Method and device for processing high-risk behaviors of target permission users based on cloud platform

Abstract

The embodiments of the present application disclose a method and device for processing high-risk behaviors of target permission users based on a cloud platform, which relates to the field of network security technology and is invented to facilitate both improving the security of the cloud platform and facilitating the administrator of the target cloud platform to obtain more information about the target permission users. The method includes: if it is monitored that the target permission user in the target cloud platform has an operation behavior in a specified operation set, then the danger level of the operation behavior is determined; if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, then the operation permission of the target permission user is reduced or closed; multiple samples of the operation behavior generated by the user on the target cloud platform and an identification indicating whether the digital portrait is accurate are obtained; based on the key features and key feature values ​​corresponding to the target permission user, a digital portrait of the target permission user is constructed. The present application is suitable for processing the danger level of operation behavior.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and readable storage medium for processing high-risk behaviors of target privileged users based on a cloud platform. Background Art

[0002] As an emerging computing model, cloud computing has become one of the important technical supports for today's enterprises. Compared with traditional local data centers, running applications on the cloud has the advantages of high flexibility, scalability, and resource utilization. However, the popularity of cloud computing has brought new security threats. For example, hacker attacks, malware propagation, and data leakage are all common security threats in cloud environments. How to ensure the security and reliability of cloud resources has become one of the urgent issues to be solved. With the continuous development of cloud computing technology in recent years, more and more enterprises and organizations have begun to adopt cloud computing models to provide computing resources, storage resources, and data processing capabilities. The popularity of cloud computing has brought convenience and flexibility, but also security risks. With the intensification of global cyber attacks, hackers and cyber criminals are becoming more and more adept at using various vulnerabilities and technical means to attack and steal data. The consequences of cyber attacks are becoming more and more serious, and the requirements for network security are also getting higher and higher. However, there is no effective way to deal with dangerous user behaviors on cloud platforms in the existing technology, resulting in low security of cloud platforms. Summary of the invention

[0003] In view of this, the embodiments of the present application provide a method, device, electronic device and readable storage medium for processing high-risk behaviors of target authorized users based on a cloud platform, which is convenient for improving the security of the cloud platform and facilitating the administrator of the target cloud platform to obtain more information of the target authorized users.

[0004] In a first aspect, an embodiment of the present application provides a method for processing high-risk behaviors of target permission users based on a cloud platform, comprising: monitoring, according to a preset monitoring strategy, whether a target permission user in a specified permission set in a target cloud platform performs an operation in a specified operation set; if the target permission user in the target cloud platform is monitored to perform an operation in the specified operation set, determining the danger level of the operation behavior; judging whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation permission of the target permission user; if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, reducing or closing the operation permission of the target permission user, and sending an alarm message to the administrator address of the target cloud platform; if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, the method The method also includes: obtaining multiple samples generated by the operation behavior of the user on the target cloud platform, each sample including at least one feature, a feature value corresponding to each feature, and an identification indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values; determining the key features for constructing the digital portrait according to the multiple samples and preset strategies; obtaining the key features and key feature values ​​corresponding to the target permission user according to the key features of the digital portrait; constructing the digital portrait of the target permission user according to the key features and key feature values ​​corresponding to the target permission user; determining the accuracy of each key feature of the target permission user according to the key features of the target permission user and the preset correspondence between features and accuracy; determining the accuracy of the digital portrait according to the accuracy of each key feature of the target permission user and the preset weights of each key feature.

[0005] According to a specific implementation method of an embodiment of the present application, determining the key features for constructing a digital portrait based on the multiple samples and a preset strategy includes: calculating the applicability index of each feature in the multiple samples based on the multiple samples; and determining the feature whose applicability index is greater than or equal to a preset threshold as a key feature.

[0006] According to a specific implementation of the embodiment of the present application, the features of the multiple samples include a first feature; and the applicability index of the first feature is calculated according to the following formula:

[0007]

[0008] in, is the applicability index of the first feature; is the number of samples; is the number of categories that indicate whether the digital portrait is accurate. =2; For the Categories The number of samples; is greater than or equal to 1 and less than or equal to integer; is the number of subsets into which the multiple samples are divided according to the eigenvalue of the first feature; is greater than or equal to 1 and less than or equal to integer; For the The number of samples in the subset; For the The subsets belong to the category The number of samples.

[0009] According to a specific implementation manner of the embodiment of the present application, the key features of the target permission user include a first key feature; the preset weight of the first key feature is determined according to the following formula:

[0010]

[0011] in, is the preset weight of the first key feature, is the initial weight of the first key feature, is the number of times the first key feature appears within a preset time, The first key feature appears for the first time within the preset time. Second-rate, is greater than or equal to 1 and less than or equal to integer, The first key feature appears The corresponding content weight is The first key feature is The number of hours since the current time that the next occurrence occurred.

[0012] According to a specific implementation method of an embodiment of the present application, determining the danger level of the operation behavior includes: obtaining the operation log of the target authorized user on the target cloud platform, the network environment of the target cloud platform, and the type of the target cloud platform; determining the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user.

[0013] According to a specific implementation method of an embodiment of the present application, the danger level of the operation behavior is determined according to the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the permissions of the target authorized user, including: determining the danger level of the operation behavior according to the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the permissions of the target authorized user and a preset machine learning model.

[0014] According to a specific implementation method of an embodiment of the present application, after sending an alarm message to the administrator address of the target cloud platform, the method also includes: monitoring whether the version number currently running the target cloud platform has changed; if the version number currently running the target cloud platform has changed, determining the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number; if the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number is lower than a compatibility threshold, issuing a monitoring policy compatibility update request to obtain and run the updated monitoring policy.

[0015] In a second aspect, an embodiment of the present application provides a processing device for high-risk behaviors of target permission users based on a cloud platform, including: a monitoring module, which is used to monitor whether the target permission users in the specified permission set in the target cloud platform have performed operation behaviors in the specified operation set according to a preset monitoring strategy; a first determination module, which is used to determine the danger level of the operation behavior if it is monitored that the target permission user in the target cloud platform has performed operation behaviors in the specified operation set; a judgment module, which is used to judge whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation permissions of the target permission user; a sending module, which is used to reduce or close the operation permissions of the target permission user if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, and send an alarm message to the administrator address of the target cloud platform; a first acquisition module, which is used to obtain the operation behavior of the user on the target cloud platform when the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user. Multiple samples are generated, each sample includes at least one feature, a feature value corresponding to each feature, and an identifier indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values; a second determination module is used to determine the key features for constructing the digital portrait according to the multiple samples and preset strategies; a second acquisition module is used to obtain the key features and key feature values ​​corresponding to the target permission user according to the key features of the digital portrait; a construction module is used to construct the digital portrait of the target permission user according to the key features and key feature values ​​corresponding to the target permission user; a third determination module is used to determine the accuracy of each key feature of the target permission user according to the key features of the target permission user and the preset correspondence between features and accuracy; a fourth determination module is used to determine the accuracy of the digital portrait according to the accuracy of each key feature of the target permission user and the preset weights of each key feature.

[0016] According to a specific implementation method of an embodiment of the present application, the second determination module is specifically used to: calculate the applicability index of each feature in the multiple samples based on the multiple samples; and determine the feature whose applicability index is greater than or equal to a preset threshold as a key feature.

[0017] According to a specific implementation of the embodiment of the present application, the features of the multiple samples include a first feature; the second determination module is specifically configured to calculate the applicability index of the first feature according to the following formula:

[0018]

[0019] in, is the applicability index of the first feature; is the number of samples; is the number of categories that indicate whether the digital portrait is accurate. =2; For the Categories The number of samples; is greater than or equal to 1 and less than or equal to integer; is the number of subsets into which the multiple samples are divided according to the eigenvalue of the first feature; is greater than or equal to 1 and less than or equal to integer; For the The number of samples in the subset; For the The subsets belong to the category The number of samples.

[0020] According to a specific implementation of the embodiment of the present application, the key feature of the target permission user includes a first key feature; the fourth determination module is specifically used to determine the preset weight of the first key feature according to the following formula:

[0021]

[0022] in, is the preset weight of the first key feature, is the initial weight of the first key feature, is the number of times the first key feature appears within a preset time, The first key feature appears for the first time within the preset time. Second-rate, is greater than or equal to 1 and less than or equal to integer, The first key feature appears The corresponding content weight is The first key feature is The number of hours since the current time that the next occurrence occurred.

[0023] According to a specific implementation method of an embodiment of the present application, the first determination module is specifically used to: obtain the operation log of the target authorized user on the target cloud platform, the network environment of the target cloud platform, and the type of the target cloud platform; determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user.

[0024] According to a specific implementation method of an embodiment of the present application, the first determination module is specifically used to determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the permissions of the target authorized user and a preset machine learning model.

[0025] According to a specific implementation method of an embodiment of the present application, the device is also used to: after the reduction module sends an alarm message to the administrator address of the target cloud platform, monitor whether the version number currently running the target cloud platform has changed; if the version number currently running the target cloud platform has changed, determine the compatibility of the preset monitoring strategy with the target cloud platform corresponding to the changed version number; if the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number is lower than the compatibility threshold, issue a monitoring policy compatibility update request, obtain and run the updated monitoring policy.

[0026] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the shell, and the processor and the memory are arranged on the circuit board; a power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method for processing high-risk behaviors of target permission users based on the cloud platform as described in any of the aforementioned implementation methods.

[0027] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for processing high-risk behaviors of target permission users based on the cloud platform as described in any of the aforementioned implementation methods.

[0028] The method, device, electronic device and readable storage medium for processing high-risk behaviors of target permission users based on the cloud platform of this embodiment monitor whether the target permission users of the target cloud platform have performed operation behaviors in the specified operation set. If the target permission users in the target cloud platform are monitored to have performed operation behaviors in the specified operation set, the danger level of the operation behavior is determined. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission users, the operation permissions of the target permission users are reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform. This embodiment proposes a new method for monitoring high-risk behaviors based on the cloud platform for the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission users, the operation permissions of the target permission users are reduced or closed, thereby facilitating the improvement of the security of the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission users, the operation permissions of the target permission users are reduced or closed, thereby facilitating the improvement of the security of the cloud platform. In the case of not being a subset of the danger level set corresponding to the operating authority of the target permission user, multiple samples generated by the operating behavior of the user on the target cloud platform are obtained, each sample includes at least one feature, a feature value corresponding to each feature, and an identification indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values, and according to multiple samples and preset strategies, key features for constructing the digital portrait are determined, and according to the key features of the digital portrait, the key features and key feature values ​​corresponding to the target permission user are obtained, and according to the key features and key feature values ​​corresponding to the target permission user, a digital portrait of the target permission user is constructed, and the accuracy of the data portrait is determined, so that the administrator of the target cloud platform can obtain more information about the target permission user, ensure the safe and stable operation of the cloud platform, and further, facilitate the provision of more reliable and efficient services to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 A flowchart of a method for processing high-risk behaviors of target permission users based on a cloud platform provided in one embodiment of the present application;

[0031] Figure 2 A schematic diagram of the architecture of a cloud-based high-risk behavior perception, warning and blocking system provided for a specific embodiment of the present application;

[0032] Figure 3A schematic diagram of the structure of a device for processing high-risk behaviors of target-authorized users based on a cloud platform according to an embodiment of the present application;

[0033] Figure 4 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0034] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings. It should be clear that the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0035] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0036] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0037] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or a communication; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0038] In order to enable those skilled in the art to better understand the technical concept, implementation plan and beneficial effects of the embodiments of the present application, specific embodiments are described in detail below.

[0039] Figure 1A flowchart of a method for processing high-risk behaviors of target privileged users based on a cloud platform according to an embodiment of the present application is shown in FIG. Figure 1 As shown, the method for processing high-risk behaviors of target permission users based on the cloud platform in this embodiment may include:

[0040] S101. According to a preset monitoring strategy, monitor whether a target permission user in a specified permission set in a target cloud platform performs an operation in a specified operation set.

[0041] The preset monitoring strategy may include the method of implementing monitoring, the interface for implementing monitoring, etc.

[0042] The user rights to access the target platform can be specified in advance, and users who exceed the specified rights are not allowed to perform operations on the cloud platform. The rights of the operations that are allowed to be performed on the cloud platform form a permission set, namely a designated permission set. The rights of users in this set can be divided into low-authority users, medium-authority users, and high-authority users. If a high-authority user in the designated permission set is monitored, the high-authority user is the target permission user.

[0043] The specified operation set may include multiple operation behaviors, and the operation behaviors may include logging in, accessing data, modifying logs, clearing logs, closing log records, and / or closing services, etc.

[0044] S102: If it is monitored that a target authorized user in the target cloud platform performs an operation in a specified operation set, the danger level of the operation is determined.

[0045] The security level of each operation behavior in the specified operation set is different. When an operation behavior in the specified operation set occurs, the danger level of the operation behavior is determined.

[0046] Danger levels can include high-level danger, medium-level danger and low-level danger. Danger levels can also be expressed as level 1, level 2, level 3, etc., and start from level 1 and the levels gradually decrease.

[0047] S103: Determine whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation authority of the target authority user.

[0048] The target permission user's operation has certain permissions, that is, a certain operation range. The operation permissions within the target permission user's operation permissions correspond to different risk levels, and these risk levels constitute the risk level set corresponding to the target permission user's operation permissions.

[0049] After determining the danger level of the operation behavior, it is determined whether the danger level is a danger level in the danger level set corresponding to the operation authority of the target authority user.

[0050] S104. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, the operation permission of the target permission user is reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform.

[0051] If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, it means that the operation behavior of the target permission user is relatively dangerous. In order to improve the security of the cloud platform, the operation permissions of the target permission user can be reduced or closed. Among them, the level of the operation permissions of the target permission user can be reduced, such as from level 1 operation permissions to level 2, or to level 3.

[0052] If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, the operation behavior of the target permission user can be blocked, and the information of the target permission user can be visually displayed.

[0053] S105: Acquire multiple samples generated by user operation behaviors on the target cloud platform.

[0054] Each sample includes at least one feature, a feature value corresponding to each feature, and an identifier indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed based on the features in the respective samples and the corresponding feature values.

[0055] Each sample may be an operation behavior of a user on the target cloud platform, that is, a sample is generated based on the operation behavior, and at least one feature may include the user's age, occupation, IP address, etc.

[0056] S106. Determine key features for constructing a digital portrait based on multiple samples and preset strategies.

[0057] Based on at least one feature in the sample, the feature value corresponding to each feature, an identifier indicating whether the digital portrait is accurate, and a preset strategy, key features for constructing the digital portrait are determined.

[0058] Each sample includes at least one feature. According to a preset strategy, a key feature can be determined from the at least one feature, and a digital portrait can be constructed using the key feature.

[0059] In one example, determining the key features of constructing a digital portrait based on multiple samples and preset strategies in step S106 may include:

[0060] S106a. Calculate the applicability index of each feature in the multiple samples based on the multiple samples.

[0061] When the features of the multiple samples include the first feature, the applicability index of the first feature is calculated according to the following formula:

[0062]

[0063] in, is the applicability index of the first feature; is the number of samples; is the number of categories that indicate whether the digital portrait is accurate. =2; For the Categories The number of samples; is greater than or equal to 1 and less than or equal to integer; is the number of subsets into which the multiple samples are divided according to the eigenvalue of the first feature; is greater than or equal to 1 and less than or equal to integer; For the The number of samples in the subset; For the The subsets belong to the category The number of samples.

[0064] In a specific example, the number of samples may be 15. If it is the first category, the first category may be samples corresponding to the identification indicating that the digital portrait is accurate, and the number of samples may be 5. Correspondingly, the second category is samples corresponding to the identification indicating that the digital portrait is inaccurate, and the number of samples may be 10.

[0065] The values ​​of feature A are a1, a2,...a n , according to the eigenvalues ​​of A, divide the 15 samples into n subsets. For example, if the number of eigenvalues ​​of A is 3, then divide the 15 samples into 3 subsets, and the number of samples in each subset is 4, 6, and 5 respectively. Then exist If the values ​​are 1, 2, and 3 respectively, the corresponding values ​​are 4, 6, and 5. ,but is 1, and there are 3 in the first subset that belong to ,but is 3.

[0066] S106b. Determine the features whose applicability index is greater than or equal to the preset threshold as key features.

[0067] S107. According to the key features of the digital portrait, obtain the key features and key feature values ​​corresponding to the target authorized user.

[0068] If the key features of the digital portrait determined in step S107 are the user's age and occupation, then in this step, the age and occupation features of the target permission user and the corresponding feature values ​​are obtained to construct the digital portrait accordingly.

[0069] S108. Construct a digital portrait of the target permission user based on the key features and key feature values ​​corresponding to the target permission user.

[0070] S109: Determine the accuracy of each key feature of the target permission user according to the key features of the target permission user and the corresponding relationship between the preset features and the accuracy.

[0071] S110. Determine the accuracy of the digital portrait based on the accuracy of each key feature of the target authorized user and the preset weight of each key feature.

[0072] The accuracy of the digital portrait can help administrators evaluate the accuracy of the digital portrait to further determine whether to take measures.

[0073] In this embodiment, whether the target permission user of the target cloud platform performs operation behaviors in the specified operation set is monitored. If the target permission user in the target cloud platform is monitored to perform operation behaviors in the specified operation set, the danger level of the operation behavior is determined. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform. This embodiment proposes a new cloud platform-based high-risk behavior monitoring method for the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, thereby facilitating the improvement of the security and reliability of the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, thereby facilitating the improvement of the security and reliability of the cloud platform. In the case of a subset of the danger level set corresponding to the operation permission, multiple samples generated by the operation behavior of the user on the target cloud platform are obtained, each sample includes at least one feature, a feature value corresponding to each feature, and an identification indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values, and according to multiple samples and preset strategies, the key features for constructing the digital portrait are determined, and according to the key features of the digital portrait, the key features and key feature values ​​corresponding to the target permission user are obtained, and according to the key features and key feature values ​​corresponding to the target permission user, the digital portrait of the target permission user is constructed, so that the administrator of the target cloud platform can obtain more information about the target permission user, ensure the safe and stable operation of the cloud platform, and further, facilitate the provision of more reliable and efficient services to users.

[0074] In an embodiment of calculating the preset weight, when the key features of the target authorized user include the first key feature, the preset weight of the first key feature is determined according to the following formula:

[0075]

[0076] in, is the preset weight of the first key feature, is the initial weight of the first key feature, is the number of times the first key feature appears within a preset time, The first key feature appears for the first time within the preset time. Second-rate, is greater than or equal to 1 and less than or equal to integer, The first key feature appears The corresponding content weight is The first key feature is The number of hours since the current time that the next occurrence occurred.

[0077] As time goes by, that is, the weight of the content corresponding to the key features in the time earlier than the current time becomes smaller, the content weight of the first key feature m times is corrected and the average value is taken. The average value can be used as the correction value of the preset weight, so that the weight of the first key feature is more accurate, and then the calculation of the accuracy of the digital portrait is more accurate.

[0078] In some examples, determining the risk level of the operation behavior in step S102 may include:

[0079] S102a, obtaining the target authorized user's operation log on the target cloud platform, the target cloud platform's network environment, and the target cloud platform's type.

[0080] The target authorized user's operation log on the target cloud platform can record relevant information about the target authorized user's operation behavior.

[0081] An operation by a target privileged user has a lower risk level in a network environment with a higher protection level. The same operation may have a higher risk level in a network environment with a lower protection level.

[0082] If the target cloud platform is of the type that provides users with download resources and welcomes users to log in and access them, the operations of the target authorized user will generally not cause danger. An operation of the target authorized user on such a cloud platform has a low risk level. However, for the same operation, if the target cloud platform is of a more sensitive type, such as a platform involving important data, the risk level of the target authorized user will be higher.

[0083] S102b: Determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user.

[0084] By using operation logs, the network environment of the target cloud platform, the type of the target cloud platform, and the permissions of the target authorized user as factors for determining the danger level, the danger level of the operation behavior can be determined more accurately.

[0085] In some examples, step S102b, determining the risk level of the operation behavior according to the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user, may include:

[0086] A1. Determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the permissions of the target authorized user, and the preset machine learning model.

[0087] In this embodiment, the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the permissions of the target authorized user, and the preset machine learning model are combined to more accurately and intelligently determine the danger level of the operation behavior.

[0088] The preset machine learning model can be trained using historical data to obtain the model.

[0089] In this embodiment, the data generated based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform and the permissions of the target authorized user can be used as the input of the preset machine learning model to output the danger level accordingly.

[0090] In order to realize automatic monitoring of the cloud platform and improve monitoring efficiency, after sending the alarm information to the administrator address of the target cloud platform, the method may further include:

[0091] S111. Monitor whether the version number of the target cloud platform currently running has changed.

[0092] S112: If the version number of the target cloud platform currently running has changed, determine the compatibility of the preset monitoring strategy with the target cloud platform corresponding to the changed version number.

[0093] S113. If the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number is lower than the compatibility threshold, a monitoring policy compatibility update request is issued to obtain and run the updated monitoring policy.

[0094] If the compatibility is lower than the compatibility threshold, it means that the preset monitoring strategy is less compatible with the target cloud platform corresponding to the changed version number, and the monitoring strategy needs to be updated to adapt to the version number currently running on the target cloud platform.

[0095] See also Figure 2 , the application also provides a cloud-based high-risk behavior perception, alarm and blocking system. The system includes the following main modules: high-risk behavior perception module, alarm module, anomaly detection module, early warning module, compatibility identification module, blocking module, data analysis and learning module, and visualization interface.

[0096] High-risk behavior perception module: This module monitors user activities and system logs in the cloud platform in real time to identify behaviors that may involve security risks, such as abnormal login attempts, unauthorized data access, and malicious file uploads.

[0097] Alarm module: Once a high-risk behavior is detected, the module will immediately trigger the alarm mechanism and send an alarm notification to the administrator. The alarm content includes detailed information of the behavior, the time of occurrence, the resources affected, etc., so that the administrator can take timely measures to deal with it. Real-time monitoring of high-risk behaviors on the cloud and timely push of alarms.

[0098] Anomaly detection module: Use machine learning algorithms to analyze and model the data stored in the database to identify abnormal behaviors. Effectively monitor high-authority users and immediately connect to the early warning module to push alarm notifications when abnormal behaviors are found, such as changes in Userdata content, execution of high-risk commands, closure of security monitoring services, closure of log records, and log cleaning.

[0099] Early warning module: Based on the output of the anomaly detection module, an early warning signal is issued to remind the administrator to take timely measures. The metadata is effectively monitored, and an alarm notification is immediately pushed when abnormal access to the metadata address is found. Cloud tenants can locate the access source in time. Timely alarms are issued and corresponding measures are taken to effectively prevent potential security threats.

[0100] Compatibility identification module: By cooperating with leading cloud vendors, it is highly compatible with the cloud environments of various vendors. By strengthening cooperation with leading cloud vendors, it monitors the current operating environment of the system device in real time.

[0101] Blocking module: This module blocks high-risk behaviors based on preset policies and rules. For example, it limits user access rights and prohibits the upload of malicious files. Blocking operations can be performed in an automated manner, reducing the need for manual intervention.

[0102] Data analysis and learning module: The system also has certain data analysis and learning capabilities. Through the analysis and learning of historical data, the system can continuously optimize its perception and blocking capabilities, and improve the accuracy of identifying and responding to new security threats. The data analysis and learning module uses machine learning algorithms to analyze and learn historical data, and continuously improves the intelligence and recognition accuracy of the system. Through automated threat intelligence operations based on machine learning algorithms, the goals of high accuracy, high efficiency, high ease of use, high return rate, and low operating costs can be achieved.

[0103] Visual interface: To facilitate administrators' use and management, the system also provides an intuitive visual interface that displays key indicators and alarm information, supports real-time monitoring and operation, and enables administrators to easily view and manage various functions and indicators, thereby improving work efficiency and user experience.

[0104] In addition, in this embodiment, based on the above threat intelligence, the attacker can be effectively digitally profiled during the actual industry confrontation.

[0105] This embodiment improves the security and reliability of cloud services by perceiving and blocking high-risk behaviors in real time. The blocking module uses an automated approach to handle high-risk behaviors, reducing the need for manual intervention and the possibility of errors. The data analysis and learning module uses machine learning algorithms to analyze and learn historical data, continuously improving the intelligence and recognition accuracy of the system. The compatibility identification module monitors the current operating environment in real time, achieving high compatibility with cloud environments of various vendors.

[0106] In this embodiment, whether the target permission user of the target cloud platform performs operation behaviors in the specified operation set is monitored. If the target permission user in the target cloud platform is monitored to perform operation behaviors in the specified operation set, the danger level of the operation behavior is determined. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform. This embodiment proposes a new cloud platform-based high-risk behavior monitoring method for the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed. , so as to facilitate improving the security and reliability of the cloud platform, when the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, multiple samples generated by the operation behavior of the user on the target cloud platform are obtained, each sample includes at least one feature, a feature value corresponding to each feature, and an identifier indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features and corresponding feature values ​​in the respective samples, and according to the multiple samples and the preset strategy, the key features for constructing the digital portrait are determined, and according to the key features of the digital portrait, the key features and key feature values ​​corresponding to the target permission user are obtained, and according to the key features and key feature values ​​corresponding to the target permission user, the digital portrait is constructed according to the key features and key feature values ​​corresponding to the target permission user. Key feature values ​​are used to construct a digital portrait of the target authorized user and determine the accuracy of the digital portrait so that the administrator of the target cloud platform can obtain more information about the target authorized user and ensure the safe and stable operation of the cloud platform. Further, it is convenient to provide users with more reliable and efficient services. Applicable indexes can be introduced to further improve the accuracy of selecting key features. In order to provide administrators with more information, the accuracy of key features can be determined based on the key features of the target authorized user, and the accuracy of the digital portrait can be further determined. In the process of calculating the preset weights of key features, time and weight content are introduced to construct the correction coefficient of the initial weight, so that the weight of the key feature is more accurate. Through operation logs and the network environment of the target cloud platform, the correction coefficient of the initial weight is constructed. The accuracy of calculating the danger level can be improved by further combining the machine learning model to determine the danger level. In order to monitor the current cloud platform in real time and be compatible with the cloud environments of various manufacturers, when the version number currently running on the target cloud platform changes, the compatibility of the preset monitoring strategy with the target cloud platform corresponding to the changed version number can be judged. If the compatibility of the preset monitoring strategy with the target cloud platform corresponding to the changed version number is lower than the compatibility threshold, a monitoring strategy compatibility update request is issued to obtain and run the updated monitoring strategy.

[0107] Figure 3 A schematic diagram of a structure of a device for processing high-risk behaviors of target privileged users based on a cloud platform according to an embodiment of the present application is shown in FIG. Figure 3 As shown, the processing device for high-risk behaviors of target permission users based on the cloud platform of this embodiment includes: a monitoring module 11, which is used to monitor whether the target permission users in the specified permission set in the target cloud platform have performed operation behaviors in the specified operation set according to a preset monitoring strategy; a first determination module 12, which is used to determine the danger level of the operation behavior if it is monitored that the target permission user in the target cloud platform has performed operation behaviors in the specified operation set; a judgment module 13, which is used to judge whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation permission of the target permission user; a sending module 14, which is used to reduce or close the operation permission of the target permission user if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, and send an alarm message to the administrator address of the target cloud platform; a first acquisition module 15, which is used to obtain the danger level of the operation behavior in the target cloud platform when the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user. Multiple samples are generated by the operation behaviors of users on the target cloud platform, each sample includes at least one feature, a feature value corresponding to each feature, and an identification indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values; a second determination module 16 is used to determine the key features for constructing the digital portrait according to the multiple samples and preset strategies; a second acquisition module 17 is used to obtain the key features and key feature values ​​corresponding to the target permission user according to the key features of the digital portrait; a construction module 18 is used to construct the digital portrait of the target permission user according to the key features and key feature values ​​corresponding to the target permission user; a third determination module 19 is used to determine the accuracy of each key feature of the target permission user according to the key features of the target permission user and the preset correspondence between the features and the accuracy; a fourth determination module 20 is used to determine the accuracy of the digital portrait according to the accuracy of each key feature of the target permission user and the preset weights of each key feature.

[0108] The device of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0109] The device of this embodiment monitors whether the target permission user of the target cloud platform performs operation behaviors in the specified operation set. If the target permission user in the target cloud platform is monitored to perform operation behaviors in the specified operation set, the danger level of the operation behavior is determined. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform. This embodiment proposes a new cloud platform-based high-risk behavior monitoring method for the cloud platform. If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, thereby facilitating the improvement of the security and reliability of the cloud platform; if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user, the operation permissions of the target permission user are reduced or closed, thereby facilitating the improvement of the security and reliability of the cloud platform; if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permissions of the target permission user In the case of a subset of the danger level set corresponding to the operation authority, multiple samples generated by the operation behavior of the user on the target cloud platform are obtained, each sample includes at least one feature, a feature value corresponding to each feature, and an identification indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values, and according to multiple samples and preset strategies, the key features for constructing the digital portrait are determined, and according to the key features of the digital portrait, the key features and key feature values ​​corresponding to the target permission user are obtained, and according to the key features and key feature values ​​corresponding to the target permission user, a digital portrait of the target permission user is constructed, so that the administrator of the target cloud platform can obtain more information about the target permission user, ensure the safe and stable operation of the cloud platform, and further, facilitate the provision of more reliable and efficient services to users.

[0110] As an optional implementation, the second determination module is specifically used to: calculate the applicability index of each feature in the multiple samples based on the multiple samples; and determine the feature whose applicability index is greater than or equal to a preset threshold as a key feature.

[0111] As an optional implementation manner, the features in each sample include a first feature; and the second determination module is specifically configured to calculate the applicability index of the first feature according to the following formula:

[0112]

[0113] in, is the applicability index of the first feature; is the number of samples; is the number of categories that indicate whether the digital portrait is accurate. =2; For the Categories The number of samples; is greater than or equal to 1 and less than or equal to integer; is the number of subsets into which the multiple samples are divided according to the eigenvalue of the first feature; is greater than or equal to 1 and less than or equal to integer; For the The number of samples in the subset; For the The subsets belong to the category The number of samples.

[0114] As an optional implementation manner, the key feature of the target authorized user includes a first key feature; and the fourth determination module is specifically configured to determine a preset weight of the first key feature according to the following formula:

[0115]

[0116] in, is the preset weight of the first key feature, is the initial weight of the first key feature, is the number of times the first key feature appears within a preset time, The first key feature appears for the first time within the preset time. Second-rate, is greater than or equal to 1 and less than or equal to integer, The first key feature appears The corresponding content weight is The first key feature is The number of hours since the current time that the next occurrence occurred.

[0117] As an optional implementation, the first determination module is specifically used to: obtain the operation log of the target authorized user on the target cloud platform, the network environment of the target cloud platform, and the type of the target cloud platform; determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user.

[0118] As an optional implementation, the first determination module is specifically used to determine the danger level of the operation behavior based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the permissions of the target authorized user and a preset machine learning model.

[0119] As an optional implementation, the device is also used to: monitor whether the version number currently running the target cloud platform changes after the reduction module sends an alarm message to the administrator address of the target cloud platform; if the version number currently running the target cloud platform changes, determine the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number; if the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number is lower than the compatibility threshold, issue a monitoring policy compatibility update request, obtain and run the updated monitoring policy.

[0120] The device of the above embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0121] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, it may include: a shell 61, a processor 62, a memory 63, a circuit board 64 and a power supply circuit 65, wherein the circuit board 64 is arranged inside the space enclosed by the shell 61, and the processor 62 and the memory 63 are arranged on the circuit board 64; the power supply circuit 65 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 63 is used to store executable program codes; the processor 62 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 63, and is used to execute any one of the cloud platform-based target permission user high-risk behavior processing methods provided in the aforementioned embodiments, and therefore can also achieve corresponding beneficial technical effects, which have been described in detail in the previous text and will not be repeated here.

[0122] The above electronic devices exist in many forms, including but not limited to:

[0123] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, feature phones, and low-end phones.

[0124] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers and have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDAs, MIDs, and UMPC devices, such as the iPad.

[0125] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0126] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general-purpose computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0127] (5) Other electronic devices with data interaction functions.

[0128] Correspondingly, an embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of the cloud platform-based target permission user high-risk behavior processing methods provided in the aforementioned embodiments, thereby also being able to achieve the corresponding technical effects, which have been described in detail in the previous text and will not be repeated here.

[0129] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0130] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0131] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present application, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0133] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for processing high-risk behaviors of target privileged users based on a cloud platform, characterized in that: include: According to the preset monitoring strategy, monitor whether the target permission users in the specified permission set in the target cloud platform have performed operations in the specified operation set; If the target authorized user in the target cloud platform is monitored to have an operation behavior in the specified operation set, then the danger level of the operation behavior is determined; Determine whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation authority of the target authority user; If the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, the operation permission of the target permission user is reduced or closed, and an alarm message is sent to the administrator address of the target cloud platform; In the case where the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation authority of the target authority user, the method further includes: Acquire multiple samples generated by operation behaviors of users on the target cloud platform, each sample including at least one feature, a feature value corresponding to each feature, and an identifier indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values; Determining key features for constructing a digital portrait based on the multiple samples and the preset strategy; According to the key features of the digital portrait, the key features and key feature values ​​corresponding to the target authorized user are obtained; Constructing a digital portrait of the target authorized user according to the key features and key feature values ​​corresponding to the target authorized user; Determine the accuracy of each key feature of the target permission user according to the key features of the target permission user and the correspondence between the preset features and the accuracy; Determining the accuracy of the digital portrait according to the accuracy of each key feature of the target authorized user and the preset weight of each key feature; The key features of the target authorized user include a first key feature; the preset weight of the first key feature is determined according to the following formula: ； in, is the preset weight of the first key feature, is the initial weight of the first key feature, is the number of times the first key feature appears within a preset time, The first key feature appears for the first time within the preset time. Second-rate, is greater than or equal to 1 and less than or equal to integer, The first key feature appears The corresponding content weight is The first key feature is The number of hours since the current time that the next occurrence occurred.

2. The method according to claim 1, characterized in that Determining key features of constructing a digital portrait based on the multiple samples and the preset strategy includes: Calculating, based on the plurality of samples, a fitness index of each feature in the plurality of samples; The features whose applicability index is greater than or equal to a preset threshold are determined as key features.

3. The method according to claim 2, characterized in that The features of the multiple samples include a first feature; the applicability index of the first feature is calculated according to the following formula: ； in, is the applicability index of the first feature; is the number of samples; is the number of categories that indicate whether the digital portrait is accurate. =2; For the Categories The number of samples; is greater than or equal to 1 and less than or equal to integer; is the number of subsets into which the multiple samples are divided according to the eigenvalue of the first feature; is greater than or equal to 1 and less than or equal to integer; For the The number of samples in the subset; For the The subsets belong to the category The number of samples.

4. The method according to claim 1, characterized in that Determining the risk level of the operation behavior includes: Obtaining the operation log of the target authorized user on the target cloud platform, the network environment of the target cloud platform, and the type of the target cloud platform; The danger level of the operation behavior is determined according to the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user.

5. The method according to claim 4, characterized in that The determining the danger level of the operation behavior according to the operation log, the network environment of the target cloud platform, the type of the target cloud platform, and the authority of the target authorized user includes: The danger level of the operation behavior is determined based on the operation log, the network environment of the target cloud platform, the type of the target cloud platform, the authority of the target authorized user and a preset machine learning model.

6. The method according to claim 1, characterized in that After sending the warning information to the administrator address of the target cloud platform, the method further includes: Monitor whether the version number currently running on the target cloud platform has changed; If the version number of the target cloud platform currently running changes, then determine the compatibility of the preset monitoring strategy with the target cloud platform corresponding to the changed version number; If the compatibility of the preset monitoring policy with the target cloud platform corresponding to the changed version number is lower than the compatibility threshold, a monitoring policy compatibility update request is issued to obtain and run the updated monitoring policy.

7. A device for processing high-risk behaviors of target privileged users based on a cloud platform, characterized in that: include: The monitoring module is used to monitor whether the target permission user in the specified permission set in the target cloud platform has performed an operation in the specified operation set according to the preset monitoring strategy; A first determination module is used to determine the danger level of the operation behavior if it is monitored that the target authorized user in the target cloud platform has an operation behavior in a specified operation set; A judgment module, used to judge whether the danger level of the operation behavior is a subset of the danger level set corresponding to the operation authority of the target authority user; A reduction module, used for reducing or closing the operation authority of the target permission user if the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation authority of the target permission user, and sending an alarm message to the administrator address of the target cloud platform; The device also includes: A first acquisition module is used to acquire multiple samples generated by the operation behavior of the user on the target cloud platform when the danger level of the operation behavior is not a subset of the danger level set corresponding to the operation permission of the target permission user, each sample including at least one feature, a feature value corresponding to each feature, and an identifier indicating whether the digital portrait is accurate; wherein the digital portrait corresponding to each sample is constructed according to the features in the respective samples and the corresponding feature values; A second determination module is used to determine key features for constructing a digital portrait based on the multiple samples and the preset strategy; A second acquisition module is used to acquire the key features and key feature values ​​corresponding to the target authorized user according to the key features of the digital portrait; A construction module, used to construct a digital portrait of the target permission user according to the key features and key feature values ​​corresponding to the target permission user; A third determination module is used to determine the accuracy of each key feature of the target permission user according to the key features of the target permission user and the corresponding relationship between the preset features and the accuracy; The fourth determination module is used to determine the accuracy of the digital portrait according to the accuracy of each key feature of the target authorized user and the preset weight of each key feature.

8. An electronic device, characterized in that: The electronic device includes: a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the shell, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs the program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method for processing high-risk behaviors of target permission users based on the cloud platform as described in any one of the preceding claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for processing high-risk behaviors of target permission users based on the cloud platform as described in any one of claims 1-6.

Images