Network resource access control method and system based on identity authentication and port perception

Abstract

The present invention provides a network resource access control method and system based on identity authentication and port perception, wherein the method is to identify abnormalities in existing port access permission configurations according to a standardized port security policy generated by parsing port access rule configuration requests submitted by various business departments through natural language processing technology, generate permission compliance inspection results, and identify suspicious access patterns and abnormal behaviors based on data mining technology according to access log data and access flow data of various port devices to generate a port access risk assessment report, and then perform policy change simulation assessment according to a port security policy adjustment list obtained by correlation analysis of permission compliance inspection results and port access risk assessment reports to generate the latest port security policy to execute access control. The present invention can perform comprehensive and reliable monitoring and filtering of resource access to various port devices, effectively improve the intelligent level of port security management, and reduce enterprise information security risks.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a network resource access control method and system based on identity authentication and port perception. Background Art

[0002] With the rapid development of information technology, the threats to enterprise information security are gradually increasing. Enterprise information security is directly related to the company's business secrets and core competitiveness. Only reliable access control of enterprise network resources can ensure enterprise information security.

[0003] The existing network resource access control of large enterprises involves many departments and application systems. The business processes and data access requirements of various departments vary greatly. The frequent turnover of internal personnel in the enterprise and the rapid changes in positions and responsibilities lead to complex user account and permission management. In addition, each application system adopts different technical architectures and security mechanisms. The lack of a unified authentication and authorization solution requires administrators to manually configure and maintain a large number of access control rules. The rules between different systems are obscure and difficult to coordinate. Based on this, when the enterprise needs to introduce new business and technology, the original rules may become invalid or conflict. At the same time, it is difficult for administrators to fully evaluate the impact of the change. Due to the lack of effective verification methods in the access rule configuration process, errors and omissions cannot be discovered in time, making it difficult to locate faults and troubleshoot problems. This makes the enterprise network resource access control have configuration defects and management blind spots, which can be easily exploited by attackers to obtain access to sensitive data and key functions beyond their authorization scope, or even control network equipment, resulting in a greater threat to the business operations and data security of the enterprise. Summary of the invention

[0004] The purpose of the present invention is to provide a network resource access control method based on identity authentication and port perception, which associates and analyzes the abnormal identification results of the existing port access permission configuration based on the standardized port security policy with the port access risk assessment results based on the access log data and access flow data of the port device to generate a port security policy adjustment list, and dynamically adjusts the port security policy in combination with the policy change simulation assessment results. The method can comprehensively and reliably monitor and filter the resource access of each port device, avoid attackers from exploiting configuration loopholes to bypass security protection and obtain resources beyond the authority, effectively improve the intelligence level of port security management, and reduce the enterprise information security risk.

[0005] In order to achieve the above objectives, it is necessary to provide a network resource access control method and system based on identity authentication and port perception in response to the above technical problems.

[0006] In a first aspect, an embodiment of the present invention provides a method for controlling network resource access based on identity authentication and port awareness, the method comprising the following steps:

[0007] The port access rule configuration request submitted by each business department is parsed and processed through natural language processing technology to generate a corresponding standardized port security policy; the standardized port security policy includes multiple port security policies; the port security policy includes a policy ID, user role, port resource, access rule and corresponding access rights;

[0008] According to the standardized port security policy, anomalies are identified in the existing port access permission configuration, and corresponding permission compliance check results are generated;

[0009] Based on the access log data and access traffic data of each port device, suspicious access patterns and abnormal behaviors are identified based on data mining technology, and corresponding port access risk assessment reports are generated;

[0010] Correlation analysis is performed on the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list;

[0011] A policy change simulation assessment is performed according to the port security policy adjustment list to generate the latest port security policy, and port resource access control is performed according to the latest port security policy.

[0012] In a second aspect, an embodiment of the present invention provides a network resource access control system based on identity authentication and port awareness, the system comprising:

[0013] A security policy generation module is used to parse and process the port access rule configuration requests submitted by various business departments through natural language processing technology to generate corresponding standardized port security policies; the standardized port security policies include multiple port security policies; the port security policies include policy ID, user role, port resources, access rules and corresponding access rights;

[0014] A permission compliance checking module, used to identify anomalies in existing port access permission configurations according to the standardized port security policy and generate corresponding permission compliance checking results;

[0015] The access risk assessment module is used to identify suspicious access patterns and abnormal behaviors based on the access log data and access traffic data of each port device based on data mining technology, and generate corresponding port access risk assessment reports;

[0016] An adjustment suggestion generation module is used to correlate and analyze the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list;

[0017] The security policy update module is used to perform policy change simulation evaluation according to the port security policy adjustment list, generate the latest port security policy, and execute port resource access control according to the latest port security policy.

[0018] The above-mentioned application provides a network resource access control method and system based on identity authentication and port perception. The method realizes parsing and processing of port access rule configuration requests submitted by various business departments through natural language processing technology, generates a standardized port security policy corresponding to a plurality of port security policies including policy ID, user role, port resource, access rule and corresponding access rights, and identifies abnormalities of existing port access rights configuration according to the standardized port security policy. After generating the corresponding permission compliance check results, suspicious access patterns and abnormal behaviors are identified based on the access log data and access traffic data of each port device based on data mining technology, and a corresponding port access risk assessment report is generated. The permission compliance check results and the port access risk assessment report are correlated and analyzed to obtain a port security policy adjustment list, and the latest port security policy is generated according to the port security policy adjustment list and the preset port security policy change process, and a technical solution for executing port resource access control according to the latest port security policy. Compared with the existing technology, this network resource access control method based on identity authentication and port perception associates and analyzes the abnormal identification results of the existing port access permission configuration based on the standardized port security policy with the port access risk assessment results based on the access log data and access traffic data of the port device to generate a port security policy adjustment list, and dynamically adjusts the port security policy in combination with the policy change simulation assessment results. It can comprehensively and reliably monitor and filter the resource access of each port device, prevent attackers from exploiting configuration vulnerabilities to bypass security protection and obtain resources beyond the permission, effectively improve the intelligence level of port security management, and reduce enterprise information security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of a network resource access control method based on identity authentication and port perception in an embodiment of the present invention;

[0020] Figure 2 It is a structural diagram of a network resource access control system based on identity authentication and port perception in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and beneficial effects of the present application clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Obviously, the embodiments described below are part of the embodiments of the present invention and are only used to illustrate the present invention, but are not used to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The network resource access control method based on identity authentication and port perception provided by the present invention can be understood as a method for dynamically updating the port security policy by analyzing the abnormal identification results of the existing port access permission configuration based on the standardized port security policy, and the port access risk assessment results based on the access log data and access flow data of the port device, based on the configuration defects and management blind spots of the existing enterprise network resource access control that are easily exploited by attackers, resulting in a greater threat to the enterprise information security. The following embodiments will explain the network resource access control method based on identity authentication and port perception of the present invention in detail.

[0023] In one embodiment, Figure 1 As shown, a network resource access control method based on identity authentication and port awareness is provided, comprising the following steps:

[0024] S11. Parse and process the port access rule configuration requests submitted by each business department through natural language processing technology to generate corresponding standardized port security policies; wherein, the port access rule configuration request can be understood as the rule configuration request information described in natural language issued by each business department when submitting the port access control rule configuration according to the specific business scenario requirements, which may specifically include information such as department name, business scenario, user role, communication protocol type, required access port number and required access resource; the standardized port security policy generated based on the parsing results of all port access rule configuration requests includes multiple port security policies, and the port security policy includes a policy ID, user role, port resource, access rule and corresponding access rights.

[0025] Specifically, the step of parsing the port access rule configuration requests submitted by each business department through natural language processing technology to generate a corresponding standardized port security policy includes:

[0026] Each port access rule configuration request is processed by word segmentation and part-of-speech tagging in turn to obtain a corresponding rule configuration request word segmentation information set; wherein, the process of obtaining the rule configuration request word segmentation information set can be understood as firstly processing the description text corresponding to the port access rule configuration request by word segmentation, removing punctuation marks and stop words, and then using a part-of-speech tagging tool to identify nouns, verbs and other parts of speech and perform corresponding part-of-speech tagging to obtain the corresponding rule configuration request word segmentation information set; it should be noted that the specific text word segmentation, punctuation removal and stop word removal processing, as well as the use of the part-of-speech tagging tool can be selected according to actual application requirements and are not specifically limited here.

[0027] According to each rule configuration request word segmentation information set, a corresponding configuration request semantic dependency tree is constructed based on a dependency syntax analysis tool; wherein, the dependency syntax analysis tool can be understood as a tool that determines the syntactic structure of a sentence by analyzing the dependency relationship between words in a sentence; in this embodiment, one of Stanford Parser, SpaCy, Google SyntaxNet and DDParser can be selected for use according to actual application requirements. The specific process of constructing a corresponding configuration request semantic dependency tree based on the rule configuration request word segmentation information set can refer to the relevant use technology of the corresponding selected dependency syntax analysis tool, which will not be described in detail here.

[0028] According to each configuration request semantic dependency tree, the corresponding rule configuration key information is obtained, and according to the rule configuration key information, the corresponding rule element structured data is generated; wherein, the rule configuration key information includes user role, port number and protocol type; in order to facilitate the subsequent efficient use of the rule configuration key information, the present implementation preferably converts the rule configuration key information extracted from the configuration request semantic dependency tree into rule element structured data in JSON format.

[0029] According to the rule element structured data and the preset traffic monitoring rule base, the corresponding traffic monitoring rule elements and port abnormal traffic detection model are obtained; the traffic monitoring rule elements include monitoring objects, monitoring indicators and indicator thresholds; wherein, the preset traffic monitoring rule base can be understood as being constructed based on historical port traffic monitoring experience, including monitoring objects (user roles), monitoring indicators (traffic anomaly determination indicators of different protocol types), indicator thresholds for each port device corresponding to each business scenario, and a database of port abnormal traffic detection models corresponding to each port device. The acquisition process of specific traffic monitoring rule elements and port abnormal traffic detection models can be understood as extracting key information of rule configuration in the rule element structured data based on preset regular expressions, and searching for matching information in the preset traffic monitoring rule base based on the key information of the rule configuration, so as to obtain the required traffic monitoring rule elements and port abnormal traffic detection model.

[0030] Fill the traffic monitoring rule elements into the corresponding preset service port security policy template to generate the corresponding service port traffic monitoring rules; wherein, the preset service port security policy template can be understood as a preset table including service type, port number, user role, required monitoring protocol type, required monitoring abnormal traffic indicators, indicator thresholds and port abnormal traffic detection model, etc.; fill the traffic monitoring rule elements into the corresponding fields in the preset service port security policy template respectively to obtain the required service port traffic monitoring rules.

[0031] According to the service port traffic monitoring rules, the port abnormal traffic detection model is parameter updated and optimized to obtain the service port abnormal traffic detection model, and according to the model parameters of the service port abnormal traffic detection model, an abnormal behavior detection rule set is generated; wherein, the port abnormal traffic detection model is a port abnormal traffic detection model pre-constructed in a preset traffic monitoring rule base as described above, and in order to ensure the high efficiency of the port abnormal traffic detection model detection application, this implementation preferably adopts a single-class support vector machine model to construct it; specifically, the steps of constructing the service port abnormal traffic detection model include:

[0032] Obtain historical normal traffic data of the port; the historical normal traffic data of the port includes normal traffic data of multiple business types, and the normal traffic data of the business type can be understood as normal traffic data in the business scenarios of each business department. The specific acquisition method can refer to the relevant existing technology implementation, which is not described in detail here.

[0033] According to the historical normal traffic data of the port, a one-class support vector machine model is trained to obtain the service port abnormal traffic detection model; wherein, the one-class support vector machine model (OC-SVM) is an anomaly detection model that is based only on a single category of data sets and seeks a hyperplane with the maximum interval from the origin to distinguish positive samples from all potential negative samples. The specific training process can be implemented with reference to relevant existing technologies.

[0034] In order to ensure that the model can be better applied to abnormal traffic identification of port devices in different business scenarios, this embodiment preferably updates and optimizes the parameters of the port abnormal traffic detection model according to the business port traffic monitoring rules in the corresponding business scenarios, so as to obtain a detection model that can perform efficient and reliable abnormal traffic detection for different business scenarios, and the corresponding parameter update optimization includes adjusting the traffic feature weights and adjusting the abnormal judgment threshold; that is, according to the abnormal judgment threshold in the optimal model parameters corresponding to each business port abnormal traffic detection model, an abnormal behavior detection rule set including the business type, port number and traffic anomaly judgment threshold can be generated.

[0035] The user roles corresponding to the port access rule configuration requests, the abnormal behavior detection rule set and the service port traffic monitoring rules are integrated and processed to generate the standardized port security policy; wherein, the integration process can be understood as a comprehensive analysis of the abnormal behavior detection rule sets and service port traffic monitoring rules of different user roles corresponding to the same port device through a decision tree algorithm to achieve conflicting rule screening and complementary rule merging, and the specific processing process can be understood as using a decision tree algorithm to classify and screen repeated or conflicting abnormal behavior detection rule sets and service port traffic monitoring rules, retaining high-priority rules, wherein the priority of the rules can be determined according to the level of the business department and the timeliness of the rule application, and for complementary rules, more comprehensive security management rules are obtained by merging; that is, a plurality of complementary port security policies can be obtained in the end, and the access rules and access rights corresponding to each policy are sorted out based on the port resource type accessed by the user role.

[0036] S12. According to the standardized port security policy, anomalies are identified for existing port access permission configurations, and corresponding permission compliance check results are generated; wherein, the anomaly identification for existing port access permission configurations can be understood as a compliance check for existing permission configurations to identify potential defects such as permission configuration errors and configuration conflicts, and the corresponding permission compliance check results include configuration compliance scores and a port security policy adjustment list; specifically, the step of identifying anomalies for existing port access permission configurations according to the standardized port security policy and generating corresponding permission compliance check results includes:

[0037] According to all the port security policies in the standardized port security policy, a corresponding user resource relationship map is constructed based on the graph database technology; wherein, the user resource relationship map can be understood as a map that can reflect the relationship between user roles (user identities), port resources and access rights. That is, firstly use regular expressions to extract information such as user identity, port resources and access rights from each port security policy in the standardized port security policy, such as user ID matching pattern "UID-\d{4}", port number matching pattern "PORT-\d{1,5}", permission type matching pattern "(READ|WRITE|EXECUTE)", and define the node type and attributes of the graph database based on this information. The corresponding node types of the user resource relationship map include user nodes, port nodes and permission nodes, and the attributes of user nodes include user ID and role, etc., the attributes of port nodes include port number and protocol, etc., and the attributes of permission nodes are operation type and access level, etc. For example, the extracted information is converted into a CSV format acceptable to the graph database Neo4j, including node text. At the same time, based on the corresponding relationship between user roles, port resources, access rules and access rights in each port security policy, the connection edges between nodes in the graph are designed, such as user-permission edges represent the permissions owned by users, and permission-port edges represent the ports to which permissions apply. The initial relationship graph can be obtained by using a graph database to store and manage these entities and their relationships. For example, the LOADCSV command of Neo4j can be used to import data to create the initial relationship between user nodes, port nodes and permissions. Based on the initial relationship graph, the breadth-first search algorithm is applied to traverse the nodes and edges, starting from each user node, to explore the reachable permission nodes and port nodes, to obtain the association path between users, permissions and ports, and then to construct a complete relationship graph of user identity, port resources and access rights. In addition, in the process of constructing the user resource relationship graph, the degree centrality of each node in the graph can be further calculated based on the degree centrality algorithm corresponding to the graph database. According to the preset degree centrality threshold (for example, 0.8), user nodes with high degree centrality are regarded as key users, and port nodes with high degree centrality are regarded as sensitive port resources, and the calculation results are stored in the relationship graph as new attributes of the corresponding nodes. It should be noted that the graph database technology used to construct the user resource relationship graph in this embodiment can be selected according to actual application requirements, such as Neo4j or ArangoDB, etc., and is not specifically limited here.

[0038] Through the subgraph isomorphism algorithm, the user resource relationship graph is subjected to the existing permission configuration anomaly identification, and the corresponding permission configuration anomaly identification result is obtained; wherein, the subgraph isomorphism algorithm is an algorithm used in graph theory to find and compare the similarity between two graphs, such as the Ullmann algorithm, the Nauty algorithm, the SD algorithm, the VF algorithm, and the VF2 algorithm improved on the VF algorithm, etc., which can be selected according to application requirements in practical applications, and are not specifically limited here. In this embodiment, the subgraph isomorphism algorithm is adopted to perform compliance check on the user resource relationship graph based on the preset permission rule template structure, so as to efficiently and accurately capture the nodes and edges that may have errors in the relationship graph, that is, to identify potential permission configuration errors. The specific process of obtaining permission configuration anomaly identification results can be understood as pre-defining the permission rule template structure according to the actual application scenario. For example, based on the principle of separation of duties, a least privilege principle template structure can be designed that requires that the number of permission nodes connected to the user node does not exceed the threshold, and that user nodes of two specific roles should not be connected to a sensitive port node at the same time; then a subgraph isomorphism algorithm is used to retrieve a subgraph in the relationship graph that matches the preset permission rule template structure. If it exists, the relevant nodes and edges in the corresponding subgraph are determined to be potential permission configuration errors. Otherwise, it is considered that there is no risk of any permission configuration error.

[0039] If there is no permission configuration error in the permission configuration anomaly identification result, the configuration compliance score is set to the highest compliance score value. Otherwise, the role permission matrix corresponding to each permission configuration error is obtained respectively, and the corresponding mutual information between permissions is obtained according to the role permission matrix; wherein, the highest compliance score value can be understood as the preset highest compliance score value corresponding to the absence of any permission configuration error risk, and the specific value is not specifically limited here. For the potential permission configuration error risk identified by the above-mentioned subgraph isomorphism algorithm, a step of analysis is required to confirm the error type, and then a specific compliance score is performed according to different error types; in order to ensure the reliability of the permission configuration error classification, this embodiment preferably uses the mutual information between permissions as the classification basis. Specifically, for the identified permission configuration error, the association relationship between user roles and permissions is extracted to generate a role permission matrix, in which each element represents the frequency of a specific role having a specific permission. Then, according to the role permission matrix, the mutual information between permissions is calculated by the following mutual information calculation formula:

[0040]

[0041] Where I(x;y) represents the mutual information between random variables x and y; p(x,y) is the joint probability distribution of x and y, and p(x) and p(y) are the marginal probability distributions of x and y, respectively.

[0042] In practical applications, assuming that the preset permission rule template is defined based on the principle of least privilege as: (user)-[:HAS_PERMISSION]->(port)WHEREuser.role='employee'ANDpermission.accessLevel>'read', the APOC library of Neo4j can be used to execute the subgraph matching algorithm to identify the permission configuration that violates the rules. For the identified abnormal configuration, based on the preset minimum support (such as 0.1) and minimum confidence (such as 0.7), the association rule mining algorithm Apriori is applied to analyze the association pattern between user roles and permissions, and generate the corresponding role permission matrix. Then, based on the above mutual information calculation formula, the required mutual information between permissions can be obtained.

[0043] It is determined whether the mutual information between permissions corresponding to each permission configuration error is greater than the preset mutual information threshold. If so, it is determined that there is a permission mutual exclusion conflict, and the corresponding permission compliance score is set to the first compliance deduction value. Otherwise, the corresponding permission compliance score is set to the second compliance deduction value. The preset mutual information threshold can be selected according to actual application requirements. Assuming that the preset mutual information threshold is set to 0.6, when the obtained mutual information between permissions exceeds the preset mutual information threshold, it can be determined that the two permission configurations may conflict, that is, the corresponding permission configuration error is identified as a permission mutual exclusion conflict error, and the first compliance deduction value in this case can be obtained according to the compliance score value of the error type set in advance. When it is determined that the permission configuration error belongs to a configuration conflict based on the mutual information analysis between permissions, the second compliance deduction value in this case can also be obtained according to the compliance score value of the error type set in advance. It should be noted that the first compliance deduction value and the second compliance deduction value in this embodiment can be set in advance according to the actual application requirements and the severity of the configuration error. In principle, the more serious the error, the greater the corresponding compliance deduction value, which is not specifically limited here.

[0044] The first compliance deduction value and the second compliance deduction value are added to obtain the cumulative compliance deduction value, and the highest compliance score value is subtracted from the cumulative compliance deduction value to obtain the configuration compliance score; wherein, the coordination compliance score can be understood as a comprehensive score of all permission configuration situations in the entire user resource relationship map, that is, the compliance deduction values ​​corresponding to all identified permission configuration errors are accumulated as the total compliance score deduction item, and the configuration compliance score value obtained is deducted from the highest compliance score value.

[0045] When there is a conflict of mutual exclusion of permissions, a conflict optimization analysis is performed on the corresponding permission configuration in the user resource relationship map, and the port security policy adjustment list is generated according to the corresponding conflict optimization analysis results; wherein, the port security policy adjustment list can be understood as taking into account the fact that the error of mutual exclusion of permissions in actual applications is relatively serious and needs to be rectified in a timely manner. In this embodiment, conflict optimization records are preferably performed on the permission mutual exclusion conflicts identified based on the mutual information value between permissions, and a port security policy adjustment list to be optimized is generated. It should be noted that the above-mentioned conflict optimization analysis of the corresponding permission configuration in the user resource relationship map can be understood as identifying the conflicting edges in the relationship map, marking them as to be deleted, and identifying the missing edges in the relationship map and marking them as to be added, and then collating and summarizing the obtained conflict optimization analysis results to obtain the corresponding port security policy adjustment list.

[0046] This embodiment parses and processes the port access rule configuration requests submitted by various business departments, generates corresponding standardized port security policies, and uses a subgraph isomorphism algorithm to perform compliance checks on various permission configuration items in the standardized port security policies. It can efficiently and accurately identify existing port permission configuration problems, effectively avoid the risks of errors or omissions in port security access rule configuration, and thus provide reliable protection for secure access to port resources from the bottom-level configuration aspect.

[0047] S13. According to the access log data and access traffic data of each port device, suspicious access patterns and abnormal behaviors are identified based on data mining technology to generate a corresponding port access risk assessment report; wherein, the access log data can be understood as the information record of the port device being accessed by the user, which may include the access user name, access login time and access login IP address, etc.; correspondingly, the access traffic data can be understood as the relevant information record of the traffic data packets sent by each user to access the business resources on the port device, which may include the source IP address, destination IP address, source port number, destination port number, communication protocol type and data packet size of the data flow, etc.; it should be noted that the access log data and access traffic data of each port device can be obtained through relevant existing technologies, such as the access log data can be obtained by collecting the operation log of the port device using the distributed log collection tool Flume, and the access traffic data can be obtained based on the relevant traffic monitoring equipment deployed on the port device, which is not described in detail here.

[0048] The port access risk assessment report in this embodiment can be understood as the security policy application risk obtained by evaluating the application performance of the port security policy from the level of real user access control effect based on the access log data and access traffic data of the port device; in order to facilitate the subsequent joint analysis of the port access risk assessment report and the permission compliance check results to dynamically adjust the port security policy, this embodiment is preferably configured to include the port access risk assessment report including the port risk score and the abnormal access frequency corresponding to different abnormal behavior types. Specifically, the steps of generating the corresponding port access risk assessment report based on the access log data and access traffic data of each port device, identifying suspicious access patterns and abnormal behaviors based on data mining technology, include:

[0049] The access log data of each port device is parsed and processed respectively to obtain the corresponding user identity authentication information; wherein, the parsing of the access log data can be understood as filtering and selecting text data only related to the user identity authentication information, so as to facilitate the fast and reliable analysis of the user identity authentication information; correspondingly, the user identity authentication information includes the user name, login time and login IP address, which can be matched and extracted from the parsed access log data by means of a preset regular expression and stored in the user behavior table of the distributed database HBase, for example, the user name matches the pattern "user_\w+", the login time matches the pattern "\d{4}-\d{2}-\d{2}\d{2}:\d{2}:\d{2}", and the login IP address matches the pattern "\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}", which will not be described in detail here.

[0050] The access traffic data of each port device is parsed and processed respectively to obtain the corresponding port access behavior characteristics; wherein, the parsing of the access traffic data is understood to be the use of existing traffic packet parsing tools to parse each access data packet and convert it into a data form that is convenient for efficiently extracting the port access behavior characteristics; correspondingly, the port access behavior characteristics include source IP, destination IP, port number, protocol type and data packet size, which can be matched and extracted from the parsed access traffic data by means of preset regular expressions and stored in the traffic characteristic table of the distributed database HBase, which is not described in detail here; it should be noted that in actual applications, the user identity authentication information and port access behavior characteristics extracted according to the access log data and access traffic data of each port device are respectively stored in the user behavior table and traffic characteristic table of the distributed database HBase, which can facilitate the subsequent efficient calculation of port access characteristics.

[0051] A comprehensive analysis is performed on the user authentication information and port access behavior characteristics of all port devices to obtain the port access characteristics; wherein the comprehensive analysis can be understood as a multi-dimensional feature extraction of the user authentication information and the port access behavior characteristics to obtain the access frequency, average session duration, and number of access ports of each user, as well as the number of access users and average traffic size of each port; in actual applications, if the user authentication information and the port access behavior characteristics are stored in the distributed database HBase as described above, SparkSQL can be used to perform statistical analysis according to the preset multi-dimensional feature extraction requirements to obtain port access characteristics including the access frequency, average session duration, and number of access ports of each user.

[0052] According to the port access features, a corresponding user port access matrix is ​​generated, and user access behavior clustering analysis is performed based on the user port access matrix to obtain multiple user access behavior clusters; wherein, the user port access matrix can be understood as a matrix that records the number of times each user accesses each port, that is, the matrix element value is the number of accesses; in actual applications, after using SparkSQL to extract the port access features, the distributed matrix calculation function in the SparkMLlib library can be directly used to generate the required user port access matrix (user-port access matrix) and store it in the feature table created in HBase. The specific generation process can refer to the relevant existing technology implementation, which will not be described in detail here. After obtaining the user port access matrix, the SparkMLlib library can be used to execute the K-means clustering algorithm to perform clustering analysis on the user port access matrix to obtain normal access behavior clusters and abnormal access behavior clusters, that is, to obtain the required multiple user access behavior clusters for subsequent identification and analysis of suspicious access patterns.

[0053] The user access behaviors in each user access behavior cluster whose distance from the cluster center exceeds a preset distance threshold are marked as suspicious access patterns; wherein, the distance from the cluster center can be understood as the Euclidean distance between each user access behavior and the cluster center; in order to ensure the reliability of suspicious access pattern identification, this implementation preferably sets the preset distance threshold to twice the standard deviation of the cluster center. If the distance between a user access behavior and the cluster center exceeds the threshold, the user access behavior is marked as a suspicious access pattern.

[0054] According to each suspicious access mode, association rule mining is performed based on the FP-growth algorithm to generate corresponding frequent item sets, and according to the frequent item sets and the preset confidence threshold, the abnormal behavior type, abnormal behavior level and corresponding abnormal risk score are obtained; wherein, the acquisition of frequent item sets can be understood as selecting the minimum support (for example, 0.01) and the minimum confidence (for example, 0.5) according to application requirements, and using the FP-growth algorithm in the SparkMLlib library to perform association rule mining to analyze the association relationship between user identity, access time and port number. The specific implementation process can refer to the relevant existing technology implementation of association rule mining based on the FP-growth algorithm, which will not be described in detail here. After obtaining the frequent item sets, high-confidence abnormal behavior types can be screened out according to the preset confidence threshold, such as user A accessing port X during non-working hours, frequently switching login IPs, or accessing multiple sensitive ports in a short period of time, etc., and then based on the determined abnormal behavior types, the pre-constructed abnormal behavior evaluation table is searched to obtain the corresponding abnormal behavior level and the corresponding abnormal risk score; it should be noted that the abnormal behavior evaluation table can be understood as a relationship table including preset abnormal behavior levels and abnormal risk scores of different abnormal behavior types, which can be constructed based on historical management experience and is not specifically limited here.

[0055] A comprehensive statistical analysis is performed based on the abnormal behavior types, abnormal behavior levels and abnormal risk scores corresponding to all suspicious access patterns to generate the port access risk assessment report; wherein, the port access risk assessment report can be understood as an Excel format risk assessment report containing information such as a list of suspicious access patterns, descriptions of abnormal behavior types and risk level assessment results. In actual applications, it can be generated using the ApachePOI library, which will not be described in detail here.

[0056] This embodiment evaluates the port security access risk based on the access log data and access traffic data of the port device at the same time, thereby realizing efficient and reliable evaluation of the port security policy application performance from the level of real user access control effect, and can truly and objectively reflect the access control effect of the currently executed standardized port security policy, providing a reliable basis for the subsequent dynamic adjustment of the port security policy.

[0057] S14, correlating and analyzing the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list; wherein the port security policy adjustment list can be understood as a port security policy adjustment suggestion determined based on the comprehensive analysis result of the permission compliance check result and the port access risk assessment report. Specifically, the step of correlating and analyzing the permission compliance check result and the port access risk assessment report to obtain the port security policy adjustment list includes:

[0058] The port security protection satisfaction is predicted by using the permission compliance check result, the port access risk assessment report and the pre-built access control satisfaction prediction model to obtain the corresponding security protection satisfaction score; wherein, the access control satisfaction prediction model can be understood as a network model that takes the configuration compliance score, port risk score and abnormal access frequency as input, and takes the security protection satisfaction score as output. In order to ensure the simplicity and efficiency of the port security protection satisfaction prediction in actual use, this embodiment preferably optimizes and trains the random forest model based on the relevant feature historical data of the model input and output, and uses the cross-validation method to evaluate the model performance, and selects the model with higher accuracy as the required access control satisfaction prediction model. The specific training process can refer to the training method of the relevant random forest model, which will not be described in detail here. That is, the security protection satisfaction score can be obtained by inputting the configuration compliance score in the permission compliance check result, the port risk score in the port access risk assessment report, and the abnormal access frequency corresponding to different abnormal behavior types into the access control satisfaction prediction model for prediction analysis.

[0059] When the security protection satisfaction score is lower than the preset satisfaction threshold, the relationship between each port security policy and the security protection satisfaction in the standardized port security policy is analyzed by the Apriori algorithm, and the association rule to be analyzed is screened; the association rule to be analyzed satisfies the minimum support and minimum confidence conditions; wherein, the preset satisfaction threshold can be selected according to actual application requirements and is not specifically limited here; when the obtained security protection satisfaction score is lower than the preset satisfaction threshold, it can be considered that the currently executed standardized port security policy is insufficient, and further analysis is needed to obtain the security policy that has a greater impact on the security protection satisfaction for subsequent policy adjustment. The association rules to be analyzed in this embodiment can be understood as first using the Apriori algorithm to analyze the relationship between each port security policy in the standardized port security policy and the security protection satisfaction to obtain a frequent item set, and then screening it from the frequent item set according to the minimum support and minimum confidence conditions, and used for subsequent analysis to obtain the association rules of the port security policy to be adjusted and optimized in the standardized port security policy. For example, when the minimum support is set to 0.05 and the minimum confidence is set to 0.7, the Apriori association rule mining algorithm is used to analyze the relationship between the port security policy items and the security protection satisfaction. The highly correlated policy items screened out are "dynamic authorization revocation mechanism triggering frequency is high -> security protection satisfaction is low".

[0060] The port security policy in the association rule to be analyzed is used as the port security policy item to be optimized, and the policy parameters of the port security policy item to be optimized are optimized by a grid search method to obtain corresponding port security policy parameters to be selected; wherein, the policy parameter optimization can be understood as the policy operation parameters involved in the port security policy item to be optimized, for example, based on the association rule to be analyzed given above "dynamic authorization revocation mechanism triggering frequency is high -> security protection satisfaction is low", the corresponding policy parameters involved in the port security policy item to be optimized include dynamic authorization revocation time and port security event alarm frequency threshold; when determining the port security policy parameters to be selected, the search space of each parameter can be defined first, such as the dynamic authorization revocation time range is [1 hour, 24 hours] and the adjustment step is 1 hour, the port security event alarm frequency threshold range is [10 times / minute, 100 times / minute] and the adjustment step is 10 times / minute, and then the grid search method (Grid Search) is used to search for the optimal policy parameters to obtain the optimal dynamic authorization revocation time and port security event alarm frequency threshold. The specific parameter optimization process can refer to the relevant technical implementation of the grid search method, which will not be described in detail here.

[0061] The port security policy adjustment list is generated according to all the port security policy items to be optimized and the corresponding port security policy parameters to be selected; wherein, the generation process of the port security policy adjustment list can be understood as uniformly replacing the policy parameters in the port security policy corresponding to all the port security policy items to be optimized in the standardized port security policy with the corresponding optimal policy parameters obtained through the above analysis, and summarizing the port security policies after the policy parameters are replaced to obtain the required port security policy adjustment recommendation list.

[0062] This embodiment determines the port security policy adjustment list by combining the port resource security protection analysis based on the underlying configuration and the real user access control application effect. It can comprehensively and reliably analyze the potential protection risks of the currently applied standardized port security policy, and then give accurate and effective port security policy adjustment suggestions, providing a reliable basis for the subsequent dynamic adjustment of the port security policy to provide high-quality resource security protection.

[0063] S15. Perform a policy change simulation assessment based on the port security policy adjustment list to generate the latest port security policy, and perform port resource access control based on the latest port security policy. Among them, the policy change simulation can be understood as a security policy change risk pre-assessment process that is preferably adopted to verify the applicability of the port security policy adjustment list obtained through analysis, thereby reducing the uncertainty caused by the port security policy adjustment. Specifically, the steps of performing a policy change simulation assessment based on the port security policy adjustment list to generate the latest port security policy include:

[0064] By using natural language processing technology, key change information of the port security policy adjustment list is obtained; wherein, the key change information can be understood as the main parameter information of each port security policy operation, such as user roles, communication protocols, port location changes or permission adjustment changes that may be involved in the port security policy adjustment list, which is not specifically limited here.

[0065] The change key information is converted into corresponding change structured data, and the Activiti workflow engine is called according to the change structured data to generate a corresponding policy change process; wherein, the change structured data can be understood as the structured data obtained by converting the change key information, which is convenient for generating structured data used in the policy change process, such as obtaining the change key information data stored in JSON format. The Activiti workflow engine in this embodiment is a business process automation execution management method that can extract complex business processes in a business system, use a special modeling language to define the process, and execute according to the pre-set business process. Specifically, according to the Activiti workflow engine, the method for creating a policy change process based on changing structured data can refer to the relevant prior art implementation of the Activiti workflow engine, which will not be described in detail here; the corresponding generated policy change process includes an approval node, an execution node, and a rollback node, each node contains an execution condition and a timeout processing mechanism, and a state mechanism model is used to manage the workflow status, and the workflow status includes submitted, under approval, under evaluation, under generation, completed, and rejected. After each process node is completed, the next node will be automatically triggered. For example, after approval, it will automatically enter the risk assessment stage to ensure the rationality of the entire change process, thereby ensuring the reliability of subsequent policy risk assessment based on the change process.

[0066] A plurality of groups of simulated random variables are generated by a Monte Carlo simulation method, and a policy change risk assessment is performed based on the policy change process according to each group of simulated random variables to obtain a corresponding scenario security risk index; wherein, the simulated random variables include user access frequency, traffic size and time distribution, and a variety of user access scenarios in actual applications are simulated based on the generated plurality of groups of simulated random variables to obtain security risk indexes under different application scenarios; in order to ensure the comprehensiveness and effectiveness of the scenario security risk assessment, this embodiment preferably performs a comprehensive analysis based on multiple aspects such as port sensitivity, authority change range, applicant user credibility, unauthorized access probability, data leakage risk and service interruption risk to obtain the required scenario security risk index, so as to truly feedback the risk size of each application scenario after the policy change.

[0067] According to the security risk indexes of all scenarios, the latest port security policy is generated through a genetic algorithm; that is, after obtaining the security risk indexes of all scenarios, the population size, crossover rate and mutation rate can be set, and a fitness function constructed based on comprehensive consideration of security and availability factors can be used. In combination with the chromosome encoding method including the port open state, access control rules and authentication method, the genetic algorithm is executed to obtain the optimal policy parameter combination that can meet the port resource security protection requirements, so as to obtain the required latest port security policy; it should be noted that the specific process of using a genetic algorithm to obtain the optimal policy parameter combination that meets the port resource security protection requirements can refer to the existing relevant technical implementation of strategy optimization based on a genetic algorithm, which will not be described in detail here.

[0068] In this embodiment, obtaining the latest port security policy can be understood as a security protection policy that needs to be sent to the corresponding port device, and the subsequent port device directly uses it for port resource access control; specifically, the step of executing port resource access control according to the latest port security policy includes:

[0069] According to the latest port security policy, the Drools rule engine is used to dynamically generate the corresponding port access control list and port traffic monitoring rules; that is, the latest port security policy obtained above is decomposed and parsed, and the access permission rules, abnormal traffic judgment rules and processing measures corresponding to different access permission rules and abnormal traffic judgment rules for each port in different business scenarios are obtained, and then the corresponding Drools rules are designed based on the access permission rules and abnormal traffic judgment rules of different ports in different business scenarios obtained by parsing. For example, for given rule conditions such as source IP, target IP, port number, traffic size and traffic mode, the corresponding result part may include operations such as allow, deny, log, trigger alarm, etc.; through a similar rule generation method, the port access control list and port traffic monitoring rules corresponding to the latest port security policy can be obtained. Among them, the traffic monitoring rules include IP address filtering, port number restriction and protocol type control. In actual applications, there can be multiple traffic monitoring rules corresponding to each port device at the same time, and each rule has a unique identification ID, as well as a corresponding effective time and expiration time. The specific content of each rule may vary depending on the actual application scenario.

[0070] It should be noted that the generation of the port access control list in this embodiment can adopt a differentiated update method, that is, only the changed part is modified on the basis of the currently executed port access control list to reduce the update overhead, and while modifying the access control list, it is also necessary to modify the user resource relationship map, that is, update the nodes and the relationships between nodes through the query language of the corresponding graph database. For example, in the case of using the Neo4j graph database to store the relationship map, the nodes and relationships can be updated through the Cypher query language. When performing the specific operation of modifying the user resource relationship map, it is necessary to create a transaction in the graph database to ensure the atomic update of the relationship map. If an error occurs during the update process, it will automatically roll back to the previous stable state to avoid the current update failure affecting the normal operation of subsequent port access control.

[0071] According to the port traffic monitoring rules, a corresponding access rule set is generated, and the access rule set is sent to the corresponding port device in real time, so that the port device performs port resource access control according to the access rule set; wherein, the access rule set can be understood as a set of rules obtained by summarizing multiple port traffic monitoring rules corresponding to each port device; after obtaining the access rule set, it can be sent to the corresponding port device in real time through the authority proxy gateway for executing corresponding access control; it should be noted that in order to ensure the confidentiality and integrity of the access rule set transmission, this embodiment preferably adopts TLS1.3 secure transmission protocol to send the access rule set and uses X.509 digital certificate to authenticate the port device, and sets the rule version number and Unix timestamp when sending the access rule set to implement an incremental update mechanism. When a rule conflict is detected, it automatically rolls back to the previous stable version and records the conflict log to ensure that the port device can continuously and stably perform resource access management.

[0072] In addition, in order to ensure the reliability of the port device's actual application of the access rule set to perform resource access control, this implementation preferably combines the access rule set with real-time traffic depth monitoring and analysis to filter user access requests in real time; specifically, the step of the port device performing port resource access control according to the access rule set includes:

[0073] According to the access rule set, each access request is filtered and identified based on the Suricata deep packet inspection engine to obtain suspicious access requests; wherein the Suricata deep packet inspection engine is a network intrusion detection tool for performing content deep analysis and detection on the traffic data packet of each access request. In actual applications, the relevant functional traffic filtering parameters of the Suricata deep packet inspection engine can be dynamically set according to the specific access rule set to perform real-time deep analysis and filtering based on the access rule set, so as to capture abnormal access in a timely and accurate manner.

[0074] The traffic characteristics of each suspicious access request are obtained, and according to the traffic characteristics, the corresponding request risk score is calculated based on the random forest model; wherein the traffic characteristics may include information such as source IP address, destination port, protocol type, data packet size and time interval. The random forest model constructed based on relevant historical data training is used to receive the traffic characteristics input of each suspicious access request to efficiently predict the corresponding request risk score.

[0075] Determine whether the request risk score of each suspicious access request is greater than the preset risk threshold. If so, directly reject the suspicious access request. Otherwise, continuously monitor the real-time traffic data of the suspicious access request, perform real-time traffic anomaly detection based on the real-time traffic data and the corresponding service port abnormal traffic detection model, and report an alarm based on the identified traffic anomaly. The preset risk threshold can be selected according to actual application requirements and is not specifically limited here. Assuming that the preset risk threshold is 0.8, suspicious access requests with a request risk score greater than 0.8 can be directly rejected and the corresponding detailed rejection reason can be recorded at the same time. However, for suspicious access requests with a request risk score not exceeding 0.8, it cannot be directly determined to be normal. It is necessary to continuously collect traffic data for a period of time according to requirements for anomaly identification and analysis to ensure the comprehensiveness of abnormal traffic supervision. At the same time, in order to simplify the access control process of the port device as much as possible, the business port abnormal traffic detection model in this embodiment still adopts the abnormal traffic detection model obtained by updating and optimizing the parameters of the port abnormal traffic detection model according to the business port traffic monitoring rules. At present, the abnormal traffic detection model here can also be replaced by other models that can efficiently identify traffic anomalies as needed, such as identifying traffic trend anomalies based on the ARIMA model, and judging that there is an alarm risk when the real-time traffic data exceeds 2 standard deviations of the average value, etc., which will not be described in detail here. It should be noted that in actual applications, multi-dimensional alarm thresholds can be set, for example, the number of single IP connections exceeds 100 / minute, the data packet size exceeds 10MB / second, the access frequency exceeds 1000 times / minute, etc. The specific implementation process of reporting alarms may include automatically triggering alarms by detecting anomalies, pushing alarm information through message queues, and simultaneously starting predefined emergency response workflows, including automatically isolating suspicious IPs / ports, restricting user access rights, increasing monitoring granularity, increasing logging frequency, and notifying security operation and maintenance personnel. All monitoring data and corresponding alarm information are written to the relevant equipment operation and maintenance log in real time to facilitate subsequent analysis and auditing, so as to ensure that port resource access risks can be discovered and handled in a timely manner, effectively improving the protection level of port resource security.

[0076] The embodiment of the present application proposes to parse and process the port access rule configuration requests submitted by each business department through natural language processing technology, generate a standardized port security policy corresponding to multiple port security policies including policy ID, user role, port resource, access rule and corresponding access rights, identify abnormalities of existing port access rights configuration according to the standardized port security policy, generate corresponding permission compliance check results, identify suspicious access patterns and abnormal behaviors based on access log data and access traffic data of each port device based on data mining technology, generate corresponding port access risk assessment report, and correlate and analyze the permission compliance check results and the port access risk assessment report to obtain a port security policy adjustment list, and generate a port security policy adjustment process according to the port security policy adjustment list and the preset port security policy change process. The latest port security policy is generated, and the scheme of port resource access control is implemented according to the latest port security policy. The abnormal identification results of the existing port access permission configuration based on the standardized port security policy are correlated with the port access risk assessment results based on the access log data and access traffic data of the port device to generate a port security policy adjustment list, and the port security policy is dynamically adjusted in combination with the policy change simulation assessment results. This effectively solves the application defects of the existing enterprise network resource access control that are easily exploited by attackers and the management blind spots that cause greater threats to enterprise information security. It can comprehensively and reliably monitor and filter the resource access of each port device, prevent attackers from exploiting configuration loopholes to bypass security protection and obtain resources beyond the permission, effectively improve the intelligence level of port security management, and reduce enterprise information security risks.

[0077] It should be noted that although the steps in the above flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0078] In one embodiment, Figure 2 As shown, a network resource access control system based on identity authentication and port perception is provided, and the system includes:

[0079] The security policy generation module 1 is used to parse and process the port access rule configuration requests submitted by each business department through natural language processing technology to generate a corresponding standardized port security policy; the standardized port security policy includes multiple port security policies; the port security policy includes a policy ID, user role, port resource, access rule and corresponding access rights;

[0080] The permission compliance checking module 2 is used to identify abnormalities in the existing port access permission configuration according to the standardized port security policy and generate corresponding permission compliance checking results;

[0081] Access risk assessment module 3, used to identify suspicious access patterns and abnormal behaviors based on the access log data and access flow data of each port device based on data mining technology, and generate a corresponding port access risk assessment report;

[0082] An adjustment suggestion generating module 4 is used to correlate and analyze the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list;

[0083] The security policy updating module 5 is used to perform policy change simulation evaluation according to the port security policy adjustment list, generate the latest port security policy, and execute port resource access control according to the latest port security policy.

[0084] In one embodiment, a network resource access control system based on identity authentication and port awareness is provided, wherein the port access rule configuration request submitted by each business department is parsed and processed by natural language processing technology to generate a corresponding standardized port security policy, including:

[0085] Perform word segmentation and part-of-speech tagging on each port access rule configuration request in turn to obtain a corresponding rule configuration request word segmentation information set;

[0086] According to each rule configuration request word segmentation information set, the corresponding configuration request semantic dependency tree is constructed based on the dependency syntax analysis tool;

[0087] According to each configuration request semantic dependency tree, the corresponding rule configuration key information is obtained, and according to the rule configuration key information, the corresponding rule element structured data is generated; the rule configuration key information includes user role, port number and protocol type;

[0088] According to the rule element structured data and the preset traffic monitoring rule library, the corresponding traffic monitoring rule elements and the port abnormal traffic detection model are obtained; the traffic monitoring rule elements include monitoring objects, monitoring indicators and indicator thresholds;

[0089] Fill the traffic monitoring rule elements into the corresponding preset service port security policy template to generate the corresponding service port traffic monitoring rules;

[0090] According to the service port traffic monitoring rules, the port abnormal traffic detection model is optimized and updated with parameters to obtain the service port abnormal traffic detection model, and according to the model parameters of the service port abnormal traffic detection model, an abnormal behavior detection rule set is generated; the parameter update optimization includes adjusting the traffic feature weight and adjusting the abnormal judgment threshold;

[0091] The user role corresponding to each port access rule configuration request, the abnormal behavior detection rule set and the service port traffic monitoring rule are integrated and processed to generate the standardized port security policy.

[0092] In one embodiment, a network resource access control system based on identity authentication and port awareness is provided, wherein the permission compliance check result includes a configuration compliance score and a port security policy adjustment list;

[0093] The step of identifying anomalies in the existing port access permission configuration according to the standardized port security policy and generating corresponding permission compliance check results includes:

[0094] According to all the port security policies in the standardized port security policy, a corresponding user resource relationship map is constructed based on the graph database technology; the node types of the user resource relationship map include user nodes, port nodes and authority nodes;

[0095] Using a subgraph isomorphism algorithm, the user resource relationship graph is used to identify abnormalities in existing permission configurations, and corresponding permission configuration abnormality identification results are obtained;

[0096] If the permission configuration anomaly identification result does not contain a permission configuration error, the configuration compliance score is set to the highest compliance score value; otherwise, the role permission matrix corresponding to each permission configuration error is obtained respectively, and the corresponding mutual information between permissions is obtained according to the role permission matrix;

[0097] Determine whether the mutual information between permissions corresponding to each permission configuration error is greater than a preset mutual information threshold. If so, determine that there is a permission mutual exclusion conflict, and set the corresponding permission compliance score to the first compliance deduction value. Otherwise, set the corresponding permission compliance score to the second compliance deduction value.

[0098] Adding the first compliance deduction value and the second compliance deduction value to obtain a compliance deduction cumulative value, and subtracting the highest compliance score from the compliance deduction cumulative value to obtain the configuration compliance score;

[0099] When there is a conflict of mutually exclusive permissions, a conflict optimization analysis is performed on the corresponding permission configuration in the user resource relationship map, and the port security policy adjustment list is generated according to the corresponding conflict optimization analysis results.

[0100] In one embodiment, a network resource access control system based on identity authentication and port perception is provided, wherein the port access risk assessment report includes a port risk score and abnormal access frequencies corresponding to different abnormal behavior types;

[0101] The method of identifying suspicious access patterns and abnormal behaviors based on the access log data and access traffic data of each port device and generating a corresponding port access risk assessment report includes:

[0102] The access log data of each port device is parsed and processed respectively to obtain the corresponding user identity authentication information; the user identity authentication information includes the user name, login time and login IP address;

[0103] Analyze and process the access traffic data of each port device respectively to obtain the corresponding port access behavior characteristics; the port access behavior characteristics include source IP, destination IP, port number, protocol type and data packet size;

[0104] Comprehensively analyzing the user identity authentication information and port access behavior characteristics of all port devices to obtain the port access characteristics; the port access characteristics include the access frequency, average session duration and number of access ports of each user;

[0105] Generate a corresponding user port access matrix according to the port access feature, and perform user access behavior cluster analysis according to the user port access matrix to obtain multiple user access behavior clusters;

[0106] Obtaining user access behaviors in each user access behavior cluster whose distance from the cluster center exceeds a preset distance threshold and marking them as suspicious access patterns;

[0107] According to each suspicious access pattern, association rule mining is performed based on the FP-growth algorithm to generate corresponding frequent item sets, and according to the frequent item sets and the preset confidence threshold, the abnormal behavior type, abnormal behavior level and corresponding abnormal risk score are obtained;

[0108] A comprehensive statistical analysis is performed based on the abnormal behavior types, abnormal behavior levels and abnormal risk scores corresponding to all suspicious access patterns to generate the port access risk assessment report.

[0109] In one embodiment, a network resource access control system based on identity authentication and port perception is provided, wherein the permission compliance check result and the port access risk assessment report are correlated and analyzed to obtain a port security policy adjustment list, including:

[0110] The permission compliance check result, the port access risk assessment report and the pre-built access control satisfaction prediction model are used to predict the port security protection satisfaction to obtain a corresponding security protection satisfaction score;

[0111] When the security protection satisfaction score is lower than a preset satisfaction threshold, the relationship between each port security policy in the standardized port security policy and the security protection satisfaction is analyzed by the Apriori algorithm, and the association rule to be analyzed is obtained by screening; the association rule to be analyzed satisfies the minimum support and minimum confidence conditions;

[0112] The port security policy in the association rule to be analyzed is used as the port security policy item to be optimized, and the policy parameters of the port security policy item to be optimized are optimized by a grid search method to obtain corresponding port security policy parameters to be selected;

[0113] The port security policy adjustment list is generated according to all the port security policy items to be optimized and the corresponding port security policy parameters to be selected.

[0114] In one embodiment, a network resource access control system based on identity authentication and port awareness is provided, wherein the policy change simulation evaluation is performed according to the port security policy adjustment list to generate the latest port security policy, including:

[0115] Obtaining key information of changes in the port security policy adjustment list through natural language processing technology;

[0116] Convert the key change information into corresponding change structured data, and call the Activiti workflow engine according to the change structured data to generate a corresponding policy change process; the policy change process includes an approval node, an execution node, and a rollback node;

[0117] Generate multiple groups of simulated random variables through the Monte Carlo simulation method, and perform a policy change risk assessment based on the policy change process according to each group of simulated random variables to obtain a corresponding scenario security risk index; the simulated random variables include user access frequency, traffic size and time distribution;

[0118] The latest port security policy is generated by a genetic algorithm according to the security risk index of all scenarios; the chromosome encoding of the genetic algorithm includes the port opening state, access control rules and authentication methods.

[0119] For the specific definition of the network resource access control system based on identity authentication and port perception, please refer to the definition of the network resource access control method based on identity authentication and port perception in the above text, and the corresponding technical effects can also be obtained equivalently, which will not be repeated here. Each module in the above-mentioned network resource access control system based on identity authentication and port perception can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.

[0120] In summary, the embodiment of the present invention provides a network resource access control method and system based on identity authentication and port perception. The network resource access control method based on identity authentication and port perception implements parsing and processing of port access rule configuration requests submitted by various business departments through natural language processing technology, generates a standardized port security policy corresponding to a plurality of port security policies including policy IDs, user roles, port resources, access rules and corresponding access rights, and identifies abnormalities of existing port access right configurations according to the standardized port security policy. After generating corresponding permission compliance check results, suspicious access patterns and abnormal behaviors are identified based on access log data and access traffic data of each port device based on data mining technology, and a corresponding port access risk assessment report is generated, and the permission compliance check results and port access right compliance check results are compared. The risk assessment report is correlated and analyzed to obtain a port security policy adjustment list, and the latest port security policy is generated according to the port security policy adjustment list and the preset port security policy change process, and a technical solution for executing port resource access control according to the latest port security policy is adopted. The method uses the existing port access permission configuration abnormality identification results based on the standardized port security policy, and the port access risk assessment results based on the access log data and access traffic data of the port device to generate a port security policy adjustment list, and dynamically adjusts the port security policy in combination with the policy change simulation assessment results. The resource access of each port device can be comprehensively and reliably monitored and filtered, avoiding attackers from exploiting configuration vulnerabilities to bypass security protection and obtain resources beyond the permission, effectively improving the intelligence level of port security management, and reducing enterprise information security risks.

[0121] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A network resource access control method based on identity authentication and port awareness, It is characterized in that The method comprises the following steps: The port access rule configuration request submitted by each business department is parsed and processed through natural language processing technology to generate a corresponding standardized port security policy; the standardized port security policy includes multiple port security policies; the port security policy includes a policy ID, user role, port resource, access rule and corresponding access rights; According to the standardized port security policy, anomalies are identified for existing port access permission configurations, and corresponding permission compliance check results are generated; the anomaly identification for existing port access permission configurations includes: obtaining a user resource relationship graph corresponding to the standardized port security policy, and performing permission configuration anomaly identification analysis on the user resource relationship graph to obtain the permission compliance check result; the node types of the user resource relationship graph include user nodes, port nodes, and permission nodes; Based on the access log data and access traffic data of each port device, suspicious access patterns and abnormal behaviors are identified based on data mining technology, and corresponding port access risk assessment reports are generated; Correlation analysis is performed on the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list; A policy change simulation assessment is performed according to the port security policy adjustment list to generate the latest port security policy, and port resource access control is performed according to the latest port security policy.

2. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The step of parsing the port access rule configuration requests submitted by each business department through natural language processing technology to generate a corresponding standardized port security policy includes: Perform word segmentation and part-of-speech tagging on each port access rule configuration request in turn to obtain a corresponding rule configuration request word segmentation information set; According to each rule configuration request word segmentation information set, the corresponding configuration request semantic dependency tree is constructed based on the dependency syntax analysis tool; According to each configuration request semantic dependency tree, the corresponding rule configuration key information is obtained, and according to the rule configuration key information, the corresponding rule element structured data is generated; the rule configuration key information includes user role, port number and protocol type; According to the rule element structured data and the preset traffic monitoring rule library, the corresponding traffic monitoring rule elements and the port abnormal traffic detection model are obtained; the traffic monitoring rule elements include monitoring objects, monitoring indicators and indicator thresholds; Fill the traffic monitoring rule elements into the corresponding preset service port security policy template to generate the corresponding service port traffic monitoring rules; According to the service port traffic monitoring rules, the port abnormal traffic detection model is optimized and updated with parameters to obtain the service port abnormal traffic detection model, and according to the model parameters of the service port abnormal traffic detection model, an abnormal behavior detection rule set is generated; the parameter update optimization includes adjusting the traffic feature weight and adjusting the abnormal judgment threshold; The user role corresponding to each port access rule configuration request, the abnormal behavior detection rule set and the service port traffic monitoring rule are integrated and processed to generate the standardized port security policy.

3. The network resource access control method based on identity authentication and port perception as claimed in claim 2, It is characterized in that The steps of constructing the service port abnormal traffic detection model include: Acquire historical normal traffic data of the port; the historical normal traffic data of the port includes normal traffic data of multiple business types; The single-class support vector machine model is trained according to the historical normal traffic data of the port to obtain the abnormal traffic detection model of the service port.

4. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The permission compliance check result includes a configuration compliance score and a port security policy adjustment list; The step of identifying anomalies in the existing port access permission configuration according to the standardized port security policy and generating corresponding permission compliance check results comprises: According to all the port security policies in the standardized port security policy, a corresponding user resource relationship graph is constructed based on the graph database technology; Using a subgraph isomorphism algorithm, the user resource relationship graph is used to identify abnormalities in existing permission configurations, and corresponding permission configuration abnormality identification results are obtained; If the permission configuration anomaly identification result does not contain a permission configuration error, the configuration compliance score is set to the highest compliance score value; otherwise, the role permission matrix corresponding to each permission configuration error is obtained respectively, and the corresponding mutual information between permissions is obtained according to the role permission matrix; Determine whether the mutual information between permissions corresponding to each permission configuration error is greater than a preset mutual information threshold. If so, determine that there is a permission mutual exclusion conflict, and set the corresponding permission compliance score to the first compliance deduction value. Otherwise, set the corresponding permission compliance score to the second compliance deduction value. Adding the first compliance deduction value and the second compliance deduction value to obtain a compliance deduction cumulative value, and subtracting the highest compliance score from the compliance deduction cumulative value to obtain the configuration compliance score; When there is a conflict of mutually exclusive permissions, a conflict optimization analysis is performed on the corresponding permission configuration in the user resource relationship map, and the port security policy adjustment list is generated according to the corresponding conflict optimization analysis results.

5. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The port access risk assessment report includes a port risk score and abnormal access frequencies corresponding to different abnormal behavior types; The steps of identifying suspicious access patterns and abnormal behaviors based on data mining technology and generating a corresponding port access risk assessment report according to the access log data and access traffic data of each port device include: The access log data of each port device is parsed and processed respectively to obtain the corresponding user identity authentication information; the user identity authentication information includes the user name, login time and login IP address; Analyze and process the access traffic data of each port device respectively to obtain the corresponding port access behavior characteristics; the port access behavior characteristics include source IP, destination IP, port number, protocol type and data packet size; Comprehensively analyzing the user identity authentication information and port access behavior characteristics of all port devices to obtain port access characteristics; the port access characteristics include the access frequency, average session duration and number of access ports of each user; Generate a corresponding user port access matrix according to the port access feature, and perform user access behavior cluster analysis according to the user port access matrix to obtain multiple user access behavior clusters; Obtaining user access behaviors in each user access behavior cluster whose distance from the cluster center exceeds a preset distance threshold and marking them as suspicious access patterns; According to each suspicious access pattern, association rule mining is performed based on the FP-growth algorithm to generate corresponding frequent item sets, and according to the frequent item sets and the preset confidence threshold, the abnormal behavior type, abnormal behavior level and corresponding abnormal risk score are obtained; A comprehensive statistical analysis is performed based on the abnormal behavior types, abnormal behavior levels and abnormal risk scores corresponding to all suspicious access patterns to generate the port access risk assessment report.

6. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The step of correlating and analyzing the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list includes: The permission compliance check result, the port access risk assessment report and the pre-built access control satisfaction prediction model are used to predict the port security protection satisfaction to obtain a corresponding security protection satisfaction score; When the security protection satisfaction score is lower than a preset satisfaction threshold, the relationship between each port security policy in the standardized port security policy and the security protection satisfaction is analyzed by the Apriori algorithm, and the association rule to be analyzed is obtained by screening; the association rule to be analyzed satisfies the minimum support and minimum confidence conditions; The port security policy in the association rule to be analyzed is used as the port security policy item to be optimized, and the policy parameters of the port security policy item to be optimized are optimized by a grid search method to obtain the corresponding port security policy parameters to be selected; The port security policy adjustment list is generated according to all the port security policy items to be optimized and the corresponding port security policy parameters to be selected.

7. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The step of performing a policy change simulation evaluation according to the port security policy adjustment list to generate the latest port security policy comprises: Obtaining key information of changes in the port security policy adjustment list through natural language processing technology; Convert the key change information into corresponding change structured data, and call the Activiti workflow engine according to the change structured data to generate a corresponding policy change process; the policy change process includes an approval node, an execution node, and a rollback node; Generate multiple groups of simulated random variables through the Monte Carlo simulation method, and perform a policy change risk assessment based on the policy change process according to each group of simulated random variables to obtain a corresponding scenario security risk index; the simulated random variables include user access frequency, traffic size and time distribution; The latest port security policy is generated by a genetic algorithm according to the security risk index of all scenarios; the chromosome encoding of the genetic algorithm includes the port opening state, access control rules and authentication methods.

8. The network resource access control method based on identity authentication and port perception as claimed in claim 1, It is characterized in that The step of performing port resource access control according to the latest port security policy comprises: According to the latest port security policy, the Drools rule engine is used to dynamically generate corresponding port access control lists and port traffic monitoring rules; the traffic monitoring rules include IP address filtering, port number restriction and protocol type control; According to the port traffic monitoring rules, a corresponding access rule set is generated, and the access rule set is sent to the corresponding port device in real time, so that the port device performs port resource access control according to the access rule set.

9. The network resource access control method based on identity authentication and port perception as claimed in claim 8, It is characterized in that The step of the port device performing port resource access control according to the access rule set comprises: According to the access rule set, each access request is filtered and identified based on the Suricata deep packet inspection engine to obtain suspicious access requests; Obtaining traffic characteristics of each suspicious access request, and calculating a corresponding request risk score based on the random forest model according to the traffic characteristics; Determine whether the request risk score of each suspicious access request is greater than the preset risk threshold. If so, directly reject the suspicious access request. Otherwise, continuously monitor the real-time traffic data of the suspicious access request, perform real-time traffic anomaly detection based on the real-time traffic data and the corresponding service port abnormal traffic detection model, and report an alarm based on the identified traffic anomaly.

10. A network resource access control system based on identity authentication and port perception, It is characterized in that The system comprises: A security policy generation module is used to parse and process the port access rule configuration requests submitted by various business departments through natural language processing technology to generate corresponding standardized port security policies; the standardized port security policies include multiple port security policies; the port security policies include policy ID, user role, port resources, access rules and corresponding access rights; The permission compliance checking module is used to identify the abnormalities of the existing port access permission configuration according to the standardized port security policy and generate the corresponding permission compliance checking result; the abnormal identification of the existing port access permission configuration includes: obtaining the user resource relationship map corresponding to the standardized port security policy, and performing permission configuration abnormality identification analysis on the user resource relationship map to obtain the permission compliance checking result; the node types of the user resource relationship map include user nodes, port nodes and permission nodes; The access risk assessment module is used to identify suspicious access patterns and abnormal behaviors based on the access log data and access traffic data of each port device based on data mining technology, and generate corresponding port access risk assessment reports; An adjustment suggestion generation module is used to correlate and analyze the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list; The security policy update module is used to perform policy change simulation evaluation according to the port security policy adjustment list, generate the latest port security policy, and execute port resource access control according to the latest port security policy.

11. The network resource access control system based on identity authentication and port awareness as claimed in claim 10, It is characterized in that The port access rule configuration request submitted by each business department is parsed and processed by natural language processing technology to generate a corresponding standardized port security policy, including: Perform word segmentation and part-of-speech tagging on each port access rule configuration request in turn to obtain a corresponding rule configuration request word segmentation information set; According to each rule configuration request word segmentation information set, the corresponding configuration request semantic dependency tree is constructed based on the dependency syntax analysis tool; According to each configuration request semantic dependency tree, the corresponding rule configuration key information is obtained, and according to the rule configuration key information, the corresponding rule element structured data is generated; the rule configuration key information includes user role, port number and protocol type; According to the rule element structured data and the preset traffic monitoring rule library, the corresponding traffic monitoring rule elements and the port abnormal traffic detection model are obtained; the traffic monitoring rule elements include monitoring objects, monitoring indicators and indicator thresholds; Fill the traffic monitoring rule elements into the corresponding preset service port security policy template to generate the corresponding service port traffic monitoring rules; According to the service port traffic monitoring rules, the port abnormal traffic detection model is optimized and updated with parameters to obtain the service port abnormal traffic detection model, and according to the model parameters of the service port abnormal traffic detection model, an abnormal behavior detection rule set is generated; the parameter update optimization includes adjusting the traffic feature weight and adjusting the abnormal judgment threshold; The user role corresponding to each port access rule configuration request, the abnormal behavior detection rule set and the service port traffic monitoring rule are integrated and processed to generate the standardized port security policy.

12. The network resource access control system based on identity authentication and port awareness as claimed in claim 10, It is characterized in that The permission compliance check result includes a configuration compliance score and a port security policy adjustment list; The step of identifying anomalies in the existing port access permission configuration according to the standardized port security policy and generating corresponding permission compliance check results includes: According to all the port security policies in the standardized port security policy, a corresponding user resource relationship map is constructed based on the graph database technology; the node types of the user resource relationship map include user nodes, port nodes and authority nodes; Using a subgraph isomorphism algorithm, the user resource relationship graph is used to identify abnormalities in existing permission configurations, and corresponding permission configuration abnormality identification results are obtained; If the permission configuration anomaly identification result does not contain a permission configuration error, the configuration compliance score is set to the highest compliance score value; otherwise, the role permission matrix corresponding to each permission configuration error is obtained respectively, and the corresponding mutual information between permissions is obtained according to the role permission matrix; Determine whether the mutual information between permissions corresponding to each permission configuration error is greater than a preset mutual information threshold. If so, determine that there is a permission mutual exclusion conflict, and set the corresponding permission compliance score to the first compliance deduction value. Otherwise, set the corresponding permission compliance score to the second compliance deduction value. Adding the first compliance deduction value and the second compliance deduction value to obtain a compliance deduction cumulative value, and subtracting the highest compliance score from the compliance deduction cumulative value to obtain the configuration compliance score; When there is a conflict of mutually exclusive permissions, a conflict optimization analysis is performed on the corresponding permission configuration in the user resource relationship map, and the port security policy adjustment list is generated according to the corresponding conflict optimization analysis results.

13. The network resource access control system based on identity authentication and port awareness as claimed in claim 10, It is characterized in that The port access risk assessment report includes a port risk score and abnormal access frequencies corresponding to different abnormal behavior types; The method of identifying suspicious access patterns and abnormal behaviors based on the access log data and access traffic data of each port device and generating a corresponding port access risk assessment report includes: The access log data of each port device is parsed and processed respectively to obtain the corresponding user identity authentication information; the user identity authentication information includes the user name, login time and login IP address; Analyze and process the access traffic data of each port device respectively to obtain the corresponding port access behavior characteristics; the port access behavior characteristics include source IP, destination IP, port number, protocol type and data packet size; Comprehensively analyzing the user identity authentication information and port access behavior characteristics of all port devices to obtain port access characteristics; the port access characteristics include the access frequency, average session duration and number of access ports of each user; Generate a corresponding user port access matrix according to the port access feature, and perform user access behavior cluster analysis according to the user port access matrix to obtain multiple user access behavior clusters; Obtaining user access behaviors in each user access behavior cluster whose distance from the cluster center exceeds a preset distance threshold and marking them as suspicious access patterns; According to each suspicious access pattern, association rule mining is performed based on the FP-growth algorithm to generate corresponding frequent item sets, and according to the frequent item sets and the preset confidence threshold, the abnormal behavior type, abnormal behavior level and corresponding abnormal risk score are obtained; A comprehensive statistical analysis is performed based on the abnormal behavior types, abnormal behavior levels and abnormal risk scores corresponding to all suspicious access patterns to generate the port access risk assessment report.

14. The network resource access control system based on identity authentication and port awareness as claimed in claim 10, It is characterized in that The correlating analysis of the permission compliance check result and the port access risk assessment report to obtain a port security policy adjustment list includes: The permission compliance check result, the port access risk assessment report and the pre-built access control satisfaction prediction model are used to predict the port security protection satisfaction to obtain a corresponding security protection satisfaction score; When the security protection satisfaction score is lower than a preset satisfaction threshold, the relationship between each port security policy in the standardized port security policy and the security protection satisfaction is analyzed by the Apriori algorithm, and the association rule to be analyzed is obtained by screening; the association rule to be analyzed satisfies the minimum support and minimum confidence conditions; The port security policy in the association rule to be analyzed is used as the port security policy item to be optimized, and the policy parameters of the port security policy item to be optimized are optimized by a grid search method to obtain the corresponding port security policy parameters to be selected; The port security policy adjustment list is generated according to all the port security policy items to be optimized and the corresponding port security policy parameters to be selected.

15. The network resource access control system based on identity authentication and port awareness as claimed in claim 10, It is characterized in that The performing a policy change simulation evaluation according to the port security policy adjustment list to generate the latest port security policy includes: Obtaining key information of changes in the port security policy adjustment list through natural language processing technology; Convert the key change information into corresponding change structured data, and call the Activiti workflow engine according to the change structured data to generate a corresponding policy change process; the policy change process includes an approval node, an execution node, and a rollback node; Generate multiple groups of simulated random variables through the Monte Carlo simulation method, and perform a policy change risk assessment based on the policy change process according to each group of simulated random variables to obtain a corresponding scenario security risk index; the simulated random variables include user access frequency, traffic size and time distribution; The latest port security policy is generated by a genetic algorithm according to the security risk index of all scenarios; the chromosome encoding of the genetic algorithm includes the port opening state, access control rules and authentication methods.

Images