Business access methods, devices, computer equipment, computer-readable storage media, and products based on dynamic trust assessment

Abstract

This application relates to a service access method, apparatus, and computer device based on dynamic trust assessment. The method includes: determining an initial trust level based on attribute information when the attribute information is legitimate and the user terminal has passed authentication; analyzing access traffic data to determine traffic behavior information and determining traffic behavior trust information based on the traffic behavior information; identifying vulnerability information in the attribute information and generating security profile information based on access behavior log information, vulnerability information, and access traffic data; inputting the traffic behavior trust information and security profile information into a trust assessment model to obtain a trust assessment value; adjusting the initial trust level based on the trust assessment value to obtain an adjusted trust level, and determining access permission information based on the adjusted trust level. This method enables dynamic assessment and adjustment of the user terminal's trust level, thereby granting accurate access permissions to the user terminal and improving the security of service access.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a business access method and device based on dynamic trust evaluation, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] In the running process of a business system, a terminal device can connect to the business system through a network and interactively use the functions and services of the business system to realize data exchange, function operation and service request, etc. Terminal users can access various services provided by the system through the above operations to efficiently and conveniently complete work tasks. Since a large number of terminals access the business system for operations, it is particularly important to ensure the security and stability of the business system.

[0003] In the traditional technology, the trust degree of an access subject (such as a user terminal) is usually static, that is, after confirming the trust level of the access subject and granting access rights, no further trust evaluation is performed. However, the access rights granted to the access subject by the traditional technology cannot accurately reflect the threat level of the access subject to the business system in a timely manner, which may threaten the safe and stable operation of the business system and is not conducive to improving the security of business access. SUMMARY

[0004] Therefore, it is necessary to provide a business access method, device, computer equipment, computer readable storage medium and computer program product based on dynamic trust evaluation to improve the security of business access.

[0005] In a first aspect, the present application provides a business access method based on dynamic trust evaluation, comprising:

[0006] In a case where attribute information of a user terminal is legal information and the user terminal passes identity verification, an initial trust level corresponding to the user terminal is determined in a preset trust level database according to the attribute information;

[0007] Traffic behavior information is determined by analyzing access traffic data of the user terminal, and traffic behavior trust information is determined according to the traffic behavior information;

[0008] Vulnerability information in the attribute information is determined based on a preset vulnerability information library, and security portrait information is generated according to access behavior log information of the user terminal, the vulnerability information and the access traffic data;

[0009] The traffic behavior trust information and the security portrait information are input into a pre-trained trust evaluation model to obtain a trust evaluation value;

[0010] Adjust the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determine access permission information of the user terminal for a service system according to the adjusted trust level; the access permission information is used to control an access operation of the user terminal for the service system.

[0011] In one of the embodiments, determining the traffic behavior trust information according to the traffic behavior information comprises:

[0012] Obtaining behavior parameter index information corresponding to the traffic behavior information;

[0013] Constructing a fuzzy consistent matrix according to the behavior parameter index information, and obtaining weight information of each element in the fuzzy consistent matrix;

[0014] Determining an evaluation value of the traffic behavior information according to a preset evaluation rule, and determining the traffic behavior trust information according to the evaluation value and the weight information.

[0015] In one of the embodiments, constructing the fuzzy consistent matrix according to the behavior parameter index information comprises:

[0016] Determining evaluation hierarchy information according to the behavior parameter index information based on an analytic hierarchy process;

[0017] Generating an initial judgment matrix according to the evaluation hierarchy information;

[0018] In a case where a maximum eigenvalue corresponding to the initial judgment matrix passes a consistency check, generating the fuzzy consistent matrix according to the initial judgment matrix.

[0019] In one of the embodiments, generating the security portrait information according to the access behavior log information of the user terminal, the vulnerability information and the access traffic data comprises:

[0020] Generating traffic vector information according to a packet in the access traffic data, and generating access traffic feature information according to the packet and the traffic vector information;

[0021] Generating threat degree attribute label information according to the access behavior log information and the vulnerability information;

[0022] Generating the security portrait information according to the access traffic feature information and the threat degree attribute label information.

[0023] In one of the embodiments, generating the threat degree attribute label information according to the access behavior log information and the vulnerability information comprises:

[0024] determine historical access behavior information according to the access behavior log information, and determine access attribute label information based on the historical access behavior information;

[0025] analyze the access behavior log information according to preset situation awareness analysis strategy information, and determine access behavior label information;

[0026] generate the threat degree attribute label information according to the access attribute label information, the access behavior label information and the vulnerability information.

[0027] In one of the embodiments, access traffic feature information is generated according to the packet and the traffic vector information, including:

[0028] divide the packet into at least one packet segment, and obtain a syntax keyword in the packet segment;

[0029] obtain a keyword matched with the syntax keyword in a preset keyword database;

[0030] generate the access traffic feature information according to the traffic vector information, the keyword, the occurrence times of each field in the packet and the quantity information of the packet.

[0031] In a second aspect, the application further provides a business access device based on dynamic trust evaluation, including:

[0032] an attribute information analysis module, configured to, in a case where attribute information of a user terminal is legal information and the user terminal passes identity verification, determine an initial trust level corresponding to the user terminal according to the attribute information in a preset trust level database;

[0033] an access traffic analysis module, configured to analyze access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information according to the traffic behavior information;

[0034] a portrait generation module, configured to determine vulnerability information in the attribute information based on a preset vulnerability information library, and generate security portrait information according to access behavior log information of the user terminal, the vulnerability information and the access traffic data;

[0035] a trust evaluation module, configured to input the traffic behavior trust information and the security portrait information into a pre-trained trust evaluation model to obtain a trust evaluation value;

[0036] The permission determination module is configured to adjust the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determine access permission information of the user terminal for a service system according to the adjusted trust level; the access permission information is used to control an access operation of the user terminal for the service system.

[0037] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to implement the steps of the above method.

[0038] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the above method.

[0039] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the above method.

[0040] The aforementioned business access method, apparatus, computer equipment, computer-readable storage medium, and computer program product based on dynamic trust assessment, determine the initial trust level of the user terminal based on the attribute information in a preset trust level database when the user terminal's attribute information is legitimate and the user terminal has passed authentication. This provides a data foundation for subsequent trust level adjustments and access permission determination. Furthermore, it analyzes the user terminal's access traffic data to determine traffic behavior information and, based on this information, determines traffic behavior trust information. This accurately obtains traffic behavior trust information characterizing the degree of trust in the user terminal, providing a data foundation for subsequent trust level adjustments. Finally, it identifies vulnerability information in the attribute information based on a preset vulnerability information database and generates security profile information based on the user terminal's access behavior logs, vulnerability information, and access traffic data. This accurately generates a security profile of the user terminal, providing a data foundation for subsequent security-based assessments. The comprehensive profile provides the data foundation for determining trust assessment values. Traffic behavior trust information and security profile information are input into a pre-trained trust assessment model to obtain trust assessment values. This model then processes and analyzes the traffic behavior trust information and security profile information to obtain accurate trust assessment values. The initial trust level is adjusted based on these values ​​to obtain an adjusted trust level. Based on this adjusted trust level, the user terminal's access permissions to the business system are determined. These access permissions control the user terminal's access operations to the business system. Even after the user terminal has passed attribute verification and authentication, the model analyzes the user terminal's corresponding attribute information, access traffic data, and access behavior logs to accurately obtain the user terminal's security profile. The pre-trained trust assessment model processes the security profile's output trust assessment value to adjust the user terminal's initial trust level. Combined with the adjusted trust level, the model determines the access permissions used to control the user terminal's business access operations. This dynamic assessment and adjustment of the user terminal's trust level ensures accurate access permissions are granted, thereby improving the security of business access. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1This is an application environment diagram of a service access method based on dynamic trust assessment in one embodiment;

[0043] Figure 2 This is a flowchart illustrating a service access method based on dynamic trust assessment in one embodiment;

[0044] Figure 3 This is a schematic diagram of a process for obtaining initial access permissions in one embodiment;

[0045] Figure 4 This is a schematic diagram of a process for determining traffic behavior trust information in one embodiment.

[0046] Figure 5 This is a schematic diagram of a process for generating security profile information in one embodiment;

[0047] Figure 6 This is a schematic diagram of a process for obtaining access permissions in one embodiment;

[0048] Figure 7 This is a structural block diagram of a service access device based on dynamic trust assessment in one embodiment;

[0049] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] This application provides a service access method based on dynamic trust assessment, which can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. When the user terminal's attribute information is valid and the user terminal has passed authentication, server 104 determines the initial trust level of the user terminal based on the attribute information in a preset trust level database. Server 104 analyzes the user terminal's access traffic data, determines traffic behavior information, and determines traffic behavior trust information based on the traffic behavior information. Server 104, based on a preset vulnerability information database, determines vulnerability information in the attribute information and generates security profile information based on the user terminal's access behavior log information, vulnerability information, and access traffic data. Server 104 inputs the traffic behavior trust information and security profile information into a pre-trained trust evaluation model to obtain a trust evaluation value. Server 104 adjusts the initial trust level based on the trust evaluation value to obtain an adjusted trust level, and determines the user terminal's access permission information for the business system based on the adjusted trust level. The access permission information is used to control the user terminal's access operations to the business system. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0052] In one exemplary embodiment, such as Figure 2 As shown, a business access method based on dynamic trust assessment is provided. Taking the application of this method to a server as an example, the method includes the following steps S202 to S210. Wherein:

[0053] Step S202: If the attribute information of the user terminal is valid and the user terminal has passed authentication, determine the initial trust level of the user terminal in the preset trust level database based on the attribute information.

[0054] In this context, a user terminal can refer to the terminal used by a user when performing business operations (access operations, etc.) on a business system.

[0055] Among them, attribute information can refer to information used to distinguish terminals. In practical applications, attribute information may include, but is not limited to, terminal hardware information, system configuration information, physical address information, account information, and network address information.

[0056] Among them, legitimate information can refer to information that meets the preset terminal verification requirements. In practical applications, the preset information management database can include legitimate information.

[0057] The preset trust level database can refer to a pre-set database used to record the trust level of a terminal.

[0058] The initial trust level can refer to information that characterizes the security of a user terminal. In practical applications, when it is necessary to determine the trust level of a user terminal at the current moment, the trust level of the user terminal before the current moment can be used as the initial trust level.

[0059] As an example, to ensure the security of user terminal access to the business system, the server can perform dynamic trust assessment of the user terminal. First, the server can obtain the user terminal's attribute information, access traffic data, and access behavior logs. Then, the server can search a pre-set information management database for legitimate information matching the user terminal's attributes. Since the information management database does not contain illegitimate information, if legitimate information matching the user terminal's attributes is found in the database, the server can determine that the user terminal's attributes are legitimate. Next, the server can obtain the access request sent by the user terminal to the application in the business system and analyze the authorization token carried in the request. The server can compare this authorization token with authorization tokens pre-stored in a token database. If an authorization token matching the one carried in the access request exists in the database, the authorization token verification is successful, and the server can determine that the user terminal has passed authentication. The user terminal's authentication is complete. The server can then determine the initial trust level for the user terminal based on its attribute information (which can be considered a form of identity information) in a pre-set trust level database. In practical applications, trust levels correspond to access permissions, and the initial access permissions corresponding to the initial trust level can be used to control user terminals' access operations to business systems.

[0060] Step S204: Analyze the access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information based on the traffic behavior information.

[0061] Access traffic data can refer to the data that represents the traffic generated when a user uses the business services provided by the business system through a user terminal. In practical applications, access traffic data can include user business access traffic data, and access traffic data can be data packets transmitted in network communication.

[0062] Traffic behavior information can refer to information that characterizes the data transmission behavior between a user terminal and a business system. In practical applications, traffic behavior information may include, but is not limited to, source address, destination address, source port, destination port, response information, data packet characteristics, and payload content.

[0063] Among them, traffic behavior trust information can refer to information that characterizes the security of data transmission and other behaviors between users and business systems, as represented by access traffic data.

[0064] As an example, servers can use deep flow inspection technology to analyze access traffic data for traffic behavior analysis. Deep flow inspection technology employs application identification techniques based on traffic behavior; different application types are reflected differently in the state of session connections or data streams. This allows for the analysis of the source address, destination address, source port, destination port, and response information of the access traffic data. Deep flow inspection technology can refer to data analysis techniques based on traffic behavior. In practical applications, deep flow inspection technology can take streams as the basic research object, where a stream can be a set of ordered data packets from a source address to a destination address. Deep packet inspection technology can refer to data analysis techniques based on the content of data packets.

[0065] The server can also perform deep packet inspection (DPI) analysis on access traffic data to obtain packet characteristic data and payload content. The payload content is the data packet containing the code's effective payload. DPI is an application-layer traffic detection and control technology that matches packet characteristic data with preset attack behavior characteristic data. If the packet characteristic data matches the preset attack behavior characteristic data, a trust level label is added to the access traffic data. This trust level label can include, but is not limited to, medium level. Then, the server can construct traffic behavior information from the source address, destination address, source port, destination port, and response information corresponding to the access traffic data, along with the packet characteristic data and payload content. The server can then use preset behavior indicators, combined with the traffic behavior information, to determine traffic behavior trust information.

[0066] Step S206: Based on the preset vulnerability information database, determine the vulnerability information in the attribute information, and generate security profile information based on the user terminal's access behavior log information, vulnerability information and access traffic data.

[0067] The preset vulnerability information database can refer to a pre-set database that stores a number of vulnerability information. In practical applications, the preset vulnerability information database may include, but is not limited to, information such as the types of vulnerability information and the threat level of vulnerability information.

[0068] Vulnerability information can refer to information that threatens or affects the secure and stable operation of business systems.

[0069] Access behavior log information refers to information that records user actions such as accessing business operations in a business system through a user terminal. In practical applications, access behavior log information may include the total number of times the terminal accesses applications in the business system, the number of times unauthorized access was attempted, and the number of times access was successful.

[0070] Among them, security profile information can refer to information describing the level of security risk of a user terminal.

[0071] As an example, the server can use a pre-set vulnerability information database to find vulnerability information in the attribute information. Then, the server can analyze the user terminal's access behavior log information, access traffic data, and information such as the types and threat levels of vulnerability information. Using a reference profile in the pre-set profile database as a template, the server can generate security profile information for the user terminal through data visualization.

[0072] Step S208: Input traffic behavior trust information and security profile information into the pre-trained trust evaluation model to obtain the trust evaluation value.

[0073] The pre-trained trust evaluation model can refer to the model used to generate trust evaluation values. In practical applications, the trust evaluation model can include the entity extraction and intent classification model (Dual Intent and EntityTransformer, DIET).

[0074] The trust assessment value can refer to information that characterizes the security of a user's access to a business system and / or applications through a user terminal.

[0075] As an example, the server can input traffic behavior trust information and security profile information into a pre-trained trust assessment model, which can then calculate the trust assessment value of the user terminal based on the traffic behavior trust information and security profile information.

[0076] Step S210: Adjust the initial trust level according to the trust assessment value to obtain the adjusted trust level, and determine the user terminal's access permission information for the business system based on the adjusted trust level; the access permission information is used to control the user terminal's access operations for the business system.

[0077] The adjusted trust level can refer to the trust level obtained after adjusting the initial trust level.

[0078] Access permission information refers to information that represents the operations or behaviors that a user can perform on a business system through a user terminal. In practical applications, access permission information is used to control the user terminal's access operations to the business system.

[0079] The business system may include, but is not limited to, the power business system.

[0080] In this context, access operations can refer to data transmission operations between a user and a business / application within a business system via a user terminal.

[0081] As an example, the server can adjust the initial trust level based on the trust assessment value to obtain the adjusted trust level. The server can then use the access permissions corresponding to the adjusted trust level as the access permission information for the user terminal to the business system. This access permission information can be used for access control when the user accesses the business system and / or the business applications in the business system through the user terminal.

[0082] In the aforementioned business access method based on dynamic trust assessment, the initial trust level of the user terminal is determined based on the attribute information in a preset trust level database when the user terminal's attribute information is legitimate and the user terminal has passed authentication. This provides a data foundation for subsequent trust level adjustments and access permission determination. The method also analyzes the user terminal's access traffic data to determine traffic behavior information and traffic behavior trust information. This accurately obtains traffic behavior trust information that characterizes the degree of trust in the user terminal, providing a data foundation for subsequent trust level adjustments. Finally, based on a preset vulnerability information database, vulnerability information in the attribute information is determined. Security profile information is generated based on the user terminal's access behavior logs, vulnerability information, and access traffic data. This accurately generates a security profile of the user terminal, providing data for subsequent trust assessment values ​​based on the security profile. The basic process involves inputting traffic behavior trust information and security profile information into a pre-trained trust assessment model to obtain a trust assessment value. This model is then used to process and analyze the traffic behavior trust information and security profile information to obtain an accurate trust assessment value. Based on the trust assessment value, the initial trust level is adjusted to obtain an adjusted trust level. Based on this adjusted trust level, the access permission information for the user terminal to access the business system is determined. This access permission information controls the user terminal's access operations to the business system. Even when the user terminal has passed attribute validity verification and identity verification, the system analyzes the user terminal's corresponding attribute information, access traffic data, and access behavior log information to accurately obtain the user terminal's security profile. The trust assessment value output from the security profile is processed by the pre-trained trust assessment model to adjust the user terminal's initial trust level. Combined with the adjusted trust level, the system determines the access permission information used to control the user terminal's business access operations. This dynamic assessment and adjustment of the user terminal's trust level aims to grant accurate access permissions to the user terminal, thereby improving the security of business access.

[0083] In an exemplary embodiment, determining traffic behavior trust information based on traffic behavior information includes: obtaining behavior parameter index information corresponding to the traffic behavior information; constructing a fuzzy consistency matrix based on the behavior parameter index information and obtaining the weight information of each element in the fuzzy consistency matrix; determining the evaluation value of the traffic behavior information according to a preset evaluation rule; and determining the traffic behavior trust information based on the evaluation value and the weight information.

[0084] Among them, behavioral parameter indicators can refer to information from the perspective of analyzing business access operations represented by traffic behavior information. In practical applications, behavioral parameter indicators can include network behavior indicators and attack behavior indicators. Network behavior indicators can include the complexity of changes in terminal source address, destination address, source port, and destination port. Attack behavior indicators can include the number of historical attack behaviors that the terminal has committed while accessing the business system.

[0085] Here, the elements can refer to the data that constitute the fuzzy consistency matrix.

[0086] Among them, weight information can refer to information that characterizes the importance of an element in the fuzzy consistent matrix relative to each other in the fuzzy consistent matrix.

[0087] Among them, the preset evaluation rules can refer to the information used to analyze the threat level of traffic behavior information to the business system. In practical applications, the preset evaluation rules can be determined by preset expert rules.

[0088] Among them, the evaluation value of traffic behavior information can refer to information that characterizes the degree of threat that traffic behavior information poses to the business system.

[0089] As an example, the server can obtain the behavioral parameter index information corresponding to the traffic behavior information, and construct a fuzzy consistency matrix based on the behavioral parameter index information. Then, the server can determine the weight information of each element in the fuzzy consistency matrix based on the data value of each element in the fuzzy consistency matrix. The server can also determine the evaluation value of the traffic behavior information based on the preset evaluation rules. Then, the server can calculate the trust information of the traffic behavior based on the trust evaluation value and the weight information.

[0090] In this embodiment, behavioral parameter index information corresponding to traffic behavior information is obtained; a fuzzy consistency matrix is ​​constructed based on the behavioral parameter index information, and the weight information of each element in the fuzzy consistency matrix is ​​obtained; the evaluation value of traffic behavior information is determined according to preset evaluation rules; and the trust information of traffic behavior is determined based on the evaluation value and weight information. It is possible to construct a fuzzy consistency matrix using the behavioral parameter index information corresponding to traffic behavior information, and calculate accurate trust information of traffic behavior by combining the weight information of each element in the fuzzy consistency matrix and the evaluation value of traffic behavior information. This allows for the adjustment of the initial trust level based on the trust evaluation value generated by the traffic behavior trust information and the security profile, thereby obtaining access permissions for controlling business access operations and improving the security of business access.

[0091] In some embodiments, constructing a fuzzy consistency matrix based on behavioral parameter index information includes: determining evaluation hierarchical structure information based on behavioral parameter index information using the analytic hierarchy process; generating an initial judgment matrix based on the evaluation hierarchical structure information; and generating a fuzzy consistency matrix based on the initial judgment matrix if the largest eigenvalue corresponding to the initial judgment matrix passes the consistency check.

[0092] Among them, evaluation hierarchy information can refer to information used to analyze behavioral parameter indicators.

[0093] The initial judgment matrix can refer to the information on the relative importance of behavioral parameter indicators to each layer in the evaluation hierarchy information.

[0094] The largest eigenvalue can refer to the maximum value among the eigenvalues ​​corresponding to the initial judgment matrix.

[0095] As an example, the server can determine the evaluation hierarchy information based on behavioral parameter index information using the analytic hierarchy process (AHP). Then, the server can determine the form of the initial judgment matrix based on the evaluation hierarchy information and establish the initial judgment matrix according to the form of the initial judgment matrix and the behavioral parameter index information. The server can then verify the consistency of the initial judgment matrix using preset verification coefficients. If the largest eigenvalue corresponding to the initial judgment matrix fails the consistency verification, the server can correct the initial judgment matrix and perform consistency verification on the corrected initial judgment matrix until the largest eigenvalue corresponding to the judgment matrix passes the consistency verification. If the largest eigenvalue corresponding to the initial judgment matrix passes the consistency verification, the server can use the initial judgment matrix as the final judgment matrix and construct a fuzzy consistency matrix based on this final judgment matrix.

[0096] In this embodiment, the evaluation hierarchy information is determined based on the behavioral parameter index information using the analytic hierarchy process (AHP). An initial judgment matrix is ​​generated based on the evaluation hierarchy information. When the largest eigenvalue corresponding to the initial judgment matrix passes the consistency check, a fuzzy consistency matrix is ​​generated based on the initial judgment matrix. This allows for the generation of the initial judgment matrix based on the behavioral parameter index information, using the AHP and the evaluation hierarchy information. When the initial judgment matrix passes the consistency check, an accurate fuzzy consistency matrix is ​​generated based on the initial judgment matrix. This enables the determination of traffic behavior trust information based on the weight information of each element in the fuzzy consistency matrix, thereby improving the accuracy of traffic behavior trust information.

[0097] In some embodiments, security profile information is generated based on user terminal access behavior log information, vulnerability information, and access traffic data, including: generating traffic vector information based on packets in the access traffic data, and generating access traffic feature information based on packets and traffic vector information; generating threat level attribute label information based on access behavior log information and vulnerability information; and generating security profile information based on access traffic feature information and threat level attribute label information.

[0098] Among them, the packets in the access traffic data can refer to the packets carried by the access traffic data.

[0099] Traffic vector information can refer to information that characterizes the basic attributes of a message. In practical applications, the basic attributes of a message can include the source IP, destination IP, traffic type, message length, and message frequency. Traffic vector information can serve as a basic traffic vector.

[0100] As an example, the server can extract basic attribute information of the packets carried in the access traffic data and generate traffic vector information based on this basic attribute information. Then, the server can generate access traffic feature information based on the packets and traffic vector information. The server can also generate threat level attribute label information based on access behavior log information and vulnerability information. Then, the server can generate security profile information based on the access traffic feature information and threat level attribute label information, using a reference profile in a preset profile database as a template. In specific implementations, the security profile information can be displayed in the form of lists, items, and charts, etc. The specific display format is not limited here.

[0101] In this embodiment, traffic vector information is generated based on the packets in the access traffic data, and access traffic feature information is generated based on the packets and traffic vector information. Threat level attribute label information is generated based on access behavior log information and vulnerability information. Security profile information is generated based on access traffic feature information and threat level attribute label information. This allows for the analysis of the packets carried in the access traffic data to generate access traffic feature information. Combined with the threat level attribute label information generated from access behavior log information and vulnerability information, accurate security profile information is obtained. This allows for the adjustment of the initial trust level based on the trust assessment value generated from the traffic behavior trust information and the security profile, thereby obtaining access permissions to control business access operations and improving the security of business access.

[0102] In some embodiments, threat level attribute label information is generated based on access behavior log information and vulnerability information, including: determining historical access behavior information based on access behavior log information, and determining access attribute label information based on historical access behavior information; analyzing access behavior log information based on preset situational awareness analysis strategy information to determine access behavior label information; and generating threat level attribute label information based on access attribute label information, access behavior label information, and vulnerability information.

[0103] Historical access behavior information can refer to information that represents the access operations that a user has performed on the business system through the user terminal.

[0104] The access attribute tag information can refer to the proportion of the number of access operations of the user terminal to the business system and / or specific business applications in the business system to the total number of access operations of the business system and / or specific business applications in the business system.

[0105] Among them, the preset situational awareness analysis strategy information can refer to the information of the strategy used to analyze the degree of security threat to the accessed services by the terminal. In practical applications, the analysis dimensions represented by the preset situational awareness analysis strategy information may include, but are not limited to, whether there is an abnormal behavior source.

[0106] Among them, access behavior tag information can refer to information that characterizes whether there are any abnormalities in the user terminal's access operations / access behavior to the business system and / or business application.

[0107] As an example, the server can use access behavior log information to statistically analyze the total number of resource accesses, the ranking of total resource accesses among all access terminals, and the number of times access to business system resources is authorized and unauthorized. This allows the server to collect historical access behavior information and determine access attribute tag information based on the historical access behavior information. The server can also analyze the access behavior log information for abnormal behavior sources and / or abnormal operations based on preset situational awareness analysis strategies to obtain access behavior tag information. Then, the server can generate threat level attribute tag information based on the access attribute tag information, access behavior tag information, and vulnerability information.

[0108] In this embodiment, historical access behavior information is determined based on access behavior log information, and access attribute tag information is determined based on historical access behavior information; access behavior log information is analyzed according to preset situational awareness analysis strategy information to determine access behavior tag information; threat level attribute tag information is generated based on access attribute tag information, access behavior tag information, and vulnerability information. This allows for a thorough analysis of the quantity and results of access behaviors and whether there are any anomalies in the access behaviors, obtaining accurate threat level attribute tag information. This information can then be combined with access traffic characteristic information to generate accurate security profile information, thereby improving the accuracy of the security profile information.

[0109] In some embodiments, generating access traffic feature information based on message and traffic vector information includes: dividing the message into at least one message segment and obtaining syntactic keywords in the message segment; obtaining keywords that match the syntactic keywords from a preset keyword database; and generating access traffic feature information based on traffic vector information, keywords, the number of occurrences of each field in the message, and the number of messages.

[0110] Here, a message fragment can refer to information obtained by dividing a message into several fragments.

[0111] Syntax keywords can refer to text and / or data with specific meanings. In practical applications, syntax keywords can be used to compare the text and / or data in the message with a preset syntax keyword database one by one. The text and / or data existing in the preset syntax keyword database can be used as syntax keywords.

[0112] The preset keyword database can refer to a pre-set database used to determine keywords. In practical applications, the preset keyword database can contain several keywords.

[0113] Here, keywords can refer to text / data that matches grammatical keywords in a pre-defined keyword database.

[0114] The number of times each field appears in the message can refer to information that represents the number of times each field appears in the message.

[0115] Among them, the message quantity information can refer to information that represents the total number of messages.

[0116] As an example, the server can divide a message into several message fragments, parse each message fragment to obtain the syntactic keywords in the message fragment, and then perform keyword feature transformation on the syntactic keywords to obtain several keywords with the same keyword features that constitute semantics. The server can match the several keywords with the same keyword features that constitute semantics with the (valid) keywords stored in the preset keyword database to obtain keywords. Then, the server can generate access traffic feature information based on traffic vector information, the matched keywords, the occurrence frequency of each field in the message, and the number of messages.

[0117] In this embodiment, by dividing the message into at least one message segment and obtaining the grammatical keywords in the message segment; obtaining keywords that match the grammatical keywords from a preset keyword database; and generating access traffic feature information based on traffic vector information, keywords, the frequency of occurrence of each field in the message, and the number of messages, the system can fully analyze the message content, combine the keywords in the message and the number of messages to obtain accurate access traffic feature information, so as to generate accurate security profile information by combining threat level attribute tag information and improve the accuracy of security profile information.

[0118] In some embodiments, the server can read the user terminal's behavior log information, access traffic data, and attribute information through a preset program. The attribute information includes the terminal's hardware information, system configuration information, physical address information, account information, and network address information, etc. The access traffic data is the user's business access traffic data, and the access behavior log information includes the total number of times the terminal accesses the power system business application, the number of times it attempts to access without authorization, the number of times it successfully accesses, etc.

[0119] like Figure 3The diagram illustrates a process for obtaining initial access permissions. The server can authenticate the terminal based on attribute information, determine the initial trust level based on the authentication, and then determine the terminal's initial access permissions to the business system based on the initial trust level. Specifically, the server can search for legitimate information matching the terminal's attribute information in the information management database. Legitimate information matching the terminal's attribute information only exists in the information management database; illegitimate information does not. If legitimate information is found, the terminal's attribute information is considered legitimate. After confirming the legitimacy, an access request is sent to the power system business application. The server analyzes the authorization token carried in the access request and compares it with the stored terminal authorization tokens. If they match, the authorization token verification is successful. Once verified, the terminal's authentication is complete, and the terminal's identity information is determined. The server then matches the corresponding initial trust level in the database based on the terminal's identity information. Based on the initial trust level, the terminal's initial access permissions to the business system are determined. Finally, the initial access permissions are matched against the corresponding access permissions in the permission management database based on the initial trust level.

[0120] like Figure 4The diagram illustrates a process for determining traffic behavior trust information. The server can perform traffic behavior analysis based on access traffic data to obtain traffic behavior information, construct a fuzzy consistency matrix, and then calculate the traffic behavior trust value (traffic behavior trust information) based on the fuzzy consistency matrix and the traffic behavior information. Specifically, the server can perform traffic behavior analysis on access traffic data using deep flow inspection technology. Deep flow inspection technology employs application identification technology based on traffic behavior, meaning that different application types manifest differently in the state of session connections or data streams. This analysis identifies the source address, destination address, source port, destination port, and response information of the access traffic data. Then, the server can perform deep packet inspection analysis on the access traffic data using deep packet inspection technology to obtain packet feature data and payload content. The payload content is the data packet containing the code's effective payload. Deep packet inspection technology is an application-layer-based traffic detection and control technology that matches packet feature data with preset attack behavior feature data. If the packet feature data successfully matches the preset attack behavior feature data, a trust level label is added to the access traffic data; here, the trust level label is set to medium. The server can then construct traffic behavior information from the source address, destination address, source port, destination port, response information, packet characteristics, and payload content of the access traffic data. Behavioral parameters are configured, including network behavior indicators and attack behavior indicators. Network behavior indicators include the complexity of changes in the terminal's source address, destination address, source port, and destination port. Attack behavior indicators are the number of historical attack behaviors that occurred when the terminal accesses the business system. The server can then construct a judgment matrix using these behavioral parameters. An evaluation hierarchy is built using the analytic hierarchy process (AHP) based on these indicators. The initial judgment matrix is ​​then determined to be an n*n square matrix, where n represents the behavioral parameter indicator in the evaluation hierarchy. An initial judgment matrix is ​​established based on this determined initial judgment matrix form. The consistency of the initial judgment matrix is ​​verified using preset verification coefficients. The maximum eigenvalue of the initial judgment matrix is ​​calculated, and consistency is verified against the maximum eigenvalue using the preset verification coefficients. The consistency index (CI) can be expressed as:

[0121] .

[0122] in, It can refer to the largest eigenvalue of the judgment matrix, and n can refer to the order of the judgment matrix.

[0123] The Random Index (RI) is calculated from a random matrix using a formula, and can be replaced by a preset verification coefficient. The Consistency Ratio (CR) can be expressed as: CR = CI / RI. The preset verification coefficient can be obtained from a preset database. If the consistency check fails, the initial judgment matrix is ​​modified; if the consistency check passes, no modification is needed. After completing the consistency check of the initial judgment matrix, the final judgment matrix can be obtained, and a fuzzy consistency matrix can be constructed based on the judgment matrix. The calculation expression for each element in the fuzzy consistency matrix can be expressed as:

[0124] .

[0125] Among them, a ij Let a be the element in the i-th row and j-th column of the fuzzy consistency matrix. ii To determine the sum of the elements in the i-th row of a matrix, a jj To determine the sum of the elements in the j-th row of the matrix, where n is the total number of row parameter indicators and σ is the correction coefficient.

[0126] The server can normalize the fuzzy consistent matrix to obtain the weight vector (weight information) corresponding to each element. The calculation expression for the weight vector can be expressed as:

[0127] .

[0128] Among them, w i It can refer to the weight of the i-th element.

[0129] The server can obtain a trust assessment value for traffic behavior information based on preset evaluation rules. The preset evaluation rules are determined by expert rules. The trust assessment value of traffic behavior information is calculated based on the weight vector to obtain the traffic behavior trust value. If the data packet feature data matches the preset attack behavior feature data, a correction coefficient is obtained based on the trust level mark. The traffic behavior trust value is corrected based on the correction coefficient to obtain the final traffic behavior trust value.

[0130] like Figure 5The diagram illustrates a process for generating security profile information. The server can obtain access traffic characteristics based on access traffic data, obtain threat level attribute tags based on access behavior log information and attribute information, and generate a target security profile based on the access traffic characteristics and threat level attribute tags. Specifically, the server can extract basic attribute information of packets from the access traffic data. This basic attribute information includes the source IP, destination IP, traffic type, packet length, and packet frequency. Based on the basic attributes of the packets, a traffic base vector is represented. The access traffic data is semantically parsed using a protocol parsing method, and the protocol packets are segmented into several segments using synchronous parsing. These segments are parsed to extract syntactic key fields (keywords). Keyword feature transformations are performed on the syntactic key fields to obtain several keywords whose features are identical and constitute semantics. These keywords are matched with valid keywords stored in the database to obtain target key fields. Based on the target key fields, prior knowledge is used to match syntactic key fields to obtain semantic keyword features. High-frequency words in the access traffic data packet segments are statistically analyzed. The frequency of field occurrences is determined by the proprietary protocols used in power systems. Therefore, the location and frequency of specific fields within these protocols are generally fixed. Scanning the protocols allows for the statistical analysis of field occurrences. By counting the total number of packets in the access traffic data, the access traffic characteristics are constructed using the traffic base vector, the frequency of high-frequency fields, semantic keyword features, and the total number of packets. The server can then analyze and statistically process multiple historical access behaviors of terminals based on access behavior logs. This analysis can be performed through information flow tasks. Dimensional information for this analysis may include total resource access volume, the ranking of total resource access volume among all access terminals, and the number of authorized and unauthorized accesses to business system resources. Access attribute tags are obtained based on historical access behavior. If the total resource access volume ranks high among all access terminals, the access attribute tag indicates a high-resource-access-volume terminal. The server can then analyze the access behavior logs for abnormal behavior sources based on a preset situational awareness analysis strategy. Abnormal behavior sources may include terminals repeatedly accessing the business system without authorization. The preset situational awareness analysis strategy refers to the strategy for detecting and analyzing the security threat level posed by the terminal to the accessed services. Situational awareness analysis strategies can be built into the server or provided by a third party. The server can determine access behavior tags based on the presence of abnormal behavior sources. The server can detect vulnerability information based on attribute information. The vulnerability information database detects vulnerabilities in the terminal's attribute information. The vulnerability information database contains vulnerability types and threat levels. Based on the types and threat levels of the vulnerabilities, vulnerability threat tags are determined. Vulnerability threat tags, such as a large number of vulnerabilities, are used to determine the threat level attribute tag. The vulnerability threat tag, access attribute tag, and access behavior tag together constitute the threat level attribute tag.The server can generate a target security profile based on access traffic characteristics and threat level attribute tags using data visualization methods. It can use similar profiles in the profile model library as templates to quickly generate a target security profile by using the access traffic characteristics and threat level attribute tags.

[0131] like Figure 6 The diagram illustrates a process for obtaining access permissions. The server can calculate a trust assessment value based on traffic behavior trust values ​​and the target security profile using a trust assessment model. Specifically, the server can construct a DIET model as the initial trust assessment model. The DIET (Dual Intent and Entity Transformer) model is a multi-task architecture that can simultaneously perform intent classification and entity recognition. The DIET model includes a feature pipeline module, a Transformer layer, a named entity recognition module, a masking layer, and a classification module. The feature pipeline module includes a sparse feature layer and a fully connected layer. The sparse feature layer helps reduce the dimensionality of the data, thereby enabling faster and more efficient training and inference. The sparse feature layer includes three EmbeddingBag modules, which are optimized on top of the Embedding layer. The first EmbeddingBag module has a length of 5 one-hot characters, and the second EmbeddingBag module has a length of 5 one-hot characters. The `ingBag` module has a length of 4 one-hot encodings, and the third `EmbeddingBag` module has a length of 3 one-hot encodings. The feature pipeline module is used to match the dimensionality of dense features. The Transformer layer is used to enhance the model's ability to extract higher-dimensional features. The named entity recognition module corresponds to the input sequence of the Transformer layer. The mask layer acts as a regularization layer, learning more features from the text. The classification module is used to perform label embedding calculations. The initial trust assessment model is trained to obtain a trained trust assessment model. The traffic behavior trust value and the target security profile are input into the trained trust assessment model, which performs trust assessment calculations and outputs a trust assessment value. Then, the server can adjust the initial trust level based on the trust assessment value to obtain the target trust level. Based on the target trust level, the final access permissions of the terminal to the business system are determined. The server can re-match trust levels in the database based on the trust assessment value to obtain the final target trust level. Based on the target trust level, the server adjusts the initial access permissions of the terminal to the business system and determines the final access permissions (access permission information) of the terminal to the business system. The server can then perform access control on the terminal's access to the power business system or business application based on the final access permissions, thereby determining the permitted and prohibited operations of the terminal device after it accesses the power business system or business application.

[0132] In this embodiment, traffic behavior analysis is performed based on access traffic data to obtain traffic behavior information, enabling a comprehensive analysis of the access traffic data. Then, based on a fuzzy consistency matrix combined with the traffic behavior information, traffic behavior trust calculation is performed to obtain a traffic behavior trust value, making the obtained trust value more accurate and the traffic behavior trust calculation more comprehensive. Access traffic characteristics are obtained based on access traffic data, and threat level attribute tags are obtained based on access behavior log information and attribute information. A target security profile is generated based on the access traffic characteristics and threat level attribute tags. This target security profile can more comprehensively and accurately assess the potential risks of terminal devices accessing the power business system. Furthermore, combining the threat level attribute tags to generate the target security profile ensures the comprehensiveness of the profile information while improving the profile generation speed. Trust assessment is performed using a trust assessment model based on the traffic behavior trust value and the target security profile. The DIET model is used to calculate the trust assessment value more accurately. Simultaneously, calculating the trust assessment value using both the traffic behavior trust value and the target security profile makes the obtained trust assessment value more reliable. This makes the final access permissions more accurate and reliable. Based on these permissions, better access control can be exercised over terminal access to the business system, improving the security of the access system, preventing system threats, and thus enhancing the security of business access.

[0133] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0134] Based on the same inventive concept, this application also provides a dynamic trust assessment-based service access device for implementing the aforementioned dynamic trust assessment-based service access method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the dynamic trust assessment-based service access device provided below can be found in the limitations of the dynamic trust assessment-based service access method described above, and will not be repeated here.

[0135] In one exemplary embodiment, such as Figure 7 As shown, a business access device based on dynamic trust assessment is provided, including: an attribute information analysis module 702, an access traffic analysis module 704, a profile generation module 706, a trust assessment module 708, and a permission determination module 710, wherein:

[0136] The attribute information analysis module 702 is used to determine the initial trust level of the user terminal based on the attribute information in a preset trust level database when the attribute information of the user terminal is legal and the user terminal has passed authentication.

[0137] The access traffic analysis module 704 is used to analyze the access traffic data of the user terminal, determine traffic behavior information, and determine traffic behavior trust information based on the traffic behavior information.

[0138] The profile generation module 706 is used to determine the vulnerability information in the attribute information based on a preset vulnerability information database, and generate security profile information based on the user terminal's access behavior log information, the vulnerability information, and the access traffic data.

[0139] The trust assessment module 708 is used to input the traffic behavior trust information and the security profile information into a pre-trained trust assessment model to obtain a trust assessment value.

[0140] The permission determination module 710 is used to adjust the initial trust level according to the trust assessment value to obtain the adjusted trust level, and to determine the user terminal's access permission information for the business system according to the adjusted trust level; the access permission information is used to control the user terminal's access operations for the business system.

[0141] In one exemplary embodiment, the access traffic analysis module 704 is further configured to obtain behavioral parameter index information corresponding to the traffic behavior information; construct a fuzzy consistency matrix based on the behavioral parameter index information, and obtain the weight information of each element in the fuzzy consistency matrix; determine the evaluation value of the traffic behavior information according to a preset evaluation rule, and determine the trust information of the traffic behavior based on the trust evaluation value and the weight information.

[0142] In one exemplary embodiment, the access traffic analysis module 704 is further configured to determine the evaluation hierarchy information based on the behavioral parameter index information using the analytic hierarchy process; generate an initial judgment matrix based on the evaluation hierarchy information; and generate the fuzzy consistency matrix based on the initial judgment matrix if the largest eigenvalue corresponding to the initial judgment matrix passes the consistency check.

[0143] In one exemplary embodiment, the profile generation module 706 is further configured to generate traffic vector information based on the packets in the access traffic data, and generate access traffic feature information based on the packets and the traffic vector information; generate threat level attribute label information based on the access behavior log information and the vulnerability information; and generate the security profile information based on the access traffic feature information and the threat level attribute label information.

[0144] In one exemplary embodiment, the profile generation module 706 is further configured to determine historical access behavior information based on the access behavior log information, and determine access attribute tag information based on the historical access behavior information; analyze the access behavior log information according to preset situational awareness analysis strategy information to determine access behavior tag information; and generate the threat level attribute tag information based on the access attribute tag information, the access behavior tag information, and the vulnerability information.

[0145] In one exemplary embodiment, the profile generation module 706 is further configured to divide the message into at least one message segment and obtain keywords in the message segment; obtain grammatical keywords that match the keywords in a preset grammatical keyword database; and generate the access traffic feature information based on the traffic vector information, the grammatical keywords, the number of occurrences of each field in the message, and the number of messages.

[0146] The modules in the aforementioned service access device based on dynamic trust assessment can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0147] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores attribute information, access traffic data, and access behavior logs. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a business access method based on dynamic trust assessment.

[0148] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0149] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0150] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0151] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0152] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0153] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0154] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0155] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for service access based on dynamic trust evaluation, characterized in that, The method comprises: In the case that the attribute information of the user terminal is legal information and the user terminal passes the identity authentication, determining an initial trust level corresponding to the user terminal in a preset trust level database according to the attribute information; the attribute information comprises hardware information, system configuration information, physical address information, account information and network address information of the user terminal; Analyzing access traffic data of the user terminal to determine traffic behavior information, obtaining behavior parameter index information corresponding to the traffic behavior information, determining evaluation hierarchy structure information according to the behavior parameter index information based on the analytic hierarchy process, determining the form of an initial judgment matrix according to the evaluation hierarchy structure information, and establishing the initial judgment matrix according to the form of the initial judgment matrix and the behavior parameter index information; verifying the consistency of the initial judgment matrix by using a preset verification coefficient, generating the fuzzy consistent matrix according to the initial judgment matrix in the case that the maximum eigenvalue corresponding to the initial judgment matrix passes the consistency verification, obtaining weight information of each element in the fuzzy consistent matrix, determining an evaluation value of the traffic behavior information according to a preset evaluation rule, and determining the traffic behavior trust information according to the evaluation value and the weight information; the traffic behavior information comprises source address, destination address, source port, destination port, response information of a reply packet, packet feature data and payload content; Based on a preset vulnerability information library, determining vulnerability information in the attribute information, extracting basic attribute information of a packet carried by the access traffic data from the access traffic data, and generating traffic vector information according to the basic attribute information; dividing the packet into at least one packet segment, and obtaining a syntax keyword in the packet segment; obtaining a keyword matched with the syntax keyword in a preset keyword database; generating access traffic feature information according to the traffic vector information, the keyword, the number of occurrences of each field in the packet and the number information of the packet; determining historical access behavior information according to access behavior log information of the user terminal, and determining access attribute tag information based on the historical access behavior information; analyzing the access behavior log information according to preset situation awareness analysis strategy information to determine access behavior tag information; generating threat degree attribute tag information according to the access attribute tag information, the access behavior tag information and the vulnerability information; generating security portrait information of the user terminal by taking a reference portrait in a preset portrait database as a template according to the access traffic feature information and the threat degree attribute tag information; the access attribute tag information refers to information about the proportion of the number of access operations of the user terminal on a business system and / or a specific business application in the business system to the total number of access operations on the business system and / or the specific business application in the business system; the access behavior tag information refers to information about whether the access operation of the user terminal on the business system is abnormal. inputting the traffic behavior trust information and the security portrait information into a pre-trained trust evaluation model to obtain a trust evaluation value; adjusting the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determining access permission information of the user terminal for the business system according to the adjusted trust level; the access permission information is used to control an access operation of the user terminal for the business system.

2. The method of claim 1, wherein, The elements refer to data constituting the fuzzy consistent matrix.

3. The method of claim 1, wherein, The evaluation value of the traffic behavior information refers to information representing a threat degree of the traffic behavior information to the business system.

4. The method of claim 1, wherein, The trust evaluation model comprises an entity extraction and intent classification model.

5. The method of claim 1, wherein, The business system comprises a power business system.

6. The method of claim 1, wherein, The maximum eigenvalue refers to a maximum value in eigenvalues corresponding to the initial judgment matrix.

7. A service access apparatus based on dynamic trust evaluation, characterized by, The device comprises: An attribute information analysis module is configured to determine an initial trust level corresponding to the user terminal in a preset trust level database according to attribute information of the user terminal in a case where the attribute information is legitimate information and the user terminal passes identity verification; the attribute information comprises hardware information, system configuration information, physical address information, account information and network address information of the user terminal. An access traffic analysis module is configured to analyze access traffic data of the user terminal, determine traffic behavior information, obtain behavior parameter index information corresponding to the traffic behavior information, determine evaluation hierarchy structure information according to the behavior parameter index information based on an analytic hierarchy process, determine a form of an initial judgment matrix according to the evaluation hierarchy structure information, establish the initial judgment matrix according to the form of the initial judgment matrix and the behavior parameter index information, verify consistency of the initial judgment matrix by using a preset verification coefficient, generate the fuzzy consistent matrix according to the initial judgment matrix in a case where a maximum eigenvalue corresponding to the initial judgment matrix passes consistency verification, obtain weight information of each element in the fuzzy consistent matrix, determine an evaluation value of the traffic behavior information according to a preset evaluation rule, and determine the traffic behavior trust information according to the evaluation value and the weight information; the traffic behavior information comprises a source address, a destination address, a source port, a destination port, response information of a back packet, feature data of a data packet and load content. The image generation module is configured to determine vulnerability information in the attribute information based on a preset vulnerability information base, extract basic attribute information of a packet carried by the access traffic data from the access traffic data, generate traffic vector information according to the basic attribute information, divide the packet into at least one packet segment, obtain a syntax keyword in the packet segment, obtain a keyword matched with the syntax keyword in a preset keyword database, generate access traffic feature information according to the traffic vector information, the keyword, occurrence times of each field in the packet, and quantity information of the packet, determine historical access behavior information according to the access behavior log information of the user terminal, determine access attribute label information based on the historical access behavior information, analyze the access behavior log information according to preset situation awareness analysis strategy information, determine access behavior label information, generate threat degree attribute label information according to the access attribute label information, the access behavior label information, and the vulnerability information, generate security image information of the user terminal according to the access traffic feature information and the threat degree attribute label information, and take a reference image in a preset image database as a template. The trust evaluation module is configured to input the traffic behavior trust information and the security image information into a pre-trained trust evaluation model to obtain a trust evaluation value. The permission determination module is configured to adjust the initial trust level according to the trust evaluation value to obtain an adjusted trust level, and determine access permission information of the user terminal for the business system according to the adjusted trust level, wherein the access permission information is used to control access operations of the user terminal for the business system. 8.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-7. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

Images