Zero-trust dynamic behavior computing method, system and device based on browser

Abstract

The present invention discloses a zero-trust dynamic behavior calculation method, system and device based on a browser, the method comprising: obtaining relevant data in the access alarm log, baseline detection log and multi-factor authentication information generated during the user access process; based on the relevant data of the access alarm log and the baseline detection log, and in combination with the threshold verification model, a threshold verification is performed, and if the number reaches a preset threshold, a confidence change request is triggered; in response to the confidence change request, the confidence is calculated based on a preset confidence change model to obtain a confidence change value; if the confidence change value exceeds the threshold, the user is processed based on the current confidence level in combination with the dynamic policy information to obtain the processing result. Management is more convenient and flexible: the user's access resource policy is changed through the user's actual access behavior, and the administrator does not need to add new policies to temporarily modify the policies of certain employees.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a browser-based zero-trust dynamic behavior computing method, system and device. Background Art

[0002] At present, the policy configuration in zero-trust products is overly dependent on the manual configuration of administrators. According to the company's business foundation, personnel and resources are reasonably allocated and authorized. However, when the rules are configured strictly, some small changes in the employee access environment and context information will affect the actual use of employees; when the rules are configured too loosely, it cannot play a good protective effect. If you need to adapt to the environment, the administrator needs to adjust the policy configuration in time, which has a high labor cost and is prone to generate a large amount of redundant policy configuration data, which increases the computing pressure of related modules and makes the system less smooth. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention provides a browser-based zero-trust dynamic behavior calculation method, system, device and readable storage medium.

[0004] In order to solve the above technical problems, the present invention is solved by the following technical solutions:

[0005] A zero-trust dynamic behavior calculation method based on a browser includes the following steps:

[0006] Obtain access log information, alarm logs, access alarm logs generated during the process of blocking user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0007] Based on the relevant data of the access alarm log and the baseline detection log, the threshold verification is performed in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, which is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0008] In response to the confidence change request, the confidence is calculated based on a preset confidence change model to obtain a confidence change value;

[0009] If the confidence change value exceeds the threshold, the user is processed based on the current confidence level to determine whether he or she has access rights to resources of different sensitivity levels in combination with the dynamic policy information to obtain a processing result.

[0010] As an implementable method, the threshold verification model further includes periodic threshold verification and banned user detection;

[0011] The periodic threshold check is: based on a preset time interval, regularly counting the number of times and calculating the confidence using a preset confidence change model;

[0012] The user account blocking detection is: when the user account access process, the triggered handling arrangement action is "blocking the user" or the confidence is less than the preset threshold, the user account is blocked and the confidence cannot be automatically updated.

[0013] The real-time threshold verification also includes: when a multi-factor authentication is performed during user access, a confidence change is immediately triggered.

[0014] As an implementable method, the step of calculating the confidence based on a preset confidence change model to obtain a confidence change value includes the following steps:

[0015] Mark the information that can be marked in the access log, obtain the first confidence through the LightGBM algorithm model, and obtain the second confidence through the KNN algorithm model;

[0016] A weighted mean is obtained based on the first confidence level and the second confidence level, and the weighted mean is the confidence level change value.

[0017] As an implementable method, the LightGBM algorithm model, the training process is as follows:

[0018] Build the LightGBM initial model and loss function;

[0019] Train the initial LightGBM model, that is, obtain the gradient and second-order derivative of the loss function based on each training sample, build a new decision tree based on the gradient and second-order derivative, divide the nodes of the decision tree based on the gradient and second-order derivative, and add the new decision tree to the initial LightGBM model;

[0020] Until the training reaches the specified number of iterations or meets other stopping conditions, the optimal LightGBM algorithm model is obtained.

[0021] As an implementable method, the training process of the KNN algorithm model is as follows:

[0022] The distance between the new data point and other training samples is obtained through the Euclidean distance formula;

[0023] Based on the distance, select the K training samples with the closest distance as neighbors;

[0024] A new data point is selected by voting, and the category of the new data point is the most common category among the K nearest neighbors, thereby obtaining the optimal KNN algorithm model.

[0025] As an implementable method, the confidence level includes at least six levels, specifically:

[0026] The first level of confidence can normally access resources with sensitivity levels 1-5;

[0027] The second level of confidence can normally access resources with sensitivity levels 1-4;

[0028] The third level of confidence can normally access resources with sensitivity levels 1-3;

[0029] The fourth level of confidence can normally access resources with a sensitivity level of 1-2;

[0030] The fifth level of confidence can normally access resources with a sensitivity level of 1;

[0031] Level 6 confidence cannot access any resources, but can restore confidence through multi-factor authentication and periodic threshold verification to gain access rights;

[0032] Among them, new user accounts are configured as the first level of confidence.

[0033] As an implementation method, the method combines dynamic policy information to process whether the user has access rights to resources of different sensitivity levels based on the current confidence level, including the following steps:

[0034] Obtaining environment data and the user's current policy information, where the policy information includes a key, which is formed by the user ID and resource ID, and different users have different keys;

[0035] The effective dynamic policy information is obtained by combining the policy status, policy timeliness and policy priority of the policy associated with the user.

[0036] As an implementable method, the following steps are also included:

[0037] The effective dynamic policy information includes policy execution points and handling orchestration actions;

[0038] Based on the effective dynamic policy information, when a user accesses a resource, the policy execution point monitors the access compliance in real time. If non-compliance is found, a disposal orchestration action is triggered and it is determined whether the confidence level has changed; if the confidence level has changed, the disposal orchestration action is executed.

[0039] A zero-trust dynamic behavior calculation method system based on a browser, comprising a data acquisition module, a judgment verification module, a confidence calculation module and a processing result module;

[0040] The data acquisition module is used to acquire access log information, alarm logs, access alarm logs generated during the process of blocking and managing user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0041] The judgment verification module is used to perform threshold verification based on relevant data of the access alarm log and the baseline detection log in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, and the real-time threshold verification is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0042] The confidence calculation module is used to calculate the confidence based on a preset confidence change model in response to the confidence change request to obtain a confidence change value;

[0043] The processing result module is configured to: if the confidence change value exceeds a threshold, process whether the user has access rights to resources of different sensitivity levels based on the current confidence level based on a preset change model to obtain a processing result.

[0044] A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the following method:

[0045] Obtain access log information, alarm logs, access alarm logs generated during the process of blocking user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0046] Based on the relevant data of the access alarm log and the baseline detection log, the threshold verification is performed in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, which is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0047] In response to the confidence change request, the confidence is calculated based on a preset confidence change model to obtain a confidence change value;

[0048] If the confidence change value exceeds the threshold, the user is processed based on the current confidence level to determine whether he or she has access rights to resources of different sensitivity levels in combination with the dynamic policy information to obtain a processing result.

[0049] A device for a zero-trust dynamic behavior computing method implemented based on a browser includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following method when executing the computer program:

[0050] Obtain access log information, alarm logs, access alarm logs generated during the process of blocking user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0051] Based on the relevant data of the access alarm log and the baseline detection log, the threshold verification is performed in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, which is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0052] In response to the confidence change request, the confidence is calculated based on a preset confidence change model to obtain a confidence change value;

[0053] If the confidence change value exceeds the threshold, the user is processed based on the current confidence level to determine whether he or she has access rights to resources of different sensitivity levels in combination with the dynamic policy information to obtain a processing result.

[0054] The present invention has significant technical effects due to the adoption of the above technical solution:

[0055] Through the solution of the present invention, management is more convenient and flexible: the policy for user access to resources is changed according to the user's actual access behavior, and there is no need for the administrator to add new policies to temporarily modify the policies of certain employees; the management and control is more fine-grained: changes in policy information will only affect certain resources of a certain user, and will not affect the policy information itself and the access of other users to the application; the management and control is safer: different confidence levels can access application resources of different sensitivity levels, and policy information can be changed in time to protect resources with higher sensitivity levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0057] Figure 1 It is a schematic diagram of the overall process of the method of the present invention;

[0058] Figure 2 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0059] The present invention is further described in detail below in conjunction with embodiments. The following embodiments are for explanation of the present invention but the present invention is not limited to the following embodiments.

[0060] Embodiment 1:

[0061] A browser-based zero-trust dynamic behavior computing method, such as Figure 1 As shown, the following steps are included:

[0062] S100, obtaining access log information, alarm logs, access alarm logs generated during the process of blocking and managing user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0063] S200, based on the relevant data of the access alarm log and the baseline detection log, and in combination with the threshold verification model, threshold verification is performed, wherein the threshold verification model at least includes real-time threshold verification, and the real-time threshold verification is to count the number of access alarms, baseline detections, and multi-factor authentications occurring per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0064] S300, in response to a confidence change request, calculating the confidence based on a preset confidence change model to obtain a confidence change value;

[0065] S400: If the confidence change value exceeds a threshold, processing is performed based on the dynamic policy information to determine whether the user has access rights to resources of different sensitivity levels based on the current confidence level, and a processing result is obtained.

[0066] In step S200, the threshold verification model also includes periodic threshold verification and banned user detection;

[0067] The periodic threshold check is: based on a preset time interval, regularly counting the number of times and calculating the confidence using a preset confidence change model;

[0068] The user account blocking detection is: when the user account access process, the triggered handling arrangement action is "blocking the user" or the confidence is less than the preset threshold, the user account is blocked and the confidence cannot be automatically updated.

[0069] That is, the verification includes: Real-time threshold verification: when the access alarm log and baseline detection log generated during the user access process, or after multi-factor authentication, the number of occurrences per unit time will be counted, and if a certain threshold is reached, the confidence change will be triggered; when the user successfully performs multi-factor authentication, the confidence change will be triggered immediately;

[0070] Periodic threshold verification: The dynamic behavior calculation engine will regularly count and calculate the confidence changes based on the weekly / monthly dimensions;

[0071] Banned user detection: When a user triggers a policy with the action of "banning the user" or the confidence level drops to a certain level, the user account will be banned. The confidence level of such users cannot be automatically restored, and the administrator needs to manually lift the ban status after eliminating the threat.

[0072] In step S300, the confidence is calculated based on the preset confidence change model to obtain the confidence change value, including the following steps:

[0073] Mark the information that can be marked in the access log, obtain the first confidence through the LightGBM algorithm model, and obtain the second confidence through the KNN algorithm model;

[0074] A weighted mean is obtained based on the first confidence level and the second confidence level, and the weighted mean is the confidence level change value.

[0075] The LightGBM algorithm model training process is as follows:

[0076] Build the LightGBM initial model and loss function;

[0077] Train the initial LightGBM model, that is, obtain the gradient and second-order derivative of the loss function based on each training sample, build a new decision tree based on the gradient and second-order derivative, divide the nodes of the decision tree based on the gradient and second-order derivative, and add the new decision tree to the initial LightGBM model;

[0078] Until the training reaches the specified number of iterations or meets other stopping conditions, the optimal LightGBM algorithm model is obtained.

[0079] The training process of the KNN algorithm model is as follows:

[0080] The distance between the new data point and other training samples is obtained through the Euclidean distance formula;

[0081] Based on the distance, select the K training samples with the closest distance as neighbors;

[0082] A new data point is selected by voting, and the category of the new data point is the most common category among the K nearest neighbors, thereby obtaining the optimal KNN algorithm model.

[0083] The confidence calculation is divided into supervised learning and unsupervised learning according to data features: After marking the markable information in the access log, the first confidence data is calculated through the LightGBM algorithm, and then the second confidence data is calculated by combining it with the access information through the KNN algorithm. The two values ​​are then calculated as a weighted mean, which is the change value of the confidence calculated this time.

[0084] LightGBM model training:

[0085] Initially, the model is a constant predictor, usually the mean of the target variable;

[0086] For each training sample, the gradient and second-order derivative of the loss function are calculated based on the current model. The inconsistency of the model is measured by the mean square error loss in the loss function:

[0087]

[0088] Build a decision tree based on gradients and second-order derivatives: In each iteration, use gradients and second-order derivatives to partition tree nodes, and the optimization goal is to maximize the reduction of the loss function. Add new trees to the model and update the predicted values;

[0089] Repeat the above steps until the specified number of iterations is reached or other stopping conditions are met. The results of all trees are combined to obtain the final model.

[0090] KNN model training:

[0091] The distance between the new data point and other training samples is calculated using the Euclidean distance formula;

[0092]

[0093] Based on the calculated distance, select the K nearest training samples as neighbors;

[0094] Finally, the voting method is used, that is, the category of the new data point is the most common category among its K nearest neighbors;

[0095] After the model is trained, when new user access data and alarm information enter, the result values ​​x1 and x2 given by the two training models will be obtained in the two models respectively. The weights are set to 0.5 and 0.5 respectively (the initial values ​​need to be adjusted according to the actual data), and the final change value can be obtained according to the formula:

[0096]

[0097] Dynamically change the policy, that is, combine the dynamic policy information to process whether the user has access rights to resources of different sensitivity levels based on the current confidence level: that is, after the user performs multi-factor authentication or the confidence level is restored, the user is granted access rights to the relevant resources; when the user's confidence level is downgraded, the user's access rights to the corresponding resources are deleted;

[0098] The confidence level is divided into six levels: a, b, c, d, e, and f (system default, administrators can modify): Level a can normally access resources with sensitivity levels of 1-5; Level b can normally access resources with sensitivity levels of 1-4; Level c can normally access resources with sensitivity levels of 1-3; Level d can normally access resources with sensitivity levels of 1 and 2; Level e can only normally access resources with sensitivity level 1;

[0099] Level f users cannot access any resources, but can obtain access rights through multi-factor authentication and periodic calculation of confidence recovery. Blocked users cannot use multi-factor authentication and periodic calculation of confidence recovery, and can only obtain a certain level of initial confidence value after the administrator manually lifts the ban.

[0100] New users have a level A confidence by default. User confidence also has a threshold range. Changes in user confidence during subsequent use will not exceed the threshold range.

[0101] In step S400, the process of determining whether the user has access rights to resources of different sensitivity levels based on the current confidence level in combination with the dynamic policy information includes the following steps:

[0102] Obtaining environment data and the user's current policy information, where the policy information includes a key, which is formed by the user ID and resource ID, and different users have different keys;

[0103] The effective dynamic policy information is obtained by combining the policy status, policy timeliness and policy priority of the policy associated with the user.

[0104] In addition, the effective dynamic policy information includes policy execution points and handling orchestration actions;

[0105] Based on the effective dynamic policy information, when a user accesses a resource, the policy execution point monitors the access compliance in real time. If non-compliance is found, a disposal orchestration action is triggered and it is determined whether the confidence level has changed; if the confidence level has changed, the disposal orchestration action is executed.

[0106] That is to say: when a user accesses a resource, the policy execution point will monitor the access compliance in real time. If non-compliance is found, the corresponding policy action will be taken immediately and the data collection layer will be notified; at the same time, it will affect the user confidence score. When the user confidence level changes, the data will be sent to the action orchestration engine, which will automatically respond and handle it according to the arranged "script". The "script" is configured by the system by default, and the administrator can modify the key parameters (modify the score threshold of the user confidence level, the security level of resources accessible to different user levels): users with different confidence levels can make policy changes to resources with existing permissions based on the security level of the resource itself, and have the right to directly revoke the user's access rights to the application or require the user to perform secondary authentication before accessing the corresponding resources.

[0107] In actual operation, the backend administrator needs to configure permissions for users, user departments, application groups, applications, application resources, and application tags on the configuration management side, and select policy rules and their disposal actions based on actual business needs;

[0108] After configuration, the data is converted into user and resource dimensions, the configured data is calculated according to the policy status, timeliness and priority, and the final calculation results are stored;

[0109] According to the classification of policy information, different data will be notified to users at different ends respectively, so that the user's policy changes in real time according to the administrator's operation; at the same time, the disposal orchestration action will be notified, which will automatically handle the orchestration action according to the data and notify the policy execution point of the disposal result;

[0110] The user's access log is generated during the user's access to resources. Abnormal access situations will be directly blocked by the policy execution point and disposal actions will be taken; normal access logs will be regularly extracted, cleaned and pre-processed by the data analysis engine, and the user's behavior analysis results can be obtained and the user's confidence score can be re-evaluated.

[0111] Embodiment 2:

[0112] A browser-based zero-trust dynamic behavior computing method system, such as Figure 2 As shown, it includes a data acquisition module 100, a judgment and verification module 200, a confidence calculation module 300 and a processing result module 400;

[0113] The data acquisition module 100 is used to acquire access log information, alarm logs, access alarm logs generated during the process of blocking and managing user access, baseline detection logs, and relevant data in multi-factor authentication information;

[0114] The judgment verification module 200 is used to perform threshold verification based on the relevant data of the access alarm log and the baseline detection log in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, and the real-time threshold verification is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold;

[0115] The confidence calculation module 300 is used to calculate the confidence based on a preset confidence change model in response to a confidence change request to obtain a confidence change value;

[0116] The processing result module 400 is configured to: if the confidence change value exceeds a threshold, process whether the user has access rights to resources of different sensitivity levels based on the current confidence level based on a preset change model to obtain a processing result.

[0117] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0118] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] It should be noted that:

[0123] The "one embodiment" or "embodiment" mentioned in the specification means that the specific features, structures or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present invention. Therefore, the phrases "one embodiment" or "embodiment" appearing in various places throughout the specification do not necessarily refer to the same embodiment.

[0124] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic creative concepts. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. In addition, it should be noted that the shapes, names, etc. of the parts and components of the specific embodiments described in this specification may be different. All equivalent or simple changes made according to the structure, features and principles described in the patent concept of the present invention are included in the protection scope of the patent of the present invention. Those skilled in the art of the technical field to which the present invention belongs may make various modifications or supplements to the described specific embodiments or replace them in a similar manner, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A zero-trust dynamic behavior computing method based on a browser, characterized in that: The following steps are involved: Obtain access log information, alarm logs, access alarm logs generated during the process of blocking user access, baseline detection logs, and relevant data in multi-factor authentication information; Based on the relevant data of the access alarm log and the baseline detection log, the threshold verification is performed in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, which is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold; In response to the confidence change request, the confidence is calculated based on a preset confidence change model to obtain a confidence change value; If the confidence change value exceeds the threshold, the user is processed based on the current confidence level to determine whether he or she has access rights to resources of different sensitivity levels in combination with the dynamic policy information to obtain a processing result; The step of calculating the confidence based on the preset confidence change model to obtain the confidence change value includes the following steps: Mark the information that can be marked in the access log, obtain the first confidence through the LightGBM algorithm model, and obtain the second confidence through the KNN algorithm model; A weighted mean is obtained based on the first confidence level and the second confidence level, wherein the weighted mean is the confidence level change value; Among them, the LightGBM algorithm model, the training process is as follows: Build the LightGBM initial model and loss function; Train the initial LightGBM model, that is, obtain the gradient and second-order derivative of the loss function based on each training sample, build a new decision tree based on the gradient and second-order derivative, divide the nodes of the decision tree based on the gradient and second-order derivative, and add the new decision tree to the initial LightGBM model; Until the training reaches the specified number of iterations or meets other stopping conditions, the optimal LightGBM algorithm model is obtained; Among them, the KNN algorithm model and training process are as follows: The distance between the new data point and other training samples is obtained through the Euclidean distance formula; Based on the distance, select the K training samples with the closest distance as neighbors; A new data point is selected by voting, and the category of the new data point is the most common category among the K nearest neighbors, thereby obtaining the optimal KNN algorithm model.

2. The browser-based zero-trust dynamic behavior computing method according to claim 1 is characterized in that: The threshold verification model also includes periodic threshold verification and banned user detection; The periodic threshold check is: based on a preset time interval, regularly counting the number of times and calculating the confidence using a preset confidence change model; The banned user detection is: when the user account access process triggers the handling arrangement action of "banning the user" or the confidence is less than the preset threshold, the user account is banned and the confidence cannot be automatically updated; The real-time threshold verification also includes: when a multi-factor authentication is performed during user access, a confidence change is immediately triggered.

3. The browser-based zero-trust dynamic behavior computing method according to claim 1 or 2, characterized in that: The confidence level includes at least six levels, specifically: The first level of confidence can normally access resources with sensitivity levels 1-5; The second level of confidence can normally access resources with sensitivity levels 1-4; The third level of confidence can normally access resources with sensitivity levels 1-3; The fourth level of confidence can normally access resources with a sensitivity level of 1-2; The fifth level of confidence can normally access resources with a sensitivity level of 1; Level 6 confidence cannot access any resources, but can restore confidence through multi-factor authentication and periodic threshold verification to gain access rights; Among them, new user accounts are configured as the first level of confidence.

4. The browser-based zero-trust dynamic behavior computing method according to claim 1, characterized in that: The method combines the dynamic policy information to determine whether the user has access rights to resources of different sensitivity levels based on the current confidence level, including the following steps: Obtaining environment data and the user's current policy information, wherein the policy information includes a key, which is formed by the user ID and resource ID, and different users have different keys; The effective dynamic policy information is obtained by combining the policy status, policy timeliness and policy priority of the policy associated with the user.

5. The browser-based zero-trust dynamic behavior computing method according to claim 4 is characterized in that: The following steps are also included: The effective dynamic policy information includes policy execution points and handling orchestration actions; Based on the effective dynamic policy information, when a user accesses a resource, the policy execution point monitors the access compliance in real time. If non-compliance is found, a disposal orchestration action is triggered and it is determined whether the confidence level has changed; if the confidence level has changed, the disposal orchestration action is executed.

6. A browser-based zero-trust dynamic behavior computing system, characterized in that: It includes a data acquisition module, a judgment and verification module, a confidence calculation module and a processing result module; The data acquisition module is used to acquire access log information, alarm logs, access alarm logs generated during the process of blocking and managing user access, baseline detection logs, and relevant data in multi-factor authentication information; The judgment verification module is used to perform threshold verification based on relevant data of the access alarm log and the baseline detection log in combination with the threshold verification model, wherein the threshold verification model at least includes real-time threshold verification, and the real-time threshold verification is to count the number of access alarms, baseline detections and multi-factor authentications per unit time during the user access process, and trigger a confidence change request if the number reaches a preset threshold; The confidence calculation module is used to calculate the confidence based on a preset confidence change model in response to the confidence change request to obtain a confidence change value; The processing result module is configured to: if the confidence change value exceeds a threshold, process whether the user has access rights to resources of different sensitivity levels based on the current confidence level based on a preset change model to obtain a processing result; The step of calculating the confidence based on the preset confidence change model to obtain the confidence change value includes the following steps: Mark the information that can be marked in the access log, obtain the first confidence through the LightGBM algorithm model, and obtain the second confidence through the KNN algorithm model; A weighted mean is obtained based on the first confidence level and the second confidence level, wherein the weighted mean is the confidence level change value; Among them, the LightGBM algorithm model, the training process is as follows: Build the LightGBM initial model and loss function; Train the initial LightGBM model, that is, obtain the gradient and second-order derivative of the loss function based on each training sample, build a new decision tree based on the gradient and second-order derivative, divide the nodes of the decision tree based on the gradient and second-order derivative, and add the new decision tree to the initial LightGBM model; Until the training reaches the specified number of iterations or meets other stopping conditions, the optimal LightGBM algorithm model is obtained; Among them, the KNN algorithm model and training process are as follows: The distance between the new data point and other training samples is obtained through the Euclidean distance formula; Based on the distance, select the K training samples with the closest distance as neighbors; A new data point is selected by voting, and the category of the new data point is the most common category among the K nearest neighbors, thereby obtaining the optimal KNN algorithm model.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

8. A device for implementing a zero-trust dynamic behavior computing method based on a browser, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

Images