Terminal access control method, device, equipment, medium and product

Abstract

The present disclosure provides a terminal access control method, apparatus, device, medium and product, wherein the method comprises: in response to an access request of a terminal device, determining multiple execution strategies for the access request in historical execution strategies based on terminal information of the terminal device; wherein the terminal information comprises: access memory information and terminal status information of the terminal device for historical access requests; determining a policy scoring result for each of the execution strategies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information of each of the execution strategies, and a matching score of the access memory information of each of the execution strategies; according to the policy scoring result, determining a target execution strategy that meets the scoring requirements from the multiple execution strategies, and executing the access request based on the target execution strategy.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a terminal access control method, apparatus, device, medium, and product. Background Art

[0002] Existing enterprises complete access control to terminal devices through the interaction between the client, security gateway and the service end of the business system; and perform access verification on terminal devices (or clients) based on user identity and user permissions.

[0003] In related technologies, when a terminal device is compromised, the attacker obtains the user's identity identifier. This identifier is then used to send an access request to the server. The server then executes the corresponding execution policy, allowing the attacker to access protected system resources. However, existing technologies use a relatively simple verification algorithm for terminal device legitimacy, resulting in low terminal device security. Summary of the Invention

[0004] The embodiments of the present disclosure at least provide a terminal access control method, apparatus, device, medium, and product.

[0005] In a first aspect, an embodiment of the present disclosure provides a terminal access control method, including:

[0006] In response to an access request from a terminal device, determining a plurality of execution strategies for the access request from historical execution strategies based on terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information;

[0007] Determining a policy scoring result for each of the execution policies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information for each of the execution policies, and a matching score of the access memory information for each of the execution policies;

[0008] According to the policy scoring result, a target execution policy that meets the scoring requirements is determined among the multiple execution policies, and the access request is executed based on the target execution policy.

[0009] In an optional implementation, determining a policy scoring result for each execution policy based on the terminal information includes:

[0010] Determining a first scoring result for each of the execution strategies based on the terminal environment information in the terminal information, and determining a second scoring result for the execution strategy based on the terminal behavior information in the terminal information;

[0011] A status score of the terminal status information of the execution policy is determined based on the first scoring result and the second scoring result.

[0012] In an optional implementation, the terminal status information includes current terminal behavior information and historical terminal behavior information corresponding to the execution policy;

[0013] The determining, based on the terminal behavior information in the terminal information, a second scoring result of the execution strategy includes:

[0014] Determining a label score for each behavior label in the terminal behavior information; wherein the label score is used to indicate the degree of difference between the label value of the behavior label in the current terminal behavior information and the label value of the same behavior label in the historical terminal behavior information, where the historical terminal behavior information is the terminal status information corresponding to the historical access request;

[0015] A weighted sum calculation is performed on the tag score of each of the behavior tags to obtain a second scoring result of the execution strategy.

[0016] In an optional implementation, determining a tag score for each behavior tag in the terminal behavior information includes:

[0017] A ratio between a label value of the behavior label in the historical terminal behavior information and a label value of the same behavior label in the current terminal behavior information is calculated, and the label score is determined based on the ratio.

[0018] In an optional embodiment, the terminal status information includes current terminal environment information and historical terminal environment information corresponding to the execution policy; and determining the first scoring result of each execution policy based on the terminal environment information in the terminal information includes:

[0019] Calculating a status score for each environmental monitoring item based on the current terminal environment information and the historical terminal environment information;

[0020] A weighted scoring calculation is performed on the status scores of all the environmental monitoring items to obtain a first scoring result of the execution strategy.

[0021] In an optional implementation, the calculating the status score of each environmental monitoring item based on the current terminal environment information and the historical terminal environment information includes:

[0022] Determining predicted values ​​of various environmental monitoring items at a target time based on the historical terminal environment information; wherein the target time is the time when the access request is obtained;

[0023] Calculating the difference between the monitored value of each environmental monitoring item in the current terminal environment information and the predicted value of the same environmental monitoring item;

[0024] The difference is normalized to obtain a status score for each environmental monitoring item.

[0025] In an optional implementation, determining a policy scoring result for each execution policy based on the terminal information includes:

[0026] Determine access memory information of historical access requests corresponding to each execution strategy in the terminal information to obtain target access memory information;

[0027] A degree of matching between the target access memory information and the request content of the access request is calculated, and a matching score of the access memory information is determined according to the degree of matching.

[0028] In an optional implementation, determining a target execution strategy that meets the scoring requirements from among the multiple execution strategies based on the strategy scoring result includes:

[0029] Performing weighted sum processing on the status score of the terminal status information and the matching score of the access memory information to obtain a target score for each execution strategy;

[0030] Determine the execution strategy corresponding to the maximum target score as the target execution strategy.

[0031] In an optional implementation, after executing the access request based on the target execution policy, the method further includes:

[0032] Obtaining the expected execution result in the target execution strategy;

[0033] comparing the expected execution result with the actual execution result of the target execution strategy;

[0034] If it is determined according to the comparison result that the access request does not match the target execution policy, the target execution policy is updated to obtain a new target execution policy, and the access request is executed according to the new target execution policy.

[0035] In an optional implementation manner, updating the target execution policy to obtain a new target execution policy includes:

[0036] Calculating a target weight for each execution strategy through a self-attention mechanism; wherein the target weight is used to indicate the degree of influence of the terminal information on the corresponding execution strategy;

[0037] Determine the execution strategy corresponding to the maximum target weight as the new target execution strategy.

[0038] In a second aspect, an embodiment of the present disclosure provides a terminal access control device, including:

[0039] a policy determination unit, configured to, in response to an access request from a terminal device, determine a plurality of execution policies for the access request from historical execution policies based on terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information;

[0040] a scoring determination unit, configured to determine a policy scoring result for each of the execution policies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information for each of the execution policies, and a matching score of the access memory information for each of the execution policies;

[0041] A processing unit is configured to determine, according to the policy scoring result, a target execution policy that meets the scoring requirements among the multiple execution policies, and execute the access request based on the target execution policy.

[0042] In a third aspect, an embodiment of the present disclosure further provides an electronic device comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps in the above-mentioned first aspect are performed.

[0043] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the first aspect are executed.

[0044] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the steps in the first aspect above.

[0045] In an embodiment of the present application, first, in response to an access request from a terminal device, multiple execution strategies for the access request are determined in historical execution strategies based on the terminal information of the terminal device; wherein the terminal information includes: access memory information and terminal status information of the terminal device for historical access requests; then, a policy scoring result for each execution strategy is determined based on the terminal information, and a status score of the terminal status information of each execution strategy and a matching score of the access memory information of each execution strategy can be determined through the policy scoring result; finally, according to the policy scoring result, a target execution strategy that meets the scoring requirements can be determined from multiple execution strategies, and the access request is executed based on the target execution strategy.

[0046] In the above implementation, the policy scoring result of each execution policy is determined by using the access memory information and terminal status information of historical access requests of the terminal device. The status score of the terminal status information of each execution policy and the matching score of the access memory information of the execution policy can be determined. Through the status score and the matching score, the execution policy that better matches the access request, i.e., the target execution policy, can be determined, thereby improving the efficiency of security access decision-making and further improving the accuracy and effectiveness of decision-making.

[0047] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without inventive effort.

[0049] Figure 1 A flow chart of a terminal access control method provided by an embodiment of the present disclosure is shown;

[0050] Figure 2 A schematic diagram of a terminal access control agent provided by an embodiment of the present disclosure is shown;

[0051] Figure 3 A schematic diagram of a decision center provided by an embodiment of the present disclosure is shown;

[0052] Figure 4 A schematic diagram of a terminal access control agent algorithm provided by an embodiment of the present disclosure is shown;

[0053] Figure 5 An interactive diagram of a terminal access control process provided by an embodiment of the present disclosure is shown;

[0054] Figure 6 A schematic diagram of a terminal access control device provided by an embodiment of the present disclosure is shown;

[0055] Figure 7 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the disclosure for which protection is sought, but merely represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0057] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0058] The term "and / or" herein simply describes an association relationship, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, and the existence of B alone. In addition, the term "at least one" herein refers to any combination of at least two of any one or more of a plurality of items. For example, "at least one of A, B, and C" can represent any one or more elements selected from the set consisting of A, B, and C.

[0059] Existing enterprises complete access control to terminal devices through the interaction between the client, security gateway and the service end of the business system; and perform access verification on terminal devices (or clients) based on user identity and user permissions.

[0060] In related technologies, when a terminal device is compromised, the attacker obtains the user's identity identifier. This identifier is then used to send an access request to the server. The server then executes the corresponding execution policy, allowing the attacker to access protected system resources. However, existing technologies use a relatively simple verification algorithm for terminal device legitimacy, resulting in low terminal device security.

[0061] Based on the above research, the present disclosure provides a terminal access control method, apparatus, device, medium, and product. In an embodiment of the present application, first, in response to an access request from a terminal device, multiple execution policies for the access request are determined from historical execution policies based on the terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information; then, based on the terminal information, a policy scoring result for each execution policy is determined, and the status score of the terminal status information of each execution policy and the matching score of the access memory information of each execution policy can be determined through the policy scoring result; finally, based on the policy scoring result, a target execution policy that meets the scoring requirements can be determined from the multiple execution policies, and the access request is executed based on the target execution policy.

[0062] In the above implementation, the policy scoring result of each execution policy is determined by using the access memory information and terminal status information of historical access requests of the terminal device. The status score of the terminal status information of each execution policy and the matching score of the access memory information of the execution policy can be determined. Through the status score and the matching score, the execution policy that better matches the access request, i.e., the target execution policy, can be determined, thereby improving the efficiency of security access decision-making and further improving the accuracy and effectiveness of decision-making.

[0063] To facilitate understanding of this embodiment, we first provide a detailed introduction to a terminal access control method disclosed in this embodiment. The terminal access control method provided in this embodiment is generally executed by an electronic device with certain computing capabilities, such as a terminal device, a server, or other processing device. In some possible implementations, this terminal access control method can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0064] See also Figure 1 FIG. 1 is a flow chart of a terminal access control method provided by an embodiment of the present disclosure. The terminal access control method is applied to an intelligent agent, which can be set on a server or a cloud platform. The method includes steps S101 to S103, wherein:

[0065] Step S101: In response to an access request from a terminal device, multiple execution strategies for the access request are determined in historical execution strategies based on the terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information.

[0066] Terminal information includes access memory information and terminal status information. Terminal status information includes terminal environment information and terminal behavior information. Terminal environment information includes current terminal environment information and historical terminal environment information. Current terminal environment information refers to the terminal environment information of the terminal device at the current moment, while historical terminal environment information refers to the terminal environment information of the terminal device at historical moments. Terminal behavior information includes the current terminal behavior information of the terminal device at the current moment and the historical terminal behavior information of the terminal device at historical moments.

[0067] Access memory is a collection of textual information that includes the processing procedures, execution strategies, and results of various historical access requests. Access memory is a long-term storage memory that contains historical processing information (e.g., processing procedures, execution strategies, and results) of various historical tasks (e.g., access requests) handled by the agent.

[0068] In an embodiment of the present disclosure, the terminal environment information may include terminal security information and terminal connection monitoring information, wherein the terminal security information may include at least one of the following: system vulnerability patching status, antivirus software status, firewall status, security policy status and USB device detection, etc.; the terminal connection monitoring information may include at least one of the following: sensitive system process monitoring, network connection monitoring, network traffic monitoring, network protocol monitoring, deep message monitoring and network port monitoring, etc.

[0069] In the disclosed embodiments, terminal behavior information is offline statistical information based on big data and includes multiple behavior tags, each of which is used to indicate the specific behavior of the terminal device during working hours and / or non-working hours. The behavior tags may include working hour statistics, non-working hour statistics, the number of logins during working hours or non-working hours, the number of login methods during working hours or non-working hours, and the number of login locations during working hours or non-working hours.

[0070] Here, the execution strategy is used to indicate how to handle the access request. The access request and terminal information can be input into a neural network model, such as a large language model (LLM), and the model outputs multiple execution strategies for the access request.

[0071] In the embodiment of the present application, after the terminal device initiates an access request, it first verifies the identity of the user who logged into the terminal device through the security gateway and obtains a verification result. After the security gateway determines that the user identity verification has passed based on the verification result, the security gateway sends the access request to the intelligent agent for processing.

[0072] For example, multiple execution policies for an access request include Policy 1, Policy 2, and Policy 3. Policy 1: Denies the access request; Policy 2: Accepts the access request but pays attention to the access policy for the access request; Policy 3: Accepts the access request.

[0073] In an embodiment of the present application, a terminal device sends an access request to an agent. Upon receiving the access request, the agent obtains the terminal device's terminal information and inputs the access request and terminal information into a neural network model. The neural network model then determines multiple execution strategies for the access request based on the historical execution strategies in the terminal information. For example, the neural network model may select multiple execution strategies from the historical execution strategies that are semantically similar to the access request.

[0074] Step S102: determining a policy scoring result for each of the execution policies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information for each of the execution policies, and a matching score of the access memory information for each of the execution policies.

[0075] In an embodiment of the present application, the intelligent agent can perform calculation simulation execution on each execution strategy, that is, calculate the status score and matching score of each execution strategy in parallel based on the terminal information; and determine the strategy scoring result of each execution strategy based on the status score and matching score.

[0076] Step S103: According to the policy scoring result, a target execution policy that meets the scoring requirements is determined from the multiple execution policies, and the access request is executed based on the target execution policy.

[0077] Here, the scoring requirement is used to indicate a method for selecting a target execution policy for an access request from multiple execution policies. The scoring requirement can be used to select an execution policy that better matches the access request from multiple execution policies as the target execution policy.

[0078] During implementation, a scoring threshold can be set for the policy scoring results. If the policy scoring result of an execution policy exceeds the scoring threshold, the execution policy is determined to meet the scoring requirements. In this case, the execution policy corresponding to the policy scoring result can be selected as the target execution policy. Alternatively, the execution policy corresponding to the maximum policy scoring result can be selected as the execution policy that meets the scoring requirements. In this case, this execution policy is determined to be the target execution policy.

[0079] In an embodiment of the present application, after calculating the policy scoring result of each execution policy, the policy scoring results of multiple execution policies can be sorted. When the policy scoring result meets the scoring requirements, the execution policy corresponding to the policy scoring result is selected, and then the execution policy is used as the target execution policy for the access request, and the access request is executed according to the target execution policy.

[0080] In the above implementation, the policy scoring result of each execution policy is determined by using the access memory information and terminal status information of historical access requests of the terminal device. The status score of the terminal status information of each execution policy and the matching score of the access memory information of the execution policy can be determined. Through the status score and the matching score, the execution policy that better matches the access request, i.e., the target execution policy, can be determined, thereby improving the efficiency of security access decision-making and further improving the accuracy and effectiveness of decision-making.

[0081] In an optional implementation, the above step of determining a policy scoring result of each execution policy based on the terminal information includes:

[0082] Step S21: determining a first scoring result for each of the execution strategies based on the terminal environment information in the terminal information, and determining a second scoring result for the execution strategy based on the terminal behavior information in the terminal information;

[0083] Step S22: Determine the status score of the terminal status information of the execution policy based on the first scoring result and the second scoring result.

[0084] Here, the first scoring result is used to indicate the environmental information score of the execution policy, and the first scoring result can be calculated according to the current terminal environmental information and the historical terminal environmental information in the terminal environmental information.

[0085] Here, the second scoring result is used to indicate the behavior information score of the execution policy, and the second scoring result can be calculated according to the current terminal behavior information and the historical terminal behavior information in the terminal behavior information.

[0086] In an embodiment of the present application, after obtaining the terminal information of the terminal device, the first scoring result and the second scoring result of each execution strategy can be calculated based on the terminal environment information and the terminal behavior information in the terminal information, and the status score of the execution strategy can be determined based on the first scoring result and the second scoring result.

[0087] In an optional embodiment, the terminal status information includes current terminal behavior information and historical terminal behavior information corresponding to the execution policy;

[0088] The determining, based on the terminal behavior information in the terminal information, a second scoring result of the execution strategy includes:

[0089] Step S31: Determine a label score for each behavior label in the terminal behavior information; wherein the label score indicates the degree of difference between the label value of the behavior label in the current terminal behavior information and the label value of the same behavior label in the historical terminal behavior information, where the historical terminal behavior information is the terminal status information corresponding to the historical access request;

[0090] Step S32: performing weighted sum calculation on the tag scores of each of the behavior tags to obtain a second scoring result of the execution strategy.

[0091] Here, the behavior label is a label used to indicate the terminal behavior of the terminal device during working hours and non-working hours, for example, the number of logins of the terminal device during working hours and non-working hours.

[0092] Here, the second scoring result AS can be obtained by To calculate, where W k Used to indicate the weight information of each behavior label, A k It is used to indicate the label score of each behavior label, and n is used to indicate the number of behavior labels.

[0093] In an embodiment of the present application, multiple behavior tags in the terminal behavior information are first determined, and the tag score of each behavior tag is calculated based on the current terminal behavior information and historical terminal behavior information in the terminal behavior information. Each tag score and the weight corresponding to each behavior tag are weighted and summed to obtain a second scoring result.

[0094] In an optional implementation, determining the tag score of each behavior tag in the terminal behavior information includes:

[0095] Step S41: Calculate the ratio between the label value of the behavior label in the historical terminal behavior information and the label value of the same behavior label in the current terminal behavior information, and determine the label score based on the ratio.

[0096] Here, the label score A k Available through To calculate, where CY is used to indicate the label value of the behavior label in the historical terminal behavior information, CN is used to indicate the label value of the behavior label in the current terminal behavior information, and CY and CN are used to indicate the label value of the same behavior label under the historical terminal behavior and the current terminal behavior.

[0097] For example, the number of logins of the terminal device during the working hours the day before was 5, and the number of logins of the terminal device during the working hours today was 2, that is, CY=5, CN=2.

[0098] In the above implementation, by determining the label score based on historical terminal behavior information and current terminal behavior information, abnormal behavior labels among multiple behavior labels can be identified, thereby improving the security of the access control process and improving the efficiency of security access decision-making.

[0099] In an optional embodiment, the terminal state information includes current terminal environment information and historical terminal environment information corresponding to the execution policy;

[0100] The determining, based on the terminal environment information in the terminal information, a first scoring result of each of the execution strategies, includes:

[0101] Step S51: Calculating a status score for each environmental monitoring item based on the current terminal environment information and the historical terminal environment information;

[0102] Step S52: performing weighted scoring calculation on the status scores of all the environmental monitoring items to obtain a first scoring result of the execution strategy.

[0103] Here, the status score is used to indicate whether the status of the environmental monitoring item is normal, that is, the deviation value between the monitoring value and the predicted value. The monitoring value is used to indicate the monitoring value of the environmental monitoring item in the current terminal environment information. The predicted value is used to indicate the monitoring value of the environmental monitoring item at the target time predicted based on the historical terminal environment information. The target time is the time when the access request is obtained.

[0104] Here, the first scoring result ES can be obtained by To calculate, where WE q Used to indicate the weight information of each environmental monitoring item, MS q It is used to indicate the status score of each environmental monitoring item, and m is used to indicate the number of environmental monitoring items.

[0105] In an embodiment of the present application, multiple environmental monitoring items in the terminal status information can be determined, and the status score of each environmental monitoring item can be calculated based on the current terminal environment information and historical terminal environment information in the terminal status information. Each status score and the weight corresponding to each environmental monitoring item are weighted and summed, and the weighted average score of different environmental monitoring items is calculated to obtain a first scoring result.

[0106] In an optional implementation, the calculating the status score of each environmental monitoring item based on the current terminal environment information and the historical terminal environment information includes:

[0107] Step S61: Determine the predicted value of each environmental monitoring item at a target time based on the historical terminal environment information; wherein the target time is the time when the access request is obtained;

[0108] Step S62: Calculating the difference between the monitored value of each environmental monitoring item in the current terminal environment information and the predicted value of the same environmental monitoring item;

[0109] Step S63: normalizing the difference to obtain a status score for each environmental monitoring item.

[0110] Here, the predicted value is used to indicate the monitoring value of the environmental monitoring item at the target time predicted based on the historical terminal environment information. For example, the target time is the time when the access request is obtained, and the monitoring value of the environmental monitoring item at the specified time can also be predicted.

[0111] For example, if the environmental monitoring items in the historical terminal environment information are {X1, X2, ..., X m}, the predicted value is {E1,E2,...,E m}, the predicted value can be obtained by the long short-term memory LSTM (Long Short Term Memory) algorithm, that is, the solution formula: {E1, E2, ..., E m}=LSTM({X1,X2,...,X m}).

[0112] Here, the monitoring value is used to indicate the monitoring value of the environmental monitoring item in the specified monitoring time, that is, the monitoring value of each environmental monitoring item in the current terminal environment information at the target time, wherein the predicted value and the monitoring value are used to indicate the value of the same environmental monitoring item at the target time.

[0113] Here, the state score MS can be To calculate, where P is used to indicate the difference between the monitored value and the predicted value, min is used to indicate the minimum value of the environmental monitoring item in the specified monitoring time, and max is used to indicate the maximum value of the environmental monitoring item in the specified monitoring time.

[0114] In an embodiment of the present application, the predicted value of each environmental monitoring item at the target time can be calculated by the LSTM algorithm, and then the monitoring value of each environmental monitoring item in the current terminal environment information is obtained, the difference between the monitoring value and the corresponding predicted value is calculated, and the difference is normalized to the maximum and minimum values ​​to obtain the status score of each environmental monitoring item.

[0115] In an optional implementation, determining a policy scoring result of each execution policy based on the terminal information includes:

[0116] Step S71: determining the access memory information of the historical access request corresponding to each execution policy in the terminal information, and obtaining target access memory information;

[0117] Step S72: Calculate the matching degree between the target access memory information and the request content of the access request, and determine the matching score of the access memory information according to the matching degree.

[0118] Here, the matching degree can be obtained by performing multiple calculations on the target access memory information through the model. For example, the LLM model can be obtained by LLM({F1,F2,...,F z}) Calculate the matching degree, where F z It is used to instruct the extraction of target access memory information corresponding to each execution strategy from the terminal information, that is, the memory content that is more useful for the current execution process. z is the number of target access memory information.

[0119] If the target access memory information successfully matches the access request, it means that the target access memory information has a greater influence weight on the access request, that is, the matching score of the execution strategy corresponding to the target access memory information is improved, and the matching score FS is determined based on the matching degree.

[0120] In the above embodiment, the target access memory information is matched multiple times with the request content of the access request (i.e., the matching degree between the target access information and the request content of the access request is calculated), the legitimacy of the access request can be evaluated based on the matching degree, and the matching degree score can be determined based on the matching degree, so that the access request is monitored for risk based on the matching degree score, thereby improving the security of the terminal access control process.

[0121] In an optional embodiment, determining a target execution strategy that meets the scoring requirements from among the multiple execution strategies based on the strategy scoring results includes:

[0122] Step S81: performing weighted sum processing on the status score of the terminal status information and the matching score of the access memory information to obtain a target score for each execution strategy;

[0123] Step S82: Determine the execution strategy corresponding to the maximum target score as the target execution strategy.

[0124] Here, the target score HS can be calculated by HS=W F FS+W E ES+W A AS is used to calculate, where W F 、W E 、W A Used to indicate the dynamic weight value of the corresponding score, which can be adaptively configured and adjusted according to the model. FS is used to indicate the matching score of each execution strategy, ES is used to indicate the first scoring result of each execution strategy, and AS is used to indicate the second scoring result of each execution strategy.

[0125] In an embodiment of the present application, the dynamic weight value of the policy scoring result (i.e., the status score and the matching score) of each execution strategy can be determined, and each execution strategy can be simulated and executed. The policy scoring result and the corresponding dynamic weight value are weighted and summed to obtain the target score of each execution strategy, and the execution strategy corresponding to the maximum target score is used as the target execution strategy.

[0126] In an optional implementation, after executing the access request based on the target execution policy, the method further includes:

[0127] Step S91: Obtain the expected execution result in the target execution strategy;

[0128] Step S92: comparing the expected execution result with the actual execution result of the target execution strategy;

[0129] Step S93: When it is determined according to the comparison result that the access request does not match the target execution policy, the target execution policy is updated to obtain a new target execution policy, and the access request is executed according to the new target execution policy.

[0130] Here, the expected execution result is used to indicate the processing result expected to be obtained by determining the target execution strategy according to the preset rules.

[0131] Here, the "Actual Execution Result" indicates the result of executing the access request according to the target execution policy. The relevant access control actions can be executed according to preset rules. For example, if the target execution policy is "Accept but Watch" (i.e., accepting the access request but watching the access policy for that access request), the terminal corresponding to the access request will be marked as a "Key Watch" target and the Watch level for that terminal will be increased. A higher Watch level indicates that access requests from that terminal are more likely to generate anomalies.

[0132] In the above implementation, the expected execution result and the actual execution result are compared to obtain a comparison result, and the target execution policy can be adjusted according to the comparison result, thereby ensuring that the target execution policy matches the access request and improving the accuracy of decision-making.

[0133] In an optional implementation, updating the target execution policy to obtain a new target execution policy includes:

[0134] Step S1001: Calculating a target weight for each execution strategy through a self-attention mechanism; wherein the target weight is used to indicate the degree of influence of the terminal information on the corresponding execution strategy;

[0135] Step S1002: Determine the execution strategy corresponding to the maximum target weight as the new target execution strategy.

[0136] Here, the target weight can be obtained by Calculated, where A is the access memory information, B is the terminal environment information, C is the terminal behavior information, and d is the information dimension of the terminal environment information. (A)B T Used to calculate the similarity between access memory information and each terminal environment information.

[0137] Among them, the larger the target weight is, the more important the terminal information corresponding to the target weight is to the formation of the execution strategy, that is, the terminal information corresponding to the maximum target weight is the information feature that has the greatest impact on the correct result.

[0138] In an embodiment of the present application, the target weight of each execution strategy can be calculated through the self-attention mechanism, the terminal information that has the greatest impact on the correct result can be determined based on the target weight, and the terminal information can be stored in the access memory information corresponding to the access request. By comparing the target weights of different execution strategies, the execution strategy corresponding to the maximum target weight can be determined as the new target execution strategy.

[0139] In the above implementation, the target weight of each execution policy can be calculated, and a new target execution policy for the access request can be identified based on the target weight, thereby continuously optimizing the execution policy to adapt to the ever-changing security environment and user behavior patterns.

[0140] like Figure 2 As shown, the present application relates to a terminal access control agent (i.e., an agent), which consists of a context module, a decision center, an execution module, and a verification module.

[0141] The context module is used to collect input information from the statistical decision center, which includes access memory information, terminal environment information, and terminal behavior information.

[0142] The decision center is used to extract features from input information, make decisions, and finally output the target execution strategy.

[0143] The execution module is used to perform specific actions on the target execution policy output by the decision center (i.e., execute access requests according to the target execution policy) and record the execution results.

[0144] The verification module is used to compare the expected execution result of the target execution strategy of the decision center with the actual execution result of the execution module, obtain a comparison result, and feed the comparison result back to the context module for processing and storage.

[0145] like Figure 3 As shown in Figure 1, the decision center consists of a feature extraction module, an LLM model, a thinking module, and a sorting module.

[0146] The feature extraction module is responsible for the input information of the decision center, including access memory information, terminal environment information and terminal behavior information, and is used to perform feature engineering operations such as feature extraction and feature fusion on the input information.

[0147] The LLM model is responsible for processing each execution strategy in parallel and calculating the strategy scoring result for each execution strategy.

[0148] The thinking module is responsible for planning the execution process of the LLM model and timely correcting the target execution strategy output by the sorting module.

[0149] The sorting module is responsible for performing weighted calculations on the strategy scoring results of the LLM model to obtain the target score for each execution strategy and output the target execution strategy based on the target score.

[0150] like Figure 4 As shown in Figure 1, the terminal access agent algorithm includes interaction flow, execution flow, and feedback flow. The algorithm mainly uses the agent as the core, where the agent mainly uses the LLM model as the main body or brain, enabling the agent to automatically plan, make decisions, and solve complex problems.

[0151] The interaction flow is a process in which the context module generates different terminal information and inputs the terminal information as input information to the LLM model of the decision center for interaction. The terminal information includes access memory information, terminal environment information, and terminal behavior information.

[0152] The execution flow is the process in which the decision center processes the input information mainly through the LLM model after receiving the input information, outputs the target execution strategy based on the input information, sends the target execution strategy to the execution module, and the execution module performs specific actions according to the target execution strategy and outputs the execution results.

[0153] The feedback flow is the process in which the verification module compares the expected execution result of the target execution strategy with the actual execution result of the execution module after receiving the execution result of the execution module, and returns the comparison result to the context module.

[0154] The following combination Figure 5 The above terminal access control process is described as follows:

[0155] S501: The terminal device sends an access request to the security gateway.

[0156] S502: After receiving the access request from the terminal device, the security gateway verifies the user who logs into the terminal device, and after the verification passes, sends the access request to the context module of the terminal access control agent.

[0157] Among them, the terminal access control agent includes a context module, a decision center, an execution module and a verification module.

[0158] S503: The context module collects terminal information of the terminal device in response to the access request and sends the terminal information to the decision center.

[0159] S504: The decision center determines a target execution policy for the access request based on the terminal information, and sends the target execution policy to the execution module.

[0160] S505: The execution module executes the access request according to the target execution policy to obtain an actual execution result.

[0161] S506: The execution module sends the actual execution result to the security gateway, and the security gateway performs corresponding actions according to the actual execution result.

[0162] S507: The execution module sends the actual execution result to the verification module, and the verification module compares the expected execution result of the target execution policy with the actual execution result to obtain a comparison result.

[0163] S508: The verification module sends the comparison result to the decision center, and the decision center updates the target execution strategy according to the comparison result to obtain a new target execution strategy.

[0164] S509: The decision center sends the new target execution policy to the context module, and the context module stores the terminal information of the new target execution policy into the access memory information corresponding to the access request.

[0165] From the above description, it can be seen that the technical solution disclosed in this disclosure has the following advantages:

[0166] This application is based on the autonomous understanding and planning decision-making capabilities of the intelligent agent algorithm to solve the security control of the terminal, dynamically judge the security risks of the terminal, and promptly intercept risk requests. The terminal information of the terminal device is obtained through the context module. Then, after extracting effective information through the decision center based on the LLM large model, the target score of each execution strategy is processed in parallel using the GOT thinking chain. The execution strategy corresponding to the maximum target score is selected as the target execution strategy, and the target execution strategy is executed through the execution module. Finally, based on the verification module, the actual execution results of the target execution strategy are reflected and analyzed, and the judgment accuracy of the decision center is continuously optimized.

[0167] Those skilled in the art will understand that in the above-mentioned method of the specific implementation method, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0168] Based on the same inventive concept, the embodiment of the present disclosure also provides a terminal access control device corresponding to the terminal access control method. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned terminal access control method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0169] Reference Figure 6 FIG. 1 is a schematic diagram of a terminal access control device provided by an embodiment of the present disclosure, wherein the device includes: a policy determination unit 60, a score determination unit 61, and a processing unit 62; wherein:

[0170] a policy determination unit, configured to, in response to an access request from a terminal device, determine a plurality of execution policies for the access request from historical execution policies based on terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information;

[0171] a scoring determination unit, configured to determine a policy scoring result for each of the execution policies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information for each of the execution policies, and a matching score of the access memory information for each of the execution policies;

[0172] A processing unit is configured to determine, according to the policy scoring result, a target execution policy that meets the scoring requirements among the multiple execution policies, and execute the access request based on the target execution policy.

[0173] In a possible implementation manner, the device is further used for:

[0174] Determining a first scoring result for each of the execution strategies based on the terminal environment information in the terminal information, and determining a second scoring result for the execution strategy based on the terminal behavior information in the terminal information;

[0175] A status score of the terminal status information of the execution policy is determined based on the first scoring result and the second scoring result.

[0176] In a possible implementation manner, the device is further used for:

[0177] Determining a label score for each behavior label in the terminal behavior information; wherein the label score is used to indicate the degree of difference between the label value of the behavior label in the current terminal behavior information and the label value of the same behavior label in the historical terminal behavior information, where the historical terminal behavior information is the terminal status information corresponding to the historical access request;

[0178] A weighted sum calculation is performed on the tag score of each of the behavior tags to obtain a second scoring result of the execution strategy.

[0179] In a possible implementation manner, the device is further used for:

[0180] A ratio between a label value of the behavior label in the historical terminal behavior information and a label value of the same behavior label in the current terminal behavior information is calculated, and the label score is determined based on the ratio.

[0181] In a possible implementation manner, the device is further used for:

[0182] Calculating a status score for each environmental monitoring item based on the current terminal environment information and the historical terminal environment information;

[0183] A weighted scoring calculation is performed on the status scores of all the environmental monitoring items to obtain a first scoring result of the execution strategy.

[0184] In a possible implementation manner, the device is further used for:

[0185] Determining predicted values ​​of various environmental monitoring items at a target time based on the historical terminal environment information; wherein the target time is the time when the access request is obtained;

[0186] Calculating the difference between the monitored value of each environmental monitoring item in the current terminal environment information and the predicted value of the same environmental monitoring item;

[0187] The difference is normalized to obtain a status score for each environmental monitoring item.

[0188] In a possible implementation manner, the device is further used for:

[0189] Determine access memory information of historical access requests corresponding to each execution strategy in the terminal information to obtain target access memory information;

[0190] A degree of matching between the target access memory information and the request content of the access request is calculated, and a matching score of the access memory information is determined according to the degree of matching.

[0191] In a possible implementation manner, the device is further used for:

[0192] Performing weighted sum processing on the status score of the terminal status information and the matching score of the access memory information to obtain a target score for each execution strategy;

[0193] Determine the execution strategy corresponding to the maximum target score as the target execution strategy.

[0194] In a possible implementation manner, the device is further used for:

[0195] Obtaining the expected execution result in the target execution strategy;

[0196] comparing the expected execution result with the actual execution result of the target execution strategy;

[0197] If it is determined according to the comparison result that the access request does not match the target execution policy, the target execution policy is updated to obtain a new target execution policy, and the access request is executed according to the new target execution policy.

[0198] In a possible implementation manner, the device is further used for:

[0199] Calculating a target weight for each execution strategy through a self-attention mechanism; wherein the target weight is used to indicate the degree of influence of the terminal information on the corresponding execution strategy;

[0200] Determine the execution strategy corresponding to the maximum target weight as the new target execution strategy.

[0201] For descriptions of the processing flow of each unit in the device and the interaction flow between each module, reference can be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0202] Corresponding to Figure 1 The terminal access control method in the present disclosure also provides an electronic device 70, such as Figure 7 FIG. 1 is a schematic diagram of the structure of an electronic device 70 provided in an embodiment of the present disclosure, including:

[0203] Processor 71, memory 72, and bus 73; memory 72 is used to store execution instructions, including internal memory 721 and external memory 722; the internal memory 721 is also called internal memory, which is used to temporarily store operation data in the processor 71 and data exchanged with external memory 722 such as a hard disk. The processor 71 exchanges data with the external memory 722 through the internal memory 721. When the electronic device 70 is running, the processor 71 communicates with the memory 72 via the bus 73, so that the processor 71 executes the following instructions:

[0204] In response to an access request from a terminal device, determining a plurality of execution strategies for the access request from historical execution strategies based on terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information;

[0205] Determining a policy scoring result for each of the execution policies based on the terminal information; wherein the policy scoring result is used to indicate a status score of the terminal status information for each of the execution policies, and a matching score of the access memory information for each of the execution policies;

[0206] According to the policy scoring result, a target execution policy that meets the scoring requirements is determined among the multiple execution policies, and the access request is executed based on the target execution policy.

[0207] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program executes the steps of the terminal access control method described in the above method embodiment. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0208] The embodiments of the present disclosure also provide a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the terminal access control method described in the above method embodiment. For details, please refer to the above method embodiment and will not be repeated here.

[0209] The computer program product may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0210] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0211] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0212] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0213] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0214] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The scope of protection of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed in the present disclosure, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure shall be subject to the scope of protection of the claims.

Claims

1. A terminal access control method, characterized in that: include: In response to an access request from a terminal device, determining multiple execution strategies for the access request from historical execution strategies based on terminal information of the terminal device; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information; the access memory information includes the processing process, historical execution strategies, and historical execution results of various historical access requests; Determine access memory information of historical access requests corresponding to each execution strategy in the terminal information to obtain target access memory information; Calculating a matching degree between the target access memory information and the request content of the access request, and determining a matching score of the access memory information according to the matching degree; Performing weighted sum processing on the status score of the terminal status information and the matching score of the access memory information to obtain a target score for each execution strategy; Determine the execution strategy corresponding to the maximum target score as the target execution strategy; The access request is executed based on the target execution policy.

2. The method according to claim 1, characterized in that The method further comprises: Determining a first scoring result for each of the execution strategies based on the terminal environment information in the terminal information, and determining a second scoring result for the execution strategy based on the terminal behavior information in the terminal information; A status score of the terminal status information of the execution policy is determined based on the first scoring result and the second scoring result.

3. The method according to claim 2, characterized in that The terminal status information includes current terminal behavior information and historical terminal behavior information corresponding to the execution policy; The determining, based on the terminal behavior information in the terminal information, a second scoring result of the execution strategy includes: Determining a label score for each behavior label in the terminal behavior information; wherein the label score is used to indicate the degree of difference between the label value of the behavior label in the current terminal behavior information and the label value of the same behavior label in the historical terminal behavior information, where the historical terminal behavior information is the terminal status information corresponding to the historical access request; A weighted sum calculation is performed on the tag score of each of the behavior tags to obtain a second scoring result of the execution strategy.

4. The method according to claim 3, characterized in that Determining a tag score for each behavior tag in the terminal behavior information includes: A ratio between a label value of the behavior label in the historical terminal behavior information and a label value of the same behavior label in the current terminal behavior information is calculated, and the label score is determined based on the ratio.

5. The method according to claim 2, characterized in that The terminal status information includes current terminal environment information and historical terminal environment information corresponding to the execution policy; The determining, based on the terminal environment information in the terminal information, a first scoring result of each of the execution strategies, includes: Calculating a status score for each environmental monitoring item based on the current terminal environment information and the historical terminal environment information; A weighted scoring calculation is performed on the status scores of all the environmental monitoring items to obtain a first scoring result of the execution strategy.

6. The method according to claim 5, characterized in that The calculating the status score of each environmental monitoring item based on the current terminal environment information and the historical terminal environment information includes: Determining predicted values ​​of various environmental monitoring items at a target time based on the historical terminal environment information; wherein the target time is the time when the access request is obtained; Calculating the difference between the monitored value of each environmental monitoring item in the current terminal environment information and the predicted value of the same environmental monitoring item; The difference is normalized to obtain a status score for each environmental monitoring item.

7. The method according to claim 1, characterized in that After executing the access request based on the target execution policy, the method further comprises: Obtaining the expected execution result in the target execution strategy; comparing the expected execution result with the actual execution result of the target execution strategy; If it is determined according to the comparison result that the access request does not match the target execution policy, the target execution policy is updated to obtain a new target execution policy, and the access request is executed according to the new target execution policy.

8. The method according to claim 7, characterized in that The updating of the target execution strategy to obtain a new target execution strategy includes: Calculating a target weight for each execution strategy through a self-attention mechanism; wherein the target weight is used to indicate the degree of influence of the terminal information on the corresponding execution strategy; Determine the execution strategy corresponding to the maximum target weight as the new target execution strategy.

9. A terminal access control device, characterized in that: include: a policy determination unit, configured to, in response to an access request from a terminal device, determine, based on terminal information of the terminal device, a plurality of execution policies for the access request from historical execution policies; wherein the terminal information includes: access memory information of the terminal device for historical access requests and terminal status information; the access memory information includes processing procedures, historical execution policies, and historical execution results of various historical access requests; a score determination unit, configured to determine access memory information of historical access requests corresponding to each execution policy in the terminal information to obtain target access memory information; calculate a matching degree between the target access memory information and the request content of the access request, and determine a matching score for the access memory information based on the matching degree; A processing unit is used to perform weighted summation processing on the status score of the terminal status information and the matching score of the access memory information to obtain a target score for each of the execution strategies; determine the execution strategy corresponding to the maximum target score as the target execution strategy; and execute the access request based on the target execution strategy.

10. An electronic device, characterized in that: include: A processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate via the bus. When the machine-readable instructions are executed by the processor, the steps of the terminal access control method according to any one of claims 1 to 8 are performed.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the terminal access control method according to any one of claims 1 to 8 are executed.

12. A computer program product, characterized in that The computer program product is stored in a storage medium, and the program product is executed by at least one processor to implement the terminal access control method according to any one of claims 1 to 8.

Images