacked from 15:31 to 16:42 on September 7, 2022, and employee account D accesses host A1 from 14:21 to 15:42 on September 7, employee account D meets level K1, and its spatiotemporal risk coefficient will be assigned a value of 1.0. The classification of preset spatiotemporal risk levels, the specific settings of preset spatiotemporal overlap, and the specific values ​​of preset spatiotemporal risk coefficients can be adjusted according to actual needs; this embodiment does not impose any restrictions on this.

[0101] In practice, the spatiotemporal overlap of an employee account is determined based on the resource attack time and the resource access time, and then the spatiotemporal risk level corresponding to that spatiotemporal overlap is found.

[0102] Step S103: Determine the login overlap based on the attack login location and the login location; determine the logout overlap based on the attack logout location and the logout location; determine the regional overlap of the employee account based on the login overlap and the logout overlap; and determine the regional risk coefficient corresponding to the regional overlap based on the regional risk rules.

[0103] It should be noted that "attack login location" refers to the login location of this supply chain security attack, "attack logout location" refers to the logout location of this supply chain security attack, "login overlap" refers to the overlap between the employee account's login location and the attack's login location, and "logout overlap" refers to the overlap between the employee account's logout location and the attack's logout location. Login / logout locations have two levels: physical location and source IP (Internet Protocol Address). "Regional overlap" refers to the overlap between the employee account's login / logout location and the attack's login / logout location, and is used to make a comprehensive judgment based on both login and logout overlap. Regional risk rules include preset regional risk levels, as well as preset regional overlap and preset regional risk coefficients corresponding to each preset regional risk level. Multiple risk levels, i.e., preset regional risk levels, are set within the regional risk rules. Each risk level has a corresponding regional overlap and regional risk coefficient; that is, each preset regional risk level corresponds to one preset regional overlap and preset regional risk coefficient.

[0104] It is understood that in this embodiment, the preset area risk levels are divided into M1, M2, M3, and M4, and the preset area overlap is divided into the following: same login / logout, same login and different logout, different login and same logout, and different login / logout, corresponding to levels M1, M2, M3, and M4, respectively. The preset area risk coefficient is set to 0.1, 0.05, 0.02, and 0.0 for levels M1, M2, M3, and M4, respectively. For example, if employee account D's login location is the same as the attack's login location, and employee account D's logout location is also the same as the attack's logout location, then employee account D's area risk coefficient will be assigned a value of 1.0. The preset area risk level classification, the specific setting of the preset area overlap, and the specific value of the preset area risk coefficient can be adjusted according to actual needs, and this embodiment does not impose any restrictions on this.

[0105] In practice, the overlap between the login / logout location of the attack and the login / logout location of the employee account is determined, thereby determining the degree of regional overlap, and then finding the regional risk coefficient corresponding to the degree of regional overlap.

[0106] Step S104: Based on the uploaded file type and file risk rules, determine the file risk coefficient corresponding to the uploaded file type. When the file risk coefficient is greater than the file risk threshold, perform malicious detection on the uploaded file content of the employee account, and adjust the file risk coefficient according to the malicious detection result.

[0107] It should be understood that the uploaded file type refers to the type of file uploaded by the employee account within the set time range, and the uploaded file content refers to the content of the file uploaded by the employee account within the set time range. The set time range can be 7 days before and after the attack, and can be flexibly adjusted according to the actual situation. This embodiment does not impose any restrictions on this. The file risk rules include preset file risk levels, as well as preset file types and preset file risk coefficients corresponding to the preset file risk levels. The file risk rules set multiple risk levels, i.e., preset file risk levels. Each risk level has a corresponding file type and file risk coefficient. That is, each preset file risk level corresponds to a preset file type and a preset file risk coefficient. Among them, multiple different file types can be set for each preset file type, and different risk coefficients can be set for different file types.

[0108] It should be noted that in this embodiment, the preset file risk levels are divided into N1, N2, N3, and N4, and the preset file types are divided into Jsp / exe / asp, sql / war, doc / xls, and txt, corresponding to N1, N2, N3, and N4 respectively. The preset file risk coefficients are set to 0.5, 0.3, 0.1, and 0.0 for levels N1, N2, N3, and N4 respectively. The classification of preset area risk levels, the specific settings of preset area overlap, and the specific values ​​of preset area risk coefficients can be adjusted according to actual needs, and this embodiment does not impose any restrictions on them.

[0109] Understandably, the malicious detection result is the result obtained from malicious detection. The file risk threshold is the threshold of the set file risk coefficient. When the file risk coefficient is greater than the threshold, it is considered that the employee account has uploaded a high-risk file. It needs to be synchronized to the sandbox for malicious detection of the file content, and the risk value is adjusted again according to the detection result. If malicious backdoor features are detected, the file risk coefficient of the employee account will be assigned a value of 0.5.

[0110] In practice, within a limited time frame, the types and content of files uploaded by employee accounts are identified and analyzed. High-risk files will be synchronized to a sandbox for malicious detection.

[0111] Step S105: When the operation command of the employee account does not match the preset high-risk operation command, determine the operation habit matching degree according to the operation habit and the operation command, and determine the operation risk coefficient corresponding to the operation habit matching degree according to the operation risk rule.

[0112] It should be understood that operation commands refer to the commands used by employee accounts during operation. Preset high-risk operation commands are high-risk operation commands, including commonly used malicious attack commands such as fscan / httpscan / lcx-listen, etc., which can be set according to actual needs; this embodiment does not impose any restrictions on this. Operation habits refer to the operational patterns of each employee account. Based on the recorded historical operation records of employee accounts, the operation habits of each employee account can be obtained through long-term machine learning. The historical operation records include the user's command set, user operation time period, the time interval between the user's operation command and the next command, and the relationship between the previous and next user operation commands. Operation habit matching degree refers to the matching degree between the employee account's operations and its operation habits.

[0113] It should be noted that the operational risk rules include preset operational risk levels, as well as preset operational matching degrees and preset operational risk coefficients corresponding to the preset operational risk levels. The operational risk rules set multiple risk levels, i.e., preset operational risk levels. Each risk level has a corresponding operational habit matching degree and operational risk coefficient; that is, each preset operational risk level corresponds to a preset operational matching degree and a preset operational risk coefficient. In this embodiment, the preset operational risk levels can be divided into R1, R2, R3, and R4. The preset operational matching degrees include 90%, 80%, 70%, and 40%, corresponding to levels R1, R2, R3, and R4, respectively. The preset operational risk coefficients are set to 0.0, 0.3, 0.4, and 1.0 for levels R1, R2, R3, and R4, respectively. The classification of preset operational risk levels, the specific settings of preset operational matching degrees, and the specific values ​​of preset operational risk coefficients can be adjusted according to actual needs; this embodiment does not impose any restrictions on this.

[0114] In the specific implementation, the operation command is first compared with the preset high-risk operation command. Once a preset high-risk operation command is matched, the operation risk coefficient is directly assigned the highest value of 1.0. If no preset high-risk operation command is matched, the operation risk coefficient is determined according to the matching degree of operation habits.

[0115] In this embodiment, the spatiotemporal overlap of employee accounts is determined based on the resource attack time and resource access time. A spatiotemporal risk coefficient corresponding to the spatiotemporal overlap is determined according to spatiotemporal risk rules. Login overlap is determined based on the attack login location and login location. Logout overlap is determined based on the attack logout location and logout location. The regional overlap of employee accounts is determined based on the login and logout overlap. A regional risk coefficient corresponding to the regional overlap is determined according to regional risk rules. A file risk coefficient corresponding to the uploaded file type is determined based on the uploaded file type and file risk rules. When the file risk coefficient is greater than the file risk threshold, malicious detection is performed on the uploaded file content of the employee account. The file risk coefficient is adjusted based on the malicious detection results. When the employee account's operation commands do not match preset high-risk operation commands, the operation habit matching degree is determined based on the operation habits and operation commands. An operation risk coefficient corresponding to the operation habit matching degree is determined according to operation risk rules. This embodiment assesses account security risks from multiple dimensions, including time, space, region, file, and operation. It can quickly identify account risks, so that security codes can be defined according to the risks, and permissions can be dynamically adjusted in a hierarchical manner to ensure the overall operation of the enterprise while preventing further losses to the enterprise.

[0116] Reference Figure 5 , Figure 5 This is a flowchart illustrating a third embodiment of an account permission security control method according to the present invention.

[0117] Based on the first embodiment described above, step S20 includes:

[0118] Step S201: Obtain the information gain corresponding to the preset risk rule.

[0119] Further, step S201 includes: determining simulated sample data according to the preset risk level in the preset risk rule, the simulated sample data including a preset risk level combination and a preset security code level corresponding to the preset risk level combination; determining the security code level ratio corresponding to the preset risk level according to the simulated sample data; obtaining a first correspondence between the security code level ratio, the number of security code levels, and the root node value; determining the root node value corresponding to the preset risk level according to the first correspondence, the security code level ratio, and the number of security code levels; obtaining a second correspondence between the root node value and the information gain; and determining the information gain corresponding to the preset risk rule according to the second correspondence and the root node value.

[0120] It should be noted that the preset risk level is the risk level set in the preset risk rules, and each preset risk rule has its corresponding preset risk level. Simulated sample data refers to simulated data, including preset risk level combinations and their corresponding preset security code levels; that is, possible combinations of risk levels and their corresponding security code levels. The preset security code level corresponding to the preset risk level combination is determined based on the actual situation. In this embodiment, the preset risk level combination is calculated using a Cartesian product and can be represented by the following set:

[0121] {(K1,M1,N1,R1),(K1,M1,N1,R2),(K1,M1,N1,R3),(K1,M1,N1,R4),(K1,M1,N1,R1),

[0122] Among them, K1, K2, K3 and K4 are risk levels in the spatiotemporal risk rules, M1, M2, M3 and M4 are risk levels in the regional risk rules, N1, N2, N3 and N4 are risk levels in the document risk rules, and R1, R2, R3 and R4 are risk levels in the operational risk rules.

[0123] like Figure 6 As shown, this displays some of the simulated sample data.

[0124] It's understandable that the security code level ratio refers to the proportion of different security code levels. If the security code levels are divided into three levels: Level 1 (R), Level 2 (Y), and Level 3 (G), then the corresponding security code level ratios are the proportions of Level 1, Level 2, and Level 3. For example, in a simulated sample data set with 17 samples, 7 are at Security Level R, 6 are at Security Level Y, and 4 are at Security Level G. The proportion of Level 1 is 7 / 17, Level 2 is 6 / 17, and Level 3 is 4 / 17. The number of security code levels is the number of security code levels. If the security code levels are divided into R, Y, and G levels, the number of security code levels is 3.

[0125] It should be understood that the first correspondence is the calculation formula for the root node value, as shown below:

[0126]

[0127] In the formula, Ent(D) v ) represents the root node value of the risk level coefficient for level v, D v p represents the risk level coefficient for level v, || represents the number of security code levels, and p kThis represents the security code level ratio for level k. By substituting the relevant values, the root node value corresponding to the risk level coefficient for each level can be calculated.

[0128] It should be noted that the second correspondence is the formula for calculating information gain, as shown below:

[0129]

[0130] In the formula, Gain() represents information gain, Ent(D) represents the root node value of the risk level coefficient, and D v Let D represent the risk level coefficient for level v, || represent the number of security code levels, and p represent the risk level coefficient for level v. k This represents the proportion of the security code level at the k-th level. Substituting the relevant data, the information gain corresponding to the spatiotemporal risk coefficient, regional risk coefficient, file risk coefficient, and operational risk coefficient is calculated. This embodiment uses information gain to eliminate measurements with uncertain information in risk rules, as well as information that may be contained in unknown events, thereby allowing it to be used to measure the authenticity of the data.

[0131] Step S202: Based on the information gain corresponding to the preset risk rules, establish a graded decision model.

[0132] It is understandable that the information gain corresponding to the spatiotemporal risk coefficient, regional risk coefficient, document risk coefficient, and operational risk coefficient can be used as parameters of the decision tree algorithm model to establish a hierarchical decision model.

[0133] Step S203: Based on the level decision model and the risk level coefficient of the employee account, determine the security code level of the employee account.

[0134] In practice, the four risk level coefficients of the employee account are input into the level decision model, and the output of the model is the security code level of the employee account.

[0135] In this embodiment, the information gain corresponding to the preset risk rule is obtained. Based on the information gain, a graded decision model is established. Based on the graded decision model and the risk level coefficient of the employee account, the security code level of the employee account is determined. This embodiment assesses the security risk of the account from multiple dimensions, which can quickly identify account risks and define security codes according to risks, implement hierarchical and graded access control, and ensure the overall operation of the enterprise while preventing further losses to the enterprise.

[0136] Furthermore, this embodiment of the invention also proposes a storage medium storing an account permission security control program, which, when executed by a processor, implements the steps of the account permission security control method described above.

[0137] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the account permission security control device of the present invention.

[0138] like Figure 7 As shown, the account permission security control device proposed in this embodiment of the invention includes:

[0139] Analysis module 10 is used to determine the risk level coefficient of employee accounts in the target company based on preset risk rules after the supply chain is subjected to a security attack.

[0140] The analysis module 10 is also used to determine the security code level of the employee account based on the risk level coefficient.

[0141] The scheduling module 20 is used to determine the permission scope of the employee account based on the security code level of the employee account, and to identify risky employee accounts among the employee accounts.

[0142] The scheduling module 20 is also used to obtain the diffusion account corresponding to the risk employee account, determine the permission scope of the diffusion account according to the security code level of the diffusion account, and identify the risk diffusion account in the diffusion account.

[0143] The scanning module 30 is used to perform risk scanning on the risky employee account and the risk-spreading account, and obtain the scanning results.

[0144] The decision module 40 is used to adjust the permission scope of the risk employee account and the spread risk account based on the scan results.

[0145] In this embodiment, after a security attack on the supply chain, based on preset risk rules, the risk level coefficient of employee accounts in the target enterprise is determined. Based on the risk level coefficient, the security code level of the employee account is determined. Based on the security code level, the permission scope of the employee account is determined. Risky employee accounts are identified among the employee accounts, and the corresponding spreading accounts are obtained. Based on the security code level of the spreading accounts, the permission scope of the spreading accounts is determined. Risk spreading accounts are also identified among the spreading accounts. Risk scans are performed on the risky employee accounts and risk spreading accounts to obtain scan results. Based on the scan results, the permission scopes of the risky employee accounts and the spreading risk accounts are adjusted. Compared to the traditional approach of unilaterally suspending all involved accounts, which can easily lead to adverse effects, this embodiment assesses account security risks from multiple dimensions, quickly identifies account risks, and dynamically adjusts permissions based on risk-defined security codes, tiering and classifying them. This ensures the overall operation of the enterprise while preventing further losses. Compared to the traditional approach, which has a long response time and is prone to risk spread, this embodiment can quickly identify cross-enterprise risky accounts, facilitating risk investigation, suppression, and eradication, and preventing the spread of security risks.

[0146] In one embodiment, the preset risk rules include spatiotemporal risk rules, regional risk rules, file risk rules, and operational risk rules, and the risk level coefficients include spatiotemporal risk coefficients, regional risk coefficients, file risk coefficients, and operational risk coefficients. The risk level coefficients of employee accounts in the target enterprise are determined based on the preset risk rules. The analysis module 10 is also used to determine resource access time, login location, logout location, uploaded file type, uploaded file content, operation commands, and operation habits based on the account system data of the employee accounts.

[0147] Based on the resource attack time and the resource access time, the spatiotemporal overlap of the employee account is determined, and based on the spatiotemporal risk rules, the spatiotemporal risk coefficient corresponding to the spatiotemporal overlap is determined.

[0148] Based on the attack login location and the login location, determine the login overlap; based on the attack logout location and the logout location, determine the logout overlap; based on the login overlap and the logout overlap, determine the regional overlap of the employee account; and based on the regional risk rules, determine the regional risk coefficient corresponding to the regional overlap.

[0149] Based on the uploaded file type and file risk rules, a file risk coefficient corresponding to the uploaded file type is determined. When the file risk coefficient is greater than the file risk threshold, malicious detection is performed on the uploaded file content of the employee account, and the file risk coefficient is adjusted according to the malicious detection result.

[0150] When the operation commands of the employee account do not match the preset high-risk operation commands, the matching degree of operation habits is determined according to the operation habits and operation commands, and the operation risk coefficient corresponding to the matching degree of operation habits is determined according to the operation risk rules.

[0151] In one embodiment, the analysis module 10 is further configured to obtain the information gain corresponding to the preset risk rule;

[0152] A graded decision model is established based on the information gain corresponding to the preset risk rules.

[0153] Based on the aforementioned level decision model and the risk level coefficient of the employee account, the security code level of the employee account is determined.

[0154] In one embodiment, the analysis module 10 is further configured to determine simulated sample data based on the preset risk level in the preset risk rule, wherein the simulated sample data includes a preset risk level combination and a preset security code level corresponding to the preset risk level combination;

[0155] Based on the simulated sample data, determine the security code level ratio corresponding to the preset risk level;

[0156] Obtain the first correspondence between the security code level ratio, the number of security code levels, and the root node value;

[0157] Based on the first correspondence, the security code level ratio, and the number of security code levels, determine the root node value corresponding to the preset risk level;

[0158] Obtain the second correspondence between the root node value and the information gain;

[0159] Based on the second correspondence and the root node value, the information gain corresponding to the preset risk rule is determined.

[0160] In one embodiment, the security code level includes at least a first security level, a second security level, and a third security level. The scheduling module 20 is further configured to determine that the employee account has no authentication permissions when the security code level of the employee account is the first security level.

[0161] When the security code level of the employee account is the second security level, it is determined that the employee account has a preset level of authentication permissions, and the second security level is higher than the first security level;

[0162] When the security code level of the employee account is the third security level, it is determined that the employee account has full authentication permissions, and the third security level is higher than the second security level.

[0163] In one embodiment, the scan results include at least the scan results of risk features and the scan results of the access environment. Based on the scan results, the decision module 40 is further configured to determine the risk level of the risky employee account and the risk-spreading account based on the scan results of the risk features and the scan results of the access environment. The risk features include at least malicious file features, abnormal process features, backdoor program features, vulnerability exploitation trace features, and attacked resource features.

[0164] Based on the risk level, low-risk accounts are identified from the risky employee accounts and the risk-spreading accounts.

[0165] The security code level of the low-risk account is downgraded, and the scope of permissions for the low-risk account is determined based on the downgraded security code level.

[0166] In one embodiment, the account access security control device further includes:

[0167] The scanning module 50 is used to monitor preset monitoring objects. When preset attack keywords appear in the preset monitoring objects, it is determined that the supply chain is under security attack. The monitoring objects include at least media, target supplier websites, target supplier contact emails, and messaging software.

[0168] After the supply chain is subjected to a security attack, attack element data is obtained. The attack element data includes at least the attack time, attack resources, event type, degree of impact, scope of impact, urgency level, and company name.

[0169] Based on the attack element data, the target enterprise is identified, and the account system data corresponding to the employee accounts in the target enterprise is extracted. The account system data includes at least account information, login logs, and operation logs.

[0170] It should be understood that the above are merely illustrative examples and do not constitute any limitation on the technical solutions of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any restrictions on this.

[0171] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0172] In addition, for technical details not described in detail in this embodiment, please refer to the account permission security control method provided in any embodiment of the present invention, which will not be repeated here.

[0173] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0174] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0176] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for secure control of account permissions, characterized in that, The account permission security control method includes: After a security attack on the supply chain, risk level coefficients for employee accounts within the target enterprise are determined based on preset risk rules. These preset risk rules include spatiotemporal risk rules, regional risk rules, file risk rules, and operational risk rules. The risk level coefficients include spatiotemporal risk coefficients, regional risk coefficients, file risk coefficients, and operational risk coefficients. The spatiotemporal risk coefficient is determined based on the spatiotemporal overlap of the employee account and the spatiotemporal risk rules. The regional risk coefficient is determined based on the regional overlap of the employee account and the regional risk rules. The file risk coefficient is determined based on the uploaded file type and the file risk rules. The operational risk coefficient is determined based on the matching degree of operational habits and the operational risk rules. The spatiotemporal overlap is the overlap between the employee account's access time and the time the resource was attacked. The regional overlap is the overlap between the employee account's login location and the attacker's login location, or the overlap between the employee account's logout location and the attacker's logout location. The security code level of the employee account is determined based on the risk level coefficient. Based on the security code level of the employee account, determine the scope of permissions for the employee account, and identify high-risk employee accounts within the employee account. Obtain the diffusion account corresponding to the risky employee account, determine the permission scope of the diffusion account based on the security code level of the diffusion account, and identify the risky diffusion account in the diffusion account; A risk scan was performed on the risky employee account and the risk-spreading account to obtain the scan results; Based on the scan results, the permission range of the risky employee account and the risk-spreading account is adjusted, wherein the permission range of the low-risk account among the risky employee account and the risk-spreading account is expanded.

2. The method as described in claim 1, characterized in that, The process of determining the risk level coefficient of employee accounts in the target company based on preset risk rules includes: Based on the account system data of the employee account, determine the resource access time, login location, logout location, uploaded file type, uploaded file content, operation commands, and operation habits; Based on the resource attack time and the resource access time, the spatiotemporal overlap of the employee account is determined, and based on the spatiotemporal risk rules, the spatiotemporal risk coefficient corresponding to the spatiotemporal overlap is determined. Based on the attack login location and the login location, determine the login overlap; based on the attack logout location and the logout location, determine the logout overlap; based on the login overlap and the logout overlap, determine the regional overlap of the employee account; and based on the regional risk rules, determine the regional risk coefficient corresponding to the regional overlap. Based on the uploaded file type and file risk rules, a file risk coefficient corresponding to the uploaded file type is determined. When the file risk coefficient is greater than the file risk threshold, malicious detection is performed on the uploaded file content of the employee account, and the file risk coefficient is adjusted according to the malicious detection result. When the operation commands of the employee account do not match the preset high-risk operation commands, the matching degree of operation habits is determined according to the operation habits and operation commands, and the operation risk coefficient corresponding to the matching degree of operation habits is determined according to the operation risk rules.

3. The method as described in claim 1, characterized in that, Determining the security code level of the employee account based on the risk level coefficient includes: Obtain the information gain corresponding to the preset risk rule; A graded decision model is established based on the information gain corresponding to the preset risk rules. Based on the aforementioned level decision model and the risk level coefficient of the employee account, the security code level of the employee account is determined.

4. The method as described in claim 3, characterized in that, The step of obtaining the information gain corresponding to the preset risk rule includes: Based on the preset risk level in the preset risk rule, simulated sample data is determined, and the simulated sample data includes a preset risk level combination and a preset security code level corresponding to the preset risk level combination. Based on the simulated sample data, determine the security code level ratio corresponding to the preset risk level; Obtain the first correspondence between the security code level ratio, the number of security code levels, and the root node value; Based on the first correspondence, the security code level ratio, and the number of security code levels, determine the root node value corresponding to the preset risk level; Obtain the second correspondence between the root node value and the information gain; Based on the second correspondence and the root node value, the information gain corresponding to the preset risk rule is determined.

5. The method as described in claim 1, characterized in that, The security code level includes at least a first security level, a second security level, and a third security level. Determining the employee account's permission scope based on the employee account's security code level includes: When the security code level of the employee account is the first security level, it is determined that the employee account has no authentication permission; When the security code level of the employee account is the second security level, it is determined that the employee account has a preset level of authentication permissions, and the second security level is higher than the first security level; When the security code level of the employee account is the third security level, it is determined that the employee account has full authentication permissions, and the third security level is higher than the second security level.

6. The method as described in claim 1, characterized in that, The scan results include at least the scan results of risk characteristics and the scan results of the access environment. Adjusting the permission scope of the risk employee account and the risk diffusion account based on the scan results includes: Based on the scanning results of the risk characteristics and the scanning results of the access environment, the risk level of the risky employee account and the risk-spreading account is determined. The risk characteristics include at least malicious file characteristics, abnormal process characteristics, backdoor program characteristics, vulnerability exploitation trace characteristics, and attacked resource characteristics. Based on the risk level, low-risk accounts are identified from the risky employee accounts and the risk-spreading accounts. The security code level of the low-risk account is downgraded, and the scope of permissions for the low-risk account is determined based on the downgraded security code level.

7. The method according to any one of claims 1 to 6, characterized in that, The account permission security control also includes: The system monitors preset targets and determines that the supply chain is under security attack when preset attack keywords appear on the preset targets. The monitored targets include at least media, target supplier websites, target supplier contact emails, and messaging software. After the supply chain is subjected to a security attack, attack element data is obtained. The attack element data includes at least the attack time, attack resources, event type, degree of impact, scope of impact, urgency level, and company name. Based on the attack element data, the target enterprise is identified, and the account system data corresponding to the employee accounts in the target enterprise is extracted. The account system data includes at least account information, login logs, and operation logs.

8. An account access security control device, characterized in that, The account access security control device includes: The analysis module is used to determine the risk level coefficient of employee accounts in a target enterprise based on preset risk rules after the supply chain is subjected to a security attack. The preset risk rules include spatiotemporal risk rules, regional risk rules, file risk rules, and operational risk rules. The risk level coefficient includes spatiotemporal risk coefficient, regional risk coefficient, file risk coefficient, and operational risk coefficient. The spatiotemporal risk coefficient is determined based on the spatiotemporal overlap of the employee account and the spatiotemporal risk rules. The regional risk coefficient is determined based on the regional overlap of the employee account and the regional risk rules. The file risk coefficient is determined based on the uploaded file type and the file risk rules. The operational risk coefficient is determined based on the matching degree of operating habits and the operational risk rules. The spatiotemporal overlap is the overlap between the employee account's access time and the time when the resource is attacked. The regional overlap is the overlap between the employee account's login location and the attacker's login location or the employee account's logout location and the attacker's logout location. The analysis module is also used to determine the security code level of the employee account based on the risk level coefficient; The scheduling module is used to determine the permission scope of the employee account based on the security code level of the employee account, and to identify high-risk employee accounts among the employee accounts. The scheduling module is also used to obtain the diffusion account corresponding to the risk employee account, determine the permission scope of the diffusion account according to the security code level of the diffusion account, and identify the risk diffusion account in the diffusion account. The scanning module is used to perform risk scanning on the risky employee accounts and the risk-spreading accounts, and obtain the scanning results; The decision module is used to adjust the permission range of the risk employee account and the risk diffusion account based on the scan results, wherein the permission range of the low-risk account among the risk employee account and the risk diffusion account is expanded.

9. An account access security control device, characterized in that, The device includes: a memory, a processor, and an account access security control program stored in the memory and executable on the processor, the account access security control program being configured to implement the steps of the account access security control method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores an account access security control program, which, when executed by a processor, implements the steps of the account access security control method as described in any one of claims 1 to 7.

Images