An adaptive determination method for control decisions for user access

Abstract

This invention discloses an adaptive method for determining control decisions for user access, relating to the field of information security technology. The invention first receives an access request carrying user access context information, which includes at least one information category from the user's access behavior, network environment, and device status. Then, the user access context information is classified to obtain preliminary rule clusters corresponding to each information category. For each preliminary rule cluster, an inductive logic programming algorithm is used to extract access control rules from the preliminary rule cluster to obtain the corresponding final rule cluster. Finally, D-S evidence theory is applied to determine the support degree of each control decision for the corresponding final rule cluster for different information categories of user access context information and integrates them to determine the final control decision. This invention improves the flexibility and accuracy of control decisions for user access and enhances service security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an adaptive determination method for control decisions regarding user access. Background Technology

[0002] In recent years, data access control has become a crucial component of information security. With the explosive growth of data volume and the diversification of data types, traditional access control methods are increasingly unable to meet complex business needs. In fields such as finance, healthcare, and the Internet of Things (IoT), the requirements for data real-time performance and sensitivity are even higher, making extended control decisions increasingly critical to ensure effective management and protection of data access in dynamic environments. Furthermore, facing constantly evolving cyber threats and compliance requirements, enterprises urgently need more flexible and intelligent access control mechanisms to protect their core data assets.

[0003] Traditional access control methods typically rely on static rules and predefined policies, such as Access Control Lists (ACLs), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC). While effective in specific environments, these methods reveal their limitations as business needs and network environments evolve. Static rules cannot be dynamically adjusted, making it difficult to adapt to real-time changes in access requests and security threats. Furthermore, although RBAC and ABAC introduce the concepts of roles and attributes, they still rely on predefined rules and lack the ability to respond to real-time contextual information. These methods often fall short in handling complex and ever-changing business scenarios, failing to provide flexible and precise access control.

[0004] To address the limitations of traditional access control methods, context-based dynamic access control has become a research hotspot in recent years. Currently, context-based dynamic access control methods typically adjust access control decisions dynamically by collecting and analyzing contextual information from access requests. Some research has proposed combining machine learning and data mining techniques to extract patterns and rules from large amounts of historical access records, thereby improving the intelligence of access control.

[0005] However, existing dynamic access control methods cannot dynamically adapt to changing access environments and lack the ability to comprehensively process multi-source heterogeneous context information, making it difficult to provide comprehensive and accurate access control in complex and ever-changing environments. Summary of the Invention

[0006] Therefore, it is necessary to provide an adaptive determination method for user access control decisions to address the aforementioned technical problems.

[0007] The present invention adopts the following technical solution:

[0008] This invention provides an adaptive determination method for control decisions related to user access, comprising:

[0009] Receive an access request that includes user access context information; the user access context information includes at least one of the following information categories: user access behavior, user network environment, and user device status;

[0010] The user access context information in the access request is classified according to information category; a preliminary rule cluster corresponding to each information category is obtained, and each preliminary rule cluster includes multiple preset access control rules;

[0011] For each preliminary rule cluster, an inductive logic programming algorithm is used to extract access control rules from the preliminary rule cluster, and the extracted access control rules are combined to obtain the final rule cluster corresponding to the preliminary rule cluster.

[0012] Multiple control decisions for user access are determined. For each final rule cluster, the Dempster-Shafer evidence theory is used to assign support to each control decision based on the user access context information of the final rule cluster and the corresponding information category. The final control decision is then determined based on the support assigned to different control decisions by each final rule cluster to perform data access control.

[0013] Optionally, the access behavior includes at least one of access frequency, operation type, access resource type, and access time; the network environment includes at least one of network traffic, IP address source, and connection security; and the device status includes at least one of hardware configuration, application software version, and security patch status.

[0014] Optionally, for each preliminary rule cluster, the extraction of access control rules from the preliminary rule cluster using an inductive logic programming algorithm specifically includes:

[0015] For each initial rule cluster, initialize the hypothesis set corresponding to that initial rule cluster;

[0016] The following inductive logic programming algorithm is used to extract multi-round access control rules from the initial rule set:

[0017] The extracted access control rules are placed into the hypothesis set corresponding to each iteration until the rules in the hypothesis set can fully explain the preset set of positive and negative access examples, at which point the extraction of access control rules stops.

[0018] in, This represents the hypothesis set corresponding to the k-th preliminary rule cluster after n iterations, and Refine() represents the access control rule refinement function. Let R represent the hypothesis set corresponding to the k-th preliminary rule cluster after n-1 iterations. (k) Let E represent the k-th preliminary rule cluster. + Indicates accessing the positive example set, E - This indicates accessing the set of negative examples.

[0019] Optionally, the control decisions include: allowing viewing, allowing downloading, allowing modification, allowing deletion, and denying access.

[0020] Optionally, the Dempster-Shafer evidence theory is adopted to assign support to each control decision based on the user access context information of the final rule cluster and the corresponding information category, specifically including:

[0021] Using the Dempster-Shafer evidence theory, support is assigned to each control decision based on the user access context information of the final rule cluster and the corresponding information category of the final rule cluster, as follows:

[0022] m k (A)=S(H k E i ),

[0023]

[0024] Where A represents any control decision, Θ represents the set of control decisions, and m k (A) represents the support of the k-th final rule cluster for control decision A, S() represents the support assignment function, and H k Let E represent the k-th final rule cluster. i This represents the user access context information for the i-th information category.

[0025] Optionally, determining the final control decision based on the support assigned to different control decisions by each final rule cluster specifically includes:

[0026] The final control decision is determined by the following formula, based on the support assigned to different control decisions by each final rule cluster:

[0027]

[0028]

[0029] Where m(A) represents the support for control decision A after fusing all final rule clusters, K represents the rule cluster conflict metric, and B and C represent control decisions that are different from A and distinct from each other. k(B) represents the support assigned to the control decision B by the k-th final rule cluster, m j (C) represents the support assigned to the control decision C by the j-th final rule cluster, and X represents the final control decision. This indicates the control decision corresponding to the maximum support level.

[0030] Optionally, the access frequency refers to the number of times a user logs into the server; the operation type includes uploading, downloading, editing, and deleting the data accessed by the user; the access resource type includes text, images, and sensitive data; and the access time includes weekdays and non-weekdays.

[0031] The above-mentioned technical solution adopted in this invention can achieve the following beneficial effects:

[0032] This invention first receives an access request carrying user access context information, which includes at least one information category from the user's access behavior, network environment, and device status. The user access context information is then categorized to obtain preliminary rule clusters corresponding to each information category. Each preliminary rule cluster includes multiple preset access control rules. For each preliminary rule cluster, an inductive logic programming algorithm is used to extract access control rules from it, resulting in a corresponding final rule cluster. Finally, Dempster-Shafer evidence theory is applied to determine and integrate the support of the corresponding final rule cluster for each control decision based on different information categories of user access context information, thereby determining the final control decision.

[0033] This invention extracts different types of access control rules based on real-time user access context information, resulting in adaptive access control rules suitable for real-time context information. This avoids the rigidity of predefined static rules and improves the flexibility of access control rules. At the same time, by using Dempster-Shafer evidence theory, the adaptive access control rules under different types assign support to different types of user access context information for different control decisions and integrate them to obtain adaptive control decisions that take into account different aspects. This improves the flexibility and accuracy of control decisions for user access and enhances service security. Attached Figure Description

[0034] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0035] Figure 1 This invention provides a flowchart illustrating an adaptive determination method for user access control decisions.

[0036] Figure 2 This is a schematic diagram illustrating a control decision determination method for user access provided by the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0038] The technical solutions provided by the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0039] Figure 1 This is a flowchart illustrating an adaptive determination method for user access control decisions according to the present invention, which specifically includes the following steps:

[0040] S101: Receive an access request including user access context information; the user access context information includes at least one of the following information categories: user access behavior, user network environment, and user device status.

[0041] Generally, when controlling user access authorization, combining real-time context information for dynamic rule generation and generalization is an important way to improve access control efficiency.

[0042] Based on this, in one or more embodiments of the present invention, the server of the business platform may first receive an access request carrying user access context information. This user access context information may include at least one of the following categories: user access behavior, user network environment, and user device status. This information helps the server to understand changes in the current environment in a timely manner and make corresponding adjustments.

[0043] Furthermore, in one or more embodiments of the present invention, the access behavior may include at least one of access frequency, operation type, access resource type, and access time. Wherein, access frequency refers to the number of times a user logs into the server. Operation type refers to the various operations performed by the user on the server (such as file upload, download, editing, and deletion). Access resource type refers to the different file types accessed by the user, including text, images, and sensitive data. Access time describes the specific time of the user's access, which can emphasize the difference in behavior between weekdays and non-weekdays.

[0044] The definition of a network environment involves the characteristics and state of the network to which a server connects. Specifically, the network environment can include at least one of the following: network traffic, IP address origin, and connection security. Network traffic refers to the inbound and outbound data passing through the server. IP address origin can be used to identify the IP addresses accessing the server device, particularly distinguishing between access from internal and external networks. Connection security characterizes the security protocols used for the network connection, such as whether encryption measures are deployed.

[0045] Device status relates to the current condition and historical records of the devices used by users to access the server. Specifically, device status may include at least one of the following: hardware configuration, application software version, and security patch status. Hardware configuration includes components such as CPU, memory, and storage. Application software version refers to the operating system and its version running on the device, as well as the versions of critical application software. Security patch status refers to the update status of security patches installed on the device.

[0046] The server mentioned in this invention can be a server set up on a business platform, or a device such as a desktop computer or laptop computer capable of executing the solution of this invention. For ease of explanation, the following description will only focus on the server as the executing entity.

[0047] S102: Classify the user access context information in the access request according to the information category; obtain the preliminary rule cluster corresponding to each information category, and each preliminary rule cluster includes multiple preset access control rules.

[0048] S103: For each preliminary rule cluster, an inductive logic programming algorithm is used to extract access control rules from the preliminary rule cluster, and the extracted access control rules are combined to obtain the final rule cluster corresponding to the preliminary rule cluster.

[0049] Upon receiving a user's access request, the server can further determine the access control rules corresponding to the real-time user access context information, which can be used as the basis for access control.

[0050] First, the server can categorize user access context information: C = {E1, E2, ..., E...} i ,...,E n}

[0051] Where C represents the set of categorized user access context information, E i This represents the user access context information for the i-th information category. It can be user access context information for a certain information category among the user's access behavior, the user's network environment, and the user's device status, or it can be user access context information for a sub-information category of the access behavior, or user access context information for a sub-information category of the network environment, and the same applies to the device status.

[0052] Next, the server can initialize a preliminary rule cluster corresponding to each type of user access context information based on preset access control prior knowledge. That is, for each type of information, a preliminary rule cluster corresponding to the user access context information of that type of information is generated based on preset access control prior knowledge. Each preliminary rule cluster may include multiple preset access control rules corresponding to the user access context information of that type of information. The prior knowledge mentioned here refers to knowledge and information already possessed before making a decision, which can be used to infer and evaluate the support level of different control decisions. Examples include existing security policies, preset access control decision logic, or expert experience. Of course, this initialization process can be completed and stored in advance, so that after receiving a user's access request, the server can directly obtain the preliminary rule clusters corresponding to each type of information in the user access context information.

[0053] Each preliminary rule cluster can be represented by the following formula:

[0054] Among them, R (k) This represents the k-th preliminary rule cluster. This represents the i-th preset access control rule in the k-th preliminary rule cluster. This represents the condition corresponding to the i-th preset access control rule in the k-th preliminary rule cluster. This represents the access control decision corresponding to the i-th preset access control rule in the k-th preliminary rule cluster.

[0055] For example, rules (User behavior):

[0056] condition A user attempts to access the same sensitive file more than five times within any consecutive three days.

[0057] Access control decisions access denied.

[0058] rule (Network environment):

[0059] condition Access requests from foreign IP addresses are attempting to enter sensitive system areas.

[0060] Access control decisions access denied.

[0061] rule (Equipment Status):

[0062] condition The device has the latest security patches installed.

[0063] Access control decisions Access granted.

[0064] Next, the server can use inductive logic programming to extract rules from the preset access control rules to obtain the final rule cluster formed by the final access control rules.

[0065] The specific steps of inductive logic programming are as follows:

[0066] The first step is to initialize the hypothesis set corresponding to each preliminary rule cluster. For example, initialize... in, This represents the initial hypothesis set corresponding to the k-th preliminary rule cluster; initially, there are no assumptions to ensure that there is no preconceived bias during the access control rule extraction process.

[0067] The second step involves extracting access control rules from the initial rule set using an inductive logic programming algorithm, as shown in the following formula: in, This represents the hypothesis set corresponding to the k-th preliminary rule cluster after the nth iteration. Let R represent the hypothesis set relative to the previous iteration in the nth iteration. (k) Let E represent the k-th preliminary rule cluster. + and E - These represent the set of positive examples and the set of negative examples, respectively, used to train and validate access control rules extracted from the initial rule set, guiding the direction of rule extraction towards positive examples while avoiding the occurrence of negative examples.

[0068] Then, the extracted access control rules can be placed into the hypothesis set corresponding to each iteration until the rules in the hypothesis set can fully explain the preset set of positive and negative access examples, at which point the extraction of access control rules will stop.

[0069] Continuing with the example above, regarding the rules... (User behavior):

[0070] Positive example Normal file access pattern, without frequent or abnormal access behavior, is allowed.

[0071] counterexample Log records show that an instance where a user attempted to access the same sensitive file more than five times over three consecutive days was still allowed access.

[0072] Hypothesis Refinement: If the current hypothesis Unexplainable Then adjust the assumptions to include authorized access behavior during normal working hours; if Explained Then adjust the assumptions to exclude the behavior of authorizing frequent access to the same file.

[0073] Regarding the rules (Network environment):

[0074] Positive example Normal, secure IP access attempts, including access to the internal network, are permitted.

[0075] counterexample High-risk access attempts from unknown IP addresses were identified, but access was still allowed.

[0076] Hypothesis Refinement: If Unable to identify access from high-risk IPs, increasing monitoring and access restrictions on IP addresses in unknown regions.

[0077] Regarding the rules (Equipment Status):

[0078] Positive example The device has been updated to the latest security patch and access is permitted.

[0079] counterexample Access is still allowed even though the device has not installed the latest security patches.

[0080] Hypothesis Refinement: If If the security patch status of an uncovered device is not specified, the assumptions are adjusted to ensure the monitoring of security patches.

[0081] If the hypothesis set Able to explain all positive examples E + And without explaining any counterexample E - If the iteration is terminated, the search will end.

[0082] Third step, output the results. H k That is, the kth final rule cluster that satisfies the conditions.

[0083] S104: Determine multiple control decisions for user access; for each final rule cluster, use Dempster-Shafer evidence theory to assign support to each control decision based on the user access context information of the final rule cluster and the corresponding information category of the final rule cluster, and determine the final control decision based on the support assigned to different control decisions by each final rule cluster for data access control.

[0084] After obtaining the final rule clusters as described above, the server can provide decision support for user access context information of the corresponding information category through each final rule cluster.

[0085] Typically, user access can correspond to multiple operations, and the control decision refers to whether to authorize various operations, such as allowing viewing, downloading, modifying, deleting, and denying access. The granularity of the control decision can be set as needed, and this invention does not impose any limitations on it.

[0086] Each final rule cluster can serve as the basis for judging the applicability of user access context information for different control decisions for each information category. As mentioned above, the rules in the final rule cluster can include conditions and corresponding access control decisions. Therefore, the user access context information for the corresponding information category can be matched with the conditions in the rules to determine the support level for different control decisions for user access based on the user access context information of that information category. This is illustrated in the following formula: m k (A)=S(H k E i ),

[0087] Where A represents any control decision, m k (A) represents the support of the k-th final rule cluster for control decision A, S() represents the support assignment function, and Θ represents the control decision set.

[0088] That is, for each possible control decision, a final rule cluster is used. Assign a support m k (A), and make the sum of the support assigned to each possible control decision through this final rule set equal to 1.

[0089] For example, suppose an access control system needs to process rules from two different types of rule sets in real time: a user behavior rule set and a network environment rule set.

[0090] User behavior rule cluster: Based on user behavior, such as frequent attempts to access sensitive files, this rule cluster assigns support to the following decisions:

[0091] Viewing allowed: 0.1; Download allowed: 0.0; Modification allowed: 0.0; Deletion allowed: 0.0; Access denied: 0.9.

[0092] Network traffic rule clusters: Based on network traffic anomalies, such as large amounts of data uploads, the following support levels may be assigned:

[0093] Viewing allowed: 0.2; Download allowed: 0.5; Modification allowed: 0.0; Deletion allowed: 0.0; Access denied: 0.3.

[0094] Finally, the final control decision can be determined based on the support assigned to different control decisions by each final rule cluster. Specifically, in one or more embodiments of the present invention, the server can perform support fusion using the following formula:

[0095] Where m(A) represents the support for control decision A after fusing all final rule clusters, K represents the rule cluster conflict metric, and B and C represent control decisions that are different from A and distinct from each other. k (B) represents the support assigned to the control decision B by the k-th final rule cluster, m j (C) represents the support assigned to the control decision C by the j-th final rule cluster, and X represents the final control decision. This indicates the control decision corresponding to the maximum support level.

[0096] The conflict metric K can be calculated first. If the support of the “user behavior rule cluster” and the “network traffic rule cluster” in the control decision of “deny access” is m1(deny access) = 0.9 and m2(deny access) = 0.3 respectively, and other support is assigned to other decisions, then K will include the sum of the support products of all combinations other than “deny access”.

[0097] Once the conflict metric K is determined, the basic probability assignment m(A) of the synthesis can be calculated using Dempster's combination rules: to calculate m(denial) for "deny access", the support product of all rule clusters that could lead to "deny access" is considered and adjusted according to K.

[0098] In one or more embodiments of the present invention, the fused basic probability assignment m(A) can finally be normalized. The final access control decision is determined by the option with the highest support: that is... This step ensures that the sum of support for all decisions equals 1, making the decision-making process more rational and stable. The final decision will select the option with the highest support; for example, if "deny access" has the highest overall support, this will be the final security decision for the access control system.

[0099] based on Figure 1The adaptive determination method for user access control decisions, as shown in this invention, first receives an access request carrying user access context information. This user access context information includes at least one information category among the user's access behavior, the user's network environment, and the user's device status. Then, the user access context information is classified to obtain preliminary rule clusters corresponding to each information category. Each preliminary rule cluster includes multiple preset access control rules. For each preliminary rule cluster, an inductive logic programming algorithm is used to extract access control rules from the preliminary rule cluster to obtain the corresponding final rule cluster. Finally, Dempster-Shafer evidence theory is applied to determine the support degree of the corresponding final rule cluster for each control decision for different information categories of user access context information, and these support degrees are integrated to determine the final control decision.

[0100] This invention extracts different types of access control rules based on real-time user access context information, resulting in adaptive access control rules suitable for real-time context information. This avoids the rigidity of predefined static rules and improves the flexibility of access control rules. At the same time, through Dempster-Shafer evidence theory, the adaptive access control rules under different types assign support to different types of user access context information for different control decisions and integrate them to obtain adaptive control decisions that take into account different aspects. This improves the flexibility and accuracy of control decisions for user access and enhances service security.

[0101] When applying the adaptive determination method for user access control decisions provided by this invention, it is not necessary to rely on... Figure 1 The steps shown are executed in sequence. The specific execution order of each step can be determined as needed, and this invention does not impose any restrictions on it.

[0102] Figure 2 This is a schematic diagram illustrating a control decision determination method for user access in this invention. As can be seen, when different users access the site based on different context information, the server can adaptively determine the access control decision according to the context information carried by the user, forming an adaptive control decision determination method driven by context information-corresponding data.

[0103] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0104] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this invention.

Claims

1. A method for adaptive determination of control decisions for user access, characterized in that Comprising: receiving an access request including user access context information; the user access context information includes at least one information category of user access behavior, user network environment and user device state; classifying the user access context information in the access request according to the information category; obtaining a preliminary rule cluster corresponding to each information category, and each preliminary rule cluster includes a plurality of preset access control rules; for each preliminary rule cluster, using an inductive logic programming algorithm to extract access control rules from the preliminary rule cluster, and combining the extracted access control rules to obtain a final rule cluster corresponding to the preliminary rule cluster; determining a plurality of control decisions that the user accesses; for each final rule cluster, employing Dempster-Shafer evidential theory to assign a support degree to each control decision based on the final rule cluster and user access context information of the information category corresponding to the final rule cluster, and employing Dempster-Shafer evidential theory to determine a final control decision based on the support degrees assigned to different control decisions by each final rule cluster for data access control.

2. The method of adaptive determination of control decisions for access of users according to claim 1, characterized in that, The access behavior includes at least one of access frequency, operation type, access resource type and access time, the network environment includes at least one of network traffic, IP address source and connection security, and the device state includes at least one of hardware configuration, application software version and security patch state.

3. The method of adaptive determination of control decisions for access of users according to claim 1, characterized by, For each preliminary rule cluster, using an inductive logic programming algorithm to extract access control rules from the preliminary rule cluster, specifically including: for each preliminary rule cluster, initializing the hypothesis set corresponding to the preliminary rule cluster; The access control rules are extracted from the preliminary rule set by using an inductive logic programming algorithm in multiple rounds by the following formula: ; Put the extracted access control rules into the hypothesis set corresponding to each iteration until the rules in the hypothesis set can completely explain the preset access positive example set and access negative example set, and stop the access control rule extraction; wherein, denotes n the hypothesis set corresponding to the k first preliminary rule cluster after the access control rule refinement function, denotes n- the hypothesis set corresponding to the k first preliminary rule cluster after the denotes the k first preliminary rule cluster, denotes the set of access positive examples, denotes the set of access negative examples.

4. The method of adaptive determination of control decisions for access of users according to claim 1, characterized by, The control decision includes: allowing to view, allowing to download, allowing to modify, allowing to delete and rejecting access.

5. The method of adaptive determination of control decisions for access of users as claimed in claim 1 wherein, The adoption Dempster-Shafer The evidence theory assigns support degrees to each control decision according to the final rule cluster and user access context information corresponding to the information category of the final rule cluster, specifically including: By the following formula using Dempster-Shafer The Dempster-Shafer theory is used to assign support degrees to each control decision based on the final rule set and the user's access context information corresponding to the information category. ， ； wherein, A represents any control decision, represents a set of control decisions, represents the support of the k th final rule cluster to a control decision A , represents a support distribution function, represents the k th final rule cluster, represents the user access context information of the i th information category.

6. The method of adaptive determination of control decisions for access of users according to claim 1, characterized by, The final control decision is determined according to the support degree of each final rule cluster for different control decisions, specifically including: The final control decision is determined according to the support degree of each final rule cluster for different control decisions by the following formula: ， ， ； wherein, denotes the support of the control decision A after fusing the final rule clusters, K denotes a rule cluster conflict measure factor, B and C denotes a control decision different from A and different from each other, denotes the k final rule cluster assigned to the control decision B , denotes the j final rule cluster assigned to the control decision C , denotes the final control decision, denotes the control decision corresponding to the maximum support, denotes the set of control decisions.

7. The method of adaptive determination of control decisions for access of users according to claim 2, characterized by, The access frequency is the number of times the user logs in to the server; the operation type includes uploading, downloading, editing and deleting operations of the user on the accessed data; the access resource type includes text, picture and sensitive data; and the access time includes weekdays and non-weekdays.

Images