A network port access control method and system

Abstract

The present invention provides a network port access control method and system, the method dynamically adjusts the access control strategy of the new and old systems according to the system access permission dynamic mapping table generated based on the current user identity data set of the new and old systems and the preset identity authentication rule base combined with the user access pattern set obtained by analyzing the user access pattern according to the port status data flow of the new and old systems, and dynamically adjusts the key business access control rules according to the abnormal access identification results obtained based on the business access characteristics of the business data packet accessed by the system key business data, and after the migration is completed, updates the system access control strategy according to the system strategy adjustment scheme obtained based on the performance data of the new and old systems and the strategy adjustment prediction model. The present invention can perceive the dynamic changes of employee access rights, the differences between the new and old systems, and the access anomalies during the migration process, and adaptively update the system prevention and control strategy, effectively improving the network port security protection capability.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a network port access control method, system, computer equipment and storage medium. Background Art

[0002] With the change of business needs and the upgrading of technology, enterprises will inevitably face the problem of system migration. The coexistence of old and new systems in the process of enterprise system migration will inevitably lead to complex and changeable network topology and access mode. Different employees have different access rights to the old and new systems, which will also be adjusted with the progress of the migration, which will inevitably bring new challenges to the network port security access control of the enterprise system.

[0003] The network port security control of existing enterprise systems usually adopts static network port protection strategies, such as setting fixed access control lists, firewall rules, and disabling non-essential ports. However, this static network port protection strategy is not only difficult to automatically perceive the changes in access port services based on the dynamic changes in employee access rights to perform real-time permission control, but also difficult to apply different protection strategies and rules to different system network ports based on the differences between the old and new systems to ensure the availability and security of each system during the migration. Therefore, it is urgent to provide an intelligent network port access control mechanism that can effectively cope with the coexistence of new and old systems during the enterprise system migration process to ensure the security of network resource access during the enterprise system migration process. Summary of the invention

[0004] The purpose of the present invention is to provide a network port access control method, which uses an intelligent network port protection technology based on the combination of identity authentication and port perception to perceive in real time the dynamic changes and access anomalies of employee access rights and differences between old and new systems during the migration process, and adaptively updates and optimizes the system prevention and control strategy based on change and difference analysis, thereby solving the dynamic access control problem during the system migration process, effectively improving the system network port security protection capability, and achieving a smooth transition between the old and new systems.

[0005] In order to achieve the above objectives, it is necessary to provide a network port access control method and system in response to the above technical problems.

[0006] In a first aspect, an embodiment of the present invention provides a network port access control method, the method comprising the following steps:

[0007] Acquire the current user identity data set of the new system and the old system in real time, and generate a corresponding system access rights dynamic mapping table based on the current user identity data set and a preset identity authentication rule library;

[0008] Monitor the port status data streams of the new system and the old system, and perform user access pattern analysis based on the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes multiple user access patterns of different identities;

[0009] Dynamically adjust the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and perform network port access control of the corresponding system according to the adjusted access control policies;

[0010] Capture business data packets for accessing key business data of the system, extract business access features of the business data packets, identify abnormal business access based on the business access features, and dynamically adjust key business access control rules in the corresponding system access control policy based on the corresponding abnormal access identification results;

[0011] In response to the completion of the system migration, the performance data of the new system and the old system are respectively obtained, the performance data are input into a pre-built policy adjustment prediction model for policy adjustment prediction, and the corresponding system access control policy is updated according to the obtained system policy adjustment solution.

[0012] Furthermore, the preset identity authentication rule base includes identity authentication rules for all system users; the identity authentication rules include multiple identity features and corresponding matching weights;

[0013] The step of generating a corresponding system access rights dynamic mapping table according to the current user identity data set and the preset identity authentication rule library comprises:

[0014] Based on a preset string matching algorithm, each user identity information in the current user identity data set is matched with each identity authentication rule in the preset identity authentication rule library, and a corresponding user identity authentication score is obtained;

[0015] Obtaining user identity information whose user identity authentication score is greater than a preset score threshold, and generating a valid user identity data set;

[0016] Obtaining system identity data corresponding to each user identity information in the valid user identity data set; the system identity data includes system identity ID, department, position and level;

[0017] According to the system identity data, generating corresponding new system permission levels and old system permission levels based on a pre-built decision tree model;

[0018] Generate a corresponding new system function permission list and an old system function permission list according to the new system permission level and the old system permission level respectively;

[0019] The system access permission dynamic mapping table is generated according to the system identity ID, the new system permission level, the new system function permission list, the old system permission level and the old system function permission list corresponding to all user identity information in the valid user identity data set.

[0020] Furthermore, the step of performing user access pattern analysis according to the port status data stream to obtain a corresponding user access pattern set includes:

[0021] By using an exponentially weighted moving average model, the flow characteristics of each network port status data in the port status data stream are extracted to obtain corresponding port flow statistics characteristics; the port flow statistics characteristics include average value, standard deviation and peak value;

[0022] Identify changes in port mapping between the new system and the old system based on port traffic statistics of all network ports in the new system and the old system, so as to update the current new system and old system port function mapping table;

[0023] According to the current new and old system port function mapping table, statistically analyze the historical status data flow of each network port in the new system and the old system to obtain the corresponding system port benchmark flow, and generate the corresponding port flow adaptive threshold based on the 3 Sigma principle according to the system port benchmark flow;

[0024] Respectively determine whether the state data flow of each network port in the new system and the old system is greater than the corresponding system port flow adaptive threshold; if so, determine that the suspicious user behavior identification result of the corresponding system network port is that there is a suspicious user access behavior; otherwise, determine that the suspicious user behavior identification result of the corresponding system network port is that there is no suspicious user access behavior;

[0025] The user access pattern analysis is performed based on the suspicious user behavior identification results of all system network ports to obtain the corresponding user access pattern set.

[0026] Further, the step of identifying the change of the port mapping between the new system and the old system according to the port traffic statistics characteristics of all network ports in the new system and the old system to update the current new and old system port function mapping table includes:

[0027] According to the port traffic statistical characteristics of all network ports in the new system and the old system, the traffic difference analysis is performed on the corresponding network ports between the new system and the old system to obtain the corresponding traffic change information, and according to the network ports whose traffic change information is greater than a preset percentile threshold, a list of ports to be analyzed is generated;

[0028] Performing cluster analysis on the port traffic statistical characteristics of each network port in the port list to be analyzed, and generating a corresponding new and old system port mapping change table;

[0029] According to the new and old system port mapping change table, the current new and old system port function mapping table is updated.

[0030] Furthermore, the step of performing user access pattern analysis based on suspicious user behavior identification results of all system network ports to obtain a corresponding user access pattern set includes:

[0031] When the suspicious user behavior identification result of the system network port is that there is a suspicious user access behavior, a corresponding suspicious access event record is generated; the suspicious access event record includes a timestamp, suspicious type, involved port, duration, and percentage exceeding a threshold;

[0032] Obtaining user identity information sets of network ports corresponding to all suspicious access event records, and performing correlation analysis between the suspicious access event records and the corresponding user identity information sets to generate a mapping relationship between user abnormal access behaviors;

[0033] According to the user abnormal access behavior mapping relationship, the abnormal access behavior features of all associated users are obtained, and the abnormal access behavior features of all associated users are clustered and analyzed to obtain the user access pattern set.

[0034] Furthermore, the step of dynamically adjusting the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table includes:

[0035] According to the system access rights dynamic mapping table, hierarchical clustering analysis is performed on all user access patterns in the user access pattern set to obtain a user access pattern feature vector; the user access pattern feature vector includes access frequency, access time distribution and access resource type;

[0036] According to the user access pattern feature vector, performing K-means clustering on the user access behaviors corresponding to all the user access patterns in the user access pattern set to obtain multiple access behavior groups;

[0037] According to the center points and boundaries of all access behavior groups, the access control policies of the new system and the old system are dynamically adjusted through a preset rule policy generator.

[0038] Furthermore, the step of extracting the service access feature of the service data packet and identifying abnormal service access according to the service access feature includes:

[0039] Perform deep packet inspection and protocol analysis on each service data packet to obtain the corresponding initial service access characteristics; the initial service access characteristics include user ID, timestamp, source IP, destination IP, source port, destination port, protocol type, request method, data volume and response code;

[0040] Based on the principal component analysis method, a dimensionality reduction analysis is performed on the initial service access features to obtain corresponding service access features;

[0041] The business access features are input into the pre-built isolation forest model to identify abnormal business accesses, and the corresponding abnormal access identification results are obtained.

[0042] Furthermore, the strategy adjustment prediction model is obtained through continuous training and updating based on the reinforcement learning model; the state space and action space of the reinforcement learning model are respectively defined according to the system performance data and the corresponding strategy adjustment scheme; and the reward function of the reinforcement learning model is designed according to the preset business continuity indicator.

[0043] Furthermore, before the system migration is completed, the method further includes:

[0044] Continuously detect network topology change information between the new system and the old system, perform real-time network topology reconstruction based on the network topology change information and a pre-built graph convolutional network model, generate a corresponding low-dimensional network topology relationship graph, and adaptively adjust the data transmission routing strategy between the new and old systems based on the low-dimensional network topology relationship graph.

[0045] In a second aspect, an embodiment of the present invention provides a network port access control system, the system comprising:

[0046] The identity permission mapping module is used to obtain the current user identity data set of the new system and the old system in real time, and generate a corresponding system access permission dynamic mapping table according to the current user identity data set and the preset identity authentication rule library;

[0047] An access pattern analysis module, used for monitoring the port status data streams of the new system and the old system, and performing user access pattern analysis according to the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes multiple user access patterns of different identities;

[0048] An access control policy adjustment module, used to dynamically adjust the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and perform network port access control of the corresponding system according to the adjusted access control policy;

[0049] A business access control adjustment module is used to capture business data packets for accessing key business data of the system, extract business access features of the business data packets, identify abnormal business access based on the business access features, and dynamically adjust key business access control rules in the corresponding system access control policy based on the corresponding abnormal access identification results;

[0050] The comprehensive policy optimization module is used to obtain the performance data of the new system and the old system respectively in response to the completion of the system migration, input the performance data into a pre-built policy adjustment prediction model for policy adjustment prediction, and update the corresponding system access control policy according to the obtained system policy adjustment plan.

[0051] The present application provides a network port access control method and system, through which the current user identity data set of the new system and the old system is obtained in real time, a corresponding system access permission dynamic mapping table is generated according to the current user identity data set and a preset identity authentication rule library, the port status data stream of the new system and the old system is monitored, and the user access mode analysis is performed according to the port status data stream to obtain the corresponding user access mode set including user access modes of multiple different identities, and then the access control policy of the new system and the old system is dynamically adjusted according to the user access mode set and the system access permission dynamic mapping table, and the network port access control of the corresponding system is executed according to the adjusted access control policy, and the business data packet of the system key business data access is captured, the business access characteristics of the business data packet are extracted, abnormal business access is identified according to the business access characteristics, and the key business access control rules in the corresponding system access control policy are dynamically adjusted according to the corresponding abnormal access identification results, and in response to the completion of the system migration, the performance data of the new system and the old system are respectively obtained, the performance data is input into a pre-built policy adjustment prediction model for policy adjustment prediction, and the corresponding system access control policy is updated according to the obtained system policy adjustment plan. Technical solution. Compared with the existing technology, this network port access control method, through the intelligent network port protection technology based on the combination of identity authentication and port perception, can perceive in real time the dynamic changes of employee access rights, differences between the old and new systems, and access anomalies during the migration process, and adaptively update and optimize the system prevention and control strategy based on change and difference analysis, thus solving the dynamic access control problem during the system migration process, effectively improving the system network port security protection capability, and achieving a smooth transition between the old and new systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a flow chart of a network port access control method according to an embodiment of the present invention;

[0053] Figure 2 It is a schematic diagram of the structure of a network port access control system in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and beneficial effects of the present application clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Obviously, the embodiments described below are part of the embodiments of the present invention and are only used to illustrate the present invention, but are not used to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] The network port access control method provided by the present invention can be understood as an application defect that the network port security control of the existing enterprise system adopts a static network port protection strategy and cannot automatically perceive the changes in access port services and the differences between the old and new systems based on the dynamic changes in employee access rights, and cannot dynamically adjust the network port protection strategy and rules, making it difficult to ensure the availability and security of each system during the migration. Instead, an intelligent network port protection technology based on identity authentication and port perception is proposed to perceive the dynamic changes and access anomalies of employee access rights, differences between the old and new systems in real time during the migration process, and adaptively update and optimize the system prevention and control strategy based on changes and differences analysis to effectively respond to the coexistence of new and old systems in the enterprise system migration process. Intelligent network port access control mechanism. The following embodiments will explain the network port access control method of the present invention in detail.

[0056] In one embodiment, Figure 1 As shown, a network port access control method is provided, comprising the following steps:

[0057] S11. Obtain the current user identity data set of the new system and the old system in real time, and generate a corresponding system access rights dynamic mapping table based on the current user identity data set and the preset identity authentication rule library; wherein, the current user identity data set of the new system and the old system can be understood as a data set of identity information of employees that the new system and the old system are allowed to access through the existing human resource management system and organizational structure management system of the enterprise, and the specific content of each user identity data can be set according to the actual application, such as including user name, identity ID, email address, mobile phone number, identity type, department, level, position and time of joining the company, etc., which are not specifically limited here. At the same time, due to the different progress of system migration for different regions and / or different businesses, some employees may need to access the new and old systems at the same time, that is, the identity information of some employees will exist in the current user identity data set of both the new system and the old system.

[0058] The preset identity authentication rule library in this embodiment can be understood as an identity matching rule database that is pre-built according to application requirements and is used to authenticate the legitimacy of enterprise employee identity data, including identity authentication rules for all system users, and the identity authentication rules for each system user include multiple identity features and corresponding matching weights, whose identity features can be consistent with the key data of the above-mentioned user identity data according to actual application requirements, such as user name, email address and mobile phone number, etc., and a corresponding matching weight value is set for each identity feature, which is used to calculate the corresponding user identity authentication score during employee identity authentication. Correspondingly, the system access permission dynamic mapping table can be understood as a system function permission list including different user identities in the old and new systems, which is obtained based on the dynamic update of valid identity data obtained from the system user identity data that changes with the progress of system migration in real time. Specifically, the step of generating the corresponding system access permission dynamic mapping table based on the current user identity data set and the preset identity authentication rule library includes:

[0059] Based on a preset string matching algorithm, each user identity information in the current user identity data set is matched with each identity authentication rule in the preset identity authentication rule library, and a corresponding user identity authentication score is obtained; wherein, the preset string matching algorithm may adopt a KMP (Knuth-Morris-Pratt) algorithm, and the corresponding acquisition of each user identity authentication score may be understood as the highest rule matching score obtained by matching the user identity information with each identity authentication rule based on the KMP algorithm; correspondingly, the process of matching the user identity information with each identity authentication rule may be understood as: performing string matching on each data in the user identity information and each identity feature in the identity authentication rule in turn, if a certain data in the user identity information matches a certain identity feature in the identity authentication rule, then multiplying the corresponding preset feature matching score with the matching weight value to obtain the final score of the feature matching, otherwise, the final score of the feature matching is 0; finally, the final scores of all feature matching corresponding to the user identity information are added together to obtain the rule matching score of the user identity information and a certain identity authentication rule.

[0060] Obtain user identity information whose user identity authentication score is greater than a preset score threshold, and generate a valid user identity data set; wherein, the preset score threshold can be selected according to actual application requirements and is not specifically limited here; in actual applications, if the user identity authentication score corresponding to a certain user identity information is greater than the preset score threshold, the user identity information is determined to be valid data, added to the valid user identity data set, and the corresponding system is marked as a new system and / or an old system; in this way, a final valid user identity data set corresponding to the current user identity data sets of the new system and the old system can be obtained.

[0061] Obtaining system identity data corresponding to each user identity information in the valid user identity data set; the system identity data includes system identity ID, department, position and level, which can be extracted from the corresponding user identity information in the valid user identity data set;

[0062] According to the system identity data, the corresponding new system permission level and old system permission level are generated based on the pre-built decision tree model; wherein the input of the decision tree model is the user's system identity data, and the output is the new system permission level and the old system permission level. When the user is only an access user of the new system, the corresponding new system permission level is a valid value and the corresponding old system permission level is an invalid value, that is, the user does not have the permission to access the old system; and when the user is only an access user of the old system, the corresponding old system permission level is a valid value and the corresponding new system permission level is an invalid value, that is, the user does not have the permission to access the new system. The decision tree model in this embodiment can be understood as a model trained based on a collected system historical user identity data set (each user identity data is marked with a corresponding access permission level).

[0063] A corresponding new system function permission list and an old system function permission list are generated according to the new system permission level and the old system permission level respectively; wherein, the new system permission level and the old system permission level both correspond to one of the system permission levels, and in actual applications, both the new system and the old system will set multiple permission levels according to management requirements, and each permission level will correspond to different system function permissions; that is, after obtaining a user's new system permission level, a corresponding new system function permission list can be generated according to the system function permissions corresponding to the level; similarly, after obtaining a user's old system permission level, a corresponding old system function permission list can also be generated according to the system function permissions corresponding to the level; it should be noted that the system function permissions contained in each user's new system function permission list and the old system function permission list vary according to the user level and system management rules, which are not specifically limited here.

[0064] The system access permission dynamic mapping table is generated according to the system identity ID, the new system permission level, the new system function permission list, the old system permission level and the old system function permission list corresponding to all user identity information in the effective user identity data set; wherein each user identity permission mapping relationship in the system access permission dynamic mapping table may include the system identity ID, the new system permission level, the new system function permission list, the old system permission level and the old system function permission list at the same time, and may be stored in a distributed cache in JSON format for real-time query and verification by subsequent access control, and the number of user identity permission mapping relationships and the content of each user identity permission mapping relationship in the system access permission dynamic mapping table will change with the change of the effective user identity data set during the system migration process.

[0065] In this implementation, by real-time synchronization of user identity data between the old and new systems during system migration, the dynamic changes in employee access rights can be effectively perceived, and the system access rights dynamic mapping table can be updated in real time as a basis for adjusting subsequent system access control policies, effectively improving the reliability and security of employee-level prevention and control during system migration.

[0066] S12. Monitor the port status data streams of the new system and the old system, and perform user access pattern analysis based on the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes user access patterns of multiple different identities; wherein the port status data streams of the new system and the old system can be understood as data information of status data streams of multiple network ports at the same time; in actual applications, based on the network architecture information of the new and old systems, distributed probes can be deployed on the network ports of the new and old systems in combination with the use of port traffic collection agents, and the status data streams of each network port in each system can be obtained according to a preset collection frequency based on a network sniffer, which may include port connection status, traffic change data, port number, protocol type, connection duration, data transmission volume, user login logs and operation records and other information.

[0067] The user access pattern analysis in this embodiment can be understood as a process of identifying the user access pattern in the scenario where the new and old systems coexist by monitoring the difference in the real-time port status data streams of the new and old systems; specifically, the step of performing user access pattern analysis according to the port status data stream to obtain a corresponding user access pattern set includes:

[0068] Through the exponentially weighted moving average model, the traffic characteristics of each network port status data in the port status data stream are extracted to obtain the corresponding port traffic statistical characteristics; wherein, the traffic characteristic extraction process of each network port status data can be understood as merging the currently collected network port status data with the historical network port status data of multiple cycles of the corresponding cache into the corresponding port status data stream timing data, and then performing time series analysis on the port status data stream timing data based on the exponentially weighted moving average model to obtain the required port traffic statistical characteristics, and this embodiment preferably sets the port traffic statistical characteristics to include the mean value, standard deviation and peak value.

[0069] According to the port traffic statistics characteristics of all network ports in the new system and the old system, the port mapping changes between the new and old systems are identified to update the current port function mapping table of the new and old systems; wherein, the port mapping changes between the new and old systems can be understood as the perception of the changes in the network port mapping relationship between the new system and the old system, and the basis of this identification is that when the system is migrated, there is an existing network port mapping relationship table between the new system and the old system (obtained by gradual updates based on the initial network port mapping relationship table), and the existing network port mapping relationship table is used as a basis for judging whether there will be changes in the network port mapping between the new and old systems during the system migration process, and the existing network port mapping relationship table (the current port function mapping table of the new and old systems) is updated based on the identified changes. Specifically, the steps of identifying the port mapping changes between the new and old systems according to the port traffic statistics characteristics of all network ports in the new system and the old system to update the current port function mapping table of the new and old systems include:

[0070] According to the port traffic statistical characteristics of all network ports in the new system and the old system, the corresponding network ports between the new system and the old system are respectively analyzed for traffic difference to obtain corresponding traffic change information, and a list of ports to be analyzed is generated according to the network ports whose traffic change information is greater than a preset percentile threshold; wherein, the traffic difference analysis can be understood as a process of performing traffic comparison analysis on the network ports in the new and old systems according to the port mapping relationship in the current new and old system port function mapping table to obtain the traffic difference (traffic change information) between the new system network ports and the old system network ports with a port mapping relationship; in principle, the traffic data of the network ports of the same service during the system migration process should not differ much. If the traffic data between the two network ports with a mapping relationship differs too much, it will be considered that there is an abnormality, or there is a mismatch between the network ports of the same service in the new and old systems. In this case, such port statistics need to be included in the list of ports to be analyzed for further analysis to ensure the reliability of subsequent user access pattern analysis. It should be noted that the preset percentile threshold in this embodiment can be understood as a threshold generated by a dynamic threshold function based on the percentile. For example, the 95% percentile can be used as the dynamic threshold to identify new and old system network port pairs with traffic differences exceeding 50%, and summarize them to obtain the required port list to be analyzed.

[0071] A cluster analysis is performed on the port traffic statistical characteristics of each network port in the port list to be analyzed to generate a corresponding new and old system port mapping change table; wherein, the process of obtaining the new and old system port mapping change table can be understood as first determining the number of clusters according to the number of categories of the enterprise system's network service predefined function ports (such as HTTP, HTTPS, database access and file transfer, etc.), and then performing K-means clustering analysis on the port traffic statistical characteristics of all network ports in the port list to be analyzed according to the number of clusters to obtain multiple network port clustering clusters, and then calculating the inter-cluster distance and intra-cluster distance of each network port clustering cluster based on the Euclidean distance, identifying the changes in the port function mapping relationship between the new and old systems, and then generating the new and old system port mapping change table.

[0072] According to the new and old system port mapping change table, the current new and old system port function mapping table is updated; wherein, the new and old system port mapping change table, as described above, only includes part of the port mapping relationship in the new and old system port function mapping table, and accordingly, the incorrect part of the port mapping relationship in the current new and old system port function mapping table is corrected, and an effective new and old system port function mapping table can be obtained to provide a reliable analysis basis for subsequent port traffic status analysis.

[0073] According to the current new and old system port function mapping table, the historical status data flow of each network port in the new system and the old system is statistically analyzed to obtain the corresponding system port benchmark flow, and according to the system port benchmark flow, the corresponding port flow adaptive threshold is generated based on the 3 sigma principle; wherein, the process of obtaining the system port benchmark flow can be understood as calculating the average value of the historical status data flow of the network port pair with a mapping relationship in the new and old systems according to the network port mapping relationship between the new and old systems in the current new and old system port function mapping table, and using it as the system port benchmark flow of the two network ports in the network port pair at the same time; the corresponding port flow adaptive threshold is also the flow anomaly detection threshold of the two network ports in the network port pair with a mapping relationship in the new and old systems; in this embodiment, the historical status data flow of the network port pair with a mapping relationship in the new and old systems is used as the system port benchmark flow, and the system port benchmark flow is used as the benchmark, and the adaptive threshold is generated by the 3 sigma principle to effectively ensure the reliability of the corresponding business service port flow analysis of the new and old systems. It should be noted that in order to ensure continuous adaptability to the differences between the new and old systems, the current new and old system port function mapping table can also be updated regularly, and the corresponding port traffic adaptive threshold can be generated according to the updated current new and old system port function mapping table, which will not be described in detail here.

[0074] Determine respectively whether the status data flow of each network port in the new system and the old system is greater than the corresponding system port traffic adaptive threshold; if so, determine the suspicious user behavior identification result of the corresponding system network port to be the presence of suspicious user access behavior; otherwise, determine the suspicious user behavior identification result of the corresponding system network port to be the absence of suspicious user access behavior; wherein, suspicious user access behavior can be understood as special port access behavior occurring during the system migration transition period; in order to ensure the security of port resource access during system migration while not affecting normal system business processing requirements, this embodiment preferably adopts the following steps to perform user access pattern recognition analysis during the coexistence of the new and old systems based on the suspicious user behavior identification results of all system network ports.

[0075] Performing user access pattern analysis based on suspicious user behavior identification results of all system network ports to obtain a corresponding user access pattern set; wherein the user access pattern analysis can be understood as a process of identifying all system network ports with suspicious user behavior identification results as having suspicious user access behaviors, performing user identity association analysis, and classifying user access patterns based on abnormal access behavior characteristics of associated users determined according to the association analysis; specifically, the steps of performing user access pattern analysis based on suspicious user behavior identification results of all system network ports to obtain a corresponding user access pattern set include:

[0076] When the suspicious user behavior identification result of the system network port is that there is suspicious user access behavior, a corresponding suspicious access event record is generated; the suspicious access event record includes a timestamp, suspicious type, involved ports, duration and percentage exceeding the threshold, and the suspicious type can be determined according to actual conditions. The corresponding percentage exceeding the threshold can be calculated based on the network port status data flow and the system port traffic adaptive threshold when the suspicious user behavior identification result is generated, which will not be described in detail here.

[0077] Obtain user identity information sets of network ports corresponding to all suspicious access event records, and perform correlation analysis on the suspicious access event records and the corresponding user identity information sets to generate a mapping relationship between abnormal user access behaviors; wherein, the process of obtaining the user identity information set can be understood as first obtaining the status data stream of the port involved in each suspicious access event record, and then obtaining the corresponding user system identity data according to the port access user identity ID recorded in the user login log information in each port status data stream, and finally aggregating all the obtained user system identity data to obtain the required user identity information set; correspondingly, the mapping relationship between abnormal user access behaviors can be understood as the association rules between user identity and abnormal behavior mined by performing correlation analysis on each suspicious access event record and the corresponding user identity information set using the Apriori algorithm. The specific implementation method can refer to the Apriori algorithm application technology, which will not be described in detail here.

[0078] According to the mapping relationship of the user's abnormal access behavior, the abnormal access behavior characteristics of all associated users are obtained, and the abnormal access behavior characteristics of all associated users are clustered and analyzed to obtain the user access pattern set; wherein the abnormal access behavior characteristics include access frequency, data transmission volume and access time distribution; the corresponding clustering analysis can be implemented by using the K-means algorithm, and the optimal clustering result is selected by evaluating the clustering quality based on the silhouette coefficient to generate a typical access pattern set of users during system migration, which is used to optimize and adjust the current access control policies of the new and old systems, so as to facilitate real-time comparison and analysis of the new access behavior of the system to improve the accuracy of anomaly detection.

[0079] S13, dynamically adjusting the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and performing network port access control of the corresponding system according to the adjusted access control policies; wherein the access control policies preferably include access time restrictions, resource usage quotas, and operation authority levels, etc.; specifically, the step of dynamically adjusting the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table includes:

[0080] According to the system access permission dynamic mapping table, a hierarchical clustering analysis is performed on all user access patterns in the user access pattern set to obtain a user access pattern feature vector; wherein, the hierarchical clustering analysis can be understood as a bottom-up agglomeration method, based on the user identity information of each user access pattern in the user access pattern set corresponding to the user identity permission mapping relationship in the system access permission dynamic mapping table, the user access pattern is gradually merged into the closest clusters based on the Euclidean distance until a preset number of access pattern clusters are obtained; after obtaining multiple access pattern clusters, access modal features are extracted for each access pattern cluster respectively, so as to obtain the required user access pattern feature vector, including access frequency, access time distribution and access resource type, etc., and the access frequency can be extracted based on the collected relevant time series data using fast Fourier transform, the time distribution feature can be understood as the feature formed by dividing the duration of the relevant time series into multiple time periods and counting the number of user accesses in each time period, and the access resource type can be represented by a binary vector obtained based on one-hot encoding conversion.

[0081] According to the user access pattern feature vector, the user access behaviors corresponding to all user access patterns in the user access pattern set are K-means clustered to obtain multiple access behavior groups; wherein, the method for obtaining the access behavior groups can be implemented by referring to the application technology of the relevant K-means clustering algorithm, which will not be repeated here.

[0082] According to the center points and boundaries of all access behavior groups, the access control policies of the new system and the old system are dynamically adjusted through the preset rule policy generator; wherein, the preset rule policy generator can be understood as a rule-based policy generator, and the if-then rules in the policy generator can be pre-set according to application requirements, and are not specifically limited here; in actual applications, the center points and boundaries of each access behavior group can be used as input to the preset rule policy generator, and the resource access control policies of the new system and / or the old system that need to be adjusted can be obtained through rule condition analysis in the preset rule policy generator, such as increasing the resource usage quota of the high-frequency access group by 20%.

[0083] It should be noted that the specific adjustment content of the access control strategy of the above-mentioned new and old systems can be obtained based on the analysis of actual application scenarios. In actual applications, in order to make real-time adaptive adjustments to the system access control strategy based on the changes in user access patterns during system migration, the exponentially weighted moving window algorithm can also be used to monitor the changes in user access patterns in real time, and calculate the Euclidean distance between each user's access behavior and the center point of the corresponding access behavior group. If the Euclidean distance exceeds the preset dynamic threshold, the user access pattern reclassification process is triggered; at the same time, for users whose access patterns change frequently, the back propagation algorithm combined with the cross entropy loss function can be used to continuously optimize and update the network parameters of the recurrent neural network including the input layer, hidden layer and output layer to obtain a continuously optimized access control strategy model, which is used to perform time series feature analysis on the user's historical access behavior sequence, and output the corresponding user authority allocation rules and abnormality judgment criteria, so as to improve the access control adaptive capability for the system migration transition period, so as to better cope with the characteristic conditions of the system migration transition period.

[0084] S14, capturing the business data packets accessing the key business data of the system, extracting the business access features of the business data packets, identifying abnormal business access according to the business access features, and dynamically adjusting the key business access control rules in the corresponding system access control policy according to the corresponding abnormal access identification results; wherein, the key business data access of the system can be determined according to the actual enterprise business, which is not specifically limited here; the corresponding business data packets can be understood as the network data packets involved in the key business data access process of the system, which can be captured and stored through the FPGA hardware acceleration deployed on the network port; the key business access control rules in this embodiment can be understood as the business resource data access rules formulated for various key business data access requirements; specifically, the steps of extracting the business access features of the business data packets and identifying abnormal business access according to the business access features include:

[0085] Perform deep packet inspection and protocol analysis on each business data packet to obtain the corresponding initial business access features; deep packet inspection can be understood as DPI (deep packet inspection) technology based on application layer traffic detection and control; protocol analysis can be understood as the process of identifying the application layer protocol type through a state machine-based protocol parser, extracting key fields such as HTTP header information, SQL statements and DNS queries, and restoring the complete business access process in combination with TCP reassembly technology, generating structured network traffic logs, and then constructing multi-dimensional business access features based on network traffic logs; the corresponding initial business access features include user ID, timestamp, source IP, destination IP, source port, destination port, protocol type, request method, data volume and response code, etc.

[0086] Based on the principal component analysis method, the initial business access features are subjected to dimensionality reduction analysis to obtain corresponding business access features; wherein the business access features can be understood as low-dimensional feature representations obtained by reducing the dimensionality of the initial business access features in order to ensure the high efficiency of subsequent abnormal access identification. The specific acquisition method can refer to the related existing technology implementation of dimensionality reduction analysis based on principal component analysis (Principal Component Analysis, PCA), which will not be repeated here.

[0087] The business access features are input into a pre-built isolation forest model to identify abnormal business accesses, and corresponding abnormal access identification results are obtained.

[0088] In practical applications, after obtaining the abnormal access identification results through the above method steps, the access control rules of the corresponding business can be dynamically adjusted based on the identification results and forward chain reasoning according to the rule-based expert system to achieve refined access control and security protection at the business service level.

[0089] S15. In response to the completion of system migration, the performance data of the new system and the old system are obtained respectively, and the performance data is input into the pre-built policy adjustment prediction model for policy adjustment prediction, and the corresponding system access control policy is updated according to the obtained system policy adjustment scheme; wherein, the performance data includes CPU utilization, memory usage and request response time, etc., which can be determined according to the actual application requirements; the corresponding policy adjustment prediction model can in principle adopt any network model that can generate a policy adjustment scheme function based on performance data, but in order to ensure the real-time and reliability of system policy adjustment, this embodiment preferably uses a reinforcement learning algorithm to establish a policy adjustment prediction model model that balances system performance and security, so as to dynamically adjust the protection strategy of the new and old systems according to the business continuity requirements, and adaptively balance the security protection and performance requirements of the new and old systems. Specifically, the policy adjustment prediction model is obtained based on the continuous training and updating of the reinforcement learning model; the state space and action space of the reinforcement learning model are respectively defined according to the system performance data and the corresponding policy adjustment scheme; the reward function of the reinforcement learning model is designed according to the preset business continuity index.

[0090] In practical applications, the application process of the strategy adjustment prediction model can be understood as follows: by deploying a distributed monitoring agent based on Prometheus, the performance indicator data of the new and old systems are regularly obtained according to the required collection frequency; after data cleaning and normalization, the data is transmitted to the InfluxDB time series database in real time for storage to obtain the preprocessed performance indicator data set; based on the preprocessed performance indicator data set, a multidimensional feature vector including information such as CPU utilization curve, memory usage trend and average response time is constructed, and the principal component analysis algorithm is used to reduce the feature dimension of the multidimensional feature vector to obtain a low-dimensional representation reflecting the system performance status; then, a Q-le is established based on the low-dimensional representation arning model, in which the low-dimensional representation is used as the environmental state in the reinforcement learning model, and the protection strategy adjustment plan is used as the action space in the reinforcement learning model. The business continuity index (defined as the weighted sum of the normal request processing rate and the average response time, for example, the reward function R=0.7*normal request processing rate+0.3*(1 / average response time)) is used as the reward function for iterative optimization learning. If the Q-learning model reaches the convergence condition, the protection strategy adjustment plan is output; based on the protection strategy adjustment plan, the access control rules of the new and old systems are updated through the Drools rule engine, and the rule engine maintains independent Q tables and rule sets for the new and old systems to achieve balanced adaptation of the new and old systems.

[0091] The present embodiment provides a method for obtaining the current user identity data set of the new system and the old system in real time, generating a corresponding system access permission dynamic mapping table according to the current user identity data set and a preset identity authentication rule library, monitoring the port status data stream of the new system and the old system, performing user access pattern analysis according to the port status data stream to obtain a corresponding user access pattern set including user access patterns of multiple different identities, dynamically adjusting the access control policy of the new system and the old system according to the user access pattern set and the system access permission dynamic mapping table, executing network port access control of the corresponding system according to the adjusted access control policy, capturing business data packets for access to key business data of the system, extracting business access features of the business data packets, identifying abnormal business access according to the business access features, and The key business access control rules in the corresponding system access control policy are dynamically adjusted based on the frequently accessed identification results. In response to the completion of the system migration, the performance data of the new system and the old system are respectively obtained, and the performance data is input into the pre-built policy adjustment prediction model for policy adjustment prediction. The intelligent network port control mechanism of the corresponding system access control policy is updated according to the obtained system policy adjustment plan. Through the intelligent network port protection technology based on the combination of identity authentication and port perception, the dynamic changes of employee access rights, differences between the old and new systems, and access anomalies during the migration process are perceived in real time, and the system prevention and control strategy is adaptively updated and optimized based on the change and difference analysis, which solves the dynamic access control problem during the system migration process, effectively improves the system network port security protection capability, and realizes a smooth transition between the old and new systems.

[0092] In addition, considering that in actual applications, there may be different migration progress in different regions and different business lines, and some employees need to access the old and new systems at the same time, in order to ensure the continuity of system business, this embodiment preferably detects the network topology change information between the old and new systems in real time during the migration process, and adjusts the data transmission route between the old and new systems in a timely manner based on the network topology change information, so as to ensure that abnormal cross-system access behavior can be effectively monitored and responded to, and the system migration can be gradually completed while ensuring compliance. Specifically, a network port access control method is provided, and before the system migration is completed, the method also includes:

[0093] Continuously detect network topology change information between the new system and the old system, reconstruct the network topology in real time according to the network topology change information and a pre-built graph convolutional network model, generate a corresponding low-dimensional network topology relationship diagram, and adaptively adjust the data transmission routing strategy between the new and old systems according to the low-dimensional network topology relationship diagram; wherein, the network topology change information can be understood as a network detection tool using the SNMP protocol continuously acquiring SNMP protocol data packets carrying the unique identifier of the network device during the system migration process, which is sent by the network device when a topology change occurs, so as to perceive data information such as the increase and decrease of nodes, link status, and bandwidth changes between the new and old systems.

[0094] In practical applications, by deploying a network topology discovery tool that is compatible with both the old and new system architectures, the network equipment and link information of the two systems (including parameters such as device IP address, interface status, and bandwidth utilization) is periodically detected. According to the historical detection data stored in the time series database, the longest common subsequence algorithm is used to identify and record the dynamic changes of the network topology structure during the system migration process. In order to identify and record the dynamic changes of the network topology structure during the system migration process, an incremental data set reflecting the topology changes is generated, and it is converted into an adjacency matrix of the network topology through data preprocessing. The adjacency matrix includes node feature vectors and corresponding edge feature vectors, and the node feature vector includes device type, processing power, and memory size, and the edge feature vector includes bandwidth, delay, and packet loss rate. Then, a graph convolutional network model pre-trained and constructed based on relevant historical data is used to perform element encoding processing on the adjacency matrix to realize topological reconstruction of the real-time network between the new and old systems, and obtain a low-dimensional topological relationship graph (low-dimensional network topological relationship graph) that can reflect the current differences between the new and old systems. The network structure of the graph convolutional network model includes 3 layers, with 64 neurons in each layer. The ReLU activation function is used, and the embedding representation of the node is updated by weighted average aggregation of neighbor node information and edge attributes to form a topological relationship diagram that reflects the difference between the current new and old systems. Then, the low-dimensional network topological relationship diagram obtained by the graph convolutional network model and the monitored current system network load are used as state data input. Based on the historical system network topology change data and the system historical network performance data, the routing decision model constructed by Q-learning algorithm training is used to perform optimal iterative learning of the data transmission routing strategy, and the optimal data transmission route between systems suitable for the current system migration scenario is output. The optimal data transmission route between systems is applied to the corresponding network devices through relevant network configuration management tools to adaptively and dynamically adjust the data transmission routing strategy between the new and old systems. For example, after the routing optimization is triggered, the optimal action can be output according to the routing decision model, which is converted into a specific routing table update instruction through a predefined mapping relationship, such as "iproute192.168.1.0 / 24via10.0.0.1", and the instruction is sent to the network device for execution through the NETCONF protocol. It should be noted that when the Q-learning algorithm is used to train the routing decision model, the state space is the current network load and topology, the action space is the optional routing path, and the reward function is designed based on end-to-end delay and throughput. It can adaptively adjust the data transmission routing strategy according to the current network status and related performance data, and dynamically adapt to changes in network topology during system migration.

[0095] It should be noted that the above-mentioned step of adjusting the data transmission routing strategy between the new and old systems may be triggered in real time or periodically during the entire system migration period, which is not specifically limited here.

[0096] The embodiment of the present application obtains the current user identity data set of the new system and the old system in real time, generates a corresponding system access permission dynamic mapping table according to the current user identity data set and a preset identity authentication rule library, monitors the port status data stream of the new system and the old system, performs user access mode analysis according to the port status data stream to obtain a corresponding user access mode set including user access modes of multiple different identities, dynamically adjusts the access control policy of the new system and the old system according to the user access mode set and the system access permission dynamic mapping table, executes network port access control of the corresponding system according to the adjusted access control policy, captures business data packets for access to key business data of the system, extracts business access features of the business data packets, identifies abnormal business access according to the business access features, dynamically adjusts the key business access control rules in the corresponding system access control policy according to the corresponding abnormal access identification results, and continuously detects network topology change information between the new system and the old system, performs real-time network topology reconstruction according to the network topology change information and a pre-built graph convolutional network model, generates a corresponding low-dimensional network topology relationship graph, adaptively adjusts the data transmission routing strategy between the new and old systems according to the low-dimensional network topology relationship graph, and After the system migration is completed, the performance data of the new system and the old system are obtained respectively, and the performance data is input into the pre-built policy adjustment prediction model for policy adjustment prediction, and the corresponding system access control policy is updated according to the obtained system policy adjustment plan, which effectively solves the application defects that the network port security prevention and control of the existing enterprise system adopts static network port protection strategy, which cannot automatically perceive the changes in access port services and the differences between the new and old systems based on the dynamic changes of employee access rights, and cannot dynamically adjust the network port protection strategy and rules, and it is difficult to ensure the availability and security of each system during the migration. Through the intelligent network port protection technology based on identity authentication, port perception and network topology change monitoring, the dynamic changes of employee access rights, the differences between the new and old systems, the changes in network topology between the new and old systems, and the abnormal user access behavior during the migration process are perceived in real time, and the system prevention and control strategy is adaptively updated and optimized based on the corresponding changes and differences. The refined dynamic optimization access control of the network port during the system migration process is realized, which effectively improves the system network port security protection capability, and can also meet the system performance requirements and ensure the continuity of the system business, thereby providing reliable technical support for the smooth transition between the new and old systems.

[0097] It should be noted that although the steps in the above flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0098] In one embodiment, Figure 2As shown, a network port access control system is provided, the system comprising:

[0099] The identity authority mapping module 1 is used to obtain the current user identity data set of the new system and the old system in real time, and generate a corresponding system access authority dynamic mapping table according to the current user identity data set and the preset identity authentication rule library;

[0100] Access pattern analysis module 2, used for monitoring the port status data streams of the new system and the old system, and performing user access pattern analysis according to the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes multiple user access patterns of different identities;

[0101] An access control policy adjustment module 3 is used to dynamically adjust the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and perform network port access control of the corresponding system according to the adjusted access control policy;

[0102] The business access control adjustment module 4 is used to capture the business data packets of the system key business data access, extract the business access characteristics of the business data packets, identify abnormal business access according to the business access characteristics, and dynamically adjust the key business access control rules in the corresponding system access control policy according to the corresponding abnormal access identification results;

[0103] The comprehensive policy optimization module 5 is used to obtain the performance data of the new system and the old system respectively in response to the completion of system migration, input the performance data into a pre-built policy adjustment prediction model for policy adjustment prediction, and update the corresponding system access control policy according to the obtained system policy adjustment plan.

[0104] In one embodiment, a network port access control system is provided, the system further comprising:

[0105] The routing strategy update module is used to continuously detect the network topology change information between the new system and the old system, perform real-time network topology reconstruction based on the network topology change information and a pre-built graph convolutional network model, generate a corresponding low-dimensional network topology relationship graph, and adaptively adjust the data transmission routing strategy between the new and old systems based on the low-dimensional network topology relationship graph.

[0106] For the specific definition of the network port access control system, please refer to the definition of the network port access control method above, and the corresponding technical effects can also be obtained equivalently, which will not be repeated here. Each module in the above-mentioned network port access control system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0107] In summary, an embodiment of the present invention provides a network port access control method and system, wherein the network port access control method realizes real-time acquisition of current user identity data sets of the new system and the old system, generates a corresponding system access permission dynamic mapping table according to the current user identity data sets and a preset identity authentication rule library, monitors the port status data streams of the new system and the old system, performs user access pattern analysis according to the port status data streams to obtain a corresponding user access pattern set including user access patterns of multiple different identities, dynamically adjusts the access control policy of the new system and the old system according to the user access pattern set and the system access permission dynamic mapping table, executes network port access control of the corresponding system according to the adjusted access control policy, captures business data packets for access to key business data of the system, extracts business access features of the business data packets, identifies abnormal business access according to the business access features, dynamically adjusts the key business access control rules in the corresponding system access control policy according to the corresponding abnormal access identification results, and continuously detects network topology change information between the new system and the old system, and detects the network topology change information and the system according to the network topology change information and the system access permission dynamic mapping table. A pre-built graph convolutional network model is used to reconstruct the network topology in real time, and a corresponding low-dimensional network topology relationship graph is generated. The data transmission routing strategy between the new and old systems is adaptively adjusted according to the low-dimensional network topology relationship graph. After the system migration is completed, the performance data of the new system and the old system are obtained respectively, and the performance data is input into the pre-built policy adjustment prediction model for policy adjustment prediction. The corresponding system access control policy is updated according to the obtained system policy adjustment plan. The method uses intelligent network port protection technology based on identity authentication, port perception and network topology change monitoring to perceive the dynamic changes of employee access rights, differences between the new and old systems, network topology changes between the new and old systems, and abnormal user access behaviors during the migration process in real time, and adaptively updates and optimizes the system prevention and control strategy based on the corresponding changes and difference analysis, so as to realize refined dynamic optimization access control of network ports during the system migration process, effectively improve the security protection capability of the system network ports, meet the performance requirements of the system and ensure the continuity of the system business, thereby providing reliable technical support for the smooth transition between the new and old systems.

[0108] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A network port access control method, characterized in that: The method comprises the following steps: Acquire the current user identity data sets of the new system and the old system in real time, and generate a corresponding system access rights dynamic mapping table based on the current user identity data sets and a preset identity authentication rule base; the preset identity authentication rule base includes identity authentication rules for all system users; the identity authentication rules include multiple identity features and corresponding matching weights; Monitor the port status data streams of the new system and the old system, and perform user access pattern analysis based on the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes multiple user access patterns of different identities; Dynamically adjust the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and perform network port access control of the corresponding system according to the adjusted access control policies; Capture business data packets for accessing key business data of the system, extract business access features of the business data packets, identify abnormal business access based on the business access features, and dynamically adjust key business access control rules in the corresponding system access control policy based on the corresponding abnormal access identification results; In response to the completion of the system migration, respectively obtaining performance data of the new system and the old system, inputting the performance data into a pre-built policy adjustment prediction model to perform policy adjustment prediction, and updating the corresponding system access control policy according to the obtained system policy adjustment solution; The step of generating a corresponding system access rights dynamic mapping table according to the current user identity data set and the preset identity authentication rule base includes: Based on a preset string matching algorithm, each user identity information in the current user identity data set is matched with each identity authentication rule in the preset identity authentication rule library, and a corresponding user identity authentication score is obtained; Obtaining user identity information whose user identity authentication score is greater than a preset score threshold, and generating a valid user identity data set; Obtaining system identity data corresponding to each user identity information in the valid user identity data set; the system identity data includes system identity ID, department, position and level; According to the system identity data, generating corresponding new system permission levels and old system permission levels based on a pre-built decision tree model; Generate a corresponding new system function permission list and an old system function permission list according to the new system permission level and the old system permission level respectively; The system access permission dynamic mapping table is generated according to the system identity ID, the new system permission level, the new system function permission list, the old system permission level and the old system function permission list corresponding to all user identity information in the valid user identity data set.

2. The network port access control method according to claim 1, characterized in that: The step of performing user access pattern analysis according to the port status data stream to obtain a corresponding user access pattern set comprises: By using an exponentially weighted moving average model, the flow characteristics of each network port status data in the port status data stream are extracted to obtain corresponding port flow statistics characteristics; the port flow statistics characteristics include average value, standard deviation and peak value; Identify changes in port mapping between the new system and the old system based on port traffic statistics of all network ports in the new system and the old system, so as to update the current new system and old system port function mapping table; According to the current new and old system port function mapping table, statistically analyze the historical status data flow of each network port in the new system and the old system to obtain the corresponding system port benchmark flow, and generate the corresponding port flow adaptive threshold based on the 3 Sigma principle according to the system port benchmark flow; Respectively determine whether the state data flow of each network port in the new system and the old system is greater than the corresponding system port flow adaptive threshold; if so, determine that the suspicious user behavior identification result of the corresponding system network port is that there is a suspicious user access behavior; otherwise, determine that the suspicious user behavior identification result of the corresponding system network port is that there is no suspicious user access behavior; The user access pattern analysis is performed based on the suspicious user behavior identification results of all system network ports to obtain the corresponding user access pattern set.

3. The network port access control method according to claim 2, characterized in that: The step of identifying the change of the port mapping between the new system and the old system according to the port traffic statistics characteristics of all network ports in the new system and the old system to update the current new and old system port function mapping table includes: According to the port traffic statistical characteristics of all network ports in the new system and the old system, the traffic difference analysis is performed on the corresponding network ports between the new system and the old system to obtain the corresponding traffic change information, and according to the network ports whose traffic change information is greater than a preset percentile threshold, a list of ports to be analyzed is generated; Performing cluster analysis on the port traffic statistical characteristics of each network port in the port list to be analyzed, and generating a corresponding new and old system port mapping change table; According to the new and old system port mapping change table, the current new and old system port function mapping table is updated.

4. The network port access control method according to claim 2, characterized in that: The step of performing user access pattern analysis based on suspicious user behavior identification results of all system network ports to obtain a corresponding user access pattern set includes: When the suspicious user behavior identification result of the system network port is that there is a suspicious user access behavior, a corresponding suspicious access event record is generated; the suspicious access event record includes a timestamp, suspicious type, involved port, duration, and percentage exceeding a threshold; Obtaining user identity information sets of network ports corresponding to all suspicious access event records, and performing correlation analysis between the suspicious access event records and the corresponding user identity information sets to generate a mapping relationship between user abnormal access behaviors; According to the user abnormal access behavior mapping relationship, the abnormal access behavior features of all associated users are obtained, and the abnormal access behavior features of all associated users are clustered and analyzed to obtain the user access pattern set.

5. The network port access control method according to claim 1, characterized in that: The step of dynamically adjusting the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table comprises: According to the system access rights dynamic mapping table, hierarchical clustering analysis is performed on all user access patterns in the user access pattern set to obtain a user access pattern feature vector; the user access pattern feature vector includes access frequency, access time distribution and access resource type; According to the user access pattern feature vector, performing K-means clustering on the user access behaviors corresponding to all the user access patterns in the user access pattern set to obtain multiple access behavior groups; According to the center points and boundaries of all access behavior groups, the access control policies of the new system and the old system are dynamically adjusted through a preset rule policy generator.

6. The network port access control method according to claim 1, characterized in that: The step of extracting the service access feature of the service data packet and identifying abnormal service access according to the service access feature comprises: Perform deep packet inspection and protocol analysis on each service data packet to obtain the corresponding initial service access characteristics; the initial service access characteristics include user ID, timestamp, source IP, destination IP, source port, destination port, protocol type, request method, data volume and response code; Based on the principal component analysis method, a dimensionality reduction analysis is performed on the initial service access features to obtain corresponding service access features; The business access features are input into a pre-built isolation forest model to identify abnormal business accesses, and corresponding abnormal access identification results are obtained.

7. The network port access control method according to claim 1, characterized in that: The strategy adjustment prediction model is obtained through continuous training and updating based on the reinforcement learning model; the state space and action space of the reinforcement learning model are respectively defined based on system performance data and corresponding strategy adjustment schemes; and the reward function of the reinforcement learning model is designed based on preset business continuity indicators.

8. The network port access control method according to claim 1, characterized in that: Before the system migration is completed, the method further includes: Continuously detect network topology change information between the new system and the old system, perform real-time network topology reconstruction based on the network topology change information and a pre-built graph convolutional network model, generate a corresponding low-dimensional network topology relationship graph, and adaptively adjust the data transmission routing strategy between the new and old systems based on the low-dimensional network topology relationship graph.

9. A network port access control system, characterized in that: The system comprises: The identity permission mapping module is used to obtain the current user identity data set of the new system and the old system in real time, and generate a corresponding system access permission dynamic mapping table according to the current user identity data set and a preset identity authentication rule base; the preset identity authentication rule base includes identity authentication rules for all system users; the identity authentication rules include multiple identity features and corresponding matching weights; An access pattern analysis module, used for monitoring the port status data streams of the new system and the old system, and performing user access pattern analysis according to the port status data streams to obtain a corresponding user access pattern set; the user access pattern set includes multiple user access patterns of different identities; An access control policy adjustment module, used to dynamically adjust the access control policies of the new system and the old system according to the user access mode set and the system access rights dynamic mapping table, and perform network port access control of the corresponding system according to the adjusted access control policy; A business access control adjustment module is used to capture business data packets for accessing key business data of the system, extract business access features of the business data packets, identify abnormal business access based on the business access features, and dynamically adjust key business access control rules in the corresponding system access control policy based on the corresponding abnormal access identification results; A comprehensive policy optimization module, for obtaining performance data of the new system and the old system respectively in response to the completion of system migration, inputting the performance data into a pre-built policy adjustment prediction model for policy adjustment prediction, and updating the corresponding system access control policy according to the obtained system policy adjustment plan; The step of generating a corresponding system access rights dynamic mapping table according to the current user identity data set and the preset identity authentication rule base includes: Based on a preset string matching algorithm, each user identity information in the current user identity data set is matched with each identity authentication rule in the preset identity authentication rule library, and a corresponding user identity authentication score is obtained; Obtaining user identity information whose user identity authentication score is greater than a preset score threshold, and generating a valid user identity data set; Obtaining system identity data corresponding to each user identity information in the valid user identity data set; the system identity data includes system identity ID, department, position and level; According to the system identity data, generating corresponding new system permission levels and old system permission levels based on a pre-built decision tree model; Generate a corresponding new system function permission list and an old system function permission list according to the new system permission level and the old system permission level respectively; The system access permission dynamic mapping table is generated according to the system identity ID, the new system permission level, the new system function permission list, the old system permission level and the old system function permission list corresponding to all user identity information in the valid user identity data set.

Images