User access rights control method and apparatus

Abstract

The application provides a user access permission control method and device, the method comprises the following steps: analyzing the access log of a user, and obtaining all domain names accessed by the user; determining the importance of each domain name based on the number of occurrences of each domain name, the number of access logs containing each domain name, and the total number of domain names; determining the abnormality degree of each domain name based on an anomaly detection model and the importance of each domain name; controlling the access permission of the user based on the abnormality degree of each domain name; and the anomaly detection model is trained based on the importance of historical domain names of the user and the abnormality labels of the historical domain names. Based on the anomaly detection model, the importance of each domain name is applied to determine the abnormality degree of each domain name, and then the access permission of the user can be dynamically controlled based on the abnormality degree of each domain name, and the application does not involve complex data calculation, has low cost and high efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for controlling user access permissions. Background Technology

[0002] Access control is a common feature when users access web applications. Access control is a security mechanism used to manage user access to and operations on applications. Through access control, the system can determine the scope of operations a user can access and perform based on their identity, role, or other criteria. System administrators can define different types of user roles and assign appropriate permission levels to each role. This ensures that users can only access the resources and functions they are authorized to access, preventing unauthorized access and abuse.

[0003] Currently, user access control typically involves users requesting relevant permissions from the access management department based on business needs. The department then assesses the request and grants the user the permissions in a one-time grant, after which the user can use them without restriction. However, as time passes and business changes occur, user permissions are often not adjusted or changed in a timely manner. This leads to the accumulation of user security policies and the expansion of permissions, resulting in a lack of timely and effective governance.

[0004] Furthermore, a zero-trust approach to access control is currently offered, where user permissions are untrusted by default. Each access to a resource requires risk assessment and authentication, and user access permissions are dynamically adjusted based on the risk assessment results. This leads to a poor user experience, as repeated authentication is required for every resource access, resulting in significant resource waste, limited processing performance, and an excessive workload for re-authentication. Summary of the Invention

[0005] This invention provides a user access control method and apparatus to address the deficiencies in the prior art.

[0006] This invention provides a user access control method, comprising the following steps.

[0007] Parse the user's access logs to obtain all the domains visited by the user;

[0008] The importance of each domain name is determined based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names.

[0009] Based on the anomaly detection model, the importance of each domain name is applied to determine the degree of anomaly for each domain name;

[0010] Based on the degree of abnormality of each domain name, control the user's access permissions;

[0011] The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of those historical domain names.

[0012] According to a user access control method provided by the present invention, determining the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names includes:

[0013] The word frequency of each domain name is determined based on the number of times each domain name appears and the total number of such domain names.

[0014] Based on the number of access logs for each domain and the total number of domains, the inverse document frequency for each domain is determined.

[0015] The importance of each domain is determined based on the term frequency and inverse document frequency of each domain.

[0016] According to a user access control method provided by the present invention, controlling the user's access permissions based on the degree of abnormality of each domain name includes:

[0017] If the abnormality level of any domain name exceeds the threshold, then the access permissions corresponding to that domain name are disabled.

[0018] If the abnormality level of any domain name is less than or equal to the threshold, then access permissions are granted to the domain name.

[0019] According to a user access control method provided by the present invention, controlling the user's access permissions based on the degree of abnormality of each domain name includes:

[0020] Determine the importance of access elements corresponding to each domain name, wherein the access elements include access time period and / or access location;

[0021] Based on the aforementioned anomaly detection model, the degree of anomaly of the access elements corresponding to each domain name is determined by applying the importance of each domain name's access elements.

[0022] Based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, the user's access permissions are controlled.

[0023] The anomaly detection model is trained based on the importance of the user's historical domain names, the anomaly tags of the domain names, the importance of the access elements corresponding to the historical domain names, and the anomaly tags of the access elements corresponding to the historical domain names.

[0024] According to a user access control method provided by the present invention, determining the importance of access elements corresponding to each domain name includes:

[0025] The importance of each access element is determined based on the frequency of each access element's occurrence, the number of access logs containing each access element, and the total number of access elements.

[0026] A user access control method provided by the present invention further includes:

[0027] Periodically retrieve the user's updated access logs;

[0028] Parse the update access log to obtain the updated domain name;

[0029] The importance of the updated domain name is determined based on the number of times the updated domain name appears, the number of update access logs containing the updated domain name, and the total number of updated domain names.

[0030] The anomaly detection model is updated based on the importance of the updated domain name and the anomaly label of the updated domain name.

[0031] The present invention also provides a user access control device, comprising the following modules.

[0032] The log parsing unit is used to parse the user's access logs and obtain all the domains accessed by the user.

[0033] The information determination unit is used to determine the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names.

[0034] The anomaly detection unit is used to determine the degree of anomaly of each domain name based on the anomaly detection model and the importance of each domain name.

[0035] The permission determination unit is used to control the user's access permissions based on the degree of abnormality of each domain name;

[0036] The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of those historical domain names.

[0037] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the user access control method as described above.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the user access control method as described above.

[0039] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the user access control method as described above.

[0040] The user access control method and apparatus provided by this invention are based on an anomaly detection model. By applying the importance of each domain name, the degree of anomaly of each domain name is determined, and then the user's access rights can be dynamically controlled based on the degree of anomaly of each domain name. Moreover, this invention does not involve complex data calculations, and has low cost and high efficiency. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating the user access control method provided by the present invention.

[0043] Figure 2 This is a flowchart illustrating another user access permission method provided by the present invention.

[0044] Figure 3 This is a schematic diagram of the user access control device provided by the present invention.

[0045] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0047] Currently, user access control typically involves users requesting relevant permissions from the access management department based on business needs. The department then assesses the request and grants the user the permissions in a one-time grant, after which the user can use them without restriction. However, as time passes and business changes occur, user permissions are often not adjusted or changed in a timely manner. This leads to the accumulation of user security policies and the expansion of permissions, resulting in a lack of timely and effective governance.

[0048] In addition, a zero-trust approach to access control is currently offered, where user permissions are untrusted by default. Each access to a resource requires risk assessment and authentication, and user access permissions are dynamically adjusted based on the risk assessment results. This results in a poor user experience, as each resource access requires repeated authentication, which not only wastes resources and limits processing performance, but also involves too much re-authentication work.

[0049] This invention transforms the problem of dynamically adjusting user access permissions in zero-trust networks into a problem of detecting user permission anomalies. It employs machine learning methods to establish a user baseline (i.e., user access habits). When a user's access behavior deviates from the baseline, a behavioral warning is issued, and the administrator is notified to review the user's access behavior. After administrator confirmation, the permission is restored to the user, thus achieving dynamic adjustment of user permissions. As enterprise business needs evolve, user access permissions also continuously change. Therefore, this invention further adds a model self-training module to the model prediction, automatically adjusting the user baseline to adapt to constantly changing business requirements.

[0050] Figure 1 This is a flowchart illustrating the user access control method provided by the present invention, as shown below. Figure 1 As shown, the method includes steps 110, 120, 130 and 140.

[0051] Step 110: Parse the user's access logs to obtain all the domains accessed by the user.

[0052] Here, user access logs refer to files that record user access behavior. Access logs typically include the domain names accessed, the requested paths, and the user's IP address. A domain name can be understood as the name of the website, server, application, etc., that the user accesses. Since access logs record the accessed domain names, all domain names visited by the user can be extracted from them.

[0053] When a user accesses multiple domains, the user's access logs can be obtained from the following locations:

[0054] (1) Server-side logs: Each domain name usually has a corresponding server to store and process user requests. The server usually records user access logs, including access time, source IP address, accessed web pages or resources, etc. The access logs can be configured and recorded on the server.

[0055] (2) Network device logs: User requests pass through various network devices during network transmission, such as routers and switches. These network devices can also record user access logs to facilitate network troubleshooting and security analysis.

[0056] (3) Application logs: If the domain name accessed by a user involves a specific application, that application may log the user's access. For example, online shopping applications may log the user's purchase history and browsing history, while social media applications may log the user's comments and interactions. These application logs can provide more detailed and domain-specific access information.

[0057] (4) Third-party service provider logs: If the domain name uses third-party service providers (such as CDN, analytics tools, etc.), these service providers usually also have their own access logs. User access logs may be recorded and stored in the logs of these service providers.

[0058] It should be noted that obtaining user access logs requires appropriate permissions and legitimacy. Typically, only system administrators, network administrators, or specific authorized personnel should be able to access and obtain access logs. Furthermore, personal privacy and data protection must be fully considered, and relevant privacy policies and laws and regulations must be followed during the log recording process.

[0059] Step 120: Determine the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names.

[0060] Specifically, domain names are similar to text data, including both numerical and character data. If the domain name is character data, it is not convenient for algorithm analysis and model prediction. Therefore, this embodiment of the invention determines the importance of each domain name based on the frequency of each domain name's occurrence, the number of access logs containing each domain name, and the total number of domain names. The importance of each domain name is numerical data, that is, the character domain name is escaped to obtain the numerical importance.

[0061] The frequency of each domain name's appearance in the access logs indicates how often it appears. A higher frequency indicates greater access volume and importance. The number of access logs for each domain name represents the total number of access logs recorded for that domain, indicating the number of times each domain has been requested for access by a user. The importance of each domain name indicates its relevance to the user. Higher importance indicates a stronger relevance, meaning more frequent user access to that domain and a higher demand for access rights.

[0062] Step 130: Based on the anomaly detection model, apply the importance of each domain name to determine the degree of anomaly of each domain name; the anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly labels of the historical domain names.

[0063] Specifically, after obtaining the importance of each domain name, the importance of each domain name is input into the anomaly detection model to obtain the anomaly level of each domain name output by the anomaly detection model. The anomaly level of each domain name is used to indicate whether the user's behavior of accessing each domain name deviates from the user baseline (i.e., user access habits). If so, it indicates that the corresponding behavior has deviated from the user's access habits, the corresponding access permissions are redundant, and need to be reviewed by the administrator. If not, it indicates that the corresponding behavior conforms to the user's access habits, and the corresponding access permissions are not redundant permissions.

[0064] The anomaly detection model is trained based on the importance of a user's historical domain names and their anomaly tags. Optionally, the anomaly detection model can be iteratively trained using the Local Outlier Factor (LOF) detection method.

[0065] In the iterative training of the anomaly detection model, the dataset (which can include the importance of all historical domains and their anomaly labels) can first be divided into a training set and a test set. The training set is used to train the anomaly detection model, and the test set is used to evaluate its performance. When training the anomaly detection model using the training set data, outliers are detected in the training set data using the LOF algorithm. If an anomaly is detected, it is removed from the training set, and the model is retrained. Removing outliers effectively improves the model's generalization ability and robustness. This process is repeated until the training set no longer contains outliers or the model reaches a preset stopping condition. Finally, the trained anomaly detection model is used to predict on the test set data, and the model's performance is evaluated.

[0066] When training an anomaly detection model using the LOF detection method, the degree of anomaly of each domain name is obtained as the LOF value. If the LOF value is much greater than 1, it is an outlier, that is, a deviation from the user baseline; if the LOF value is close to 1, it is a normal point.

[0067] It should be noted that both the training and test sets contain access data corresponding to authorized permissions. This means that this embodiment of the invention primarily addresses the issue of "over-authorization" in its permission control. Specifically, if unauthorized permissions are not granted, the system will automatically display a "Unauthorized, access denied" message when a user attempts to access the domain, thus preventing the generation of corresponding access logs.

[0068] Step 140: Control user access permissions based on the degree of abnormality of each domain name.

[0069] Specifically, the degree of abnormality for each domain name is used to indicate whether the user's behavior when accessing each domain name deviates from the user's access habits. If so, it means that the corresponding behavior has deviated from the user's access habits and the corresponding access permissions are redundant (that is, the corresponding access permissions are over-authorized). Access can only continue after the administrator's review and approval. If not, it means that the corresponding behavior is in line with the user's access habits and the corresponding access permissions are not redundant permissions, that is, the corresponding access permissions are not over-authorized.

[0070] The user access control method provided in this invention is based on an anomaly detection model. It applies the importance of each domain name to determine the degree of anomaly of each domain name, and then dynamically controls the user's access permissions based on the degree of anomaly of each domain name. Moreover, this invention does not involve complex data calculations, and has low cost and high efficiency.

[0071] The local outlier detection algorithm includes:

[0072] (1) For each data point, calculate the Euclidean distance between each data point and all other data points, and then sort them from nearest to farthest. The Euclidean distance is calculated based on the following formula:

[0073]

[0074] (2) Calculate the reachable distance: Given parameter k, the reachable distance r(p,o) from data point p to data point o is the maximum value of the maximum k-nearest neighbor distance of data point o and the direct distance between data point p and point o.

[0075]

[0076] in, This represents the k-nearest neighbor distance of o. This represents the Euclidean distance.

[0077] (3) Calculate local density: The local reachability density of object p is the reciprocal of the average reachability distance of p's nearest neighbors.

[0078]

[0079] in, This represents the number of k-neighborhoods.

[0080] (4) Calculate the Local Outlier Factor (LOF): the ratio of the average local reachability density of points in the k-neighborhood of point P to the local reachability density of data point P.

[0081]

[0082] in, This represents the number of k-neighborhoods.

[0083] A higher LOF value indicates a greater anomaly, while a lower LOF value indicates a closer tendency towards normality. Specifically, an LOF value significantly greater than 1 indicates an outlier, meaning a deviation from the user baseline; a value close to 1 indicates a normal range.

[0084] It should be noted that the above anomaly detection model is based on a user unit, meaning that one anomaly detection model corresponds to one user.

[0085] Based on the above embodiments, the importance of each domain name is determined based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names, including:

[0086] The word frequency of each domain name is determined based on the number of times each domain name appears and the total number of domain names.

[0087] The inverse document frequency of each domain is determined based on the number of access logs for each domain and the total number of domains.

[0088] The importance of each domain is determined based on the term frequency and inverse document frequency of each domain.

[0089] Optionally, TF-IDF (term frequency–inverse document frequency) can be used to determine the importance of each domain name. For example, each domain name can be input into a TF-IDF model, which will then perform escaping processing to obtain the importance of each domain name. TF-IDF is used to evaluate the importance of a word to a document within a document set or corpus. The importance of a word increases proportionally to the number of times it appears in a document, but decreases inversely proportionally to its frequency in the corpus. If a word or phrase appears frequently in one article but rarely in others, it is considered to have good category distinguishing ability.

[0090] Specifically, when using TF-IDF to determine the importance of each domain name, the following formula can be used:

[0091] TF = Number of times each domain appears / Total number of domains

[0092] IDF = log(total number of domains / (number of access logs for each domain + 1))

[0093] TFIDF=TF×IDF

[0094] Here, TF (Term Frequency) represents the term frequency of each domain name, IDF (Inverse Document Frequency) represents the inverse document frequency of each domain name, and TFIDF represents the importance of each domain name.

[0095] Based on any of the above embodiments, controlling user access permissions based on the degree of abnormality of each domain name includes:

[0096] If the abnormality level of any domain exceeds the threshold, then the access permissions for that domain will be disabled.

[0097] If the abnormality level of any domain name is less than or equal to the threshold, then access permissions are granted to the domain name.

[0098] Specifically, if the abnormality level of any domain name exceeds the threshold, it indicates that the user's corresponding access permission is not frequently used or the user does not need the corresponding access permission, indicating over-authorization. In this case, after management review, the access permission for any domain name can be disabled.

[0099] If the abnormality level of any domain name is less than or equal to the threshold, it indicates that the user's corresponding access permissions are frequently used and there is no over-authorization. In this case, the corresponding access permissions can continue to be authorized.

[0100] Based on any of the above embodiments, controlling user access permissions based on the degree of abnormality of each domain name includes:

[0101] The importance of access elements corresponding to each domain name is determined. Access elements include access time period and / or access location. Access elements may also include other dimensions of data, which are not specifically limited in this embodiment of the invention.

[0102] Based on the anomaly detection model, the importance of the access elements corresponding to each domain name is applied to determine the degree of anomaly of the access elements corresponding to each domain name.

[0103] Based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, control the user's access permissions;

[0104] The anomaly detection model is trained based on the importance of the user's historical domain names, the anomaly labels of the domain names, the importance of the access elements corresponding to the historical domain names, and the anomaly labels of the access elements corresponding to the historical domain names.

[0105] Specifically, the access period can be understood as the time period information of user access. This can be obtained from access logs, and the time periods are then processed into dimensionless pure numerical values. These values ​​are then divided according to the time period, such as 0:00 to 1:00 as value 1, 1:00 to 2:00 as value 2, etc., ultimately resulting in 24 values. The access periods are then input into a TF-IDF model for processing to obtain the importance of the escaped access periods. Finally, the importance of the access periods is input into an LOF model for processing. The resulting LOF value is used to characterize the degree of anomaly of the access period, i.e., the degree of anomaly of the corresponding time period.

[0106] Access location can be understood as the geographical location of a user's access to a domain name. If a user accesses the same domain name from different geographical locations within a short period of time, it may indicate an anomaly. This can be achieved by obtaining the geographical location of the user's accessed domain name from access logs, processing the geographical locations into dimensionless pure numerical values, and numbering different geographical locations (e.g., starting from 1). This results in multiple numerical values ​​corresponding to different geographical locations. The access locations are then input into a TF-IDF model for escaping processing to obtain the importance of the escaped access locations. Finally, the importance of the access locations is input into a LOF model for further processing. The resulting LOF value represents the degree of anomaly of the access location, i.e., the degree of anomaly of the corresponding geographical location.

[0107] Optionally, based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, the degree of access abnormality can be determined, and user access permissions can be controlled based on the degree of access abnormality. The degree of access abnormality can be determined based on the following formula:

[0108] LOF=LOF(C)×y1+LOF(T)×y2+LOF(W)×y3

[0109] In summary, LOF represents the degree of access anomaly, LOF(C) represents the degree of anomaly of each domain name, LOF(T) represents the degree of anomaly of the access time period, LOF(W) represents the degree of anomaly of the access location, and y1, y2 and y3 represent weights, which can be set according to actual needs, and the sum of y1, y2 and y3 is 1.

[0110] When the LOF value is significantly greater than 1, it indicates an outlier, meaning a deviation from the baseline; a value close to 1 is considered normal. A LOF value exceeding the threshold indicates that the access behavior has deviated from the user's usual access habits, representing over-authorization. Optionally, when the LOF value exceeds the threshold, the administrator can be notified for review, and the user can only continue accessing the site after the administrator's approval.

[0111] Figure 2 This is a flowchart illustrating another user access permission method provided by the present invention, as shown below. Figure 2 As shown, the method includes:

[0112] Obtain the user's access logs from the server, parse the access logs, and obtain all the domains accessed by the user, the access time of each domain, and the access location of each domain.

[0113] Each domain name, the access time period of each domain name, and the access location of each domain name are input into the TF-IDF model to obtain the importance of each domain name, the importance of each domain name's access time period, and the importance of each domain name's access location.

[0114] The importance of each domain name, the importance of each domain name's access time, and the importance of each domain name's access location are input into the LOF model to obtain the degree of anomaly of each domain name, the degree of anomaly of each domain name's access time, and the degree of anomaly of each domain name's access location.

[0115] The degree of access anomaly is determined based on the degree of anomaly of each domain name, the degree of anomaly of each domain name's access time, and the degree of anomaly of each domain name's access location, and access control is implemented based on the degree of access anomaly.

[0116] Based on any of the above embodiments, determining the importance of access elements corresponding to each domain name includes:

[0117] The importance of each access element is determined based on the frequency of each access element's occurrence, the number of access logs containing each access element, and the total number of access elements.

[0118] Optionally, the term frequency of each access element is determined based on the number of times each access element appears and the total number of access elements; the inverse document frequency of each access element is determined based on the number of access logs containing each access element and the total number of access elements; and the importance of each access element is determined based on the term frequency and the inverse document frequency of each access element.

[0119] The importance of each access element can be determined based on the following formula:

[0120] TF' = Number of occurrences of each domain name / Total number of domain names

[0121] IDF ’ =log(total number of domains / (number of access logs for each domain + 1))

[0122] TFIDF ’ =TF'×IDF ’

[0123] Where TF' represents the word frequency of each accessed element, and IDF... ’ TF-IDF represents the inverse document frequency of each accessed element. ’ This indicates the importance of each access element.

[0124] Based on any of the above embodiments, the method further includes:

[0125] Regularly retrieve users' updated access logs;

[0126] Parse the update access logs to obtain the updated domain name;

[0127] The importance of an updated domain name is determined based on the number of times the updated domain name appears, the number of update access logs containing the updated domain name, and the total number of updated domain names.

[0128] The anomaly detection model is updated based on the importance of the updated domain name and the anomaly label of the updated domain name.

[0129] Specifically, considering that users' access permissions may differ at different times—for example, the required access permissions might differ between the previous month and the following month due to different business needs—it is necessary to dynamically update the anomaly detection model to adapt to changes in user access permissions over time, thereby achieving dynamic control of user permissions.

[0130] The update access logs can be user access logs obtained periodically, such as obtaining user update access logs every month. After obtaining the update access logs, the logs are parsed to obtain the updated domain names. Then, based on the number of times the updated domain names appear, the number of update access logs containing the updated domain names, and the total number of updated domain names, the importance of the updated domain names is determined. Based on the importance of the updated domain names and their anomaly tags, the anomaly detection model is updated.

[0131] The user access control device provided by the present invention is described below. The user access control device described below can be referred to in correspondence with the user access control method described above.

[0132] Based on any of the above embodiments Figure 3 This is a schematic diagram of the user access permission determination device provided by the present invention, as shown below. Figure 3 As shown, the device includes:

[0133] Log parsing unit 310 is used to parse the user's access logs and obtain all the domain names accessed by the user.

[0134] Information determination unit 320 is used to determine the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names;

[0135] Anomaly detection unit 330 is used to determine the degree of anomaly of each domain name based on the anomaly detection model and the importance of each domain name.

[0136] The permission determination unit 340 is used to control user access permissions based on the degree of abnormality of each domain name;

[0137] The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly labels of those historical domain names.

[0138] Based on any of the above embodiments, the importance of each domain name is determined based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names, including:

[0139] The word frequency of each domain name is determined based on the number of times each domain name appears and the total number of domain names.

[0140] The inverse document frequency of each domain is determined based on the number of access logs for each domain and the total number of domains.

[0141] The importance of each domain is determined based on the term frequency and inverse document frequency of each domain.

[0142] Based on any of the above embodiments, controlling user access permissions based on the degree of abnormality of each domain name includes:

[0143] If the abnormality level of any domain exceeds the threshold, then the access permissions for that domain will be disabled.

[0144] If the abnormality level of any domain name is less than or equal to the threshold, then access permissions are granted to the domain name.

[0145] Based on any of the above embodiments, controlling user access permissions based on the degree of abnormality of each domain name includes:

[0146] Determine the importance of the access elements corresponding to each domain name. Access elements include access time and / or access location.

[0147] Based on the anomaly detection model, the importance of the access elements corresponding to each domain name is applied to determine the degree of anomaly of the access elements corresponding to each domain name.

[0148] Based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, control the user's access permissions;

[0149] The anomaly detection model is trained based on the importance of the user's historical domain names, the anomaly labels of the domain names, the importance of the access elements corresponding to the historical domain names, and the anomaly labels of the access elements corresponding to the historical domain names.

[0150] Based on any of the above embodiments, determining the importance of access elements corresponding to each domain name includes:

[0151] The importance of each access element is determined based on the frequency of each access element's occurrence, the number of access logs containing each access element, and the total number of access elements.

[0152] Based on any of the above embodiments, the method further includes:

[0153] Regularly retrieve users' updated access logs;

[0154] Parse the update access logs to obtain the updated domain name;

[0155] The importance of an updated domain name is determined based on the number of times the updated domain name appears, the number of update access logs containing the updated domain name, and the total number of updated domain names.

[0156] The anomaly detection model is updated based on the importance of the updated domain name and the anomaly label of the updated domain name.

[0157] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a user access control method. This method includes: parsing the user's access logs to obtain all domain names accessed by the user; determining the importance of each domain name based on the frequency of occurrence of each domain name, the number of access logs containing each domain name, and the total number of domain names; determining the degree of abnormality of each domain name based on an anomaly detection model and applying the importance of each domain name; and controlling the user's access permissions based on the degree of abnormality of each domain name. The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly labels of those historical domain names.

[0158] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0159] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the user access control method provided by the above methods. The method includes: parsing the user's access logs to obtain all domain names accessed by the user; determining the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names; determining the degree of abnormality of each domain name based on an anomaly detection model and applying the importance of each domain name; and controlling the user's access permissions based on the degree of abnormality of each domain name. The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of the historical domain names.

[0160] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the user access control method provided by the above methods. The method includes: parsing the user's access logs to obtain all domain names accessed by the user; determining the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names; determining the degree of abnormality of each domain name by applying the importance of each domain name based on an anomaly detection model; and controlling the user's access permissions based on the degree of abnormality of each domain name. The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of the historical domain names.

[0161] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0162] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0163] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A user access control method, characterized in that, include: Parse the user's access logs to obtain all the domains visited by the user; The importance of each domain name is determined based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names. Based on the anomaly detection model, the importance of each domain name is applied to determine the degree of anomaly for each domain name; Based on the degree of abnormality of each domain name, control the user's access permissions; The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of those historical domain names; The control of user access permissions based on the degree of abnormality of each domain name includes: Determine the importance of access elements corresponding to each domain name, wherein the access elements include access time period and / or access location; Based on the aforementioned anomaly detection model, the degree of anomaly of the access elements corresponding to each domain name is determined by applying the importance of each domain name's access elements. Based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, the user's access permissions are controlled. The anomaly detection model is trained based on the importance of the user's historical domain name, the anomaly label of the domain name, the importance of the access elements corresponding to the historical domain name, and the anomaly label of the access elements corresponding to the historical domain name. Determining the importance of access elements corresponding to each domain name includes: The importance of each access element is determined based on the frequency of each access element's occurrence, the number of access logs containing each access element, and the total number of access elements.

2. The user access control method according to claim 1, characterized in that, The importance of each domain name is determined based on its occurrence frequency, the number of access logs containing each domain name, and the total number of domain names, including: The word frequency of each domain name is determined based on the number of times each domain name appears and the total number of such domain names. Based on the number of access logs for each domain and the total number of domains, the inverse document frequency for each domain is determined. The importance of each domain is determined based on the term frequency and inverse document frequency of each domain.

3. The user access control method according to any one of claims 1 to 2, characterized in that, The method further includes: Periodically retrieve the user's updated access logs; Parse the update access log to obtain the updated domain name; The importance of the updated domain name is determined based on the number of times the updated domain name appears, the number of update access logs containing the updated domain name, and the total number of updated domain names. The anomaly detection model is updated based on the importance of the updated domain name and the anomaly label of the updated domain name.

4. A user access permission determination device, characterized in that, include: The log parsing unit is used to parse the user's access logs and obtain all the domains accessed by the user. The information determination unit is used to determine the importance of each domain name based on the number of times each domain name appears, the number of access logs containing each domain name, and the total number of domain names. The anomaly detection unit is used to determine the degree of anomaly of each domain name based on the anomaly detection model and the importance of each domain name. The permission determination unit is used to control the user's access permissions based on the degree of abnormality of each domain name; The anomaly detection model is trained based on the importance of the user's historical domain names and the anomaly tags of those historical domain names; The control of user access permissions based on the degree of abnormality of each domain name includes: Determine the importance of access elements corresponding to each domain name, wherein the access elements include access time period and / or access location; Based on the aforementioned anomaly detection model, the degree of anomaly of the access elements corresponding to each domain name is determined by applying the importance of each domain name's access elements. Based on the degree of abnormality of each domain name and the degree of abnormality of the access elements corresponding to each domain name, the user's access permissions are controlled. The anomaly detection model is trained based on the importance of the user's historical domain name, the anomaly label of the domain name, the importance of the access elements corresponding to the historical domain name, and the anomaly label of the access elements corresponding to the historical domain name. Determining the importance of access elements corresponding to each domain name includes: The importance of each access element is determined based on the frequency of each access element's occurrence, the number of access logs containing each access element, and the total number of access elements.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the user access control method as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the user access control method as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the user access control method as described in any one of claims 1 to 3.

Images