A user semantic role mining method and device based on overlapping clustering

Abstract

The application relates to the technical field of role mining, and discloses a user semantic role mining method and device based on overlapping clustering, which comprises the following steps: obtaining user permission assignment relationship data set and user attribute data; generating a user permission matrix according to the user permission assignment relationship data set; generating a user association graph according to a preset similarity threshold and user similarity determined by the user permission matrix and the user attribute data; generating a candidate role set according to the user association graph by using an overlapping clustering algorithm, wherein any candidate role contains multiple users; determining semantic information contained in the candidate role based on the user similarity corresponding to the multiple users contained in the candidate role; and generating a user semantic role set according to the semantic information contained in the candidate role and a preset threshold. The application achieves the effects of improving the semantic expression ability of roles and reducing the role management burden of an access control system, and solves the problem of weak semantic expression ability of roles in related technologies.

Description

Technical Field

[0001] This invention relates to the field of role mining technology, specifically to a method and apparatus for mining user semantic roles based on overlapping clustering. Background Technology

[0002] With the development of attack techniques, the methods, extent, and forms of cyberattacks are also showing new trends. New attack techniques characterized by low frequency, multi-step attacks, and strong concealment are constantly evolving, and various attack methods that breach boundary defenses and move laterally are emerging in an endless stream, leading to frequent security incidents such as unauthorized access and leakage of important information. How to effectively protect the security of privacy data and business resources in an increasingly complex network environment is a key research focus in security protection.

[0003] Role-Based Access Control (RBAC) restricts user access permissions by assigning appropriate roles, offering advantages such as simple management and security, and has become a recognized secure access control technology. However, using RBAC requires mining the relationships between users and roles. Current role mining methods primarily consider the allocation relationships and constraints between users and permissions, with less consideration for the impact of semantic information on role mining. This results in weak semantic expressiveness of generated roles, making it difficult to meet the needs of real-world applications. Therefore, existing technologies suffer from the problem of weak semantic expressiveness of roles. Summary of the Invention

[0004] In view of this, the present invention provides a method and apparatus for mining user semantic roles based on overlapping clustering, so as to solve the problem of weak semantic expressiveness of roles.

[0005] In a first aspect, the present invention provides a user semantic role mining method based on overlapping clustering, comprising: acquiring a user permission allocation relationship dataset and user attribute data; generating a user permission matrix based on the user permission allocation relationship dataset, wherein the user permission matrix is ​​a relationship matrix between users and permissions; generating a user association graph based on a preset similarity threshold and user similarity determined by the user permission matrix and user attribute data; generating a candidate role set based on the user association graph using an overlapping clustering algorithm, wherein any candidate role contains multiple users; determining the semantic information contained in the candidate role based on the user similarity corresponding to the multiple users contained in the candidate role; and generating a user semantic role set based on the semantic information contained in the candidate role and the preset threshold.

[0006] In this embodiment of the invention, a user association graph is generated based on a user permission allocation relationship dataset, user similarity, and a preset similarity threshold. An overlapping clustering algorithm is then used to mine a candidate role set from this user association graph. Furthermore, user similarity, which includes user permissions and attribute information, is used to determine the semantic information contained in the candidate roles. This achieves the goal of considering semantic information during role mining. A user semantic role set is generated based on this semantic information and the preset threshold, thereby improving the semantic expressiveness of roles and reducing the role management burden of the access control system. This solves the problem of weak semantic expressiveness of roles in related technologies.

[0007] In one optional implementation, a user semantic role set is generated based on the semantic information contained in the candidate roles and a preset threshold, including: retaining candidate roles whose semantic information is greater than or equal to the preset threshold; obtaining multiple users contained in candidate roles whose semantic information is less than the preset threshold; reassigning roles to the multiple users contained in candidate roles whose semantic information is less than the preset threshold; and determining the user semantic role set based on the retained candidate roles and the reassigned roles.

[0008] In this embodiment of the invention, by comparing the semantic information contained in the candidate roles with a preset threshold, the candidate roles are retained or roles are reassigned to users, thereby improving the reliability of role discovery and reducing the role management burden of the access control system.

[0009] In one optional implementation, reassigning roles to multiple users included in candidate roles whose semantic information is less than a preset threshold includes: selecting any user included in candidate roles whose semantic information is less than the preset threshold; calculating the semantic information contained in each role after assigning any user to each role in a preset role set based on user similarity; assigning any user to the role with the largest semantic information contained in the preset role set; and repeatedly performing the steps of calculating the semantic information contained in each role after assigning any user to each role in the preset role set and assigning any user to the role with the largest semantic information contained in the preset role set until roles are reassigned to all users.

[0010] In this embodiment of the invention, by calculating the semantic information contained in each role after assigning any user to each role in a preset role set, the purpose of reassigning any user based on semantic information is achieved, thereby improving the accuracy and reliability of the user semantic role set.

[0011] In one optional implementation, a user permission matrix is ​​generated based on a user permission allocation relationship dataset. The user permission matrix is ​​a relationship matrix between users and permissions. The process includes: extracting user permission allocation relationships from the user permission allocation relationship dataset; generating an original user permission matrix with users as rows and permissions as columns based on the user permission allocation relationships; and deleting duplicate user permission allocation relationships from the original user permission matrix to obtain the user permission matrix.

[0012] In this embodiment of the invention, by extracting user permission allocation relationships from the user permission allocation relationship dataset to generate an original user permission matrix and deleting duplicate relationships in the matrix, the goal of improving the simplification of the user permission matrix and thus improving the efficiency of role mining is achieved.

[0013] In one optional implementation, a user association graph is generated based on a preset similarity threshold and user similarity determined by a user permission matrix and user attribute data. This includes: constructing an initial user association graph with all users as nodes; calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data; and if the user similarity between any two users is greater than the preset similarity threshold, adding an edge between the two users to obtain the user association graph.

[0014] In this embodiment of the invention, by calculating the user similarity between any two user nodes in the initial user association graph and comparing it with a preset similarity threshold, it is determined whether to add an edge between any two user nodes, thus achieving the purpose of establishing a user association graph.

[0015] In one optional implementation, calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data includes: calculating the permission similarity between any two users using the product of the Jaccard coefficient and the reciprocal of the Hamming distance based on the permission matrix; calculating the attribute similarity between any two users using the cosine coefficient formula based on the user attribute data; and calculating the user similarity between any two users in the initial user association graph based on the weighted sum of the permission similarity and the attribute similarity.

[0016] In this embodiment of the invention, by calculating the permission similarity and attribute similarity between any two users, and determining the user similarity between any two users based on the weighted sum of the two, the semantic information contained in the user similarity is improved, thereby enhancing the reliability of user similarity calculation.

[0017] In one optional implementation, the semantic information contained in the candidate role is determined based on the user similarity corresponding to multiple users included in the candidate role, including: obtaining the number of users included in the candidate role; determining the semantic information contained in the candidate role based on the number of users and the similarity of multiple users included in the candidate role, wherein the similarity of multiple users is the sum of the user similarity corresponding to each pair of multiple users.

[0018] In this embodiment of the invention, the semantic information contained in the candidate role is calculated by obtaining the number of users contained in the candidate role and the user similarity of each user. This achieves the purpose of considering the semantic information of the role in the role mining process and improves the reliability of role mining.

[0019] Secondly, the present invention provides a user semantic role mining device based on overlapping clustering, comprising: a data acquisition module for acquiring a user permission allocation relationship dataset and user attribute data; a user permission matrix generation module for generating a user permission matrix based on the user permission allocation relationship dataset, wherein the user permission matrix is ​​a relationship matrix between users and permissions; a user association graph generation module for generating a user association graph based on a preset similarity threshold and user similarity determined by the user permission matrix and user attribute data; a candidate role set generation module for generating a candidate role set based on the user association graph using an overlapping clustering algorithm, wherein any candidate role contains multiple users; a semantic information determination module for determining the semantic information contained in the candidate role based on the user similarity corresponding to the multiple users contained in the candidate role; and a semantic role set generation module for generating a user semantic role set based on the semantic information contained in the candidate role and a preset threshold.

[0020] In one optional implementation, the semantic role set generation module includes: a retention unit for retaining candidate roles whose semantic information is greater than or equal to a preset threshold; an acquisition unit for acquiring multiple users included in candidate roles whose semantic information is less than the preset threshold; an allocation unit for reallocating roles to the multiple users included in candidate roles whose semantic information is less than the preset threshold; and a determination unit for determining a user semantic role set based on the retained candidate roles and the reallocated roles.

[0021] In one optional implementation, the allocation unit includes: a selection subunit for selecting any user among candidate roles whose semantic information is less than a preset threshold; a calculation subunit for calculating the semantic information contained in each role after assigning any user to each role in the preset role set based on user similarity; an allocation subunit for assigning any user to the role with the largest semantic information contained in the preset role set; and a looping subunit for repeatedly executing the steps of calculating the semantic information contained in each role after assigning any user to each role in the preset role set and assigning any user to the role with the largest semantic information contained in the preset role set until roles are reassigned to all users.

[0022] In one optional implementation, the user permission matrix generation module includes: an extraction unit for extracting user permission allocation relationships from a user permission allocation relationship dataset; a generation unit for generating an original user permission matrix based on the user permission allocation relationships, with users as rows and permissions as columns; and a obtaining unit for deleting duplicate user permission allocation relationships from the original user permission matrix to obtain the user permission matrix.

[0023] In one optional implementation, the user association graph generation module includes: a construction unit for constructing an initial user association graph with all users as nodes; a user similarity calculation unit for calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data; and an association graph obtaining unit for adding an edge between any two users if the user similarity between any two users is greater than a preset similarity threshold, thereby obtaining the user association graph.

[0024] In one optional implementation, the user similarity calculation unit includes: a permission similarity calculation subunit, used to calculate the permission similarity between any two users based on the permission matrix using the product of the Jaccard coefficient and the reciprocal of the Hamming distance; an attribute similarity calculation subunit, used to calculate the attribute similarity between any two users based on user attribute data using the cosine coefficient formula; and a user similarity calculation subunit, used to calculate the user similarity between any two users in the initial user association graph based on the weighted sum of permission similarity and attribute similarity.

[0025] In one optional implementation, the semantic information determination module includes: a user count acquisition unit, used to acquire the number of users included in the candidate role; and a semantic information determination unit, used to determine the semantic information included in the candidate role based on the number of users and the similarity of multiple users included in the candidate role, wherein the similarity of multiple users is the sum of the user similarities corresponding to pairwise combinations of multiple users.

[0026] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the user semantic role mining method based on overlapping clustering described in the first aspect or any corresponding embodiment thereof.

[0027] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the user semantic role mining method based on overlapping clustering described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0028] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating the user semantic role mining method based on overlapping clustering according to an embodiment of the present invention;

[0030] Figure 2 This is a flowchart illustrating another user semantic role mining method based on overlapping clustering according to an embodiment of the present invention;

[0031] Figure 3 This is a flowchart illustrating another user semantic role mining method based on overlapping clustering according to an embodiment of the present invention;

[0032] Figure 4 This is a schematic diagram of a method for constructing a user association graph according to an embodiment of the present invention;

[0033] Figure 5 This is a schematic diagram of a method for filtering a set of candidate roles based on a role semantic information evaluation method according to an embodiment of the present invention;

[0034] Figure 6 This is a schematic diagram of a method for reallocating users who do not meet a preset threshold according to an embodiment of the present invention;

[0035] Figure 7 This is a structural block diagram of a user semantic role mining device based on overlapping clustering according to an embodiment of the present invention;

[0036] Figure 8 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] It should be noted that in the description of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. The terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal connection between two components; and they can refer to wireless connections or wired connections. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0039] Furthermore, if the term "and / or" appears in this invention, it includes three parallel solutions. Taking "A and / or B" as an example, it includes solution A, solution B, or a solution that simultaneously satisfies A and B. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0040] Role-based access control (RBAC) is a technology that assigns access permissions to users within an organization based on their roles and the tasks they perform. It ensures that users can only access information or files relevant to their current position or project, effectively reducing data loss and holding significant importance for the management of large enterprises or organizations. For example, in large organizations with multiple departments, each department typically has its own group of employees and computers. To ensure secure file access, prevent attacks, and avoid disrupting employee workflows, RBAC is the optimal solution. By assigning roles to users, administrators can grant different levels of permissions based on those roles, achieving optimal security and work efficiency. Even with a large number of device connections daily, each device can be detected promptly, and customized access permissions can be granted based on user roles. Each user will be able to view and transfer the data they need, while the rest of the organization's data remains unchanged, effectively preventing data leakage or tampering. While role mining can be used to assign roles to users, constructing a complete and accurate set of roles remains a challenge. Current role mining methods primarily consider the allocation relationship and constraints between users and permissions, with less consideration for the impact of semantic information on role mining. This results in generated roles with weak semantic expressiveness, making it difficult to meet the needs of real-world applications. Some semantic-based role mining methods filter and process roles based on an initial role set to obtain a final semantic role set. However, the generation of the initial role set often relies on role mining algorithms with high time complexity or intelligent algorithms with poor stability and scalability and complex implementation. Therefore, there is an urgent need for an efficient and reliable role mining method that considers semantic information.

[0041] According to an embodiment of the present invention, a user semantic role mining method based on overlapping clustering is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0042] This embodiment provides a user semantic role mining method based on overlapping clustering, which can be used in the aforementioned mobile terminals, such as central processing units and servers. Figure 1 This is a flowchart illustrating the user semantic role mining method based on overlapping clustering according to an embodiment of the present invention, as shown below. Figure 1 As shown, the process includes the following steps:

[0043] Step S101: Obtain the user permission allocation relationship dataset and user attribute data. Optionally, the user permission allocation relationship dataset is used to extract the permission information corresponding to the user, and the attribute data is used to provide semantic information. It is understood that the user attribute data can also be other data containing the required semantic information, such as the user's business data, task data, etc.

[0044] Step S102: Generate a user permission matrix based on the user permission allocation relationship dataset. The user permission matrix is ​​a relationship matrix between users and permissions. Optionally, extract the permission information corresponding to the user from the user permission allocation relationship dataset to generate the user permission matrix.

[0045] Step S103: Generate a user association graph based on a preset similarity threshold and the user similarity determined by the user permission matrix and user attribute data. Optionally, use the user attribute data obtained in step S101 and the user permission matrix generated in step S102 to calculate user similarity using common similarity calculation methods, such as cosine similarity, Euclidean distance, Hamming distance, Jaccard similarity coefficient, Pearson correlation coefficient, etc. Generate a user association graph based on the relationship between the calculated user similarity and the preset similarity threshold. This user association graph is used to establish associations for users whose user similarity is greater than the preset similarity threshold.

[0046] Step S104: Generate a candidate role set based on the user association graph using an overlapping clustering algorithm. Each candidate role contains multiple users. Optionally, the clustering algorithm can group (divide) the data into sets with similarity. Since a user may correspond to multiple roles, and an object (user) in the overlapping clustering algorithm can belong to multiple clusters (sets) simultaneously, an overlapping clustering algorithm such as Latent Factor Model (LFM) is used to reasonably assign roles to users based on the user association graph, thereby obtaining a candidate role set.

[0047] Step S105: Determine the semantic information contained in the candidate role based on the user similarity corresponding to the multiple users included in the candidate role. Optionally, determine the semantic information contained in any candidate role in the candidate role set obtained in step S104 according to the user similarity calculation method in step S103. It can be understood that since any candidate role contains multiple users, the semantic information contained in any candidate role can be the sum or average of the user similarity corresponding to the multiple users.

[0048] Step S106: Generate a set of user semantic roles based on the semantic information contained in the candidate roles and a preset threshold. Optionally, compare the semantic information contained in any candidate role in step S105 with the preset threshold, determine whether any candidate role meets the requirements based on the semantic information, and generate a set of roles containing semantics, i.e., the set of user semantic roles.

[0049] In this embodiment of the invention, a user association graph is generated based on a user permission allocation relationship dataset, user similarity, and a preset similarity threshold. An overlapping clustering algorithm is then used to mine a candidate role set from this user association graph. Furthermore, user similarity, which includes user permissions and attribute information, is used to determine the semantic information contained in the candidate roles. This achieves the goal of considering semantic information during role mining. A user semantic role set is generated based on this semantic information and the preset threshold, thereby improving the semantic expressiveness of roles and reducing the role management burden of the access control system. This solves the problem of weak semantic expressiveness of roles in related technologies.

[0050] This embodiment provides a user semantic role mining method based on overlapping clustering, which can be used in the aforementioned mobile terminals, such as central processing units and servers. Figure 2 This is a flowchart illustrating another user semantic role mining method based on overlapping clustering according to an embodiment of the present invention, as shown below. Figure 2 As shown, the process includes the following steps:

[0051] Step S201: Obtain the user permission allocation relationship dataset and user attribute data. For details, please refer to [link to relevant documentation]. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0052] Step S202: Generate a user permission matrix based on the user permission allocation relationship dataset. The user permission matrix is ​​a relationship matrix between users and permissions. Optionally, step S202 includes:

[0053] Step a1: Extract user permission allocation relationships from the user permission allocation relationship dataset.

[0054] Step a2: Generate the original user permission matrix based on the user permission allocation relationship, with users as rows and permissions as columns.

[0055] Step a3: Delete duplicate user permission assignment relationships in the original user permission matrix to obtain the user permission matrix.

[0056] Specifically, a machine learning model can be used to extract user permission allocation relationships from the user permission allocation relationship dataset. Based on the extracted user permission allocation relationships, an original user permission matrix is ​​generated with users as rows and permissions as columns. The matrix is ​​then traversed, and duplicate user permission allocation relationships are deleted to obtain the user permission matrix.

[0057] Step S203: Generate a user association graph based on a preset similarity threshold and the user similarity determined by the user permission matrix and user attribute data. Specifically, the user association graph consists of points and edges; points are determined by users, and edges are determined by the similarity between users. Step S203 includes:

[0058] Step b1: Construct an initial user association graph with all users as nodes. Optionally, all users are used as nodes in the initial user association graph, and the nodes can contain the required information, such as user ID, user attributes, user permissions, etc., as needed.

[0059] Step b2 involves calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data. Specifically, step b2 includes:

[0060] Step b21: Calculate the permission similarity between any two users based on the permission matrix using the product of the Jaccard coefficient and the reciprocal of the Hamming distance. Optionally, the permission similarity d(X,Y) between any two users can be calculated using the following formula:

[0061]

[0062] Where X and Y refer to the permission sets of two users, which are the sets of elements (permissions) with a value of 1 in the user permission allocation matrix. Jaccard(X,Y) and H(X,Y) refer to the Jaccard distance and Hamming distance between the two users, used to calculate the proportion and number of differences between the two permission sets. The specific calculation formula is as follows:

[0063]

[0064]

[0065] Where, x i y i This represents a specific permission within a permission set, where n is the number of permissions in the permission set. Common user permissions include: reading inventory, product pricing, managing customer relationships, sales data analysis, managing company personnel, and clocking in and out.

[0066] Step b22: Calculate the attribute similarity between any two users using the cosine coefficient formula based on the user attribute data. Optionally, the attribute similarity cos(P,Q) between any two users can be calculated using the following formula:

[0067]

[0068] Where P and Q represent attribute sets (or vectors) of two users, pi ,q i The attribute set represents a specific attribute within the attribute set, where m represents the number of attributes in the attribute set. Common user attributes include job title, department, and education level. The attribute set can be generated from user attribute data.

[0069] Step b23: Calculate the user similarity between any two users in the initial user association graph based on the weighted sum of permission similarity and attribute similarity. Optionally, the user similarity Sim(u1,u2) between any two users can be calculated by comprehensively considering the influence of permission similarity and attribute similarity on user similarity using the following formula:

[0070] Sim(u1,u2)=w1×d(assignedP(u1),assignedP(u2))+w2

[0071] ×cos(attr1,attr2)

[0072] Where w1 and w2 are the influence weights of user permissions and user attributes on user similarity, respectively, and w1 + w2 = 1; assignedP(u1) and assignedP(u2) are the permission sets corresponding to users u1 and u2, respectively; d(assignedP(u1), assignedP(u2)) is the permission similarity between users u1 and u2; attr1 and attr2 are the attribute sets corresponding to users u1 and u2, respectively; and cos(attr1, attr2) is the attribute similarity between users u1 and u2. Optionally, the user similarity between any two users can be calculated and stored in a user similarity matrix for convenient subsequent use.

[0073] Step b3: If the user similarity between any two users is greater than a preset similarity threshold, add an edge between the two users to obtain a user association graph. Optionally, compare the user similarity calculated in step b2 with the preset similarity threshold. If the user similarity between two users is greater than the preset similarity threshold, add an edge between the two users to establish a user association graph. It should be noted that the preset similarity threshold can be set according to specific circumstances. The larger the threshold, the fewer edges between users, and the more semantic information contained in the same role.

[0074] Step S204: Generate a candidate role set based on the user association graph using an overlapping clustering algorithm. Each candidate role contains multiple users. Optionally, the overlapping clustering algorithm is a latent semantic model algorithm. The input of the algorithm is the user association graph obtained in step b3, and the output is a candidate role set. This candidate role set includes multiple candidate roles, each with its corresponding permissions, which can be used for user permission management to achieve role-based access control. In an optional implementation, the candidate role may include a user ID assigned to that role for easier user management.

[0075] Step S205: Determine the semantic information contained in the candidate role based on the user similarity corresponding to multiple users included in the candidate role. Optionally, step S205 includes:

[0076] Step c1: Obtain the number of users included in the candidate roles.

[0077] Step c2: Determine the semantic information contained in the candidate role based on the number of users and the similarity between the multiple users included in the candidate role. The similarity between multiple users is the sum of the user similarities corresponding to each pair of users. Optionally, the semantic information contained in the candidate role can be calculated using the following formula:

[0078] Int(r)=Sim(assignedUsers(r))

[0079] Where r represents any candidate role, assignedUsers(r) refers to the set of users (multiple users) assigned to that candidate role, and Sim(assignedUsers(r)) represents the similarity of the user set (multiple users), which can be calculated using the following formula:

[0080]

[0081] Where Sim(U) represents the user set U = {u1, u2, ..., u} k The similarity between}, where k represents the number of users in the user set, i.e., the number of users included in the candidate role, Sim(u i ,u j This represents the similarity between any two users within the user set. For details, please refer to [link / reference]. Figure 2 Step b23 of the illustrated embodiment will not be repeated here.

[0082] Step S206: Generate a set of user semantic roles based on the semantic information contained in the candidate roles and a preset threshold. Specifically, step S206 includes:

[0083] Step S2061: Retain candidate roles whose semantic information is greater than or equal to a preset threshold. Optionally, sort the candidate roles according to the size of the semantic information they contain, and retain candidate roles whose semantic information is greater than the preset threshold.

[0084] Step S2062: Obtain multiple users included in the candidate roles whose semantic information is less than a preset threshold.

[0085] Step S2063 involves reassigning roles to multiple users included in candidate roles whose semantic information is less than a preset threshold. Optionally, users included in candidate roles whose semantic information is less than the preset threshold are those who do not meet the semantic information requirements and need to be reassigned roles. Specifically, step S2063 includes:

[0086] Step d1: Select any user from the candidate roles whose semantic information is less than a preset threshold.

[0087] Step d2: After assigning any user to a role in the preset role set based on user similarity calculation, the semantic information contained in each role.

[0088] Step d3: Assign any user to the role with the largest semantic information contained in the preset role set.

[0089] Step d4: Repeat the steps of calculating the semantic information contained in each role after assigning any user to each role in the preset role set, and assigning any user to the role with the largest semantic information contained in the preset role set, until roles are reassigned to all users.

[0090] Optionally, after assigning users who do not meet the semantic information requirements to roles in a preset role set, the semantic information contained in each role is calculated, and the semantic information contained in each role is sorted. The user is then assigned to the role with the highest semantic information in the preset role set, thus achieving the purpose of reallocation. This improves the semantic expression capability of roles and reduces the role management burden of the access control system. The preset role set can be selected according to specific circumstances.

[0091] Step S2064: Determine the user semantic role set based on the retained candidate roles and the reassigned roles. Optionally, the user semantic role set is obtained by following the above steps, which contains a set of roles with semantic information. This embodiment proposes a role mining method based on user similarity measurement and role semantic information evaluation. By drawing a user association graph and using an overlapping clustering algorithm to mine candidate roles, and by using a role semantic information evaluation method to filter candidate roles and reassign users, a set of roles with strong semantic expressiveness is finally obtained, which effectively reduces the role management burden of the access control system and improves the semantic expressiveness of roles.

[0092] This embodiment provides a user semantic role mining method based on overlapping clustering, which can be used in the aforementioned mobile terminals, such as central processing units, servers, etc. The method provided in this embodiment can be applied to any access control system that needs to complete the migration from access control lists (ACLs) to RBAC, or any user permission allocation relationship dataset, which will be referred to as access control dataset for ease of description. Figure 3 This is a flowchart illustrating another user semantic role mining method based on overlapping clustering according to an embodiment of the present invention, as shown below. Figure 3 As shown, the process includes the following steps:

[0093] Step S301: Obtain the user permission allocation relationship, generate a user permission allocation matrix, and perform deduplication. For details, please refer to [link to relevant documentation]. Figure 2 Steps S201 and S202 of the illustrated embodiment will not be described again here.

[0094] Step S302: Calculate user similarity based on the user permission allocation matrix and user attribute data, generate a user association graph, and generate a candidate role set based on an overlap clustering algorithm. For details, please refer to [link to relevant documentation]. Figure 2 Steps S203 and S204 of the illustrated embodiment will not be described again here.

[0095] Step S303: Calculate the semantic information contained in the candidate roles according to the role semantic information evaluation method and filter them, retaining roles that meet the threshold, and reassigning roles to users corresponding to roles that do not meet the threshold, thus obtaining the final role set (user semantic role set). For details, please refer to [link to details]. Figure 2 Steps S205 and S206 of the illustrated embodiment will not be described again here.

[0096] In one alternative implementation, Figure 4 This is a schematic diagram of a method for constructing a user relationship graph according to an embodiment of the present invention. Figure 4 As shown, firstly, permission similarity is calculated based on the user permission allocation matrix; then, attribute similarity is calculated based on user attribute data; finally, user similarity is calculated based on permission similarity and attribute similarity, and stored in the user similarity matrix. For details, please refer to [link to documentation]. Figure 2 Steps b21 to b23 of the illustrated embodiment will not be repeated here; construct an initial user association graph with all users as nodes; determine whether the similarity between two users is greater than a threshold (preset similarity threshold); if it is greater, add an edge between the nodes representing the two users; if not, determine whether the similarity between other two users is greater than the threshold; iterate the above steps until all users are traversed, and finally obtain the user association graph.

[0097] In one alternative implementation, Figure 5 This is a schematic diagram illustrating a method for filtering a candidate character set based on a character semantic information evaluation method according to an embodiment of the present invention. Figure 5 As shown, the semantic information contained in the character is first calculated. For details, please refer to [link / reference]. Figure 2 Steps c1 and c2 of the illustrated embodiment will not be repeated here; then, the candidate roles are sorted according to the size of their semantic information; it is determined whether the semantic information contained in the role meets the threshold (preset threshold); if it does, the role is retained; if it does not, the role is deleted, and a list of users whose roles need to be reassigned is generated; the final set of roles, i.e., the user semantic role set, is obtained.

[0098] Optionally, Figure 6 This is a schematic diagram illustrating a method for reallocating users who do not meet a preset threshold according to an embodiment of the present invention. Figure 6 As shown, the process first checks if the list of users whose roles need to be reassigned is empty. If the list is empty, it means there are no roles that need to be reassigned, and a new set of roles can be obtained. If the list is not empty, the user is retrieved from the list of users whose roles need to be reassigned. The user is assigned to each role in the set of roles that meet the requirements, and the semantic information contained in the role is calculated. The roles in the new set of roles are sorted according to the size of the semantic information. The user is added to the role with the largest semantic information. The user is deleted from the list. Then, the process of checking if the list of users whose roles need to be reassigned is empty and subsequent steps are executed.

[0099] This embodiment proposes a role mining method based on user similarity measurement and role semantic information evaluation. By drawing a user association graph and using an overlapping clustering algorithm to mine candidate roles, the method filters candidate roles and redistributes users through a role semantic information evaluation method, and finally obtains a set of roles with strong semantic expressiveness. This effectively reduces the role management burden of the access control system and improves the semantic expressiveness of roles.

[0100] This embodiment also provides a user semantic role mining device based on overlapping clustering, which is used to implement the above embodiments and preferred embodiments, and will not be repeated as already described. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0101] This embodiment provides a user semantic role mining device based on overlapping clustering, such as Figure 7As shown, it includes: a data acquisition module 701, used to acquire a user permission allocation relationship dataset and user attribute data; a user permission matrix generation module 702, used to generate a user permission matrix based on the user permission allocation relationship dataset, wherein the user permission matrix is ​​a relationship matrix between users and permissions; a user association graph generation module 703, used to generate a user association graph based on a preset similarity threshold and user similarity determined by the user permission matrix and user attribute data; a candidate role set generation module 704, used to generate a candidate role set based on the user association graph using an overlap clustering algorithm, wherein any candidate role contains multiple users; a semantic information determination module 705, used to determine the semantic information contained in the candidate role based on the user similarity corresponding to the multiple users contained in the candidate role; and a semantic role set generation module 706, used to generate a user semantic role set based on the semantic information contained in the candidate role and a preset threshold.

[0102] In one optional implementation, the semantic role set generation module includes: a retention unit for retaining candidate roles whose semantic information is greater than or equal to a preset threshold; an acquisition unit for acquiring multiple users included in candidate roles whose semantic information is less than the preset threshold; an allocation unit for reallocating roles to the multiple users included in candidate roles whose semantic information is less than the preset threshold; and a determination unit for determining a user semantic role set based on the retained candidate roles and the reallocated roles.

[0103] In one optional implementation, the allocation unit includes: a selection subunit for selecting any user among candidate roles whose semantic information is less than a preset threshold; a calculation subunit for calculating the semantic information contained in each role after assigning any user to each role in the preset role set based on user similarity; an allocation subunit for assigning any user to the role with the largest semantic information contained in the preset role set; and a looping subunit for repeatedly executing the steps of calculating the semantic information contained in each role after assigning any user to each role in the preset role set and assigning any user to the role with the largest semantic information contained in the preset role set until roles are reassigned to all users.

[0104] In one optional implementation, the user permission matrix generation module includes: an extraction unit for extracting user permission allocation relationships from a user permission allocation relationship dataset; a generation unit for generating an original user permission matrix based on the user permission allocation relationships, with users as rows and permissions as columns; and a obtaining unit for deleting duplicate user permission allocation relationships from the original user permission matrix to obtain the user permission matrix.

[0105] In one optional implementation, the user association graph generation module includes: a construction unit for constructing an initial user association graph with all users as nodes; a user similarity calculation unit for calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data; and an association graph obtaining unit for adding an edge between any two users if the user similarity between any two users is greater than a preset similarity threshold, thereby obtaining the user association graph.

[0106] In one optional implementation, the user similarity calculation unit includes: a permission similarity calculation subunit, used to calculate the permission similarity between any two users based on the permission matrix using the product of the Jaccard coefficient and the reciprocal of the Hamming distance; an attribute similarity calculation subunit, used to calculate the attribute similarity between any two users based on user attribute data using the cosine coefficient formula; and a user similarity calculation subunit, used to calculate the user similarity between any two users in the initial user association graph based on the weighted sum of permission similarity and attribute similarity.

[0107] In one optional implementation, the semantic information determination module includes: a user count acquisition unit, used to acquire the number of users included in the candidate role; and a semantic information determination unit, used to determine the semantic information included in the candidate role based on the number of users and the similarity of multiple users included in the candidate role, wherein the similarity of multiple users is the sum of the user similarities corresponding to pairwise combinations of multiple users.

[0108] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0109] In this embodiment, the user semantic role mining device based on overlapping clustering is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit), a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0110] This invention also provides a computer device having the above-described features. Figure 7 The illustrated device for mining user semantic roles based on overlapping clustering.

[0111] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 8As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 8 Take a processor 10 as an example.

[0112] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0113] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0114] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0115] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0116] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0117] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0118] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A user semantic role mining method based on overlapping clustering, characterized in that, The method includes: Obtain the user permission allocation relationship dataset and user attribute data; A user permission matrix is ​​generated based on the user permission allocation relationship dataset, and the user permission matrix is ​​a relationship matrix between users and permissions. A user association graph is generated based on a preset similarity threshold and the user similarity determined by the user permission matrix and the user attribute data; An overlap clustering algorithm is used to generate a set of candidate roles based on the user association graph, where each candidate role contains multiple users; The semantic information contained in the candidate role is determined based on the user similarity between the multiple users included in the candidate role. A set of user semantic roles is generated based on the semantic information contained in the candidate roles and a preset threshold.

2. The user semantic role mining method based on overlapping clustering according to claim 1, characterized in that, The step of generating a set of user semantic roles based on the semantic information contained in the candidate roles and a preset threshold includes: Retain candidate roles whose semantic information is greater than or equal to a preset threshold; Retrieve multiple users from candidate roles whose semantic information is less than a preset threshold; Reassign roles to multiple users included in candidate roles whose semantic information is less than a preset threshold; The set of user semantic roles is determined based on the retained candidate roles and the reassigned roles.

3. The user semantic role mining method based on overlapping clustering according to claim 2, characterized in that, The reassignment of roles to multiple users for candidate roles whose semantic information is less than a preset threshold includes: Select any user from the candidate roles whose semantic information is less than a preset threshold; After assigning any user to a role in a preset role set based on user similarity calculation, the semantic information contained in each role; Assign any user to the role with the largest semantic information contained in the preset role set; The process of repeatedly calculating the semantic information contained in each role after assigning any user to each role in the preset role set, and assigning any user to the role with the largest semantic information contained in the preset role set, continues until roles are reassigned to all users.

4. The user semantic role mining method based on overlapping clustering according to claim 1, characterized in that, The step of generating a user permission matrix based on the user permission allocation relationship dataset, wherein the user permission matrix is ​​a relationship matrix between users and permissions, includes: Extract user permission allocation relationships from the user permission allocation relationship dataset; Based on the user permission allocation relationship, an original user permission matrix is ​​generated with users as rows and permissions as columns; The duplicate user permission allocation relationships in the original user permission matrix are deleted to obtain the user permission matrix.

5. The user semantic role mining method based on overlapping clustering according to claim 1, characterized in that, The step of generating a user association graph based on a preset similarity threshold and user similarity determined by the user permission matrix and the user attribute data includes: Construct an initial user relationship graph with all users as nodes; Calculate the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data; If the user similarity between any two users is greater than a preset similarity threshold, an edge is added between the two users to obtain a user association graph.

6. The user semantic role mining method based on overlapping clustering according to claim 5, characterized in that, The step of calculating the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data includes: The permission similarity between any two users is calculated by multiplying the Jaccard coefficient and the reciprocal of the Hamming distance based on the permission matrix. Calculate the attribute similarity between any two users using the cosine coefficient formula based on user attribute data; The user similarity between any two users in the initial user association graph is calculated based on the weighted sum of the permission similarity and the attribute similarity.

7. The user semantic role mining method based on overlapping clustering according to claim 1, characterized in that, The step of determining the semantic information contained in a candidate role based on the user similarity among multiple users included in the candidate role includes: Get the number of users included in the candidate roles; The semantic information contained in the candidate role is determined based on the number of users and the similarity of multiple users included in the candidate role. The similarity of the multiple users is the sum of the user similarity corresponding to each pair of multiple users.

8. A user semantic role mining device based on overlapping clustering, characterized in that, The device includes: The data acquisition module is used to acquire user permission allocation relationship datasets and user attribute data; The user permission matrix generation module is used to generate a user permission matrix based on the user permission allocation relationship dataset, wherein the user permission matrix is ​​a relationship matrix between users and permissions. The user association graph generation module is used to generate a user association graph based on a preset similarity threshold and the user similarity determined by the user permission matrix and the user attribute data. The candidate role set generation module is used to generate a candidate role set based on the user association graph using an overlapping clustering algorithm, wherein any candidate role contains multiple users; The semantic information determination module is used to determine the semantic information contained in the candidate role based on the user similarity corresponding to multiple users included in the candidate role; The semantic role set generation module is used to generate a user semantic role set based on the semantic information contained in the candidate roles and a preset threshold.

9. The user semantic role mining device based on overlapping clustering according to claim 8, characterized in that, The semantic role set generation module includes: The retention unit is used to retain candidate roles whose semantic information is greater than or equal to a preset threshold. The acquisition unit is used to acquire multiple users included in candidate roles whose semantic information is less than a preset threshold; The allocation unit is used to reassign roles to multiple users included in candidate roles whose semantic information is less than a preset threshold. The determining unit is used to determine the set of user semantic roles based on the retained candidate roles and the reassigned roles.

10. The user semantic role mining device based on overlapping clustering according to claim 9, characterized in that, The allocation unit includes: Select a sub-unit to select any user included in a candidate role whose semantic information is less than a preset threshold; The calculation subunit is used to calculate the semantic information contained in each role after assigning any user to each role in the preset role set based on user similarity. The allocation subunit is used to assign any user to the role with the largest semantic information contained in the preset role set; The loop subunit is used to repeatedly execute the steps of calculating the semantic information contained in each role after assigning any user to each role in the preset role set, and assigning any user to the role with the largest semantic information contained in the preset role set until roles are reassigned to all users.

11. The user semantic role mining device based on overlapping clustering according to claim 8, characterized in that, The user permission matrix generation module includes: The extraction unit is used to extract user permission allocation relationships from the user permission allocation relationship dataset. The generation unit is used to generate an original user permission matrix based on the user permission allocation relationship, with users as rows and permissions as columns. The unit is used to delete duplicate user permission allocation relationships in the original user permission matrix to obtain the user permission matrix.

12. The user semantic role mining device based on overlapping clustering according to claim 8, characterized in that, The user association graph generation module includes: The building unit is used to construct an initial user relationship graph with all users as nodes; The user similarity calculation unit is used to calculate the user similarity between any two users in the initial user association graph based on the user permission matrix and user attribute data. The association graph generation unit is used to add an edge between any two users if the user similarity between any two users is greater than a preset similarity threshold, thereby obtaining a user association graph.

13. The user semantic role mining device based on overlapping clustering according to claim 12, characterized in that, The user similarity calculation unit includes: The permission similarity calculation subunit is used to calculate the permission similarity between any two users based on the permission matrix using the product of the Jaccard coefficient and the reciprocal of the Hamming distance; The attribute similarity calculation subunit is used to calculate the attribute similarity between any two users based on user attribute data using the cosine coefficient formula; The user similarity calculation subunit is used to calculate the user similarity between any two users in the initial user association graph based on the weighted sum of the permission similarity and the attribute similarity.

14. The user semantic role mining device based on overlapping clustering according to claim 8, characterized in that, The semantic information determination module includes: The user count acquisition unit is used to obtain the number of users included in the candidate role; The semantic information determination unit is used to determine the semantic information contained in the candidate role based on the number of users and the similarity of multiple users contained in the candidate role, wherein the similarity of the multiple users is the sum of the user similarities corresponding to each pair of multiple users.

15. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform the user semantic role mining method based on overlapping clustering as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the user semantic role mining method based on overlapping clustering as described in any one of claims 1 to 7.

Images