Adaptive Permission Management Method for Intelligent Seal Management System

Abstract

This application provides an adaptive permission management method for an intelligent seal management system, which relates to the field of information technology. The method includes: obtaining user seal operation sequence data in different time periods, including seal usage time, application batch, file type, and seal usage purpose information; constructing a user seal usage behavior feature vector; grouping all users through a clustering algorithm to obtain several user groups with different seal usage behavior patterns; for each user group, analyzing their historical seal application data, calculating the mean and standard deviation of the user group's seal application frequency at different time scales through a sliding window; and according to a preset threshold, determining that a user's seal usage behavior is abnormal when the user's real-time seal application frequency exceeds the normal fluctuation range of the group to which they belong. This improves the intelligence level of seal management and enhances the ability to identify abnormal behavior and prevent and control risks.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and particularly to an adaptive permission management method for an intelligent seal management system. Background Art

[0002] In an intelligent seal management system, the characteristics of the seal - using operation sequence of a user at different time periods can reflect their seal - using behavior pattern. When there is a continuous deviation in the user's seal - using application, the correlation degree between the application file type and the seal - using purpose will change. This change in the correlation degree will affect the dynamic adjustment of the user's permission level by the system. However, the current intelligent seal management system has a technical contradiction when dealing with this situation: on the one hand, the system needs to adjust the user's permission level in a timely manner according to the user's seal - using behavior characteristics to ensure seal - using security; on the other hand, frequent adjustment of the permission level may affect the normal seal - using needs of the user and reduce the user experience. At the same time, how to accurately identify the user behavior deviation in the massive seal - using log data and quantitatively evaluate the change in the correlation degree between it and the application file type and the seal - using purpose is also a technical problem to be solved urgently. In addition, the existing dynamic adjustment mechanism of the permission level usually adopts a simple threshold comparison method, lacking in - depth exploration and modeling of the influence law between the user behavior deviation and the permission adjustment, resulting in insufficient accuracy and timeliness of the adjustment. Therefore, there is an urgent need for a new technical solution that can, without affecting the normal seal - using needs of the user, identify the user behavior deviation in real - time and accurately, quantitatively evaluate the change in the correlation degree between it and the application file type and the seal - using purpose, and achieve precise and dynamic adjustment of the user's permission level based on the influence law model, so as to comprehensively improve the security and user experience of the intelligent seal management system. Summary of the Invention

[0003] To solve the above - mentioned technical problems, the present invention provides an adaptive permission management method for an intelligent seal management system, which mainly includes:

[0004] The user's seal operation sequence data in different time periods is obtained, including seal usage time, file type, and seal usage purpose information, and a user seal usage behavior feature vector is constructed. All users are grouped through a clustering algorithm to obtain several user groups with different seal usage behavior patterns; for each user group, their historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated through a sliding window. When a user's real-time seal application frequency exceeds the normal fluctuation range of the group to which he belongs, the user's seal usage behavior is determined to be abnormal; when a user is determined to have abnormal seal usage behavior, the user's seal application data during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different file type and seal usage purpose combinations, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal usage behavior; based on the mined strong association rules, the key features in the strong association rules are extracted, including associated file type, associated seal usage purpose information, and association strength, and historical records similar to the key features are searched in the risk assessment knowledge base through feature matching. Risk cases: Based on the risk level labels of similar cases, the current user's abnormal seal usage behavior is divided into high-risk behavior or low-risk behavior. For high-risk behavior, the user's seal usage rights are automatically reduced and an early warning is sent to the administrator. For low-risk behavior, the system temporarily maintains the user's rights unchanged, but increases the monitoring frequency. Regularly collect follow-up tracking data of all abnormal users over a period of time, including user rights change records and behavioral performance change trends after abnormal behavior occurs, to form a strategy optimization training sample set. Use factor analysis to automatically extract key factors affecting the effect of authority adjustment from the sample data of the training sample set, including the association rule characteristics of abnormal behavior and the behavioral patterns of the user group, and establish a authority adjustment strategy optimization model based on key influencing factors. The authority adjustment strategy optimization model based on key influencing factors mines the behavioral change patterns of user groups before and after authority adjustment, automatically learns and filters patterns with confidence higher than the preset confidence threshold and influence higher than the preset influence threshold as new rules, and dynamically updates by continuously feeding back the new rules to the authority adjustment strategy optimization model, thereby building an adaptive authority management mechanism in the intelligent seal management system that can evolve autonomously according to user behavior.

[0005] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0006] The present invention discloses an adaptive permission management method for an intelligent seal management system. This method constructs a user seal usage behavior feature vector, clusters and groups users, and analyzes the historical seal application data of each group. When the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which the user belongs, it is determined as an abnormal behavior. Subsequently, the present invention uses an association rule mining algorithm to analyze the characteristics of abnormal seal usage behavior and matches them with historical cases in the risk assessment knowledge base to achieve risk level classification. For high-risk behaviors, the user's permissions are automatically reduced and a warning is sent; for low-risk behaviors, the monitoring frequency is increased. The present invention also continuously collects subsequent data of abnormal users and establishes a permission adjustment strategy optimization model, realizing an adaptive permission management mechanism that can autonomously evolve according to user behavior. This method effectively improves the intelligence level of seal management and enhances the ability to identify abnormal behaviors and prevent risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 It is a flowchart of the adaptive permission management method for the intelligent seal management system of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0008] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0009] As Figure 1 , the adaptive permission management method of the intelligent seal management system in this embodiment may specifically include:

[0010] Step S101, obtain the seal usage operation sequence data of the user in different time periods, including the seal usage time, file type, and seal usage purpose information, construct a user seal usage behavior feature vector, and group all users through a clustering algorithm to obtain several user groups with different seal usage behavior patterns.

[0011] Obtain the user seal - using operation sequence data in the seal - using management database, and according to the seal - using operation sequence data, divide it by time period to statistically obtain the proportion of application times, and then get the user time - period distribution vector; for the file type and seal - using purpose fields in the seal - using operation sequence data, use the Jieba tokenizer for word - segmentation processing, calculate the word frequency of the word - segmentation results and perform normalization processing to obtain the seal - using document feature vector; set a time window for sliding statistics according to the seal - using operation sequence data, perform discrete Fourier transform on the application - times sequence within the window, and take the frequency component with the largest amplitude after the Fourier transform to obtain the application - behavior feature; splice the user time - period distribution vector, the seal - using document feature vector, and the application - behavior feature to construct a user seal - using behavior feature vector, and use the minimum - spanning - tree algorithm to perform clustering operations on the user seal - using behavior feature vector, and divide user groups through Euclidean distance.

[0012] Specifically, obtain the timestamp, batch number, file type, and purpose of seal use fields from the seal use management database in the basic data table of the user's seal use operations within 30 days. Read the application time period for seal use and applicant information in the associated document data table through the batch number. Divide the user's seal use sequence into time periods according to 24 hours based on the timestamp, and calculate the proportion of application times in each time period to obtain the time period distribution vector. Construct an industry general vocabulary based on the file type field and the purpose of seal use field in the basic data table of seal use operations. Use the Jieba word segmenter to segment the file type and the purpose of seal use, calculate the word frequency of the segmentation results to generate a document vector. Each vector dimension corresponds to the number of occurrences of a single word in the vocabulary. The document vector is normalized to obtain the seal use document feature vector. Based on the basic data table of seal use operations, set a fixed 6-hour time window, perform a sliding statistics on the user's application times data sequence to obtain the application times sequence within the window, use the discrete Fourier transform to process the sequence data, and take the 3 frequency components with the largest amplitudes after the transformation as the user's application behavior characteristics. Concatenate the user's time period distribution vector, the seal use document feature vector, and the application behavior characteristics to construct the user's seal use behavior feature vector. Use the Euclidean distance to measure the similarity between feature vectors, and perform a clustering operation on all user's seal use behavior feature vectors based on the maximum spanning tree algorithm. Divide the user groups by the Euclidean distance between the cluster centers being greater than 0.6. All the user's seal use application operation information is recorded in the seal use management database. The seal use time is reflected as a specific timestamp, such as 2024-03-15 09:23:45. The batch number is unique, using the year, month, day plus the serial number, such as 202403150023. The file types include labor contracts, project contracts, official letters, financial statements, etc. The purposes of seal use involve business scenarios such as external cooperation, personnel recruitment, project bidding, reimbursement approval, etc. Supplementary information such as the application department, applicant position, and application reason can be queried according to the batch number in the associated document table. After dividing the time periods according to 24 hours, it is statistically obtained that the proportion from 8 am to 12 pm is the highest, reaching 45%, followed by 2 pm to 6 pm accounting for 30%, indicating that the seal use applications are mainly concentrated during normal working hours. The industry general vocabulary should be constructed for the enterprise's seal use scenarios, including words for file types such as contracts, official letters, and statements, as well as words for business purposes such as procurement, sales, and personnel. Segment the business contract of the file type to obtain the two words "business" and "contract", calculate the number of occurrences in all seal use files as 25 times and 38 times respectively, and obtain the weight values of 0.3 and 0.45 after normalization. The purpose of seal use "recruitment and employment" is segmented into the two words "recruitment" and "employment", with the number of occurrences being 15 times and 12 times respectively, and the normalized weights being 0.2 and 0.15.A sliding statistical analysis of application data was performed within a fixed 6-hour window. For example, a user applied three times between 9:00 AM and 3:00 PM, twice between 12:00 PM and 6:00 PM, and once between 3:00 PM and 9:00 PM. Fourier transform analysis revealed a clear periodicity in this user's application behavior, with the primary frequency components corresponding to 24-hour, 72-hour, and 168-hour periods. After concatenating the feature vectors, the user's application time between 8:00 AM and 12:00 AM accounted for 0.45%, the afternoon for 0.3%, contract documents for 0.4%, and official letters for 0.25%. The 24-hour cycle strength was 0.8, and the weekly cycle strength was 0.4. Euclidean distances were calculated with other user feature vectors. Users with a distance less than 0.6 were grouped together, reflecting similar seal usage patterns. This group of users primarily processed seal applications in the morning, primarily for contract documents, and their application behavior exhibited a strong 24-hour periodicity.

[0013] In step S102, for each user group, the historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated through a sliding window. When the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which he belongs, it is determined that the user's seal use behavior is abnormal.

[0014] A multi-scale sliding window is established based on the application timestamp of the user group. The total application amount is counted through the multi-scale sliding window to obtain the application frequency sequence of the user group. The multi-scale sliding window includes a 24-hour scale, a 48-hour scale, and a 72-hour scale. The application frequency mean and standard deviation are calculated for the user group application frequency sequence. The standard deviation multiple is determined by the ratio of the standard deviation to the mean. If the ratio of the standard deviation to the mean is less than or equal to one-quarter, the application frequency threshold is calculated using two times the standard deviation. If the ratio of the standard deviation to the mean is greater than one-quarter of the mean, the application frequency threshold is calculated using four times the standard deviation. The real-time application record of the user is counted using the multi-scale sliding window to obtain the real-time application total amount. The real-time application frequency is converted from the real-time application total amount. It is determined whether the real-time application frequency exceeds the application frequency threshold. If the real-time application frequency of the user exceeds the application frequency threshold for three consecutive sliding windows, it is determined that the user's seal usage behavior is abnormal.

[0015] Specifically, for each user group, read the seal-using application record form for the past three months, establish a multi-scale sliding window for the application timestamps. The window length for the 24-hour scale is 4 hours, for the 48-hour scale is 8 hours, and for the 72-hour scale is 12 hours. The window slides every 10 minutes. Calculate the total number of applications within each window based on the seal-using application timestamps to form a multi-scale application frequency sequence for the user group. Calculate the mean and standard deviation of the application frequencies for the user group at different time scales based on the seal-using application frequency sequence, and dynamically adjust the multiple of the standard deviation. If the group standard deviation is less than 25% of the mean, use 2 times the standard deviation; if the group standard deviation is greater than 25% of the mean, use 4 times the standard deviation. Increase the multiple of the standard deviation by 1 during holiday periods to calculate the upper and lower threshold tables for multi-scale frequencies. Read the latest application records of users at the 24-hour, 48-hour, and 72-hour time scales from the seal-using application real-time data table updated every 10 minutes, and use the same window length as the historical data at the corresponding scale to calculate the total number of user applications, and convert it to the real-time application frequency value according to the time span. Record information such as user ID, group ID, anomaly occurrence timestamp, anomaly duration, application frequency value, application frequency threshold, and anomaly degree in the user application record anomaly table. If the real-time application frequency of a user exceeds the application frequency threshold interval of the corresponding group at the corresponding time scale for three consecutive windows, calculate the anomaly degree score according to the difference from the threshold and write the anomaly record into the anomaly table. The multi-scale sliding window plays an important role in seal-using application monitoring. By setting different window lengths, it captures the application behavior characteristics at different time spans. Using a 4-hour window at the 24-hour scale can reflect the fluctuation law of seal-using applications within a single day, an 8-hour window at the 48-hour scale reflects the cross-day application trend, and a 12-hour window at the 72-hour scale shows the application changes over consecutive days. The window sliding every 10 minutes ensures the real-time nature of the monitoring. For example, in a certain group at the 24-hour scale, the number of applications within the window from 8 am to 12 pm is 12 times, from 9 am to 13 pm is 15 times, and from 10 am to 14 pm is 8 times. Record the total number of applications within the window to form an application frequency sequence. The seal-using application frequency sequence reflects the application behavior characteristics of the group. The mean reflects the overall application level of the group, and the standard deviation characterizes the degree of group fluctuation. The average daily application volume of the sales contract approval group is 25 times, with a standard deviation of 5 times, accounting for 20% of the mean. Use 2 times the standard deviation to calculate the threshold interval as 15 - 35 times. The average daily application volume of the personnel contract approval group is 15 times, with a standard deviation of 6 times, accounting for 40% of the mean. Use 4 times the standard deviation to calculate the threshold interval as 9 - 39 times. During holidays, the application volume fluctuates more, and the multiple of the standard deviation increases by 1, making the threshold interval wider. The real-time data table is updated every 10 minutes, and the latest application records of users are read. For example, if a user's application volume within a 4-hour window at the 24-hour scale is 8 times, the daily application frequency is converted to 48 times. If the application volume within an 8-hour window at the 48-hour scale is 16 times, the daily application frequency is converted to 48 times.There were 22 applications within a 12-hour window on a 72-hour scale, and the daily application frequency was calculated to be 44 times after conversion. The frequency values at the three scales are close, indicating stable application behavior. The exception record form details the exception application information. User number U001 belongs to the sales contract approval group G001. At 10:00 am on March 15, 2024, the application frequency reached 75 times in three consecutive windows, exceeding the upper limit of the group threshold by 35 times, and the degree of exception was 2.14 times. Subsequently, the user's application frequency dropped to 30 times, returning to the normal range of the group. Judging through three consecutive windows avoids misjudgment caused by accidental fluctuations, and the degree of exception is quantified to reflect the severity of deviation.

[0016] Step S103, when it is determined that a user has an abnormal seal-using behavior, automatically extract the seal-using application data of the user during the abnormal period, and use the Apriori association rule mining algorithm to calculate the support and confidence of combinations of different document types and seal-using purposes. Set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules reflecting the characteristics of the user's abnormal seal-using behavior.

[0017] When it is determined that a user has an abnormal seal-using behavior, obtain the seal-using application data of the user during the abnormal period in the abnormal seal-using record form. The seal-using application data includes batch numbers and seal-using application forms. Associate the seal-using application forms according to the batch numbers to obtain the document type field and the seal-using purpose field; perform encoding standardization processing on the document type field according to the business type to obtain the document type identifier, and perform word segmentation on the seal-using purpose field and convert it according to the preset word library to obtain the seal-using purpose identifier; construct an association rule item set based on the document type identifier and the seal-using purpose identifier, and use the Apriori association rule mining algorithm to calculate the support and confidence of combinations of different document types and seal-using purposes. Set the minimum support threshold and the minimum confidence threshold, screen the association rule items through the minimum support threshold, and add the rule items with rule confidence greater than the minimum confidence threshold in the screened association rule items to the strong association rule set, and finally obtain a set of strong association rules reflecting the characteristics of the user's abnormal seal-using behavior.

[0018] Specifically, all application records during the abnormal period of the user are obtained from the abnormal seal - using record form. According to the batch number, the seal - using application form is associated to extract the file type field and the seal - using purpose field. The data in the file type field is encoded and standardized according to the business type to obtain the file type identifier. After word - segmentation of the seal - using purpose field, it is converted into the seal - using purpose identifier by referring to the preset thesaurus. Null - value records and outlier records are removed, and a combination of a single file type identifier and a single seal - using purpose identifier is constructed for each application record. An association rule item set is constructed for the user's application data, with the maximum number of items in the association rule limited to 3. The file type identifier plus the seal - using purpose identifier is used as the rule - associated item, and the generation time of each rule item is marked. The rule items are sorted in chronological order according to the application batch time. The ratio of the number of occurrences of each combination in the user's application data to the total number of applications is calculated to obtain the support value. The support threshold of 0.15 is set as the item - set screening criterion. For the association rule items with a support greater than the support threshold of 0.15, the rule confidence value is calculated. The conditional probability is statistically calculated from the direction of the file type identifier to the seal - using purpose identifier, and the reverse probability is statistically calculated from the direction of the seal - using purpose identifier to the file type identifier. The rule confidence threshold of 0.75 is set, and the generation time of the associated combination records with a confidence greater than the threshold is added to the strong association rule set. Based on the strong association rule set, the file type identifier with the highest frequency of occurrence among all rule items is extracted. The rules are weighted sequentially according to the chronological relationship of the rule items, and the records with a rule generation time exceeding 24 hours are attenuated. The rule strength score is calculated by multiplying the support of the file type identifier associated with the seal - using purpose identifier by the rule confidence, and finally a set of strong association rules reflecting the characteristics of the user's abnormal seal - using behavior is obtained. For the mining of the association rules between the seal - using file type and purpose, the original data needs to be standardized first. File types such as commercial contracts are marked as T01, technical contracts are marked as T02, and business operation contracts are marked as T03. Seal - using purposes such as project bidding are marked as P01, business negotiation is marked as P02, and equipment procurement is marked as P03. For the application record with batch number 2024031501 in the abnormal seal - using record, the original value of the file type "procurement contract" is converted to T03, and the original value of the seal - using purpose "bidding documents" is converted to P01, forming a standardized T03 - P01 combination mark. The construction of the association rule item set limits the maximum number of items to 3, reflecting the association relationship between the file type and the seal - using purpose. For example, the file type T03 associated with the purpose P01 forms a two - item rule, and the file type T03 associated with the purposes P01 and P02 forms a three - item rule. According to the chronological order of the batch numbers, 2024031501 is earlier than 2024031502, and the rule item T03 - P01 is generated earlier than T02 - P02. Among 100 abnormal application records, T03 - P01 appears 20 times, with a support of 0.2, which is greater than the threshold of 0.15, so this rule item is retained.The calculation of rule confidence reflects the directionality of associations. The file type T03 appears 50 times, among which 30 times are associated with the purpose P01. The confidence in the direction from T03 to P01 is 0.6. The purpose P01 appears 40 times, among which 30 times are associated with the type T03. The confidence in the direction from P01 to T03 is 0.75, meeting the threshold requirements. The generation time of the rule record is 2024031510, and the marked rule item is T03-P01-0.75-202403151000. In the strong association rule set, the file type T03 appears most frequently, reaching 35 times. The association rule items are sorted in chronological order. The weight of the earliest generated rule item is 1.0, the weight decreases by 0.1 every 1 hour, and the weight of the rule item is reduced by 50% after more than 24 hours. The generation time of the rule item T03-P01 is 10 o'clock, with a weight of 1.0. The rule item T03-P02 is generated at 11 o'clock with a weight of 0.9. The products of the support and confidence are 0.15 and 0.12 respectively. After weighting, the rule strength scores are 0.15 and 0.108.

[0019] Step S104, according to the mined strong association rules, extract the key features in the strong association rules, including the associated file type, the information of the purpose of using the seal, and the association strength. By means of feature matching, search for historical risk cases similar to the key features in the risk assessment knowledge base. According to the risk level labels of the similar cases, classify the abnormal seal-using behavior of the current user as a high-risk behavior or a low-risk behavior. For high-risk behaviors, automatically reduce the user's seal usage permission and send a warning to the administrator. For low-risk behaviors, the system temporarily maintains the user's permissions unchanged but increases the monitoring frequency.

[0020] Receive the abnormal seal-using rules of the user in the strong association rule set, and extract the file type identifier, the seal-using purpose identifier, and the rule generation time according to the abnormal seal-using rules to obtain the key features; perform bucket mapping on the feature descriptors according to the key features by using the locality-sensitive hashing algorithm, and obtain the risk cases in the risk assessment knowledge base with a similarity greater than the preset similarity threshold by calculating the cosine similarity of the rule feature descriptors; if the number of risk cases exceeds the preset threshold of the number of high-risk cases, it is determined as a high-risk behavior, and then reduce the user's seal usage permission level in the seal permission table; if the high-risk determination condition is not met, it is determined as a low-risk behavior, and then reduce the monitoring time interval value and the monitoring window length value, and obtain the user behavior change result through continuous monitoring.

[0021] Specifically, obtain the user's abnormal seal - using rules from the strong - association rule set. Extract the file - type identifier, seal - using purpose identifier, and the time - sequence order of rule generation in the rules to construct key features. Convert the rule generation time into a time - series encoding. The product of the rule confidence and support is used as the rule strength value. Generate a rule feature descriptor by means of string concatenation, and record the occurrence order and association relationship of each feature attribute in the rule. Based on the rule feature descriptor, perform a nearest - neighbor feature match in the risk case library. Use the locality - sensitive hashing algorithm to perform bucket mapping on the feature descriptor, calculate the cosine similarity of the rule feature descriptor. Select the risk cases with a similarity greater than 0.8 as the candidate set. Take out the top 10 historical cases in terms of similarity from the candidate set. Each historical case contains seal - using rule features, risk levels, and disposal records. For the matching historical cases, calculate the weighted sum of case similarities. Set the weight of cases with a similarity greater than 0.9 to 1.0, and set the weight of cases with a similarity between 0.8 and 0.9 to 0.8. If the number of high - risk cases after weighting exceeds 6, reduce the permissions of the user's contract - specific seal and financial - specific seal in the seal permission table to pending approval, and reduce the permission of the legal person seal to prohibited use. At the same time, write the user number, strong - association rule, matching cases, and permission change details into the warning message queue. Keep the seal permissions of users who do not meet the high - risk determination conditions unchanged, modify the user monitoring parameter settings. Adjust the monitoring time interval from 10 minutes to 8 minutes, adjust the monitoring window length from 4 hours to 3 hours, and strengthen the monitoring for 72 hours. If no abnormal behavior occurs for 72 consecutive hours, restore the monitoring parameters to the initial settings. If abnormal behavior occurs again during this period, extend the strengthened monitoring time by 72 hours. The construction of key features standardizes the description of seal - using behavior. For example, the user applies for the seal of a procurement contract at 10 o'clock and applies for the seal of a bidding document at 11 o'clock. The file - type identifiers are T03 and T02 respectively, and the seal - using purpose identifiers are P01 and P02. Generate the rule feature T03P01 - T02P02 according to the time sequence. Multiply the rule confidence of 0.85 by the support of 0.2 to obtain the rule strength of 0.17. The feature descriptor is recorded as T03P01 - T02P02 - 0.17 - 1011, where 1011 represents the time - sequence relationship between 10 o'clock and 11 o'clock. The locality - sensitive hashing algorithm improves the matching efficiency through feature bucketing. Map the rule feature descriptor T03P01 - T02P02 - 0.17 - 1011 to the hash bucket numbered 506. In this hash bucket, there is a historical risk case RK00125 with the feature descriptor T03P01 - T02P03 - 0.16 - 1012. Calculate the cosine similarity of the two feature descriptors to be 0.92, which exceeds the similarity threshold of 0.8, and add the case RK00125 to the candidate set. Among all candidate cases, the top 10 cases in terms of similarity all come from the contract seal - using risk case library and contain historical disposal records.The risk level determination comprehensively considers the weights of case similarities. For case RK00125 with a similarity of 0.95, the weight is 1.0, and the final weighted score is 0.95. For case RK00132 with a similarity of 0.85, the weight is 0.8, and the weighted score is 0.68. Among the 10 matching cases, 8 are marked as high-risk. After weighting, the number of high-risk cases is 7, exceeding the high-risk case number threshold of 6. The adjustment of seal permissions differentiates different seal types. The application for the contract special seal is changed to the status of pending approval and can only be used after the administrator approves. The financial special seal is also set to pending approval, while the legal person seal is directly prohibited from use. The warning message records that user U0023 had a strong association rule T03P01 - T02P02 on March 15, 2024, and case RK00125 was matched, and the permission change includes 3 seal types. The dynamic adjustment of monitoring parameters realizes differential monitoring. The time interval is shortened to 8 minutes to increase the sampling frequency, and the window length is shortened to 3 hours to improve the real-time monitoring. The enhanced monitoring lasts for 72 hours. The user has an anomaly again after 50 hours, and the enhanced monitoring period is extended by 72 hours, adding 120 hours of monitoring duration. If no anomaly occurs within 120 hours, the monitoring time interval returns to 10 minutes, and the window length returns to 4 hours.

[0022] Step S105: Regularly collect the follow-up tracking data of all abnormal users within a period of time, including the user permission change records and the trend of behavior performance after the occurrence of abnormal behaviors, form a policy optimization training sample set, and use factor analysis method to automatically extract the key factors affecting the permission adjustment effect from the sample data of the training sample set, including the association rule features of abnormal behaviors and the behavior patterns of user groups to which the users belong, and establish a permission adjustment policy optimization model based on the key influencing factors.

[0023] Read the abnormal user data from the permission change record form, and obtain the user behavior tracking sample set through standardization processing. The user behavior tracking sample set includes six-dimensional data: the total number of seal application requests, application frequency, file type distribution, seal application purpose distribution, application time period distribution, and association rule features; calculate the coefficient of variation according to the user behavior tracking sample set, and perform factor analysis using the maximum standard deviation rotation method to obtain the principal component factors with eigenvalues greater than the preset eigenvalue threshold and the cumulative contribution rate exceeding the load threshold. The principal component factors are the key factors affecting the permission adjustment effect, including the association rule features of abnormal behaviors and the behavior patterns of user groups to which the users belong; fit the relationship between the principal component factors and the permission adjustment effect through a random forest regressor to construct a permission adjustment effect scoring matrix, and establish a permission adjustment policy optimization model based on the key influencing factors based on the permission adjustment effect scoring matrix.

[0024] Specifically, read the abnormal user data that occurred within the most recent 90 days from the permission change record table, extract the original data in six dimensions: the total number of seal application requests, application frequency, file type distribution, seal application purpose distribution, application time period distribution, and association rule features. Standardize the maximum value of each record to the range of 0 to 1, fill in the missing values with the mean value of the user group to which they belong, generate a user behavior tracking sample set, and record the user ID, the group to which the user belongs, the time of the abnormality, and the performance data before and after the permission change. Calculate the coefficient of difference of each user from the group benchmark value in the six dimensions for the user behavior tracking sample set. Set the calculation window of the coefficient of difference to 30 days, perform factor analysis using the varimax rotation method, limit the number of rotation iterations to within 50 times, select the principal component factors with eigenvalues greater than 1.0 and a cumulative contribution rate exceeding the load threshold of 0.65, and name the factors based on their business meanings. Fit the relationship between the factor scores and the permission adjustment effect through a random forest regressor to construct a permission adjustment effect scoring matrix. The permission effect score is calculated by weighting three indicators: the frequency of user abnormalities, the degree of violation, and the rectification duration. Use the analytic hierarchy process to determine the weights of the three indicators, and establish an optimization model for permission adjustment strategies based on key influencing factors based on the permission adjustment effect scoring matrix. Limit the depth of the tree to 8 layers, set the minimum number of samples for splitting to 10, and extract the contribution values of each principal component factor to the adjustment effect. Update the group benchmark value of the user group by weighting based on the contribution value of the permission adjustment effect, adjust the abnormal determination threshold interval according to the contribution value ratio, and add a seal usage restriction rule to the user permission table. The restriction rule includes four attribute fields: seal type, permission level, time limit, and approval process, and set the specific values according to the rule parameter configuration table. The collection of seal usage behavior tracking data covers multiple business dimensions. For example, for sales contract users, the average monthly application volume within 90 days before the permission adjustment was 120 times, which decreased to 45 times after the adjustment. The application frequency decreased from 8 times per day to 3 times per day. The file type changed from being concentrated in procurement contracts to being dispersed in multiple types. The seal application purpose extended from equipment procurement to business negotiation. The application time period changed from a fixed morning to being evenly distributed throughout the day. The association rule feature changed from a single rule to a diverse combination. The original data is mapped to the range of 0 to 1 after standardization. The normalized value of 120 application requests is 1.0, and the normalized value of 45 application requests is 0.375. The missing values in the record are filled with the average application volume of 85 times of the sales group to which the user belongs. The calculation of the coefficient of difference reflects the difference between the individual and group behaviors of the user. The benchmark application volume of the sales group is 85 times per month. Before the adjustment, the user had 120 application requests, and the coefficient of difference was 0.41. After the adjustment, the user had 45 application requests, and the coefficient of difference was -0.47. The varimax rotation method is used to extract the principal component factors, which converge after 32 iterations, obtaining three principal components with eigenvalues of 2.8, 1.5, and 1.2 respectively, and a cumulative contribution rate of 0.72. Based on their business meanings, the three principal components are named the application intensity factor, the rule compliance factor, and the time series law factor.The comprehensive evaluation of the effect of permission adjustment considers multiple indicators. The frequency of user exceptions decreases from 3 times per month to 1 time, scoring 0.8; the degree of violation decreases from exceeding the limit by 75% to 25%, scoring 0.7; the rectification duration shortens from an average of 5 days to 2 days, scoring 0.9. The analytic hierarchy process determines the weights of the three indicators to be 0.4, 0.35, and 0.25 respectively. The random forest regressor is set with a depth of 8 layers and a minimum number of split samples of 10. The contribution value of the application intensity factor is obtained as 0.45, the contribution value of the rule compliance factor is 0.35, and the contribution value of the time series law factor is 0.2. Based on the factor contribution values, the group benchmark judgment criteria are updated. The benchmark value of the application volume of the sales group is adjusted from 85 times to 75 times, the upper limit of exception judgment is lowered from 120 times to 105 times, and the lower limit is raised from 50 times to 55 times. The rules for restricting the use of seals reflect differentiated management. The permission level of the contract special seal is set at level 4, with a daily limit of 5 times, a 3-level approval process, and a validity period of 30 days. The permission level of the financial special seal is level 3, with a daily limit of 3 times, a 2-level approval process, and a validity period of 15 days. The permission level of the legal person seal is level 5, with a daily limit of 2 times, a 4-level approval process, and a validity period of 7 days.

[0025] Step S106, an optimization model for permission adjustment strategies based on key influencing factors. By mining the behavior change patterns of user groups before and after permission adjustment, automatically learn and screen patterns with a confidence level higher than the preset confidence threshold and an influence level higher than the preset influence threshold as new rules. Through continuously feeding the new rules back to the permission adjustment strategy optimization model for dynamic update, an adaptive permission management mechanism that can autonomously evolve according to user behavior in the intelligent seal management system is constructed.

[0026] Obtain the continuous behavior data of the user group before and after the permission adjustment point from the permission change record table, and use the sliding window statistical method to obtain the change trend curve based on the behavior data; judge whether the fluctuation value is less than the preset fluctuation threshold according to the change trend curve. If the fluctuation value is less than the preset fluctuation threshold, obtain the behavior data in the stable interval; perform sequence clustering on the behavior data in the stable interval to obtain behavior patterns, calculate the confidence level and influence index values through the behavior patterns. If the confidence level is higher than the preset confidence threshold and the influence is higher than the preset influence threshold, determine the effective behavior pattern; use the effective behavior pattern as a new rule to construct a permission change rule set, and perform incremental training on the permission change rule set using a decision tree. Judge the accuracy of the new rule through the verification sample set. If the accuracy exceeds the preset threshold, feedback the new rule to the permission adjustment strategy optimization model for dynamic update.

[0027] Specifically, obtain the behavioral data of the user group to which the user belongs for 90 consecutive days before and after the permission adjustment point from the user permission change record form. Calculate the change trend based on four dimensions: application frequency, proportion of document types, distribution of seal - using purposes, and time - period distribution. Use a 6 - hour sliding window statistical method to record the slope of the change curve. Determine and eliminate the data with fluctuations exceeding the 0.3 interval through the curve fluctuation measurement index, and retain the behavioral data in the stable interval. According to the behavioral data in the stable interval, use sequence clustering to extract the behavioral patterns of the user group, and calculate three indicators: support, confidence, and lift for each behavioral sequence. Set the support threshold to 0.3, the confidence threshold to 0.7, and the lift threshold to 1.5 according to business rules. Screen the sequences exceeding the threshold as effective behavioral patterns, and calculate the occurrence frequency of events included in the behavioral patterns and the degree of business impact to obtain the confidence level value and the impact intensity value. Construct permission change rules for the effective behavioral patterns. The rule attributes include user - group identification, permission type, adjustment direction, change amplitude, effective conditions, approval process, and time - limit. The rule strength value is calculated by multiplying the product of the confidence level and the impact intensity by the rule - effective duration decay coefficient. Eliminate the rules with a strength lower than 0.5, and sort the rules according to the rule strength value to establish the rule priority. Conduct incremental training on the permission change rules based on the decision tree, set the maximum depth of the tree to 8 layers, the minimum number of samples for splitting to 10, extract rules for the newly added permission change data every 12 hours, calculate the accuracy of the new rules through the rule - verification sample set, and feedback the rules with an accuracy exceeding 0.8 and a rule strength value exceeding the minimum value of the existing rule set to the permission adjustment strategy optimization model for dynamic update. Eliminate the rules in the rule set whose effective time exceeds 90 days, and regularly update the rule evaluation indicators. The monitoring of behavioral change trends reflects the characteristics of the user group through multi - dimensional data. For the sales contract approval group, the average application frequency in the 90 days before the permission adjustment is 15 times per day. Among the document types, the proportion of procurement contracts is 0.6, and the proportion of bidding documents is 0.3. The main seal - using purpose for business negotiation accounts for 0.5. The application time - period is concentrated from 9:00 am to 11:00 am, accounting for 0.7. Use a 6 - hour sliding window to record the change curve. The application volume within the window drops from 15 times to 8 times, the slope is - 1.17, and the curve fluctuation degree is 0.25, which is lower than the preset fluctuation threshold of 0.3, so it is determined as the stable - interval data. Sequence clustering extracts behavioral patterns that reflect the group behavior law. In the stable interval of the sales group, there are 20 times of sequences for applying for the seal - using of bidding documents within 12 hours after the procurement contract is stamped with the contract - specific seal. Among the total 100 sequences, the support is 0.2, the confidence is 0.8, and the lift is 1.8, exceeding the preset threshold. The annual occurrence frequency of this sequence of events is 250 times, involving an amount of 50 million yuan, the confidence level value is 0.75, and the impact intensity value is 0.85.The authority change rule structured records control requirements. Rule number R001 applies to the sales group. The authority type includes a contract-specific stamp. The adjustment direction is to reduce the quota, with the change range being five reductions in the daily limit. The condition for effectiveness is three consecutive days of exceeding the limit. The approval process requires dual approval by the department head and the responsible leader, and the validity period is 30 days. The rule confidence level of 0.75 multiplied by the impact strength of 0.85 is 0.64. After a 15-day time decay coefficient of 0.9, the rule strength is adjusted to 0.58. Incremental decision tree training enables dynamic rule optimization. New authority change data shows that the violation rate for the sales group decreased by 40% after the quota was tightened. The new rule achieved an accuracy of 0.85 on the validation sample. The rule strength of 0.58 exceeds the minimum value of 0.52 in the existing rule set. Training is conducted every 12 hours, and eight rule updates and iterations were completed within 90 days. Rule evaluation indicators show that the accuracy of violation warnings increased from 0.75 to 0.85, and the false negative rate decreased from 0.15 to 0.08. Through continuous iterative verification, inapplicable rules are adjusted in a timely manner to maintain the timeliness of the rule base.

[0028] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. Adaptive permission management method for intelligent seal management system, characterized in that The method comprises: The user's seal operation sequence data in different time periods is obtained, including seal usage time, file type, and seal usage purpose information, and a user seal usage behavior feature vector is constructed. All users are grouped through a clustering algorithm to obtain several user groups with different seal usage behavior patterns; for each user group, their historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated through a sliding window. When a user's real-time seal application frequency exceeds the normal fluctuation range of the group to which he belongs, the user's seal usage behavior is determined to be abnormal; when a user is determined to have abnormal seal usage behavior, the user's seal application data during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of different file type and seal usage purpose combinations, set the minimum support and minimum confidence thresholds, filter out weak association rules, and finally obtain a set of strong association rules that reflect the characteristics of the user's abnormal seal usage behavior; based on the mined strong association rules, the key features in the strong association rules are extracted, including associated file type, associated seal usage purpose information, and association strength, and historical records similar to the key features are searched in the risk assessment knowledge base through feature matching. Risk cases: Based on the risk level labels of similar cases, the current user's abnormal seal usage behavior is divided into high-risk behavior or low-risk behavior. For high-risk behavior, the user's seal usage rights are automatically reduced and an early warning is sent to the administrator. For low-risk behavior, the system temporarily maintains the user's rights but increases the monitoring frequency. Regularly collect follow-up tracking data of all abnormal users over a period of time, including user rights change records and behavioral performance change trends after abnormal behavior occurs, to form a strategy optimization training sample set. Use factor analysis to automatically extract key factors that affect the effect of authority adjustment from the sample data of the training sample set, including the association rule characteristics of abnormal behavior and the behavioral patterns of the user group to which the user belongs, and establish a authority adjustment strategy optimization model based on key influencing factors. The authority adjustment strategy optimization model based on key influencing factors mines the behavioral change patterns of user groups before and after authority adjustment, automatically learns and filters patterns with confidence higher than the preset confidence threshold and influence higher than the preset influence threshold as new rules, and continuously feeds new rules back to the authority adjustment strategy optimization model for dynamic updates, thereby building an adaptive authority management mechanism in the intelligent seal management system that can evolve autonomously according to user behavior. The permission adjustment strategy optimization model based on key influencing factors mines the behavioral change patterns of user groups before and after permission adjustment, automatically learns and selects patterns with confidence levels higher than a preset confidence threshold and influence levels higher than a preset influence threshold as new rules. By continuously feeding the new rules back to the permission adjustment strategy optimization model, dynamic updates are achieved, building an adaptive permission management mechanism in the smart seal management system that can autonomously evolve according to user behavior, including: Obtaining continuous behavior data of the user group before and after the permission adjustment point from the permission change record table, and obtaining a change trend curve based on the behavior data using a sliding window statistical method; Determining whether the fluctuation value is less than a preset fluctuation threshold according to the change trend curve, and obtaining stable interval behavior data if the fluctuation value is less than the preset fluctuation threshold; Performing sequence clustering on the stable interval behavior data to obtain a behavior pattern, calculating a confidence level and an influence index value based on the behavior pattern, and determining a valid behavior pattern if the confidence level is higher than a preset confidence threshold and the influence level is higher than a preset influence threshold; The effective behavior pattern is used as a new rule to construct a permission change rule set, and the permission change rule set is incrementally trained using a decision tree. The accuracy of the new rule is judged by verifying the sample set. If the accuracy exceeds the preset threshold, the new rule is fed back to the permission adjustment strategy optimization model for dynamic update.

2. The method according to claim 1, wherein The method obtains user seal usage sequence data in different time periods, including seal usage time, file type, and seal usage purpose information, constructs user seal usage behavior feature vectors, and groups all users using a clustering algorithm to obtain several user groups with different seal usage behavior patterns, including: Obtain user seal operation sequence data from the seal management database, and calculate the percentage of application times by time period based on the seal operation sequence data to obtain the user time period distribution vector; For the file type and seal purpose fields in the seal operation sequence data, Jieba word segmenter is used to perform word segmentation processing, and the word frequency of the word segmentation result is calculated and normalized to obtain the seal document feature vector; A time window is set according to the stamp operation sequence data for sliding statistics, a discrete Fourier transform is performed on the application number sequence within the window, and the maximum frequency component after the Fourier transform is obtained to obtain the application behavior characteristics; The user time period distribution vector, the seal document feature vector and the application behavior feature are spliced together to construct a user seal usage behavior feature vector, a maximum spanning tree algorithm is used to perform clustering operation on the user seal usage behavior feature vector, and user groups are divided according to Euclidean distance.

3. The method according to claim 1, wherein For each user group, the historical seal application data is analyzed, and the mean and standard deviation of the seal application frequency of the user group at different time scales are calculated using a sliding window. When the real-time seal application frequency of a user exceeds the normal fluctuation range of the group to which he belongs, the user's seal application behavior is determined to be abnormal, including: Establishing a multi-scale sliding window based on the application timestamps of the user groups, and using the multi-scale sliding window to count the total number of applications to obtain a user group application frequency sequence, wherein the multi-scale sliding window includes a 24-hour scale, a 48-hour scale, and a 72-hour scale; Calculate the application frequency mean and standard deviation of the user group application frequency sequence, determine the standard deviation multiple by the ratio of the standard deviation to the mean, and if the ratio of the standard deviation to the mean is less than or equal to one-quarter, use two times the standard deviation to calculate the application frequency threshold; if the ratio of the standard deviation to the mean is greater than one-quarter the mean, use four times the standard deviation to calculate the application frequency threshold; The real-time application total amount is obtained by counting the user's real-time application records using the multi-scale sliding window, and the real-time application frequency is obtained by converting the real-time application total amount; It is judged whether the real-time application frequency exceeds the application frequency threshold. If the real-time application frequency of the user exceeds the application frequency threshold in three consecutive sliding windows, it is determined that the user's seal-using behavior is abnormal.

4. The method according to claim 1, wherein When the user is determined to have abnormal seal-using behavior, the seal-using application data of the user during the abnormal period is automatically extracted, and the Apriori association rule mining algorithm is used to calculate the support and confidence of combinations of different file types and seal-using purposes. The minimum support and minimum confidence thresholds are set, weak association rules are filtered out, and finally a set of strong association rules reflecting the characteristics of the user's abnormal seal-using behavior is obtained, including: When the user is determined to have abnormal seal-using behavior, the seal-using application data of the user during the abnormal period in the abnormal seal-using record table is obtained. The seal-using application data includes batch numbers and seal-using application forms. The file type field and the seal-using purpose field are obtained by associating the seal-using application forms according to the batch numbers; The file type field is encoded and standardized according to the business type to obtain a file type identifier, and the seal-using purpose field is segmented and then converted according to a preset word library to obtain a seal-using purpose identifier; An association rule item set is constructed based on the file type identifier and the seal-using purpose identifier, and the Apriori association rule mining algorithm is used to calculate the support and confidence of combinations of different file types and seal-using purposes. The minimum support threshold and the minimum confidence threshold are set. The association rule items are screened by the minimum support threshold, and the rule items with rule confidence greater than the minimum confidence threshold in the screened association rule items are added to the strong association rule set, and finally a set of strong association rules reflecting the characteristics of the user's abnormal seal-using behavior is obtained.

5. The method according to claim 1, wherein According to the mined strong association rules, the key features in the strong association rules are extracted, including associated file types, associated seal-using purpose information, and association strength. By means of feature matching, historical risk cases similar to the key features are searched in the risk assessment knowledge base. According to the risk level labels of the similar cases, the abnormal seal-using behavior of the current user is classified as a high-risk behavior or a low-risk behavior. For high-risk behaviors, the user's seal-using permission is automatically reduced, and a warning is sent to the administrator. For low-risk behaviors, the system temporarily maintains the user's permission unchanged, but increases the monitoring frequency, including: Receive the user's abnormal seal-using rules in the strong association rule set, and extract the file type identifier, the seal-using purpose identifier and the rule generation time according to the abnormal seal-using rules to obtain key features; According to the key features, the locality-sensitive hashing algorithm is used to perform bucket mapping on the feature descriptors, and risk cases with a similarity greater than a preset similarity threshold in the risk assessment knowledge base are obtained by calculating the cosine similarity of the rule feature descriptors; If the number of risk cases exceeds the preset high-risk case number threshold, it is determined as a high-risk behavior, and the user's seal-using permission level is reduced in the seal permission table; If the high-risk determination conditions are not met and it is determined as a low-risk behavior, the monitoring time interval value and the monitoring window length value are reduced, and the user behavior change result is obtained through continuous monitoring.

6. The method according to claim 1, characterized in that, Regularly collect the subsequent tracking data of all abnormal users within a period of time, including the user permission change records and the trend of behavior performance changes after abnormal behaviors occur, form a strategy optimization training sample set, and use factor analysis to automatically extract the key factors affecting the permission adjustment effect from the sample data of the training sample set, including the association rule features of abnormal behaviors and the behavior patterns of user groups, and establish a permission adjustment strategy optimization model based on the key influencing factors, including: Read the abnormal user data from the permission change record form, and obtain the user behavior tracking sample set through standardization processing. The user behavior tracking sample set includes six-dimensional data of the total number of seal application, application frequency, file type distribution, seal application purpose distribution, application time period distribution, and association rule features. Calculate the difference coefficient according to the user behavior tracking sample set, perform factor analysis using the maximum standard deviation rotation method, and obtain the principal component factors with eigenvalues greater than the preset eigenvalue threshold and the cumulative contribution rate exceeding the load threshold. The principal component factors are the key factors affecting the permission adjustment effect, including the association rule features of abnormal behaviors and the behavior patterns of user groups. Construct a permission adjustment effect scoring matrix by fitting the relationship between the principal component factors and the permission adjustment effect through a random forest regressor, and establish a permission adjustment strategy optimization model based on the key influencing factors based on the permission adjustment effect scoring matrix.

7. The method according to claim 6, wherein The permission adjustment effect scoring matrix is weighted and calculated based on three indicators: the frequency of user anomalies, the degree of violation, and the rectification duration, and the analytic hierarchy process is used to determine the weights of the three indicators.

8. The method according to claim 1, wherein The rule attributes of the permission change rule include user group identification, permission type, adjustment direction, change amplitude, effective conditions, approval process, and time limit.

Images