Server access management method and device, electronic equipment and storage medium

Abstract

The invention discloses a server access management method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring access traffic information corresponding to an access behavior received by a gateway server; determining one or more access information features according to the access traffic information; analyzing the one or more access information features through a traffic recognition model obtained through training to obtain server features corresponding to the access information features; and according to the server characteristics and an access strategy corresponding to the client, judging whether the client has an access permission, if so, allowing the access behavior of the client, and if not, refusing the access behavior of the client. Through the access management method and device of the server, the electronic equipment and the storage medium, the access of the server can be managed and controlled more reasonably and effectively, the intelligent degree of management of the access of the server is improved, and the protection capability of the access security of the server can be further improved.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to a server access management method, device, electronic device and storage medium. Background Art

[0002] As the business of enterprises continues to expand, enterprises need to continuously deploy various devices to meet the growing business needs. However, when the number of devices, especially the number of servers regarded as important assets, reaches a certain scale, relying on manual management often leads to many problems such as chaotic asset management and loose control of asset access rights, which poses a hidden danger to the information security of enterprises. Therefore, how to control the access to servers more reasonably and effectively has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present application disclose a server access management method, device, electronic device and storage medium, which can more reasonably and effectively control the access to the server, improve the intelligence level of the management of the server access, and further improve the protection capability of the server access security.

[0004] A first aspect of an embodiment of the present application discloses a method for managing access to a server, the method comprising:

[0005] Collecting access traffic information corresponding to access behaviors received by the gateway server, where the access behaviors refer to the behaviors of the client accessing any server;

[0006] determining one or more access information features according to the access flow information;

[0007] Analyze the one or more access information features through the trained traffic identification model to obtain server features corresponding to the access information features;

[0008] According to the server characteristics and the access policy corresponding to the client, it is determined whether the client has the access rights. If the client has the access rights, the access behavior of the client is allowed; if the client does not have the access rights, the access behavior of the client is denied.

[0009] In some possible embodiments, before the traffic identification model obtained through training analyzes the one or more access information features to obtain server features corresponding to the access information features, the method further includes:

[0010] Acquire a training data set, where the training data set includes a plurality of first access samples, each of the first access samples includes access sample information and actual server information corresponding to the access sample information;

[0011] Determining, according to the access sample information included in each of the first access samples, an access sample feature corresponding to each of the first access samples;

[0012] Determining, according to the actual server information included in each of the first access samples, a server sample feature corresponding to each of the first access samples;

[0013] The traffic identification model to be trained is trained according to the access sample features and the corresponding server sample features respectively corresponding to the multiple first access samples.

[0014] In some possible embodiments, the traffic identification model includes multiple hidden layers; and training the traffic identification model to be trained according to the access sample features and the corresponding server sample features respectively corresponding to the multiple first access samples includes:

[0015] Inputting the target access sample feature into the first hidden layer of the traffic identification model, and determining the output feature according to the target access sample feature through the first hidden layer; the target access sample feature is the access sample feature included in any of the first access samples;

[0016] Determine the output feature of the nth hidden layer according to the output feature of the n-1th hidden layer through the nth hidden layer, where n is an integer greater than 1;

[0017] Determine the predicted server features according to the output features of the last hidden layer;

[0018] Calculating an error based on the predicted server feature and the server sample feature corresponding to the target access sample feature;

[0019] If the error is greater than the error threshold, a back propagation method is used to adjust the parameters of the traffic identification model according to the error;

[0020] If the error is not greater than the error threshold, it is determined that the traffic identification model training is completed.

[0021] In some possible embodiments, determining the output feature of the nth hidden layer according to the output feature of the n-1th hidden layer through the nth hidden layer includes:

[0022] Determine the output feature of the nth hidden layer according to the weight and bias corresponding to the nth hidden layer and the output feature of the n-1th hidden layer.

[0023] In some possible embodiments, each of the hidden layers includes J neurons; and determining the output feature of the nth hidden layer according to the weight and bias corresponding to the nth hidden layer and the output feature of the n-1th hidden layer includes:

[0024] Determine a first feature corresponding to the jth neuron according to a weight corresponding to the jth neuron in the nth hidden layer and an output feature of the n-1th hidden layer, where j is an integer greater than or equal to 1 and less than or equal to J;

[0025] Determining a second feature corresponding to the j-th neuron according to the first feature corresponding to the j-th neuron and the deviation corresponding to the j-th neuron;

[0026] The output feature of the nth hidden layer is determined according to the second features respectively corresponding to the J neurons.

[0027] In some possible embodiments, the server feature includes a server access traffic value; and judging whether the client has access rights according to the server feature and an access policy corresponding to the client includes:

[0028] Determine, according to the access policy corresponding to the client, a target access flow value of the target server corresponding to the access behavior;

[0029] Determine whether the difference between the server access flow value and the target access flow value is within a target range;

[0030] If the difference between the server access flow value and the target access flow value is within the target range, it is determined that the client has access rights to the target server;

[0031] If the difference between the server access flow value and the target access flow value is not within the target range, it is determined that the client does not have access rights to the target server.

[0032] In some possible embodiments, the access policy corresponding to the client includes an access whitelist corresponding to the client, and the access whitelist includes various servers that the client can access; and determining, according to the access policy corresponding to the client, a target access flow value of a target server corresponding to the access behavior includes:

[0033] Determine whether the target server corresponding to the access behavior is in the access whitelist corresponding to the client;

[0034] If the target server is in the access whitelist corresponding to the client, determine the target access flow value of the target server according to the access policy corresponding to the client;

[0035] The method further comprises:

[0036] If the target server is not in the access whitelist corresponding to the client, it is determined that the client does not have access rights to the target server.

[0037] A second aspect of an embodiment of the present application discloses an access management device for a server, the device comprising:

[0038] An information collection module is used to collect access flow information corresponding to access behaviors received by the gateway server, where the access behaviors refer to the behaviors of the client accessing any server;

[0039] A feature acquisition module, used to determine one or more access information features according to the access flow information;

[0040] A traffic identification module, configured to analyze the one or more access information features through a trained traffic identification model to obtain server features corresponding to the access information features;

[0041] The access judgment module is used to judge whether the client has access rights according to the server characteristics and the access policy corresponding to the client. If the client has the access rights, the access behavior of the client is allowed; if the client does not have the access rights, the access behavior of the client is denied.

[0042] A third aspect of an embodiment of the present application discloses an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor implements the method described in any of the above embodiments.

[0043] A fourth aspect of the embodiments of the present application discloses a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor in an electronic device, the electronic device implements the method described in any of the above embodiments.

[0044] In an embodiment of the present application, the access traffic information corresponding to the access behavior received by the gateway server is collected, one or more access information features are determined based on the access traffic information, and one or more access information features are analyzed by the trained traffic identification model to obtain the server features corresponding to the access information features, and whether the client has access rights is determined based on the server features and the access policy corresponding to the client. If the client has access rights, the client's access behavior is allowed, and if the client does not have access rights, the client's access behavior is denied. In an embodiment of the present application, the access traffic information corresponding to the access behavior received by the gateway server can be collected, and the access information features corresponding to the access behavior can be analyzed by the traffic identification model to predict the server features corresponding to the access behavior. Then, based on the server features and the access policy corresponding to the client, it can be accurately determined whether the client has access rights, and the access to the server can be more reasonably and effectively managed and controlled, which improves the intelligence level of managing server access and can further improve the protection capabilities of server access security. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 An application scenario diagram of a server access management method provided in an embodiment of the present application;

[0047] Figure 2 A flowchart of a server access management method provided in an embodiment of the present application;

[0048] Figure 3 A flowchart of another server access management method provided in an embodiment of the present application;

[0049] Figure 4 A flowchart of another server access management method provided in an embodiment of the present application;

[0050] Figure 5 A flowchart of a gateway server sending alarm information to a control terminal of a first server provided in an embodiment of the present application;

[0051] Figure 6 A flow chart of using a training data set to train a traffic recognition model to be trained provided in an embodiment of the present application;

[0052] Figure 7A flow chart of a traffic identification model constructed based on a DNN for training provided in an embodiment of the present application;

[0053] Figure 8 A flowchart of updating the output features of a hidden layer in a traffic identification model based on a DNN provided in an embodiment of the present application;

[0054] Fig. 9 A structural block diagram of an access management device for a server provided in an embodiment of the present application;

[0055] Fig.10 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0057] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0058] In addition, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

[0059] Figure 1 This is an application scenario diagram of a server access management method provided in an embodiment of the present application. Figure 1 As shown, the access scenario of the server includes multiple clients 110 , a management and control server 120 and one or more servers 130 .

[0060] The client 110 may include but is not limited to terminal devices such as personal computers, mobile phones, and tablets, and may also be other types of electronic devices with communication capabilities. The client 110 may initiate access to the server 130 to obtain data or services of the server 130.

[0061] The control server 120 may refer to a data exchange hub of a communication network, which may be used to control the access behavior of multiple clients 110 to multiple servers 130, so that data can be transmitted safely and reliably. Optionally, the control server 120 may be a server, or a router, switch or other network device with a gateway function, which is not specifically limited here.

[0062] The server 130 may be a computing device that stores, processes, and provides various types of data and services for the client 110. The server 130 may be a physical server or a virtual server running in a virtual machine or container, which is not specifically limited here. The multiple servers 130 may be multiple sub-servers in a server cluster or multiple separate discrete servers, which is not specifically limited here.

[0063] The multiple clients 110 establish network connections with the control server 120, and the control server 120 establishes network connections with the multiple servers 130, thereby realizing the function of mutual data transmission and forwarding. The service end running on the server 130 can pre-build access policies corresponding to the multiple clients 110 according to user needs. The service end can refer to the program on the server 130 that provides data storage, data processing and other services for the client 110, and the access policy can refer to the access rights of the client 110 to different servers 130. Optionally, the server end of the server cluster can also pre-build access policies corresponding to the multiple clients 110.

[0064] Exemplarily, the multiple servers 130 include server A, server B and server C, and the access policy of the client 110 is pre-built as follows: the client 110 can access server A and server C, but cannot access server B, that is, the client 110 has access rights to server A and server C, but does not have access rights to server B.

[0065] The control server 120 is provided with a traffic identification model. The control server 120 determines whether the client 110 has access rights to the server 130 through the traffic identification model combined with the access policy. In the process of the client 110 accessing the server 130, the client 110 needs to first initiate an authorization authentication request to the control end of the server 130. After the authentication is successful, the control end can issue the corresponding access policy to the client 110 and the control server 120. The client 110 can initiate access behavior to the server 130 protected by the control server 120. The control server 120 analyzes the access information characteristics corresponding to the access behavior of the client 110 through the traffic identification model, and obtains the server characteristics corresponding to the access behavior of the client 110. The control server 120 verifies according to the server characteristics and the access policy, that is, determines whether the client 110 has access rights to the server 130. In the case that the client 110 has access rights to the server 130, the control server 120 allows the access behavior of the client 110 to be sent to the server 130, and the client 110 can successfully access the server 130.

[0066] like Figure 2 As shown, in one embodiment, a method for managing access to a server is provided, which can be applied to a control server, and the control server can be a gateway server or a server that is connected to the gateway server in communication. The method can include the following steps:

[0067] Step 202: Collect access traffic information corresponding to the access behavior received by the gateway server.

[0068] Access behavior refers to the action of a client accessing or requesting resources from a server, which may include but is not limited to reading data, writing data, or executing remote commands.

[0069] Access traffic information may refer to the data generated by the gateway server when receiving and processing the access behavior of the client. Access traffic information may include the user's personal information, user device information, user network information and other information corresponding to the client. User personal information may refer to information used to identify the client, which may include but is not limited to the client's user name, personal settings or browsing history, etc.; user device information may refer to information related to parameters and attributes of the client device, which may include but is not limited to configuration information such as the client device's processor information, memory or hard disk capacity, etc.; user network information may refer to relevant information about the communication network where the client is located, which may include but is not limited to the client's IP address and the client's network connection status, etc.

[0070] It should be understood that a network packet is the basic unit of information transmission in a communication network, so a client can send a network packet to a server to complete an access, and a gateway server can obtain the network packet sent by the client to the server and collect access flow information corresponding to the access behavior. Optionally, the access flow information corresponding to the access behavior can be recorded in the packet header of the network packet.

[0071] Exemplarily, 50 bytes of content are added to the header of each network packet to store access traffic information such as user personal information, user device information, and user network information.

[0072] Step 204: determine one or more access information features based on the access flow information.

[0073] The access information feature is data extracted from the access traffic information to describe the specific attributes of the client access behavior. In some embodiments, the access information feature may include recording user personal information, request source Internet Protocol (IP) address, source port, target IP address, target port, access protocol, access route, etc.

[0074] The source IP address of the request may be the IP address of the client that initiates the request, the source port may refer to the port number used by the client that initiates the request, the target IP address may refer to the IP address of the target server that the client wants to access, the target port may refer to the port number used by the target server that the client wants to access, the access protocol may refer to the type of protocol used by the client to establish a communication connection with the target server, and the access route may refer to the path that the network packet passes through from the client to the target server.

[0075] Step 206: Analyze one or more access information features using the trained traffic identification model to obtain server features corresponding to the access information features.

[0076] The gateway server can input the access information features in the client's access traffic information into the traffic identification model obtained through training for analysis. The traffic identification model can output the predicted server features, and the gateway server can determine whether the client has access rights based on the predicted server features. The traffic identification model can be constructed through machine learning algorithms, which can include but are not limited to deep learning, neural networks, decision trees, and support vector machines.

[0077] Exemplarily, a traffic identification model can be constructed using a deep neural network (DNN) algorithm, and one or more access information features including the request source IP address, source port, target IP address, target port, access protocol, and access route are introduced into the trained traffic identification model. The access information features are analyzed by the traffic identification model to predict server features corresponding to the access information features.

[0078] Server characteristics may refer to data extracted from the properties of the target server. Server characteristics may include, but are not limited to, one or more of server access traffic value, asset IP address, asset ownership, asset type, and asset tag.

[0079] The server access traffic value may refer to the numerical value of the traffic size actually generated by the client accessing the server, the asset IP address may refer to the IP address of the server, the asset ownership may refer to the department or individual to which the server belongs, and the asset type may refer to the functional attributes of the server. For example, depending on the function of the server, the asset type may include but is not limited to file servers, database servers, application servers and Web servers. The asset tag may refer to a tag used to identify and distinguish the server. The tag may include but is not limited to a barcode, a QR code and a unique identifier.

[0080] In some embodiments, before inputting one or more access information features into the trained traffic identification model, the one or more access information features may be converted into feature vectors. The one or more access information features may be converted into numerical access information features to obtain feature values ​​corresponding to each access information feature, and the feature values ​​corresponding to each access information feature may be combined into a feature vector and input into the trained traffic identification model.

[0081] Optionally, for a numerical access information feature, the number may be directly extracted to obtain a corresponding feature value. For example, the number of the request source IP address 219.239.110.138 may be directly extracted to obtain a corresponding value of 219239110138.

[0082] For character-type access information features, the character-type access information features can be mapped to numerical feature values ​​through a pre-set mapping table. The mapping table can define feature values ​​corresponding to multiple types of character-type access information features. For example, when the access protocol is the Transmission Control Protocol (TCP), the mapping table can define the feature value corresponding to TCP mapping as 1, and when the access protocol is the User Datagram Protocol (UDP), the mapping table can define the feature value corresponding to UDP mapping as 2.

[0083] Since there are usually multiple access information features corresponding to the access flow information, after mapping each access information feature to a feature value, the access information feature can be converted into an access information feature vector.

[0084] Exemplarily, the access information features consisting of the request source IP address, source port, target IP address, target port, access protocol and access route can be converted into corresponding access information feature vectors and input into the trained traffic identification model, so that the traffic identification model can output a server feature vector. The output server feature vector can represent the traffic identification model's prediction of the mapping value of the server access traffic value and the asset type.

[0085] Step 208, judging whether the client has access rights according to the server characteristics and the access policy corresponding to the client, if so, executing step 210, if not, executing step 212.

[0086] An access policy may refer to a set of predefined rules for controlling and managing client access to different servers, including decisions on allowing access and denying access. Access rights may refer to the permission certificate granted by the gateway server to the client to access the target server.

[0087] The gateway server can determine whether the client has legal access permission to the target server based on the access policy corresponding to the client, and determine whether the client's access behavior to the target server is normal based on the server characteristics of the client. If the above two conditions are met, the gateway server can determine that the client has access rights to the target server. Conversely, if any of the above two conditions is not met, the gateway server can determine that the client does not have access rights to the target server.

[0088] In other words, the client not only needs to have the access rights issued by the access policy, that is, the legal access permission for the target server obtained after the identity authentication and authorization process, but also needs to meet the gateway server's requirements for server characteristics to ensure that the client's access behavior to the target server is normal. Only in this way can the gateway server determine that the client has access rights to the target server and allow the client to access the target server.

[0089] Step 210: Allow the client's access behavior.

[0090] The gateway server determines that the client has access rights to the target server based on the server characteristics and the access policy corresponding to the client. Therefore, the gateway server allows the client to access the target server.

[0091] Step 212: deny the client's access behavior.

[0092] The gateway server determines that the client does not have access rights to the target server based on the server characteristics and the access policy corresponding to the client. Therefore, the gateway server denies the client access to the target server.

[0093] Exemplarily, the access policy sets that client D has access rights to server A and server B, but does not have access rights to server C, and the gateway server obtains the server characteristics of client D for server A, server B, and server C through the traffic identification model, which are server characteristic a, server characteristic b, and server characteristic c, respectively, among which server characteristic a meets the gateway server's requirements for server characteristics, and server characteristic b and server characteristic c do not meet the corresponding requirements. Therefore, the gateway server allows client D to access server A, but does not allow client D to access server B and server C.

[0094] In an embodiment of the present application, the gateway server can establish a traffic identification model so that in the process of the client accessing the server, the traffic identification model can analyze the access information characteristics corresponding to the access behavior, predict the server characteristics corresponding to the access behavior, and then accurately determine whether the client has access rights to the corresponding server. This can more reasonably and effectively manage and control the access to the server, improve the intelligence level of management of server access, and further improve the protection capabilities of server access security.

[0095] like Figure 3 As shown, in one embodiment, another server access management method is provided, the server characteristics include the server access flow value, and the method may include the following steps:

[0096] Step 301: Collect access traffic information corresponding to the access behavior received by the gateway server.

[0097] Step 303: determine one or more access information features according to the access flow information.

[0098] Step 305: Analyze one or more access information features through the trained traffic identification model to obtain server features corresponding to the access information features.

[0099] Step 307: Determine the target access flow value of the target server corresponding to the access behavior according to the access policy corresponding to the client.

[0100] In addition to the decision of the client to allow or deny access to different servers, the access policy may also include each server and the normal access traffic value corresponding to each server. The target access traffic value may refer to the value of the traffic size generated by the client's normal access to the target server.

[0101] The gateway server can determine in advance the normal access traffic value of the client initiating normal access behavior to each server, and store the above normal access traffic value in the access policy in the form of a list. After the gateway server determines that the client initiates an access behavior to the target server, the gateway server can first search for the normal access traffic value corresponding to the target server in the list of the access policy based on one or more access information features of the client, and then use it as the target access traffic value.

[0102] For example, client D can access server A, and the normal access traffic value generated when client D normally accesses server A is 3 megabytes. After the gateway server determines that the client initiates access behavior to server A, it first searches the access policy list according to the client's target IP address and finds that the normal access traffic value corresponding to server A is 3 megabytes. Therefore, 3 megabytes is used as the target access traffic value of client D to server A.

[0103] Step 309 , determining whether the difference between the server access flow value and the target access flow value is within the target range, if so, executing step 311 , if not, executing step 313 .

[0104] The gateway server can determine whether the difference between the server access traffic value obtained by the traffic identification model and the target access traffic value is within the target range. The server access traffic value of the target server obtained by the traffic identification model obtained through training can be considered as the predicted access traffic value corresponding to the client's access behavior to the target server. The target range can refer to the acceptable degree of difference between the server access traffic value and the target access traffic value.

[0105] If the difference between the server access traffic value obtained by the trained traffic identification model and the target access traffic value corresponding to the normal access behavior is within the target range, the client's access behavior can be considered normal, and the gateway server can determine that the client has access rights to the target server. On the contrary, if the difference exceeds the target range, the client's access behavior can be considered abnormal, and the gateway server can determine to deny or terminate the client's access behavior, so that the client does not have access rights to the target server.

[0106] Step 311: Determine whether the client has access rights to the target server.

[0107] Step 313: Determine that the client does not have access rights to the target server.

[0108] Exemplarily, the target range is preset by the gateway server as -0.1 to 0.1 megabytes, the access policy sets that client D has access rights to server A, and the target access traffic value generated when client D normally accesses server A is 3 megabytes. On the gateway server, the traffic identification model predicts that the server access traffic value generated when client D actually accesses server A is 3.05 megabytes, and the normal access traffic value corresponding to server A is found in the access policy list according to the target IP address of the client, so the difference between the server access traffic value and the target access traffic value is 0.05 megabytes, which is within the target range. Therefore, the gateway server believes that client D can access server A normally and determines that client D has access rights to server A.

[0109] In an embodiment of the present application, the gateway server can obtain the server access traffic value of the client to the target server through the trained traffic identification model, and then compare the server access traffic value with the target access traffic value to determine whether the client has access rights to the target server. This can improve the accuracy and comprehensiveness of server access rights detection, is beneficial to the intelligent level of server access management, and can further enhance the protection capabilities of server access security.

[0110] like Figure 4 As shown, in another embodiment, another server access management method is provided, the access policy corresponding to the client includes an access whitelist corresponding to the client, the access whitelist includes various servers that the client can access, and the method may include the following steps:

[0111] Step 402: Collect access traffic information corresponding to the access behavior received by the gateway server.

[0112] Step 404: determine one or more access information features based on the access flow information.

[0113] Step 406: Analyze one or more access information features using the trained traffic identification model to obtain server features corresponding to the access information features.

[0114] The gateway server can analyze one or more access information feature vectors through the trained traffic identification model to obtain the server access traffic value corresponding to the access behavior.

[0115] Step 408 , determining whether the target server corresponding to the access behavior is in the access whitelist corresponding to the client, if so, executing step 412 , if not, executing step 410 .

[0116] The access whitelist refers to a list of servers that the client has access rights to. The gateway server determines whether the client has access rights to the target server. It needs to first determine whether the client's access policy has access rights to the target server. If the access policy can determine that the client does not have access rights to the target server, the gateway server can directly deny the client's access to the target server and no longer execute subsequent steps. On the contrary, if the access policy can determine that the client has access rights to the target server, the gateway server also needs to make further judgments based on the difference between the server access traffic value and the target access traffic value.

[0117] Step 410: Determine that the client does not have access rights to the target server.

[0118] Step 412: Determine the target access flow value of the target server according to the access policy corresponding to the client.

[0119] Step 414, determining whether the difference between the server access flow value and the target access flow value is within the target range, if so, executing step 416, if not, executing step 410.

[0120] Step 416, determine whether the client has access rights to the target server.

[0121] Exemplarily, the access policy sets that client D has access rights to server A and server B, but does not have access rights to server C. The gateway server obtains the server characteristics of client D for server A, server B, and server C through the traffic identification model, which are server characteristic a, server characteristic b, and server characteristic c, respectively. Among them, server characteristic a meets the gateway server's requirements for server characteristics, and server characteristic b and server characteristic c do not meet the corresponding requirements. Therefore, the gateway server allows client D to access server A, but does not allow client D to access server B and server C.

[0122] Optionally, the gateway server can first determine whether the target server is in the access whitelist corresponding to the client. If the target server is in the access whitelist of the client, the gateway server can obtain the server access traffic value through the traffic identification model, obtain the target access traffic value through the access policy, and determine whether the client has access rights to the target server by determining whether the difference between the server access traffic value and the target access traffic value is within the target range.

[0123] In an embodiment of the present application, the gateway server determines the server characteristics corresponding to the client's access information characteristics through a traffic identification model, and combines the access whitelist and the difference between the server access traffic value and the target access traffic value to perform a double verification on whether the client has access rights. This can not only accurately identify the server characteristics corresponding to the client's access behavior, but also improve the accuracy and efficiency of server access management.

[0124] In some embodiments, after the gateway server rejects the access behavior of the client, the gateway server may also send an alarm message to the control end of the server to remind the operation and maintenance personnel to promptly discover abnormal access behavior. Figure 5 As shown, Figure 5 The flowchart of the gateway server sending alarm information to the control end of the server provided in the embodiment of the present application. After rejecting the access behavior of the client, the following steps may be included:

[0125] Step 501: Obtain the number of access denials corresponding to the first server.

[0126] The gateway server may obtain the number of access denials of the first server. The first server may refer to any one of the multiple servers protected by the gateway server. The number of access denials may refer to the number of times the gateway server denies the client access to the first server.

[0127] Furthermore, the number of access denials may include the number of times the gateway server denies the client access to the first server due to server characteristics, and the number of times the gateway server denies the client access to the first server due to access policies. Distinguishing the number of access denials helps operation and maintenance personnel to more accurately understand the specific reasons for the first server denying access.

[0128] Step 503 , determining whether the number of denied accesses corresponding to the first server is less than a predetermined number of accesses, if so, executing step 505 , if not, executing step 507 .

[0129] By judging whether the number of access denials corresponding to the first server is less than the predetermined number of accesses, it is convenient for the operation and maintenance personnel to take different processing methods. If the number of access denials corresponding to the first server is small, it means that the number of abnormal access behaviors of the client is not high, which means that there may be problems with the client's access behavior, such as the client using the wrong access method or potential malicious behavior; if the number of access denials corresponding to the first server is large, it means that the nature of the first server may have changed, causing the access traffic information corresponding to the client's access behavior to change, and it is necessary to remind the operation and maintenance personnel to intervene in the investigation in time.

[0130] Step 505: Send a first alarm message to the control terminal of the first server.

[0131] The first alarm information is used to indicate abnormal access behavior of the client.

[0132] Step 507: Send a second alarm message to the control terminal of the first server.

[0133] The second alarm message is used to indicate that the nature of the server may have changed.

[0134] In an embodiment of the present application, after the gateway server rejects the client's access to the first server, the gateway server sends a corresponding alarm message to the control end of the first server through the number of rejected accesses by the first server. This can not only timely discover and handle potential abnormal access behaviors and ensure the stable operation of the server, but also timely discover changes in the nature of the server and improve the intelligent management level of the server, thereby further improving the protection capabilities of server access security.

[0135] In some embodiments, before training the traffic identification model, the training data set needs to be preprocessed. Figure 6 As shown, Figure 6 A flowchart of using a training data set to train a traffic identification model to be trained is provided in an embodiment of the present application. Steps Before analyzing one or more access information features through the trained traffic identification model to obtain server features corresponding to the access information features, the following steps may be included:

[0136] Step 602: Obtain a training data set.

[0137] The training data set includes multiple first access samples, each of which includes access sample information and actual server information corresponding to the access sample information. The first access sample may refer to the historical access behavior of the client to multiple servers, the access sample information may refer to the access flow information corresponding to the historical access behavior of the client to the server, and the actual server information may include the target access flow value corresponding to the access sample information.

[0138] Step 604: Determine access sample features corresponding to each first access sample according to the access sample information included in each first access sample.

[0139] After determining the access sample features corresponding to each access sample information according to each access sample information, each access sample feature can be mapped according to the data type of each access sample feature to convert each access sample feature into a sample feature value. That is, the access sample feature can be converted into a sample feature vector including multiple sample feature values.

[0140] Step 606: Determine the server sample feature corresponding to each first access sample according to the actual server information included in each first access sample.

[0141] Similarly, the actual server information can be mapped in the same way as the access sample information. After determining the server sample features corresponding to each first access sample, each server sample feature is mapped to convert the server sample features into a server sample feature vector.

[0142] Step 608: training the traffic recognition model to be trained according to the access sample features and the corresponding server sample features respectively corresponding to the plurality of first access samples.

[0143] Taking multiple access sample feature vectors as input and corresponding server sample feature vectors as output, the traffic recognition model to be trained is trained.

[0144] Exemplarily, the training data set includes three first access samples, the actual server information access sample information of the first access sample is the request source IP address and the access protocol, and the actual server information of the first access sample is the target access traffic value. Therefore, the access sample information of these three first access samples is converted into corresponding sample feature vectors, which are [3689901706, 1], [167773121, 2] and [167773121, 3] respectively. The target access traffic values ​​corresponding to the sample feature vectors are 3, 4 and 5 respectively. Therefore, [3689901706, 1], [167773121, 2] and [167773121, 3] can be used as input, and the target access traffic values ​​3, 4 and 5 can be used as output to train the traffic recognition model to be trained.

[0145] In an embodiment of the present application, a training data set is constructed by accessing sample information and actual server information, and after mapping the above two to numerical values, the traffic identification model can better capture and learn the correlation characteristics between the access sample information and the actual server information during the training process, thereby improving the prediction ability of the traffic identification model and enhancing the accuracy and reliability of the traffic identification model.

[0146] In some embodiments, a DNN can be used to construct a traffic identification model. Figure 7 As shown, Figure 7 The flowchart of training a traffic identification model based on DNN provided in the embodiment of the present application. Steps: According to the access sample features and the corresponding server sample features corresponding to the plurality of first access samples, the traffic identification model to be trained is trained, which may include the following steps:

[0147] Step 701: input the target access sample features into the first hidden layer of the traffic recognition model, and determine the output features according to the target access sample features through the first hidden layer.

[0148] The target access sample feature is an access sample feature included in any first access sample. After mapping the target access sample feature to a target access sample feature vector, the target access sample feature vector is input into the first hidden layer of the traffic identification model, and the output feature vector is determined according to the target access sample feature vector through the first hidden layer.

[0149] The layer where the target access sample feature vector is located can be used as the input layer of the traffic identification model. The hidden layer can refer to one or more layers between the input layer and the output layer in the traffic identification model. The hidden layer can transform and process the input sample feature vector to further explore the potential features of the input vector. The output feature can refer to the output feature vector after processing by the hidden layer.

[0150] Exemplarily, the gateway server may obtain a training data set D consisting of m first access samples as follows:

[0151] D={(x1,y1),(x2,y2),...,(x m ,y m )} Formula (1);

[0152] Among them, x i ={x i1 ,x i2 ,...,x iNin},i=1,2,...,m,x i is the target access sample feature vector corresponding to the target access sample feature, x iNin Access the Nth sample feature vector for the target in Sample feature values, N in is the dimension of the target access sample feature vector, m is the number of first access samples, y i ={y i1 ,y i2 ,...,y iNout},i=1,2,...,m,y i is the server sample feature vector corresponding to the actual server information, y iNout is the Nth in the server sample feature vector out server sample feature values, N out is the dimension of the server sample feature vector.

[0153] The target access sample feature vector x i Input the first hidden layer of the traffic recognition model, and access the sample feature vector x according to the target through the first hidden layer i Determine the output feature vector a 1 .

[0154] Optionally, during the training process of the traffic identification model, a target access sample feature vector can be input into the first hidden layer of the traffic identification model, or multiple target access sample feature vectors can be input into the first hidden layer of the traffic identification model by batch processing, and the output feature vector corresponding to the number of target access sample feature vectors is determined by the first hidden layer according to the target access sample feature vectors. Batch processing can not only take advantage of parallel processing to speed up the training of the traffic identification model, but also reduce the noise between the first access samples and improve the stability of the traffic identification model training.

[0155] Exemplarily, the training data set includes 1000 first access samples, and the 1000 first access samples can be divided into 10 batches, with 100 first access samples in each batch. During the training process of the traffic identification model, the target access sample feature vectors corresponding to the 100 first access samples are input into the first hidden layer of the traffic identification model, and 100 output feature vectors are determined according to the target access sample feature vectors through the first hidden layer.

[0156] Step 703, determining the output feature of the nth hidden layer according to the output feature of the n-1th hidden layer through the nth hidden layer.

[0157] For example, the output feature vector a of the n-1th hidden layer can be obtained by the nth hidden layer according to the output feature vector a of the n-1th hidden layer. n-1 , determine the output feature vector a of the nth hidden layer n , n is an integer greater than 1, n=1,2,...,N, and N represents the total number of hidden layers in the traffic identification model.

[0158] In some embodiments, each hidden layer includes J neurons. Figure 8 As shown, Figure 8 A flowchart for updating the output features of hidden layer neurons in a traffic identification model based on a DNN is provided in an embodiment of the present application. The steps include determining the output features of the nth hidden layer according to the weights and biases corresponding to the nth hidden layer and the output features of the n-1th hidden layer, and may include the following steps:

[0159] Step 802: Determine the first feature corresponding to the jth neuron according to the weight corresponding to the jth neuron in the nth hidden layer and the output feature of the (n-1)th hidden layer.

[0160] According to the weight value corresponding to the jth neuron in the nth hidden layer and the output eigenvalues ​​of each neuron in the n-1th hidden layer, the first eigenvalue corresponding to the jth neuron is obtained through weighted sum calculation, where j is an integer greater than or equal to 1 and less than or equal to J.

[0161] Step 804: Determine the second feature corresponding to the jth neuron according to the first feature corresponding to the jth neuron and the deviation corresponding to the jth neuron.

[0162] The second eigenvalue corresponding to the jth neuron is determined according to the first eigenvalue corresponding to the jth neuron and the deviation value corresponding to the jth neuron.

[0163] Step 806: Determine the output feature of the nth hidden layer according to the second features corresponding to the J neurons respectively.

[0164] The second eigenvalue corresponding to the jth neuron in the nth hidden layer is substituted into the activation function to obtain the output eigenvalue of the jth neuron in the nth hidden layer. The output eigenvalues ​​of each neuron in the nth hidden layer are combined to obtain the output eigenvector of the nth hidden layer.

[0165] For example, in the traffic recognition model composed of DNN, for the output feature vector a of the nth hidden layer n ,have is the output feature vector a n The j-th output eigenvalue in , that is, the output eigenvalue corresponding to the j-th neuron in the n-th hidden layer, J is an integer greater than 1, and J represents the total number of neurons in the hidden layer.

[0166] For the output eigenvalue of the jth neuron in the nth hidden layer First, according to the weight value of the jth neuron in the nth hidden layer to the kth neuron in the n-1th hidden layer and the output eigenvalue of the kth neuron in the n-1th hidden layer Determine the output eigenvalue of the jth neuron in the nth hidden layer by weighted sum calculation The first eigenvalue of

[0167]

[0168] When the output feature vector of the current hidden layer is determined by the output feature vector of the previous hidden layer, since each hidden layer usually has the same number of neurons, J = K. Alternatively, when the number of neurons in each hidden layer is inconsistent, J≠K.

[0169] Then according to the first eigenvalue of the jth neuron in the nth hidden layer and the bias value corresponding to the jth neuron in the nth hidden layer Determine the second eigenvalue of the jth neuron in the nth hidden layer

[0170]

[0171] Then, using the activation function According to the second eigenvalue of the jth neuron in the nth hidden layer Determine the output eigenvalue of the jth neuron in the nth hidden layer As shown below:

[0172]

[0173] Therefore, according to the output feature vector a of the n-1th hidden layer n-1 , the weight matrix W of the nth hidden layer n and the bias vector b of the nth hidden layer n , the output feature vector a of the nth hidden layer can be determined n for:

[0174] a n =σ(W n a n-1 +b n ) Formula (5);

[0175] in, Weight matrix W n The dimension is J rows and K columns, and the output feature vector a n-1 The dimension is K rows and 1 column. Deviation vector b n The dimension is J rows and 1 column.

[0176] Step 705, determining the predicted server features according to the output features of the last hidden layer.

[0177] The predicted server feature vector is determined based on the output feature vector of the last hidden layer.

[0178] Optionally, when the number of neurons in the hidden layer is consistent with the number of neurons in the output layer, that is, the traffic identification model has N+1 hidden layers, the predicted server feature vector may refer to the output feature vector of the last hidden layer output by the traffic identification model.

[0179] For example, the weight matrix W of the output layer can be P , the bias vector b of the output layer P And the output feature vector a of the last hidden layer (i.e. the Nth hidden layer) N , determine the predicted server feature vector y of the output layer pred :

[0180] y pred =σ(W P a N +bP ) Formula (6);

[0181] Among them, when the number of neurons in the hidden layer is consistent with the number of neurons in the output layer, that is, when the output feature vector a N The dimension of the prediction server feature vector y pred When the dimensions are consistent, P = N + 1, the weight matrix W of the output layer P The dimension is J rows and J columns, and the output feature vector a N The dimension is J rows and 1 column, and the bias vector b of the output layer P The dimension is J rows and 1 column; when the number of neurons in the hidden layer is inconsistent with the number of neurons in the output layer, the traffic recognition model has N hidden layers, and the weight matrix W of the output layer P The dimension is K rows and J columns, and the output feature vector a N The dimension is J rows and 1 column, and the bias vector b of the output layer P The dimension is K rows and 1 column, and the predicted server feature vector y pred The dimension is K rows and 1 column, and J≠K.

[0182] Step 707, calculating the error based on the predicted server feature and the server sample feature corresponding to the target access sample feature.

[0183] The error may refer to the loss function value calculated in the neural network by predicting the server features and the server sample features corresponding to the target access sample features.

[0184] The gateway server may calculate the error of the traffic identification model according to the square of the L2 norm of the difference between the predicted server feature vector and the server sample feature vector corresponding to the target access sample feature vector.

[0185] The L2 norm is defined as the square root of the sum of the squares of all elements in the vector. The L2 norm can be used to prevent the traffic identification model from overfitting to the training data set, and can improve the generalization ability of the traffic identification model.

[0186] For example, the predicted server feature vector y output by the traffic identification model pred , the server sample feature vector y corresponding to the target access sample feature vector actual The square of the L2 norm of the difference is used to calculate the error Loss of the traffic identification model as follows:

[0187]

[0188] Optionally, when the target access sample feature vectors of the training data set are input into the traffic identification model in batches, the traffic identification model may output one or more errors in each batch, and the final error of the traffic identification model may be the average of the errors.

[0189] Step 709 , determine whether the error is greater than the error threshold, if so, execute step 711 , if not, execute step 713 .

[0190] Step 711, using a back propagation method, adjust the parameters of the traffic identification model according to the error.

[0191] Back propagation may refer to the process of calculating the gradient of the loss function with respect to the parameters in a neural network algorithm so as to update the parameters of the corresponding neurons and minimize the loss function. The parameters of the traffic recognition model may refer to the weight values ​​and bias values ​​of the neurons.

[0192] In the back propagation phase of the traffic identification model, by calculating the partial derivative (i.e., gradient) of the error with respect to the weight value and bias value in each neuron, each neuron can update the weight value and bias value of the corresponding neuron according to the gradient.

[0193] After the weight value and bias value of the traffic identification model are updated according to the error by back propagation, the traffic identification model executes steps 703 to 709 again to recalculate and determine whether the error of the traffic identification model is greater than the error threshold after the weight value and bias value are updated.

[0194] Step 713, determine whether the traffic identification model training is completed.

[0195] After the traffic identification model executes steps 703 to 709 multiple times, the error of the traffic identification model is no greater than the error threshold, indicating that the performance of the traffic identification model has reached a relatively good level. The gap between the predicted server feature vector output by the traffic identification model and the server sample feature vector corresponding to the target access sample feature vector is acceptable, and thus the training of the traffic identification model is completed.

[0196] In an embodiment of the present application, a DNN is used to construct a traffic identification model, and the weight values ​​and bias values ​​of each neuron in multiple hidden layers are continuously updated during the training process of the traffic identification model. This can improve the prediction accuracy of the traffic identification model, so that the traffic identification model can accurately obtain the server characteristics corresponding to new access behaviors, and improve the gateway server's judgment accuracy on whether the client has access rights, thereby improving the server's access management capabilities and further improving the access protection capabilities.

[0197] In other embodiments, the training data set includes a training set and a test set. After the traffic identification model is trained using the training set, the traffic identification model can be verified using the test set. Multiple target access sample feature vectors in the test set are input into the traffic identification model. After forward propagation through N hidden layers and an output layer, a verification error is obtained. It is determined whether the verification error is less than a verification error threshold. If the verification error is not greater than the verification error threshold, it is determined that the traffic identification model meets the usage requirements.

[0198] Exemplarily, the training data set includes t test sets. Given a verification error threshold ε of the traffic identification model, the target access sample feature vector in the test set is input into the traffic identification model to obtain the predicted server feature vector y pred , the validation error of the test set is calculated according to formula (7), and when the largest validation error in t validation sets is not greater than the validation error threshold ε, the following formula is satisfied:

[0199]

[0200] This indicates that the trained traffic identification model meets the usage requirements. The predicted server feature vector y obtained by the traffic identification model pred The accuracy is higher.

[0201] In an embodiment of the present application, a validation set is used to further verify the performance of the traffic identification model, which helps to timely adjust the parameters or network structure of the traffic identification model, and is beneficial to improving the generalization ability of the model and the performance of the traffic identification model.

[0202] Based on the server access management method provided in the above embodiment, Fig. 9 This is a structural block diagram of an access management device for a server provided in an embodiment of the present application. Fig. 9 As shown, in one embodiment, a server access management device 900 is provided, and the server access management device 900 includes an information collection module 901, a feature acquisition module 902, a traffic identification module 903 and an access judgment module 904.

[0203] The information collection module 901 is used to collect access flow information corresponding to the access behavior received by the gateway server. The access behavior refers to the behavior of the client accessing any server.

[0204] The feature acquisition module 902 is used to determine one or more access information features according to the access flow information.

[0205] The traffic identification module 903 is used to analyze one or more access information features through the trained traffic identification model to obtain server features corresponding to the access information features.

[0206] The access judgment module 904 is used to judge whether the client has access rights according to the server characteristics and the access policy corresponding to the client. If the client has access rights, the client's access behavior is allowed; if the client does not have access rights, the client's access behavior is denied.

[0207] In some embodiments, the access management device 900 of the server also includes a training data acquisition module and a model training module.

[0208] The training data acquisition module is used to acquire a training data set, where the training data set includes a plurality of first access samples, each of which includes access sample information and actual server information corresponding to the access sample information.

[0209] The feature acquisition module 902 is further used to determine the access sample feature corresponding to each first access sample according to the access sample information contained in each first access sample; and determine the server sample feature corresponding to each first access sample according to the actual server information contained in each first access sample.

[0210] The model training module is used to train the traffic identification model to be trained according to the access sample features and the corresponding server sample features corresponding to the multiple first access samples.

[0211] In some embodiments, the model training module is also used to input the target access sample characteristics into the first hidden layer of the traffic identification model, and determine the output characteristics through the first hidden layer according to the target access sample characteristics; the target access sample characteristics are the access sample characteristics contained in any first access sample; the output characteristics of the nth hidden layer are determined through the nth hidden layer according to the output characteristics of the n-1th hidden layer, where n is an integer greater than 1; the predicted server characteristics are determined according to the output characteristics of the last hidden layer; the error is calculated according to the server sample characteristics corresponding to the predicted server characteristics and the target access sample characteristics; if the error is greater than the error threshold, the back propagation method is used to adjust the parameters of the traffic identification model according to the error; if the error is not greater than the error threshold, it is determined that the traffic identification model training is completed.

[0212] In some embodiments, the model training module is further used to determine the output features of the nth hidden layer based on the weights and biases corresponding to the nth hidden layer and the output features of the n-1th hidden layer.

[0213] In some embodiments, the model training module includes a weight allocation unit and a bias allocation unit.

[0214] A weight allocation unit, used to determine a first feature corresponding to the jth neuron according to a weight corresponding to the jth neuron in the nth hidden layer and an output feature of the n-1th hidden layer, where j is an integer greater than or equal to 1 and less than or equal to J;

[0215] a deviation allocation unit, configured to determine a second feature corresponding to the jth neuron according to the first feature corresponding to the jth neuron and the deviation corresponding to the jth neuron;

[0216] The model training module is also used to determine the output features of the nth hidden layer according to the second features corresponding to the multiple neurons respectively.

[0217] In some embodiments, the access management device 900 of the server further includes a permission judgment module. The permission judgment module is used to determine the target access flow value of the target server corresponding to the access behavior according to the access policy corresponding to the client; determine whether the difference between the server access flow value and the target access flow value is within the target range; if the difference between the server access flow value and the target access flow value is within the target range, determine that the client has access rights to the target server; if the difference between the server access flow value and the target access flow value is not within the target range, determine that the client does not have access rights to the target server.

[0218] In some embodiments, the authority judgment module is also used to determine whether the target server corresponding to the access behavior is in the access whitelist corresponding to the client; if the target server is in the access whitelist corresponding to the client, the target access traffic value of the target server is determined.

[0219] The permission judgment module is also used to determine that the client does not have access rights to the target server if the target server is not in the access whitelist corresponding to the client.

[0220] Fig.10 This is a structural block diagram of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device 1000 may include a memory 1002 and a processor 1001. The memory 1002 stores a computer program. When the computer program is executed by the processor 1001, the electronic device 1000 implements the server access management method described in the above embodiments.

[0221] The processor 1001 may include one or more processing cores. The processor 1001 uses various interfaces and lines to connect the various parts of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor 1001 can be implemented in at least one hardware form of digital signal processing, field programmable gate array, and programmable logic array. The processor 1001 can integrate one or more combinations of a central processing unit (Central Processing Unit, referred to as CPU), a graphics processing unit (Graphics Processing Unit, referred to as GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1001, and it can be implemented separately through a communication chip.

[0222] The memory 1002 may include a random access memory or a read-only memory. The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the electronic device during use, etc.

[0223] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor implements the server access management method described in the above embodiments.

[0224] An embodiment of the present application discloses a computer program product, which includes a computer program. When the computer program can be executed by a processor, the processor implements the server access management method described in the above embodiments.

[0225] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a ROM, etc.

[0226] The above description is only a specific example of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for managing access to a server, characterized in that: The method comprises: Collecting access traffic information corresponding to access behaviors received by the gateway server, where the access behaviors refer to the behaviors of the client accessing any server; determining one or more access information features according to the access flow information; Analyze the one or more access information features through the trained traffic identification model to obtain server features corresponding to the access information features; According to the server characteristics and the access policy corresponding to the client, it is determined whether the client has the access rights. If the client has the access rights, the access behavior of the client is allowed; if the client does not have the access rights, the access behavior of the client is denied.

2. The method according to claim 1, characterized in that: Before the traffic identification model obtained through training analyzes the one or more access information features to obtain server features corresponding to the access information features, the method further includes: Acquire a training data set, where the training data set includes a plurality of first access samples, each of the first access samples includes access sample information and actual server information corresponding to the access sample information; Determining, according to the access sample information included in each of the first access samples, an access sample feature corresponding to each of the first access samples; Determining, according to the actual server information included in each of the first access samples, a server sample feature corresponding to each of the first access samples; The traffic identification model to be trained is trained according to the access sample features and the corresponding server sample features respectively corresponding to the multiple first access samples.

3. The method according to claim 2, characterized in that The traffic identification model includes a plurality of hidden layers; and the training of the traffic identification model to be trained according to the access sample features and the corresponding server sample features respectively corresponding to the plurality of first access samples includes: Inputting the target access sample feature into the first hidden layer of the traffic identification model, and determining the output feature according to the target access sample feature through the first hidden layer; the target access sample feature is the access sample feature included in any of the first access samples; Determine the output feature of the nth hidden layer according to the output feature of the n-1th hidden layer through the nth hidden layer, where n is an integer greater than 1; Determine the predicted server features according to the output features of the last hidden layer; Calculating an error based on the predicted server feature and the server sample feature corresponding to the target access sample feature; If the error is greater than the error threshold, a back propagation method is used to adjust the parameters of the traffic identification model according to the error; If the error is not greater than the error threshold, it is determined that the traffic identification model training is completed.

4. The method according to claim 3, characterized in that The step of determining the output feature of the nth hidden layer according to the output feature of the n-1th hidden layer through the nth hidden layer includes: Determine the output feature of the nth hidden layer according to the weight and bias corresponding to the nth hidden layer and the output feature of the n-1th hidden layer.

5. The method according to claim 4, characterized in that Each of the hidden layers includes J neurons; determining the output feature of the nth hidden layer according to the weight and bias corresponding to the nth hidden layer and the output feature of the n-1th hidden layer includes: Determine a first feature corresponding to the jth neuron according to a weight corresponding to the jth neuron in the nth hidden layer and an output feature of the n-1th hidden layer, where j is an integer greater than or equal to 1 and less than or equal to J; Determining a second feature corresponding to the j-th neuron according to the first feature corresponding to the j-th neuron and the deviation corresponding to the j-th neuron; The output feature of the nth hidden layer is determined according to the second features respectively corresponding to the J neurons.

6. The method according to claim 1, characterized in that The server feature includes a server access flow value; and judging whether the client has access rights according to the server feature and an access policy corresponding to the client includes: Determine, according to the access policy corresponding to the client, a target access flow value of the target server corresponding to the access behavior; Determine whether the difference between the server access flow value and the target access flow value is within a target range; If the difference between the server access flow value and the target access flow value is within the target range, it is determined that the client has access rights to the target server; If the difference between the server access flow value and the target access flow value is not within the target range, it is determined that the client does not have access rights to the target server.

7. The method according to claim 6, characterized in that The access policy corresponding to the client includes an access whitelist corresponding to the client, and the access whitelist includes various servers that the client can access; The determining, according to the access policy corresponding to the client, a target access flow value of the target server corresponding to the access behavior includes: Determine whether the target server corresponding to the access behavior is in the access whitelist corresponding to the client; If the target server is in the access whitelist corresponding to the client, determine the target access flow value of the target server according to the access policy corresponding to the client; The method further comprises: If the target server is not in the access whitelist corresponding to the client, it is determined that the client does not have access rights to the target server.

8. A server access management device, characterized in that: The device comprises: An information collection module is used to collect access flow information corresponding to access behaviors received by the gateway server, where the access behaviors refer to the behaviors of the client accessing any server; A feature acquisition module, used to determine one or more access information features according to the access flow information; A traffic identification module, configured to analyze the one or more access information features through a trained traffic identification model to obtain server features corresponding to the access information features; The access judgment module is used to judge whether the client has access rights according to the server characteristics and the access policy corresponding to the client. If the client has the access rights, the access behavior of the client is allowed; if the client does not have the access rights, the access behavior of the client is denied.

9. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor implements the server access management method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the processor implements the server access management method according to any one of claims 1 to 7.

Images