Network access control method, device, equipment and medium

Abstract

The embodiment of the present invention discloses a network access control method, device, equipment and medium. The method includes: in response to a target access instruction of a digital resource, obtaining access association data of the digital resource; based on the access association data of the digital resource, predicting the digital resource to be accessed to obtain candidate digital resources and the prediction probability of the candidate digital resources; selecting a target digital resource from the candidate digital resources according to the prediction probability of the candidate digital resources; selecting a target access restriction rule matching the target digital resource from the pre-constructed candidate access restriction rules according to the target digital resource, and verifying the target digital resource according to the target access restriction rule, and performing network access control on the digital resource according to the verification result. The above scheme improves the accuracy of the determined target digital resource, thereby improving the security of network access control.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a network access control method, device, equipment and medium. Background Art

[0002] Network access control refers to the management and protection of network resources to ensure that only authorized users can access these resources. As network security issues become increasingly prominent, network access control has become one of the important means to ensure network security. Traditional network access control methods mainly rely on static identity authentication and access control lists, which are easy to be bypassed and difficult to cope with complex network environments. Therefore, how to improve the security of network access control is crucial. Summary of the invention

[0003] The present invention provides a network access control method, device, equipment and medium to improve the security of network access control.

[0004] According to one aspect of the present invention, there is provided a network access control method, comprising:

[0005] In response to a target access instruction of a digital resource, acquiring access-related data of the digital resource;

[0006] Based on the access-related data of the digital resource, predict the digital resource to be accessed to obtain candidate digital resources and prediction probabilities of the candidate digital resources; wherein the access-related data of the digital resource includes at least one of the following: target user feature data and resource feature data of the digital resource;

[0007] Selecting a target digital resource from the candidate digital resources according to the predicted probability of the candidate digital resources;

[0008] According to the target digital resource, a target access restriction rule matching the target digital resource is selected from pre-constructed candidate access restriction rules, and the target digital resource is verified according to the target access restriction rule, and network access control is performed on the digital resource according to the verification result.

[0009] According to another aspect of the present invention, there is provided a network access control device, comprising:

[0010] A data acquisition module, configured to acquire access-related data of the digital resource in response to a target access instruction of the digital resource;

[0011] A resource prediction module, configured to predict the digital resources to be accessed based on the access-related data of the digital resources to obtain candidate digital resources and prediction probabilities of the candidate digital resources; wherein the access-related data of the digital resources includes at least one of the following: target user feature data and resource feature data of the digital resources;

[0012] A resource selection module, configured to select a target digital resource from the candidate digital resources according to the predicted probability of the candidate digital resources;

[0013] The access control module is used to select a target access restriction rule matching the target digital resource from pre-built candidate access restriction rules according to the target digital resource, verify the target digital resource according to the target access restriction rule, and perform network access control on the digital resource according to the verification result.

[0014] According to another aspect of the present invention, there is provided an electronic device, comprising:

[0015] one or more processors;

[0016] A memory for storing one or more programs;

[0017] When one or more programs are executed by one or more processors, the one or more processors can execute any one of the network access control methods provided by the embodiments of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement any network access control method provided by an embodiment of the present invention when executed.

[0019] The embodiment of the present invention provides a network access control scheme, which obtains the access association data of the digital resource by responding to the target access instruction of the digital resource; predicts the digital resource to be accessed based on the access association data of the digital resource to obtain the candidate digital resource and the prediction probability of the candidate digital resource; wherein the access association data of the digital resource includes at least one of the following: target user feature data and resource feature data of the digital resource; selects the target digital resource from the candidate digital resource according to the prediction probability; selects the target access restriction rule matching the target digital resource from the pre-built candidate access restriction rules according to the target digital resource, verifies the target digital resource according to the target access restriction rule, and performs network access control on the digital resource according to the verification result. The above scheme predicts the digital resource to be accessed based on the access association data, obtains the candidate digital resource and the corresponding prediction probability, selects the target digital resource according to the prediction probability, verifies the target digital resource according to the target access restriction rule, and implements network access control on the digital resource according to the verification result, thereby improving the accuracy of the determined target digital resource and thus improving the security of the network access control.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a network access control method provided by Embodiment 1 of the present invention;

[0023] Figure 2 is a flow chart of a network access control method provided by Embodiment 2 of the present invention;

[0024] Figure 3 It is a structural diagram of a network access control device provided by Embodiment 4 of the present invention;

[0025] Figure 4 It is a structural diagram of an electronic device for implementing a network access control method provided in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0027] Traditional network access control methods are mainly based on static identity authentication and access control lists, and have the following limitations: easy to be bypassed. Traditional identity authentication methods such as username and password authentication are at risk of being stolen and cracked by brute force, and can be easily bypassed by malicious users; static policy management. Static access control lists require manual configuration and maintenance, and are difficult to cope with the dynamic changes and complexity of the network environment; lack of intelligent decision-making. Traditional methods lack the ability to intelligently analyze and make decisions on user behavior, and are unable to identify and respond to potential security threats in a timely manner.

[0028] Embodiment 1

[0029] Figure 1 This is a flow chart of a network access control method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where network access control is performed on digital resources. The method can be executed by a network access control device, which can be implemented in software and / or hardware and can be configured in an electronic device that carries the network access control function.

[0030] See also Figure 1 The network access control method shown includes:

[0031] S110 . Responding to a target access instruction of a digital resource, obtaining access-related data of the digital resource.

[0032] Wherein, digital resources refer to network assets accessed by users. Target access instructions refer to instructions for accessing digital resources. Access-related data refer to data for determining digital resources to be accessed. Exemplarily, the embodiments of the present invention do not impose any restrictions on access-related data, which can be set by technicians based on experience. Specifically, the access-related data can be determined based on the target access instructions.

[0033] It should be noted that, in the embodiments of the present invention, the feature data under the corresponding data type can be preprocessed according to the data type in the access-related data to obtain updated access-related data, so as to improve the quality and consistency of the updated access-related data. Among them, the data type refers to the type of each feature data in the access-related data. Exemplarily, the data type may include numerical values, categories, timestamps, and text. Different data types may correspond to different preprocessing methods, such as feature data of numerical values ​​may be normalized.

[0034] Specifically, in response to the target access instruction of the digital resource, the access-related data of the digital resource is obtained from the target access instruction.

[0035] S120 . Based on the access association data of the digital resources, predict the digital resources to be accessed to obtain candidate digital resources and prediction probabilities of the candidate digital resources.

[0036] Among them, the access-related data of digital resources includes at least one of the following: target user feature data and resource feature data of digital resources. Target user feature data refers to feature data used to describe users. Exemplarily, target user feature data may include: at least one of the user's identity identification (ID), user registration time, user access time of digital resources, user group, and scene customization data. Among them, scene customization data can be customized according to digital resources in different scenes visited by users. Exemplarily, if the scene where the digital resource is located is an e-commerce website, the scene customization data may include user basic information and user location information. User basic information may include user age and user gender. Resource feature data refers to feature data used to describe digital resources. The embodiment of the present invention does not impose any restrictions on resource feature data, which can be set by technicians based on experience. For example, the resource feature data of digital resources of mobile terminals may include at least one of parameter information, terminal brand, historical user characteristics, and terminal audience groups.

[0037] The candidate digital resource refers to the predicted digital resource that the user may access. The predicted probability can be used to quantify the possibility of the user accessing the candidate digital resource. Specifically, one candidate digital resource corresponds to one predicted probability.

[0038] Specifically, based on the access association data of the digital resources, the digital resources to be accessed are predicted to obtain at least one candidate digital resource and the prediction probability corresponding to the candidate digital resource.

[0039] The embodiment of the present invention does not impose any limitation on the method of determining candidate digital resources and the prediction probability of candidate digital resources, which can be set by technicians based on experience. In an optional embodiment, it can be determined by a model. Exemplarily, if the access-related data of the digital resource also includes the time series feature data of the user accessing the digital resource; then based on the access-related data of the digital resource, the digital resource to be accessed is predicted to obtain the candidate digital resource, including: determining the data dimension in the access-related data; wherein the data dimension includes the user dimension, the resource dimension and the time series dimension; selecting the target resource prediction model corresponding to the data dimension from the pre-trained candidate resource prediction model; wherein the candidate resource prediction model includes a Bayesian classifier, a clustering model and a long short-term memory network LSTM model; inputting the dimensional feature data under the data dimension into the target resource prediction model to obtain the candidate digital resource corresponding to the data dimension; wherein the dimensional feature data is one of the target user feature data, the resource feature data and the time series feature data; wherein the user dimension corresponds to the Bayesian classifier, the resource dimension corresponds to the clustering model, and the time series dimension corresponds to the long short-term memory network LSTM model.

[0040] The time series characteristic data refers to the characteristic data about the time when the user accesses the digital resource. The embodiment of the present invention does not impose any limitation on the time series characteristic data, which can be set by the technician based on experience. For example, the time series characteristic data may include: the user registration time and the user browsing digital resources time.

[0041] Among them, data dimension refers to the dimension of each feature data in the access-related data. User dimension corresponds to target user feature data, resource dimension corresponds to resource feature data, and time series dimension corresponds to time series feature data. Candidate resource prediction model refers to a pre-trained model for predicting the digital resources to be accessed by users. Target resource prediction model refers to the candidate resource prediction model used for a certain data dimension. Dimension feature data refers to the feature data corresponding to the data dimension.

[0042] It should be noted that the target resource prediction model outputs the prediction probability corresponding to the candidate digital resources at the same time as outputting the candidate digital resources.

[0043] Exemplarily, if the data dimension is a resource dimension, and correspondingly, the target resource prediction model is a clustering model, the dimensional feature data under the data dimension is input into the target resource prediction model to obtain candidate digital resources corresponding to the data dimension, including: inputting the resource feature data under the resource dimension into the clustering model to obtain reference digital resources corresponding to the resource dimension and the predicted probability of the reference digital resources; obtaining reference user feature data corresponding to the reference digital resources, and determining the feature matching rate between the reference user feature data and the target user feature data; determining the candidate digital resources corresponding to the resource dimension from the reference digital resources based on the feature matching rate, and obtaining the predicted probability of the candidate digital resources.

[0044] It can be understood that by introducing the model, targeted predictions can be made on dimensional feature data in different dimensions, thereby achieving multi-dimensional predictions of digital resources to be accessed, thereby improving the accuracy and comprehensiveness of the predictions.

[0045] S130: Select a target digital resource from the candidate digital resources according to the predicted probabilities of the candidate digital resources.

[0046] The target digital resource refers to a digital resource to be accessed that is determined from the candidate digital resources. Exemplarily, the number of the target digital resources may be one or more, and the embodiment of the present invention does not impose any limitation on this.

[0047] Specifically, according to the prediction probabilities of the candidate digital resources, a candidate digital resource with the maximum prediction probability is selected from the candidate digital resources as the target digital resource.

[0048] S140. According to the target digital resource, a target access restriction rule matching the target digital resource is selected from pre-constructed candidate access restriction rules, and the target digital resource is verified according to the target access restriction rule, and network access control is performed on the digital resource according to the verification result.

[0049] Among them, candidate access restriction rules refer to pre-built restriction rules for accessing digital resources. Target access restriction rules refer to candidate access restriction rules corresponding to target digital resources. Candidate access control permissions may include at least one of the user's identity, the user group to which the user belongs, reference access time and reference access permissions. Reference access time refers to the pre-set time for the user to access digital resources. Reference access permissions refer to pre-set user access qualifications. User groups refer to the classification of users, and are composed of users belonging to the same category.

[0050] In an optional embodiment, the target digital resource is verified according to the target access restriction rule, including: obtaining the target access time of the target access instruction; selecting the target access restriction sub-rule from the candidate access restriction sub-rules included in the target access restriction rule according to the target access time; and verifying the target digital resource according to the target access restriction sub-rule.

[0051] The target access time refers to the time for responding to the target access instruction. The candidate access restriction sub-rule refers to the sub-rule in constructing the target access restriction rule. The target access restriction sub-rule refers to the candidate access restriction sub-rule for verifying the target digital resource under the target access time. The target access restriction sub-rule may include reference access rights. The reference access time corresponds to the reference access right item, and one candidate access restriction sub-rule corresponds to a set of reference access time and reference access rights.

[0052] Specifically, the target access time is matched with each reference access time in the target access permission sub-rule; and the candidate access control sub-rule corresponding to the reference access time with the same matching result is used as the target access restriction sub-rule.

[0053] It can be understood that by introducing the target access time, determining the target access restriction sub-rule in the target access restriction rule, and verifying the target digital resource based on the target access restriction sub-rule, the accuracy of verification is improved, thereby improving the security of subsequent network access control based on the verification results.

[0054] Exemplarily, the current access rights of the target digital resource are verified according to the target access restriction sub-rule; if the reference access right in the target access restriction sub-rule is no permission, the verification fails; if the reference access right in the target access restriction sub-rule is permission, the verification fails.

[0055] The embodiment of the present invention provides a network access control scheme, which obtains the access association data of the digital resource by responding to the target access instruction of the digital resource; predicts the digital resource to be accessed based on the access association data of the digital resource to obtain the candidate digital resource and the prediction probability of the candidate digital resource; wherein the access association data of the digital resource includes at least one of the following: target user feature data and resource feature data of the digital resource; selects the target digital resource from the candidate digital resource according to the prediction probability; selects the target access restriction rule matching the target digital resource from the pre-built candidate access restriction rules according to the target digital resource, verifies the target digital resource according to the target access restriction rule, and performs network access control on the digital resource according to the verification result. The above scheme predicts the digital resource to be accessed based on the access association data, obtains the candidate digital resource and the corresponding prediction probability, selects the target digital resource according to the prediction probability, verifies the target digital resource according to the target access restriction rule, and implements network access control on the digital resource according to the verification result, thereby improving the accuracy of the determined target digital resource and thus improving the security of the network access control.

[0056] Embodiment 2

[0057] Figure 2 It is a flow chart of a network access control method provided by the second embodiment of the present invention. Based on the above embodiments, this embodiment further refines the operation of "based on the access association data of digital resources, predicting the digital resources to be accessed to obtain candidate digital resources and the predicted probability of candidate digital resources" into "clustering the resource feature data of digital resources, taking the class to which the resource feature data of digital resources belongs as the reference digital resource, and determining the predicted probability of the reference digital resource; obtaining the reference user feature data corresponding to the reference digital resource, and determining the feature matching rate between the reference user feature data and the target user feature data; determining the candidate digital resource from the reference digital resource according to the feature matching rate, and obtaining the predicted probability of the candidate digital resource", so as to improve the determination mechanism of the candidate digital resource and the predicted probability of the candidate digital resource. It should be noted that for the part not described in detail in the embodiment of the present invention, reference can be made to the description of other embodiments.

[0058] See also Figure 2 The network access control method shown includes:

[0059] S210 . Responding to a target access instruction of a digital resource, obtaining access-related data of the digital resource.

[0060] S220: Clustering the resource characteristic data of the digital resource, taking the class to which the resource characteristic data of the digital resource belongs as a reference digital resource, and determining the prediction probability of the reference digital resource.

[0061] The reference digital resources refer to digital resources that may be candidate digital resources. The embodiment of the present invention does not impose any limitation on the number of reference digital resources, which can be set by technicians based on experience.

[0062] S230: Acquire reference user feature data corresponding to the reference digital resource, and determine a feature matching rate between the reference user feature data and the target user feature data.

[0063] The reference user feature data refers to the user feature data corresponding to the reference digital resource. The feature matching rate can be used to quantify the similarity between the reference user feature data and the target user feature data.

[0064] S240: Determine candidate digital resources from the reference digital resources according to the feature matching rate, and obtain the predicted probability of the candidate digital resources.

[0065] Exemplarily, the reference digital resource with the largest feature matching rate is used as the candidate digital resource, and the predicted probability of the aforementioned reference digital resource is used as the predicted probability of the candidate digital resource.

[0066] Exemplarily, the target digital resource can be determined from the reference digital resource by setting a predicted match rate threshold. In an optional embodiment, the candidate digital resource is determined from the reference digital resource according to the feature match rate, including: if the feature match rate is greater than or equal to the preset match rate threshold, the reference digital resource is used as a candidate digital resource; if the feature match rate is less than the preset match rate threshold, the reference digital resource is prohibited from being used as a candidate digital resource. The embodiment of the present invention does not impose any limitation on the size of the preset match rate threshold, which can be set by a technician based on experience, or can be repeatedly determined through a large number of experiments.

[0067] Specifically, for any reference digital resource, if the feature matching rate of the reference digital resource is greater than or equal to the preset matching rate threshold, the reference digital resource is used as a candidate digital resource; if the feature matching rate of the reference digital resource is less than the preset matching rate threshold, the reference digital resource is prohibited from being used as a candidate digital resource.

[0068] It can be understood that by introducing a preset matching rate threshold to determine candidate digital resources, the comprehensiveness and accuracy of the determined candidate digital resources are improved.

[0069] In the embodiment of the present invention, if the candidate digital resource cannot be determined from the reference digital resources based on the feature matching rate, it can be determined that the target access instruction does not match the digital resource to be accessed, that is, the target access instruction is abnormal.

[0070] S250: Select a target digital resource from the candidate digital resources according to the predicted probabilities of the candidate digital resources.

[0071] S260: According to the target digital resource, a target access restriction rule matching the target digital resource is selected from pre-constructed candidate access restriction rules, and the target digital resource is verified according to the target access restriction rule, and network access control is performed on the digital resource according to the verification result.

[0072] The embodiment of the present invention provides a network access control scheme, which predicts the digital resources to be accessed based on the access association data of the digital resources to obtain the candidate digital resources and the predicted probability of the candidate digital resources, and refines the operation of clustering the resource feature data of the digital resources, taking the class to which the resource feature data of the digital resources belongs as the reference digital resource, and determining the predicted probability of the reference digital resource; obtaining the reference user feature data corresponding to the reference digital resource, and determining the feature matching rate between the reference user feature data and the target user feature data; determining the candidate digital resources from the reference digital resources according to the feature matching rate, and obtaining the predicted probability of the candidate digital resources, thereby improving the determination mechanism of the candidate digital resources and the predicted probability of the candidate digital resources. The above scheme obtains the reference digital resources by clustering the resource feature data, and then determines the candidate digital resources according to the feature matching rate between the reference user feature data corresponding to the reference digital resource and the target user feature data, thereby improving the accuracy of the determined candidate digital resources.

[0073] Embodiment 3

[0074] The embodiment of the present invention provides a network access control method based on artificial intelligence on the basis of the above embodiment. The present invention relates to the field of NLP (Natural Language Processing) and the field of access control in network security, and specifically to a network access control method based on artificial intelligence. By collecting relevant data from the device host and using machine learning and deep learning technologies in artificial intelligence, a highly reliable and scalable implementation method is provided for access control of relevant assets.

[0075] Artificial intelligence technology has a wide range of applications in the field of network security, including intrusion detection, malicious code detection, abnormal behavior identification, etc. Through machine learning and deep learning algorithms, large-scale network data can be monitored and analyzed in real time, potential security threats can be identified, and corresponding defense measures can be taken. With the help of these technologies, the network access control method based on artificial intelligence can realize intelligent monitoring and management of network access behavior and improve the security and reliability of network access.

[0076] This paper proposes a network access control method based on artificial intelligence, which realizes dynamic identification and access control of network user behavior by combining machine learning and deep learning algorithm technology. This method uses deep learning models to model and analyze user access behaviors, combines real-time network traffic data, dynamically adjusts access policies, realizes real-time monitoring and intelligent control of network access behaviors, and improves network security and flexibility.

[0077] An embodiment of the present invention provides an artificial intelligence-based network access control method, comprising:

[0078] S301: Acquire access-related data and pre-process the access-related data.

[0079] Access-related data from digital resource devices from various sources, including various requests, logs, and server response data. Including data texts in various formats, such as json, txt, csv and other related data. The data acquisition process can be combined with crawlers and the device's own acquisition equipment for collection. The acquired access-related data can include structured data, unstructured data, and semi-structured data. Then, the acquired access-related data is preprocessed, which can include data cleaning, deduplication, standardization and other operations to ensure the quality and consistency of the access-related data.

[0080] In the embodiment of the present invention, a preliminary feature processing operation will be performed. For the feasible feature processing mode of numerical data, the key fields of the data finally processed here include: the user's identity can be used to uniquely identify the user in the system, which can usually be a user name, user ID or other unique identifier. User group refers to dividing users into different groups to facilitate centralized management and authorization of users in different groups. Resource identification is used to uniquely identify digital resources in the system, which can be a file path, URL (Uniform Resource Locator), database table name, etc. Resource type is used to describe the type of digital resources, such as files, directories, network services, etc. Access rights are used to define the operation rights of users or user groups on digital resources, including reading, writing, executing, etc. Access time can specify the time range in which users can access resources, such as working hours, non-working hours, etc. Access source can be used to record the source of user access to resources, such as IP (Internet Protocol, a protocol for interconnecting networks) address, device information, etc. Access control policy is used to define how to control access to digital resources for specific users or user groups based on their identification, attributes and environment. Roles can be used to centralize permissions on roles, and users simplify management by assigning roles instead of directly assigning permissions. A session can be used for the period of time when a user interacts with the system. The access control system may authorize users based on session attributes. A security policy contains a set of rules and specifications that define the security requirements and behavior specifications in the system. The authentication status is used to record the authentication status of the user, such as authenticated, unauthenticated, etc. The audit log is used to record the user's access behavior to system resources and can be used for auditing and tracking. The access control list is used to store the access permission relationship between digital resources and users or user groups, usually presented in a list form.

[0081] The access control list field in the above fields is the label of the subsequent algorithm. The field data types at this stage include: numerical, category, timestamp, and text. Multi-normalization, standardized feature scaling, feature conversion, and other processing are performed on numerical data. Label encoding is used to expand and extract features for dimensional feature data. For timestamp data, time features are extracted, such as: extracting various time units such as years, months, days, and hours from timestamps as new features; time interval calculation, calculating the time interval or time difference between timestamps. Time window features: Create a time window based on timestamp data and count the data features in each window. For text data, it is necessary to use models such as Bert, word2vector, or tf-idf to embed the text and convert it into numerical data to facilitate subsequent model training.

[0082] The access-related data types in the implementation of the present invention include four types: numerical value, category, timestamp, and text, and corresponding feature processing is performed on these four types of data. For example, for numerical data, the numerical data is normalized to avoid the situation where the value difference between different field data is too large, resulting in a certain feature being ignored. The normalization formula is as follows:

[0083]

[0084] Among them, x old Indicates access to an initial data in the feature column X in the associated data; Min indicates the maximum data in the feature column X; Max indicates the minimum data in the feature column X; x new It indicates the normalized access-related data. It should be noted that the value range of all numerical features of the normalized access-related data is within the interval [0,1].

[0085] For categorical data, a feature column Y is a categorical feature, and its values ​​include a, b, and c, a total of 3 values. Then this column can be converted into 3 columns, named Y_a, Y_b, and Y_c. If the value of this column for a sample is b, then among the values ​​of the new feature column, only Y_b is 1, and the others are 0.

[0086] For timestamp data, some digital resources are only open to users during specific periods of time. The timestamp can be processed according to the specified hour to extract the access control permissions to a certain digital resource within the specific hour.

[0087] For text data, with the help of a language model, by capturing the contextual semantics of the text, it is converted into a vector of a specific dimension, such as a vector of 1*512 dimensions.

[0088] S302: Feature fusion and joint training of multiple models.

[0089] The embodiment of the present invention performs feature fusion and joint training of multiple models on the access-related data in S301. Multi-level and dimensional splicing and fusion are performed on the access-related data in S301. This step uses a Bayesian classifier, a clustering model, and an LSTM model in a deep model for training. A corresponding feature selector is constructed for each model.

[0090] The Bayesian classifier can calculate the posterior probability of each dimension of feature data under a given feature and select the digital resource with the highest probability as the prediction result. The Bayesian classifier assumes that the features are independent of each other, and then uses the training data to estimate the prior probability of the category and the conditional probability of the feature to perform classification.

[0091] The Bayesian formula of the Bayesian classifier in the embodiment of the present invention is:

[0092]

[0093] Among them, x represents the variable, the dimensional feature data input into the Bayesian classifier; C i Indicates the i-th category to which the variable belongs; P(C i |x) indicates that the variable belongs to C after it occurs i The posterior probability of i ) indicates that it belongs to C i The prior probability of i ) indicates that the variable is in C i The probability in ; P(x) represents the probability of the variable occurring. The embodiment of the present invention can be extended to multiple dimensions. According to the independent assumptions of the feature data of each dimension, the access control category of the current sample feature to a certain digital resource can be determined. The access control categories include: accessible, inaccessible and restricted access.

[0094] Specifically, assume that the labeled digital resources are n categories, such as a certain type of goods, a certain order, etc. After training a Bayesian classifier with historical access association data, a new access association data is output, which is one or more of the n label categories to which the current new user belongs. The probability output is performed through softmax, that is, the Bayesian output is used to output the probability of belonging to the category from high to low for the current data features, such as the predicted probability of candidate digital resource n1 is 0.6, the predicted probability of candidate digital resource n2 is 0.3, and the predicted probability of candidate digital resource n3 is 0.03, etc.

[0095] The clustering model can adopt the K-Means Clustering model, which divides the selected data points into K clusters, and the center point of each cluster is the average value of all the points in the cluster. Through iterative optimization, the distance from the points in the cluster to the corresponding cluster center is minimized, and the distance between clusters is maximized. It may be affected by the initial cluster center, which is usually solved by running the algorithm multiple times and selecting the optimal result. In this way, the cluster center to which the access control of new data belongs can be judged.

[0096] An implementation example of the K-Means classifier is as follows: Assuming that a certain digital resource n needs to be clustered, and there are 6 categories of access control, the K value can be set to 6. After screening the acquired access-related data, the 6 cluster center points are continuously iterated by splicing the feature data until the position of the midline point no longer changes. At this point, 6 central clusters of the digital resource n are obtained, and the clustering model can be trained.

[0097] Long Short-Term Memory (LSTM) is a deep learning model commonly used to process sequence data, especially for sequence data with long-term dependencies. The LSTM model solves the gradient vanishing and gradient exploding problems in traditional recurrent neural networks (RNNs) by introducing a gating mechanism, enabling it to better capture long-term dependencies in sequence data. In this embodiment, by selecting time series feature data related to time series, the access control of a specific device in time series is predicted and judged.

[0098] The implementation example of the LSTM classifier is as follows: With the help of deep learning frameworks such as TensorFlow and pytorch, the feature data is spliced ​​and sent to the LSTM layer, connected to the fully connected layer, and finally the Softmax activation function is used to output the probability of multiple categories.

[0099] Specifically, according to the long short-term memory network, based on the historical access association data of all users or a certain type of users, the target digital resource that a user is most likely to access in the current time period is determined. The label of the LSTM model is the digital resource category. When a new access association data comes, the digital resource that is most likely to be accessed is predicted based on the historical access association data. If the predicted target digital resource is n1, and the digital resource determined by the target access instruction is n100, and the difference between the two is large, then the target access instruction may be an abnormal instruction.

[0100] In the embodiment of the present invention, by training three models, three candidate resource prediction models that meet the preset requirements are obtained by using accuracy, F1 score, Micro-F1 score, etc. as evaluation indicators.

[0101] For example, at a certain moment, user x needs to access digital resource y, then the target user feature data of user x will be input into the Bayesian classifier, and the output is the candidate digital resources that user x may access, such as candidate digital resource y1, candidate digital resource y2 and candidate digital resource y3. The resource feature data is sent to the K-Means classifier to obtain the class to which it belongs, that is, the reference digital resource, and the reference user feature data corresponding to the reference digital resource is matched with the target user feature data. It is found that the reference user feature data of reference digital resource y2 has a higher feature matching rate with the target user feature data, followed by the reference user feature data of reference digital resource y1. The determined candidate digital resources are sorted according to the feature matching rate, namely y2 and y1.

[0102] The LSTM model needs to use the time series features of the previous time unit of user x to output the candidate digital resources that are most likely to be accessed by the current unit. For example, the output candidate digital resources are candidate digital resource y2, candidate digital resource y3, and candidate digital resource y4 in descending order according to the predicted probability.

[0103] If the above three models are combined, the digital resource that the current user is most likely to access is y2 (based on the voting mechanism, in fact, this is also a probabilistic ranking). If y and y2 are inconsistent, then the current access request may be an abnormal access.

[0104] S303: rule-based experience verification and multi-model joint access control method.

[0105] In the embodiment of the present invention, the candidate digital resources under different data dimensions obtained by the three candidate resource prediction models are summarized to obtain the target digital resources; the target digital resources are compared and verified by the target access restriction rules selected from the candidate access restriction rules, and network access control is implemented according to the verification results, thereby avoiding low user experience and network security problems. The candidate access restriction rules can be dynamically updated according to the actual production environment, such as once every 24 hours or once a week, so as to achieve the verification of the access control authority prediction results.

[0106] For example: after determining the target digital resource, select the target access restriction rule from the candidate access restriction rules; in the target access restriction rule, determine whether the user group to which the current user belongs has access control permissions to the target digital resource within the timestamp to which the current user belongs. If there is no restriction, the current user has access control permissions to access the target digital resource, and the current user can access the target digital resource.

[0107] Through these detailed designs and analyses, while building a system based on artificial intelligence network access control methods, we focus on multi-dimensional and fine-grained control of user data, and achieve effective control of device access rights from multiple aspects such as user experience and security.

[0108] An artificial intelligence-based network access control method provided by an embodiment of the present invention realizes intelligent monitoring and identification of user behavior through artificial intelligence technologies such as deep learning, timely discovers and responds to potential security threats, and improves security; adopts dynamic access policy management, adjusts access control policies according to real-time network traffic and user behavior information, adapts to changes and complexity of the network environment, and enhances flexibility; through intelligent access control, improves the access efficiency and experience of legitimate users, reduces false alarms and false blocking, reduces the impact on legitimate users, and improves user experience; applies artificial intelligence technologies such as deep learning to the field of network access control, realizes intelligent identification and dynamic control of user behavior, and breaks through the limitations of traditional methods; the proposed method combines real-time network traffic analysis and deep learning models, can realize efficient and intelligent access control in actual network environments, and has strong practicality and operability.

[0109] Embodiment 4

[0110] Figure 3 1 is a schematic diagram of the structure of a network access control device provided in Embodiment 4 of the present invention. This embodiment is applicable to the case of performing network access control on digital resources. The method can be executed by a network access control device, which can be implemented in software and / or hardware and can be configured in an electronic device that carries the network access control function.

[0111] like Figure 3 As shown, the device includes: a data acquisition module 310, a resource prediction module 320, a resource selection module 330 and an access control module 340. Among them,

[0112] The data acquisition module 310 is used to acquire access-related data of the digital resource in response to a target access instruction of the digital resource;

[0113] The resource prediction module 320 is used to predict the digital resources to be accessed based on the access association data of the digital resources to obtain candidate digital resources and prediction probabilities of the candidate digital resources; wherein the access association data of the digital resources includes at least one of the following: target user feature data and resource feature data of the digital resources;

[0114] A resource selection module 330, configured to select a target digital resource from the candidate digital resources according to the predicted probabilities of the candidate digital resources;

[0115] The access control module 340 is used to select a target access restriction rule that matches the target digital resource from pre-built candidate access restriction rules according to the target digital resource, verify the target digital resource according to the target access restriction rule, and perform network access control on the digital resource according to the verification result.

[0116] The embodiment of the present invention provides a network access control scheme, which obtains the access association data of the digital resource by responding to the target access instruction of the digital resource; predicts the digital resource to be accessed based on the access association data of the digital resource to obtain the candidate digital resource and the prediction probability of the candidate digital resource; wherein the access association data of the digital resource includes at least one of the following: target user feature data and resource feature data of the digital resource; selects the target digital resource from the candidate digital resource according to the prediction probability; selects the target access restriction rule matching the target digital resource from the pre-built candidate access restriction rules according to the target digital resource, verifies the target digital resource according to the target access restriction rule, and performs network access control on the digital resource according to the verification result. The above scheme predicts the digital resource to be accessed based on the access association data, obtains the candidate digital resource and the corresponding prediction probability, selects the target digital resource according to the prediction probability, verifies the target digital resource according to the target access restriction rule, and implements network access control on the digital resource according to the verification result, thereby improving the accuracy of the determined target digital resource and thus improving the security of the network access control.

[0117] The resource prediction module 330 includes:

[0118] A reference resource determination unit, configured to cluster the resource characteristic data of the digital resource, take the class to which the resource characteristic data of the digital resource belongs as a reference digital resource, and determine a prediction probability of the reference digital resource;

[0119] a matching rate determining unit, configured to obtain reference user feature data corresponding to the reference digital resource, and determine a feature matching rate between the reference user feature data and the target user feature data;

[0120] The candidate resource determination unit is used to determine the candidate digital resource from the reference digital resource according to the feature matching rate, and obtain the predicted probability of the candidate digital resource.

[0121] The candidate resource determination unit is specifically used to:

[0122] If the feature matching rate is greater than or equal to a preset matching rate threshold, taking the reference digital resource as the candidate digital resource;

[0123] If the feature matching rate is less than a preset matching rate threshold, it is prohibited to use the reference digital resource as the candidate digital resource.

[0124] If the digital resource access association data also includes time series feature data of the user accessing the digital resource, the resource prediction module 320 includes:

[0125] A data dimension determination unit, used to determine the data dimension in the access-related data; wherein the data dimension includes a user dimension, a resource dimension and a time series dimension;

[0126] A model selection unit, used to select a target resource prediction model corresponding to the data dimension from pre-trained candidate resource prediction models; wherein the candidate resource prediction models include a Bayesian classifier, a clustering model, and a long short-term memory network LSTM model;

[0127] A resource determination unit, configured to input the dimension feature data under the data dimension into the target resource prediction model to obtain a candidate digital resource corresponding to the data dimension; wherein the dimension feature data is one of target user feature data, resource feature data and time series feature data;

[0128] Among them, the user dimension corresponds to the Bayesian classifier, the resource dimension corresponds to the clustering model, and the time series dimension corresponds to the long short-term memory network LSTM model.

[0129] Optionally, the access control module 340 includes:

[0130] An access time acquisition unit, used for acquiring a target access time of the target access instruction;

[0131] A sub-rule selection unit, configured to select a target access restriction sub-rule from each candidate access restriction sub-rule included in the target access restriction rule according to the target access time;

[0132] A resource verification unit is used to verify the target digital resource according to the target access restriction sub-rule.

[0133] The network access control device provided in the embodiment of the present invention can execute the network access control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each network access control method.

[0134] In the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of access-related data and candidate access restriction rules are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0135] Embodiment 5

[0136] Figure 4It is a structural diagram of an electronic device for implementing a network access control method provided by Embodiment 5 of the present invention. Electronic device 410 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0137] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0138] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0139] The processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 411 executes the various methods and processes described above, such as a network access control method.

[0140] In some embodiments, the network access control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the network access control method described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to perform the network access control method in any other appropriate manner (e.g., by means of firmware).

[0141] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0142] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0143] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0144] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0145] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0146] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0147] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0148] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network access control method, characterized in that: include: In response to a target access instruction of a digital resource, acquiring access-related data of the digital resource; Based on the access-related data of the digital resource, predict the digital resource to be accessed to obtain candidate digital resources and prediction probabilities of the candidate digital resources; wherein the access-related data of the digital resource includes at least one of the following: target user feature data and resource feature data of the digital resource; Selecting a target digital resource from the candidate digital resources according to the predicted probability of the candidate digital resources; According to the target digital resource, a target access restriction rule matching the target digital resource is selected from pre-constructed candidate access restriction rules, and the target digital resource is verified according to the target access restriction rule, and network access control is performed on the digital resource according to the verification result; If the access-related data of the digital resource also includes time-series feature data of the user accessing the digital resource, then the digital resource to be accessed is predicted based on the access-related data of the digital resource to obtain a candidate digital resource, including: Determine the data dimensions in the access-related data; wherein the data dimensions include user dimensions, resource dimensions, and time series dimensions; Selecting a target resource prediction model corresponding to the data dimension from pre-trained candidate resource prediction models; wherein the candidate resource prediction models include a Bayesian classifier, a clustering model, and a long short-term memory network LSTM model; Inputting the dimension feature data under the data dimension into the target resource prediction model to obtain the candidate digital resource corresponding to the data dimension; wherein the dimension feature data is one of target user feature data, resource feature data and time series feature data; Among them, the user dimension corresponds to the Bayesian classifier, the resource dimension corresponds to the clustering model, and the time series dimension corresponds to the long short-term memory network LSTM model.

2. The method according to claim 1, characterized in that If the data dimension is a resource dimension, the step of inputting the dimension feature data under the data dimension into the target resource prediction model to obtain the candidate digital resource corresponding to the data dimension includes: Inputting the resource feature data under the resource dimension into the clustering model to obtain the reference digital resources corresponding to the resource dimension and the predicted probability of the reference digital resources; Acquiring reference user feature data corresponding to the reference digital resource, and determining a feature matching rate between the reference user feature data and the target user feature data; According to the feature matching rate, a candidate digital resource corresponding to the resource dimension is determined from the reference digital resources.

3. The method according to claim 2, characterized in that The step of determining the candidate digital resource corresponding to the resource dimension from the reference digital resource according to the feature matching rate includes: If the feature matching rate is greater than or equal to a preset matching rate threshold, taking the reference digital resource as a candidate digital resource corresponding to the resource dimension; If the feature matching rate is less than a preset matching rate threshold, it is prohibited to use the reference digital resource as a candidate digital resource corresponding to the resource dimension.

4. The method according to any one of claims 1 to 3, characterized in that The verifying the target digital resource according to the target access restriction rule includes: Obtaining a target access time of the target access instruction; According to the target access time, selecting a target access restriction sub-rule from each candidate access restriction sub-rule included in the target access restriction rule; The target digital resource is verified according to the target access restriction sub-rule.

5. A network access control device, characterized in that: include: A data acquisition module, configured to acquire access-related data of the digital resource in response to a target access instruction of the digital resource; A resource prediction module, configured to predict the digital resources to be accessed based on the access-related data of the digital resources to obtain candidate digital resources and prediction probabilities of the candidate digital resources; wherein the access-related data of the digital resources includes at least one of the following: target user feature data and resource feature data of the digital resources; A resource selection module, configured to select a target digital resource from the candidate digital resources according to the predicted probability of the candidate digital resources; An access control module, configured to select a target access restriction rule matching the target digital resource from pre-built candidate access restriction rules according to the target digital resource, verify the target digital resource according to the target access restriction rule, and perform network access control on the digital resource according to the verification result; If the digital resource access-related data also includes time-series feature data of the user accessing the digital resource, the resource prediction module includes: A data dimension determination unit, used to determine the data dimension in the access-related data; wherein the data dimension includes a user dimension, a resource dimension and a time series dimension; A model selection unit, used to select a target resource prediction model corresponding to the data dimension from pre-trained candidate resource prediction models; wherein the candidate resource prediction models include a Bayesian classifier, a clustering model, and a long short-term memory network LSTM model; A resource determination unit, configured to input the dimension feature data under the data dimension into the target resource prediction model to obtain a candidate digital resource corresponding to the data dimension; wherein the dimension feature data is one of target user feature data, resource feature data and time series feature data; Among them, the user dimension corresponds to the Bayesian classifier, the resource dimension corresponds to the clustering model, and the time series dimension corresponds to the long short-term memory network LSTM model.

6. The device according to claim 5, characterized in that If the data dimension is a resource dimension, the resource determination unit is specifically configured to: Inputting the resource feature data under the resource dimension into the clustering model to obtain the reference digital resources corresponding to the resource dimension and the predicted probability of the reference digital resources; Acquiring reference user feature data corresponding to the reference digital resource, and determining a feature matching rate between the reference user feature data and the target user feature data; According to the feature matching rate, a candidate digital resource corresponding to the resource dimension is determined from the reference digital resources.

7. The device according to claim 6, characterized in that The step of determining the candidate digital resource corresponding to the resource dimension from the reference digital resource according to the feature matching rate includes: If the feature matching rate is greater than or equal to a preset matching rate threshold, taking the reference digital resource as a candidate digital resource corresponding to the resource dimension; If the feature matching rate is less than a preset matching rate threshold, it is prohibited to use the reference digital resource as a candidate digital resource corresponding to the resource dimension.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a network access control method as described in any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a network access control method as described in any one of claims 1 to 4 is implemented.

Images