A multi-dimensional graph neural network-based zero-trust access control method and system

Abstract

The application discloses a kind of zero trust access control method and system based on multidimensional graph neural network.It includes: defining rules, access data is modeled as multiple graphs containing multiple types of edges, can comprehensively capture user behavior patterns;Adopt feature hashing to reduce dimensionality extraction of feature information, while reducing feature dimension, try to retain the semantic information in the original data;Adopt multidimensional graph neural network to extract the deep features of access control log data from multiple dimensions and complete the judgment of access control result, the relationship between the projection matrices of different dimensions can measure the mutual influence between nodes of different dimensions, can better analyze the complex multiple relationships in the graph.The application models log data by constructing multiple graph data structures, extracts features using feature hashing, realizes feature representation and classification of nodes through graph neural network, completes the judgment of access control result, can accurately determine illegal access request, meet the access control security under zero trust environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, in particular to a zero-trust access control method and system based on a multi-dimensional graph neural network. BACKGROUND

[0002] Zero trust is a new network security concept that focuses on user and resource centricity. In the zero trust model, trust is independent of location, and access requests must meet the same security requirements regardless of whether they come from inside or outside the organization network. Zero trust emphasizes the comprehensive analysis of user identity, device, context information and other attributes to achieve continuous authentication and dynamically adaptive access control.

[0003] However, the dynamic access control technology in the existing zero trust architecture still has certain limitations. In order to achieve the goal of zero trust, it is often necessary to design complex strategies or dynamically evaluate trust values according to complex trust algorithm modules, which will result in a decline in system performance and the accuracy of access control cannot be guaranteed.

[0004] Chinese patent application CN112751860A discloses an intelligent identity analysis method in a zero trust network. A method for implementing adaptive access control using intelligent identity analysis is provided in the field of zero trust network security. By defining the identity of entities in the zero trust network and the benchmark for identity analysis, abnormal access data is detected, reducing the management overhead problem caused by the dynamic access control mechanism in the zero trust network, and achieving management automation. The method proposed in this patent involves behavior analysis of users, but lacks comprehensive analysis of different dimensions, and detection of access data anomalies relies on characteristics such as normal distribution of data, which may result in low accuracy of illegal access identification.

[0005] The present application aims to address the dynamic fine-grained access control in the zero trust architecture and the above-mentioned problems. By modeling multiple behavior patterns of users, the original log data is reduced in dimension using feature hashing to extract features, and a multi-dimensional graph neural network is constructed to extract and represent deep features of access log data, forming an efficient dynamic access control method that improves the accuracy of access control determination. SUMMARY

[0006] The purpose of the present application is to provide a zero-trust access control method and system based on a multi-dimensional graph neural network to improve the accuracy of existing access control methods.

[0007] The technical content of the present application includes:

[0008] A zero-trust access control method and system based on a multidimensional graph neural network, characterized in that the method includes the following steps:

[0009] S1. Define rules and establish a multi-graph data structure based on user behavior patterns;

[0010] S2. Introduce the feature hashing method to reduce the dimensionality and extract semantic information from the access request log data;

[0011] S3. Construct a multidimensional graph neural network model to realize automatic representation of node features and determination of access control results.

[0012] Furthermore, the graph construction process of S1 includes the following steps:

[0013] S11. Define Rules: Define rules corresponding to various relationship types, corresponding to different user behavior patterns, and in the multi-graph, corresponding to various types of edges. For each type of relationship, it includes two parts: sequence modeling and inter-sequence modeling;

[0014] S12. Sequence Modeling: Sequence modeling mainly refers to the node connection method in chronological order within a single day under corresponding rules;

[0015] S13. Inter-sequence modeling: Inter-sequence modeling mainly refers to the weighted connection method between daily sequences under corresponding rules.

[0016] Furthermore, the S12 sequence modeling includes various types of relationships, comprising the following sub-steps:

[0017] S121. Log entries of the same user are connected in chronological order within a day, and the weight of the edge between any two nodes i and j is w(i,j) = 1.

[0018] S122. Log entries of the same user on the same host are connected in chronological order within a day, and the weight of the edge between any two nodes i and j is w(i,j) = 1.

[0019] S123. Log entries of the same operation on the same host are connected in chronological order within a day, and the weight of the edge between any two nodes i and j is w(i,j) = 1.

[0020] S124. Log entries accessing the same object on the same host are connected in chronological order, and the weight of the edge between any two nodes i and j is w(i,j) = 1.

[0021] Furthermore, the inter-sequence modeling in S13 includes the following sub-steps:

[0022] S131, steps S121-S124 will establish a plurality of different single-day sequences for each single step, respectively, and the head node and tail node of each sequence will be connected to form a graph, and the weight of the edge formed is related to the similarity of the number of log entries contained in the corresponding two sequences.

[0023] S132, the calculation formula of the weight of the edge connecting nodes i, j between sequences is as follows:

[0024] w(i,j)=weight(a,b)=exp(-dist(a,b))

[0025] where a, b represents the number of log entries contained in the sequence where i, j is located, and dist(a, b) is used to measure the difference between the number of log entries contained in the sequence where i, j is located, and the formula is as follows:

[0026]

[0027] Where the closer the number of log entries contained in the sequence where i, j is located, the closer the weight is to 1.

[0028] Further, the feature hashing method of S2 includes the following steps:

[0029] S21, select a hash function and specify the feature dimension: first determine the hash function to be used and the final feature dimension size;

[0030] S22, initialize the hash table and the hash value: create an initial hash table and initialize the hash value according to the specified hash seed;

[0031] S23, select features and traverse input data: for each input sample, not all features need to be mapped by the hash function, depending on the specific task requirements, select the task-related attributes as input features;

[0032] S24, apply the hash function: apply the hash function to each feature respectively, and map it to a position in the hash table. The specific mapping operation includes a series of bit operations, shift operations and mixing operations;

[0033] S25, generate feature vector: according to the index of the hash table, set the value of the corresponding position in the new low-dimensional feature space;

[0034] S26, combine to get the final feature vector: combine the feature values of each feature of each data to get the final hash value;

[0035] S27, feature standardization: standardize the generated feature vector for subsequent model use.

[0036] Further, the multi-dimensional graph neural network model of S3 comprises the following steps:

[0037] S31, the multi-graph data structure constructed according to step S1 can obtain D graphs with the same nodes but different edge types according to the types of edges. The input feature vector is projected into D dimensions by projection to obtain the feature representation in a specific dimension, and the formula is as follows:

[0038] x i,d =σ(P d ·x i )

[0039] wherein and represent the input feature vector of node v i (i=1, 2, …, N) and its projection in dimension d (d=1, 2, …, D), i.e. the d-dimensional feature representation, P d represents the projection matrix for projecting the feature to d dimensions, and σ represents a nonlinear activation function.

[0040] The overall representation of all nodes is:

[0041] X d =σ(P d ·X)

[0042] wherein represents an input feature matrix containing all nodes, represents the projection of X in dimension d, i.e. the feature representation of all nodes in d dimensions;

[0043] S32, in each dimension graph, the spectral graph convolution is used for convolution operation on the graph, which is called intra-dimension information aggregation. After intra-dimension information aggregation, the representation of nodes in a specific dimension can be obtained, and the specific operation formula is as follows:

[0044]

[0045] wherein X d represents the feature representation of all nodes in node dimension d in each hidden layer,

[0046]

[0047] A d represents the adjacency matrix of the graph in dimension d, and each element a i,j = weight (i, j); I represents the self-connection unit matrix of the corresponding node, and D d represents the degree matrix of the corresponding node in dimension d.

[0048] S33, the information aggregation across dimensions will process the graph data of different dimensions simultaneously, and the formula is as follows:

[0049]

[0050] where X g represents the feature representation of dimension g, b g,d represents the correlation coefficient between dimension g and dimension d;

[0051] S34, combine these dimension-specific representations to obtain a new general representation:

[0052]

[0053] where the complete graph neural network contains multiple layers, X (k) represents the input of the kth layer or the output of the k-1th layer, represents the result of the intra-dimension information aggregation and the inter-dimension information aggregation of the feature representation of dimension d in the k-1th layer, and concat() represents an aggregation function used to combine the feature representations of all dimensions, represents a fully connected layer.

[0054] Further, the S33 inter-dimension information aggregation includes the following steps:

[0055] S331, the correlation degree between dimensions is not equal, and the correlation coefficient p g,d represents the correlation degree between dimension d and dimension g, and the formula is as follows:

[0056] p g,d = attention(P d ,P g )

[0057] where P d , P g represent the projection matrices projected to dimension d and dimension g respectively, and attention() represents an attention function;

[0058] S332, the formula of the attention function attention() of the correlation coefficient p g,d is as follows:

[0059]

[0060] where The formula represents a bilinear transformation for capturing the relationship and interaction between P d , P g ;

[0061] S333, use the calculated p g,d S333, use the calculated p g,d As the final use of the correlation coefficient:

[0062] BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 A flowchart of a zero-trust access control method and system based on a multi-dimensional graph neural network;

[0064] Figure 2 A structural diagram of the proposed access control method;

[0065] Figure 3 A structural diagram of the graph data structure for constructing behavior patterns;

[0066] Figure 4 A structural diagram of the multi-dimensional graph neural network constructed. DETAILED DESCRIPTION

[0067] To make the objectives, technical solutions, and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described below in detail with reference to the drawings. Obviously, the described embodiments are only specific embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0068] Figure 1 A flowchart of a zero-trust access control method and system based on a multi-dimensional graph neural network is provided for the embodiments of the present application, as shown in the figure, the method comprises:

[0069] S1, define rules and establish a multi-graph data structure based on user behavior patterns;

[0070] S2, introduce a feature hashing method to reduce dimensionality and extract semantic information from access request log data;

[0071] S3, construct a multi-dimensional graph neural network model to realize automatic representation of node features and determination of access control results.

[0072] By Figure 2As shown, the main purpose of the present application is to realize a dynamic access control method under a zero trust architecture through a multi-dimensional graph neural network. Specifically, in order to realize the zero trust access control method and system based on the multi-dimensional graph neural network, two pre-steps S1 and S2 are needed. S1 step constructs a multi-graph data structure capable of capturing user behavior patterns according to specific access control data, and S2 step initializes a low-dimensional feature vector containing semantic information. Through the method of feature hashing, the input data can be reduced in dimension, while the semantic information in the original data can be preserved to the greatest extent. Finally, the multi-dimensional graph neural network constructed by S3 step performs node feature representation learning and realizes the judgment of the access control system to the access node. The implementation example is based on a real enterprise network data set containing network attacks.

[0073] Specifically, for step S1, the following sub-steps are included:

[0074] S11, define rules: define rules corresponding to multiple relationship types, corresponding to different behavior patterns of users, and corresponding to multiple types of edges in the multi-graph. For each type, both sequence modeling and inter-sequence modeling are included. Specifically, the construction of the multi-graph is mainly based on a tuple describing an access request, which contains five attributes, namely <user, action, host, object, time>. An access request containing the above five attributes is regarded as a basic access request;

[0075] S12, sequence modeling: sequence modeling mainly refers to the connection mode of nodes in chronological order within a day under the corresponding rules;

[0076] S13, inter-sequence modeling: inter-sequence modeling mainly refers to the connection mode between sequences in a day under the corresponding rules.

[0077] Further, step S12 sequence modeling includes the following sub-steps:

[0078] S121, log entries of the same user are connected in chronological order within a day, and the weight w(i,j) of the edge between any two nodes i,j is 1.

[0079] S122, log entries of the same user on the same host are connected in chronological order within a day, and the weight w(i,j) of the edge between any two nodes i,j is 1.

[0080] S123, log entries of the same operation on the same host are connected in chronological order within a day, and the weight w(i,j) of the edge between any two nodes i,j is 1.

[0081] S124, log entries accessing the same object on the same host are connected in time order, and the weight w(i,j) of the edge between any two nodes i,j is 1.

[0082] Further, the step S13 comprises the following sub-steps:

[0083] S131, the steps S121-S124 will establish a plurality of single-day sequences of different days respectively, and the head node and the tail node of each sequence in each single step will be connected to form a graph, and the weight of the edge formed is related to the similarity of the number of log entries contained in the corresponding two sequences;

[0084] S132, the calculation formula of the weight of the edge connecting nodes i,j between sequences is as follows:

[0085] w(i,j)=wweight(a,b)=exp(-dist(a,b))

[0086] Where a,b represents the number of log entries contained in the sequence in which i,j is located, and dist(a,b) is used to measure the difference between the number of log entries contained in the sequence in which i,j is located, and the formula used in the embodiment is as follows:

[0087]

[0088] Where the closer the number of log entries contained in the sequence in which i,j is located, the closer the weight is to 1.

[0089] For step S2, the feature hashing method of S2 comprises the following sub-steps:

[0090] S21, selecting a hash function and specifying a feature dimension: first, the hash function to be used and the final feature dimension size need to be determined;

[0091] S22, initializing a hash table and a hash value: creating an initial hash table and initializing a hash value according to a specified hash seed;

[0092] S23, selecting features and traversing input data: for each input sample, not all features need to be mapped by the hash function, which depends on the specific task requirements, and the task-related attributes are selected as input features;

[0093] S24, applying a hash function: applying a hash function to each feature to map it to a position in the hash table. The specific mapping operation includes a series of bit operations, shift operations and mixing operations;

[0094] S25, generating a feature vector: according to the index of the hash table, setting the value of the corresponding position in the new low-dimensional feature space;

[0095] S26, combination to obtain the final feature vector: the feature value of each feature of each data is combined to obtain the final hash value;

[0096] S27, feature standardization: the generated feature vector is standardized for subsequent model use.

[0097] Specifically, in addition to the five basic attributes used to build the graph in step S1, in order to more completely describe a piece of access request data, the context information related to the log entry is also selected in this embodiment, such as process number, IP address and port number where the access object is located, file path and the like attributes are used for feature hashing. The hash function used in this embodiment is the MurmurHash3 hash function, which is characterized by fast non-encryption, which can map input data of any length to a fixed length hash value, and the dimension of the final feature vector generated is 32;

[0098] Further, the S3 of constructing a multi-dimensional multi-neural network comprises the following steps:

[0099] S31, according to the multi-graph data structure constructed in step S1, four types of relationships are contained, and four graphs with the same nodes but different edge types can be obtained according to the types of edges. The input feature vector is projected into four dimensions by projection to obtain a specific dimensional feature representation, and the formula is as follows:

[0100] x i,d =Relu(P d ·x i )

[0101] Among them and respectively represent the input feature vector of node v i (i=1, 2, …, N) and its projection in dimension d (d=1, 2, 3, 4), that is, the d-dimensional feature representation, P d represents the projection matrix for projecting the feature to d dimensions, and the activation function in this embodiment is the Relu() function;

[0102] The overall representation of all nodes is:

[0103] X d =Relu(P d ·X)

[0104] Among them represents the input feature matrix containing all nodes, represents the projection of X in dimension d, that is, the feature representation of all nodes in d dimensions;

[0105] S32, in each dimension of the graph, the spectral graph convolution is used to perform convolution operation on the graph, which is called intra-dimension information aggregation. After intra-dimension information aggregation, the representation of the node in a specific dimension can be obtained, and the specific operation formula is as follows:

[0106]

[0107] where X d represents the feature representation of all nodes in each hidden layer in the node dimension d,

[0108]

[0109] A d represents the adjacency matrix of the graph in dimension d, each element a i,j = weight(i,j) in the adjacency matrix; I represents the self-connection unit matrix of the corresponding node, D d represents the degree matrix of the corresponding node in dimension d;

[0110] S33, the cross-dimension information aggregation processes the graph data in different dimensions at the same time, and the formula is as follows:

[0111]

[0112] where X g represents the feature representation of dimension g, b g,d represents the correlation coefficient between dimensions g and d;

[0113] S34, these dimension-specific representations are combined to obtain a new general representation:

[0114]

[0115] where the complete graph neural network contains multiple layers, X (k) represents the input of the kth layer or the output of the k-1th layer, represents the result of the intra-dimension information aggregation and the inter-dimension information aggregation of the feature representation of dimension d in the k-1th layer, in this embodiment, the maximum pooling method is used to combine the final representations of multiple dimensions, and the elements in the same position of different dimensions are regarded as the same window to select the maximum value, represents the fully connected layer.

[0116] Further, the step S33 includes the following sub-steps:

[0117] S331, the correlation degree between dimensions is not equal, and the correlation coefficient p g,d represents the correlation degree between dimension d and dimension g, and the formula is as follows:

[0118] p g,d= attention(P d ,P g )

[0119] wherein P d ,P g represent projection matrices projected to dimension d and dimension g respectively, and attention() represents an attention function;

[0120] S332, calculate the correlation coefficient p g,d The formula of the attention function attention() is as follows:

[0121]

[0122] wherein The formula represents a bilinear transformation, which is used to capture the relationship and interaction between P d ,P g ;

[0123] S333, normalize the calculated p g,d using a softmax function, and obtain b g,d as the final correlation coefficient:

[0124]

[0125] Although the above describes the specific embodiments of the present application in detail, so as to facilitate the understanding of the present application by the person skilled in the art, it should be clear that the present application is not limited to the scope of the specific embodiments, and for the person skilled in the art, as long as various changes are within the spirit and scope of the present application defined and determined by the appended claims, all the inventions utilizing the concept of the present application are within the scope of protection.

Claims

1. A method and system for zero trust access control based on multi-dimensional graph neural networks, characterized in that, The method comprises the following steps: S1, defining rules to establish a multi-graph data structure based on user behavior patterns; S2, introducing a feature hashing method to reduce the dimensionality of the access request log data and extract semantic information; S3, constructing a multi-dimensional graph neural network model to realize automatic representation of node features and determination of access control results S31, according to the multi-graph data structure constructed in step S1, D graphs with the same nodes but different edge types can be obtained by dividing the edge types, and the input feature vector is projected into D dimensions by projection to obtain the feature representation of a specific dimension, as follows: x i,d = σ(P d · x i ) wherein and denote the input feature vector of node v i (i = 1, 2,..., N) and its projection in dimension d (d = 1, 2,..., D), i.e. a d-dimensional feature representation, denotes a projection matrix that projects the features to d dimensions, and σ denotes a non-linear activation function. The overall representation of all nodes is: X d = σ(P d · X) wherein denotes the input feature matrix containing all nodes, denotes the projection of X onto dimension d, i.e. the feature representation of all nodes in d dimensions; S32, in each dimensional graph, perform convolution operation on the graph by using spectral graph convolution, which is called intra-dimension information aggregation, and after intra-dimension information aggregation, the representation of the node in a specific dimension can be obtained, the specific operation formula is as follows: where X d represents the feature representation of all nodes in each hidden layer in node dimension d, A d denotes the adjacency matrix of the graph in dimension d, each element a i,j = weight(i,j); I denotes the identity matrix of self-connections of the corresponding node, D d denotes the degree matrix of the corresponding node in dimension d; S33, cross-dimension information aggregation will process different dimensional graph data at the same time, the formula is as follows: where X g represents a feature representation of dimension g, b g,d represents a correlation coefficient between dimensions g, d; S34, combine these dimension-specific representations to obtain a new general representation: where the complete graph neural network comprises multiple layers, X (k) denotes the input of the k-th layer or the output of the k-1-th layer, denotes the result of intra-dimension information aggregation and inter-dimension information aggregation of the feature representation of dimension d in the k-1-th layer, and concat() denotes an aggregation function for combining the feature representations of all dimensions, denotes a fully connected layer.

2. The multi-dimensional graph neural network-based zero trust access control method and system according to claim 1, characterized in that, The S1 comprises the following steps: S11, defining rules: defining rules corresponding to multiple relationship types, corresponding to different behavior patterns of users, corresponding to multiple types of edges in the multi-graph, for each type of relationship, both sequence modeling and inter-sequence modeling are included; S12, sequence modeling: sequence modeling mainly refers to the connection mode of nodes in time sequence within a day under the corresponding rules; S13, inter-sequence modeling: inter-sequence modeling mainly refers to the connection mode between single-day sequences under the corresponding rules.

3. The multi-dimensional graph neural network-based zero trust access control method and system according to claim 2, characterized in that, The S12 comprises the following steps: S121, the log entries of the same user are connected in time sequence within a day, and the weight w(i,j) between any two nodes i,j is 1; S122, the log entries of the same user on the same host are connected in time sequence within a day, and the weight w(i,j) between any two nodes i,j is 1; S123, the log entries of the same operation on the same host are connected in time sequence within a day, and the weight w(i,j) between any two nodes i,j is 1; S124, the log entries of the same object on the same host are connected in time sequence, and the weight w(i,j) between any two nodes i,j is 1.

4. The multi-dimensional graph neural network-based zero trust access control method and system according to claim 2, characterized in that, The S13 comprises the following steps: S131, steps S121-S124 will establish multiple single-day sequences of different days respectively, and the head node and the tail node of each sequence in each separate step will be connected to form a graph, and the weight of the formed edge is related to the similarity of the number of log entries contained in the corresponding two sequences; S132, the calculation formula of the weight of the edge connecting nodes i,j between sequences is as follows: w(i,j)=weight(a,b)=exp(-dist(a,b)) Where a,b represents the number of log entries contained in the sequence where i,j is located, dist(a,b) represents the difference between the number of log entries contained in the sequence where i,j is located, and the formula is as follows: Wherein, the closer the number of log entries contained in the sequence where i, j are respectively, the closer the weight is to 1.

5. The multi-dimensional graph neural network-based zero trust access control method and system of claim 1, wherein, The S2 comprises the following steps: S21, selecting a hash function and specifying a feature dimension: first, the hash function to be used and the final feature dimension size need to be determined; S22, initializing a hash table and a hash value: creating an initial hash table and initializing a hash value according to a specified hash seed; S23, selecting features and traversing input data: for each input sample, not all features need to be mapped by a hash function, depending on the specific task requirements, selecting task-related attributes as input features; S24, applying a hash function: applying a hash function to each feature to map it to a position in the hash table, including a series of bit operations, shift operations and mixing operations; S25, generating a feature vector: setting the value of the corresponding position in the new low-dimensional feature space according to the index of the hash table; S26, combining to obtain the final feature vector: combining the feature values of each feature of each data to obtain the final hash value; S27, feature standardization: normalizing the generated feature vector for subsequent model use.

6. The multi-dimensional graph neural network-based zero trust access control method and system of claim 1, wherein, The S33 comprises the following steps: S331. The correlation between dimensions is not equal; use the correlation coefficient p. g,d The formula representing the correlation between dimension d and dimension g is as follows: p g,d = attention(P d , P g ) Where P d ,P g These represent the projection matrices onto dimensions d and g, respectively, and attention() represents an attention function. S332、Calculate the correlation coefficient p g,d The formula of the attention function attention() is as follows: wherein This equation represents a bilinear transformation that captures the relationship and interaction between P d ,P g ; S333, use the softmax function to calculate p g,d Normalization processing is performed to obtain b g,d As the final use of the correlation coefficient:

Images