Access control method and device and electronic equipment

Abstract

The invention discloses an access control method and device and electronic equipment, and the method comprises the steps: carrying out the evaluation of a real-time access request of industrial equipment based on a target behavior model, and obtaining a model decision result; if it is determined that the model decision result meets the model updating condition, the target behavior model is updated again, a new target behavior model is obtained, and the real-time access request of the industrial equipment is evaluated based on the new target behavior model so as to determine whether the real-time access request is passed or not. Through the technical scheme provided by the embodiment of the invention, the target behavior model can be quickly adjusted, so that the target behavior model can cope with the real-time access request of the industrial equipment and can adapt to the dynamic change of the data and the running state of the modern industrial equipment; therefore, the problem that a resource access permission control method depending on a static access strategy has significant limitation when dealing with modern dynamically-changed industrial equipment data and operation states is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an access control method, device and electronic device. Background Art

[0002] The popularization of industrial automation and the advancement of intelligent manufacturing have made industrial equipment play an increasingly important role in the production process. Among them, resource access control of industrial equipment is of great significance. For example, unauthorized access to industrial equipment may not only cause damage to the industrial equipment and interrupt production, but also leak relevant data of the industrial equipment and lead to legal risks.

[0003] Traditional industrial equipment resource access rights control methods rely on a set of predefined rules and policies. However, the predefined rules and policies cannot dynamically adjust and control resource access rights. Therefore, the predefined rules and policies belong to static access control mechanisms. Therefore, access rights methods based on static access control mechanisms (i.e., resource access rights control methods that rely on static access policies) are suitable for fixed scenarios or scenarios that change less frequently, and thus cannot cope with dynamically changing industrial equipment data and operating conditions, making resource access rights control methods that rely on static access policies have significant limitations when dealing with dynamically changing industrial equipment data and operating conditions.

[0004] Taking the industrial edge computing scenario as an example, industrial equipment will continuously generate new data and operating status. These changes may cause changes in the behavior patterns of industrial equipment. The resource access permission control method that relies on static access policies cannot be quickly adjusted to adapt to these dynamic changes, and thus cannot identify and respond to potential security threats in a timely manner, which leads to significant limitations in industrial edge computing scenarios. Summary of the invention

[0005] The present application provides an access control method, device and electronic device to solve the problem that the resource access permission control method that relies on static access policies cannot be quickly adjusted to adapt to the dynamic changes in modern industrial equipment data and operating status, which makes it have significant limitations in dealing with modern dynamically changing industrial equipment data and operating status. The specific implementation plan is as follows:

[0006] In a first aspect, the present application provides an access control method, the method comprising:

[0007] Based on the target behavior model, the real-time access requests of industrial equipment are evaluated to obtain the model decision results;

[0008] If it is determined that the model decision result meets the model update condition, the target behavior model is updated again to obtain a new target behavior model, and based on the new target behavior model, the real-time access request of the industrial device is evaluated to determine whether the real-time access request is approved.

[0009] Through the above-mentioned application embodiment, when the model decision result obtained after the target behavior model evaluates the real-time access request of the industrial equipment meets the model update condition, the target behavior model is updated again, so that the target behavior model can be quickly adjusted so that it can respond to the real-time access request of the industrial equipment, and then the real-time access request of the industrial equipment is evaluated based on the updated new target behavior model, so as to adapt to the dynamic changes of the industrial equipment. Compared with the resource access permission control method that relies on static access policies and cannot be adjusted quickly, the target behavior model in the above-mentioned application embodiment can be quickly updated when the model update condition is met to adapt to the dynamic changes of modern dynamic industrial equipment data and operating status, thereby solving the problem that the resource access permission control method that relies on static access policies has significant limitations in responding to modern dynamically changing industrial equipment data and operating status.

[0010] In a possible implementation manner, before evaluating the real-time access request of the industrial device based on the target behavior model to obtain the model decision result, the method further includes:

[0011] Collecting access data of each industrial device by mirroring traffic, and processing the access data based on a data preprocessing method and a data format of a behavior model to obtain first training data; and

[0012] Converting the static access strategy into second training data;

[0013] Combining the first training data and the second training data to obtain a training data set;

[0014] Based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

[0015] Through the above application embodiment, the first training data obtained based on the access data of each industrial device and the second training data obtained based on the static access policy are used to obtain a training data set for training the behavior model. Then, based on the training data set, the behavior model is trained using a supervised learning algorithm, so that the target behavior model obtained is the optimal model at the current stage. In addition, by collecting access data in the form of mirrored traffic, the access behavior of each industrial device can be analyzed without affecting the normal use of the industrial equipment. In addition, processing the access data based on the data preprocessing method and the data format of the behavior model is conducive to improving the data quality of the first training data, thereby improving the quality of the training data set obtained based on the first training data, and at the same time, it is conducive to the behavior model to correctly understand the data in the training data set, thereby further improving the performance effect of the target behavior model obtained based on the training data set. In addition, the second training data obtained based on the static access policy can effectively supplement the first training data, so that the obtained training data set is more complete, so that the target behavior model trained based on the training data set is more in line with the actual needs of the business, which helps to further improve the performance effect of the target behavior model.

[0016] In a possible implementation, the target behavior model is used to evaluate the real-time access request of the industrial equipment to obtain the model decision result, including:

[0017] receiving the real-time access request of the industrial device;

[0018] Based on the data preprocessing method and the data format of the target behavior model, the real-time access request is processed to obtain the data to be predicted;

[0019] The data to be predicted is processed by the target behavior model to obtain the model decision result; wherein the model decision result includes passing the real-time access request, or includes rejecting the real-time access request.

[0020] Through the above application embodiment, based on the data preprocessing method and the data format of the target behavior model, the real-time access request of the received industrial equipment is processed to obtain the data to be predicted, which is conducive to improving the data quality of the data to be predicted and making the data to be predicted conform to the data format of the target behavior model, so that the target behavior model can correctly understand the data to be predicted, and then make the model decision result obtained after the target behavior model processes the data to be predicted more accurate. Then, through the processing of the target behavior model on the data to be predicted, an accurate model decision result is obtained, which provides an execution basis for subsequent operations.

[0021] In a possible implementation manner, after evaluating the real-time access request of the industrial device based on the target behavior model to obtain the model decision result, the following further includes:

[0022] Reviewing the model decision result to obtain a review result corresponding to the real-time access request;

[0023] If it is determined that the model decision result is consistent with the audit result, a first response instruction is generated based on the model decision result, and a corresponding operation is performed based on the first response instruction.

[0024] Through the above application embodiment, after obtaining the model decision result, the model decision result is further audited to obtain the audit result corresponding to the real-time access request, further ensuring the accuracy of the final decision. Then, when the audit result is consistent with the model decision result, a first response instruction is generated based on the model decision result, and then based on the first response instruction, the corresponding operation is performed, thereby ensuring the accuracy of subsequent operations and avoiding serious consequences such as safety accidents, equipment damage or data leakage caused by incorrect operations on access requests to industrial equipment.

[0025] In a possible implementation manner, after reviewing the model decision result and obtaining the review result corresponding to the real-time access request, the method further includes:

[0026] If it is determined that the model decision result is inconsistent with the audit result, a final decision result is obtained based on the audit result; a second response instruction is generated based on the final decision result, and a corresponding operation is performed based on the second response instruction.

[0027] Through the above-mentioned application embodiment, when the audit result is inconsistent with the model decision result, the final decision result is obtained based on the audit result, and then a second response instruction is generated based on the final decision result to perform the corresponding operation, thereby avoiding the execution of the corresponding operation based on the wrong model decision result, thereby further ensuring the accuracy of subsequent operations and avoiding serious consequences such as safety accidents, equipment damage or data leakage caused by incorrect operation of access requests to industrial equipment.

[0028] In a possible implementation, the model update condition is that the audit result is inconsistent with the model decision result, and the historical decision accuracy is lower than the accuracy threshold, then if it is determined that the model decision result meets the model update condition, the target behavior model is updated again to obtain a new target behavior model, including:

[0029] Reviewing the model decision result to obtain the review result corresponding to the real-time access request;

[0030] If it is determined that the audit result is inconsistent with the model decision result, updating the historical decision accuracy of the target behavior model;

[0031] When the updated historical decision accuracy is lower than the accuracy threshold, the update of the target behavior model is triggered to obtain the updated new target behavior model.

[0032] Through the above-mentioned application embodiment, the model decision result is audited to further ensure the accuracy of the final decision. Then, when the audit result is inconsistent with the model decision result, the historical decision accuracy of the target behavior model is updated. When the updated historical decision accuracy is not lower than the accuracy threshold, it can be determined that the current target behavior model no longer meets the current access situation of the industrial equipment. At this time, the update of the target behavior model is immediately triggered to obtain the updated new target behavior model, so that the new target behavior model can continue to meet the current access situation of the industrial equipment, thereby having excellent adaptability in the dynamically changing industrial equipment data and operating status. In addition, when the audit result is inconsistent with the model decision result, the historical decision accuracy of the target behavior model is first updated, and then based on the updated historical decision accuracy, it is determined whether to trigger the update of the target behavior model, which can avoid the inconsistency between the audit result and the model decision result caused by accidental circumstances, thereby making the timing of the update of the target behavior model more accurate.

[0033] In a possible implementation, triggering the update of the target behavior model to obtain the updated new target behavior model includes:

[0034] Saving the real-time access request and the audit result as first data to be trained;

[0035] Based on the data preprocessing method and the data format of the target behavior model, the first data to be trained is processed to obtain second data to be trained;

[0036] Merging the second data to be trained with the training data set to obtain a new training data set;

[0037] Based on the new training data set, the target behavior model is retrained to obtain the updated new target behavior model.

[0038] Through the above-mentioned application embodiment, based on the data preprocessing method and the input format of the target behavior model, the first data to be trained formed based on the real-time access request and the audit result is processed, which helps to improve the data quality of the second data to be trained, and makes the second data to be trained conform to the data format of the target behavior model, so that when the new training data set obtained based on the second data to be trained is used to train the target behavior model, the target behavior model can correctly understand the new training data set, which helps to improve the performance effect of the obtained new target behavior model. In addition, the training data set is merged with the second data to be trained based on the real-time access request and the audit result, so that the new training data set contains the real-time access request whose audit result is inconsistent with the model decision result, so that the training of the target behavior model takes into account the real situation (i.e., the real-time access request and the audit result) corresponding to the error situation (i.e., the real-time access request and the model decision result), and then the obtained new target behavior model takes into account the current access situation of the industrial equipment, further improving the performance effect of the new target behavior model.

[0039] In a second aspect, the present application further provides an access control device, the device comprising:

[0040] An evaluation module is used to evaluate the real-time access request of industrial equipment based on the target behavior model to obtain the model decision result;

[0041] A processing module is used to re-update the target behavior model to obtain a new target behavior model if it is determined that the model decision result meets the model update condition, and evaluate the real-time access request of the industrial device based on the new target behavior model to determine whether to pass the real-time access request.

[0042] In a possible implementation, the device further includes a training module, the training module being specifically configured to collect access data of each industrial device by means of mirrored traffic, and to process the access data based on a data preprocessing method and a data format of a behavior model to obtain first training data; and

[0043] Converting the static access strategy into second training data;

[0044] Combining the first training data and the second training data to obtain a training data set;

[0045] Based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

[0046] In a possible implementation, the evaluation module is specifically configured to receive the real-time access request of the industrial device;

[0047] Based on the data preprocessing method and the data format of the target behavior model, the real-time access request is processed to obtain the data to be predicted;

[0048] The data to be predicted is processed by the target behavior model to obtain the model decision result; wherein the model decision result includes passing the real-time access request, or includes rejecting the real-time access request.

[0049] In a possible implementation, the processing module is specifically used to review the model decision result to obtain a review result corresponding to the real-time access request;

[0050] If it is determined that the model decision result is consistent with the audit result, a first response instruction is generated based on the model decision result, and a corresponding operation is performed based on the first response instruction.

[0051] In one possible implementation, the processing module is specifically used to obtain a final decision result based on the audit result if it is determined that the model decision result is inconsistent with the audit result; generate a second response instruction based on the final decision result; and perform a corresponding operation based on the second response instruction.

[0052] In a possible implementation, the model update condition is that the audit result is inconsistent with the model decision result, and the historical decision accuracy is lower than the accuracy threshold, then the processing module is specifically used to audit the model decision result to obtain the audit result corresponding to the real-time access request;

[0053] If it is determined that the audit result is inconsistent with the model decision result, updating the historical decision accuracy of the target behavior model;

[0054] When the updated historical decision accuracy is lower than the accuracy threshold, the update of the target behavior model is triggered to obtain the updated new target behavior model.

[0055] In a possible implementation manner, the processing module is specifically configured to save the real-time access request and the audit result as first data to be trained;

[0056] Based on the data preprocessing method and the data format of the target behavior model, the first data to be trained is processed to obtain second data to be trained;

[0057] Merging the second data to be trained with the training data set to obtain a new training data set;

[0058] Based on the new training data set, the target behavior model is retrained to obtain the updated new target behavior model.

[0059] In a third aspect, the present application provides an electronic device, including:

[0060] Memory, used to store computer programs;

[0061] The processor is used to implement the above-mentioned access control method steps when executing the computer program stored in the memory.

[0062] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned access control method steps are implemented.

[0063] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A flowchart of an access control method provided in an embodiment of the present application;

[0065] Figure 2 A schematic diagram of a process for determining a target behavior model provided in an embodiment of the present application;

[0066] Figure 3 A schematic diagram of the processing process of the access control method provided in the embodiment of the present application;

[0067] Figure 4 A schematic diagram of an access control device provided in an embodiment of the present application;

[0068] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0070] Before introducing the access control method provided in the embodiment of the present application, in order to facilitate understanding, the technical terms involved in the embodiment of the present application are first explained below.

[0071] (1) Information Technology (IT) security refers to measures and mechanisms to protect information systems and data from unauthorized access, use, disclosure, destruction, modification or destruction. The core goal is to ensure the confidentiality, integrity and availability of data.

[0072] (2) Operational Technology (OT) Security: refers to security measures that protect industrial control systems (ICS) and physical equipment (such as factory automation equipment, manufacturing systems, power grids, transportation systems, etc.) from cyber attacks, misoperation, or physical damage. The core goal is to ensure system stability, reliability, and security to ensure the continued normal operation of industrial processes.

[0073] (3) Access control: refers to managing the access rights of users, systems or entities (such as requesters) to resources (such as industrial equipment) through a series of policies and mechanisms to ensure that only authorized individuals or systems can access, use or modify these resources. The main goal is to protect the security of systems, data and resources and prevent unauthorized access, tampering or abuse.

[0074] (4) Dynamic access control: refers to a mechanism that dynamically adjusts and controls resource access permissions based on real-time contextual information (such as user identity, location, device status, time, behavior patterns, etc.). It can instantly evaluate the environment and conditions at the time of access and make authorization decisions based on predefined policies.

[0075] (5) Access Control List: A mechanism for managing and controlling the access rights of users or systems to resources (such as files, directories, network devices, etc.). It implements security control of resources by listing specific users or user groups and their corresponding access rights.

[0076] (6) Role-based access control: An access control model that controls user access to system resources by assigning access rights to roles and then assigning these roles to users.

[0077] (7) Machine Learning: An AI technique that enables computer systems to automatically learn and improve from data without being explicitly programmed, using algorithms to analyze and identify patterns in data and make predictions or decisions based on new data.

[0078] (8) Supervised learning: A type of machine learning method in which the model makes predictions or classifications by learning labeled training data. Each training sample contains input data and a corresponding output label. The model is trained based on these known input-output pairs until it can accurately predict the output of new data.

[0079] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0080] With the development of Industry 4.0 and Internet of Things (IoT), the interconnection of industrial equipment has become increasingly close. Therefore, access control of industrial equipment is extremely important.

[0081] Traditional resource access permission control methods for industrial equipment rely on static access policies, and thus implement resource access permission control for industrial equipment based on static access policies. However, resource access permission control methods that rely on static access policies cannot be dynamically adjusted according to actual network behaviors and threats, and thus cannot identify changes in access behaviors of industrial equipment in complex and changeable industrial networks, and thus cannot accurately distinguish between legitimate access and potential threats in access behaviors, resulting in security risks in the industrial networks corresponding to industrial equipment.

[0082] Therefore, the present application proposes an access control method, which evaluates the real-time access request of industrial equipment through a target behavior model to evaluate the access behavior of industrial equipment in a complex and changeable industrial network; after the target behavior model evaluates the real-time access request and obtains the model decision result, if the model decision result meets the model update condition, the target behavior model is updated again, so that the target behavior model can be quickly adjusted so that it can respond to the real-time access request of industrial equipment, and then the real-time access request of industrial equipment is evaluated based on the updated new target behavior model, so as to accurately identify the changes in the access behavior of industrial equipment in a complex and changeable industrial network, so as to accurately distinguish between legitimate access and potential threats in the access behavior, so as to improve the security of the industrial network corresponding to the industrial equipment. Compared with the resource access permission control method that relies on static access policies and cannot be adjusted quickly, the access control method proposed in the embodiment of the present application can quickly update the target behavior model when the model update condition is met, so that the behavior model can adapt to the dynamic changes of modern industrial equipment data and operating status, thereby solving the problem that the resource access permission control method that relies on static access policies has significant limitations in responding to modern dynamically changing industrial equipment data and operating status.

[0083] Reference Figure 1 The figure is a flow chart of an access control method provided by an embodiment of the present application, the method comprising:

[0084] S101, based on the target behavior model, the real-time access request of the industrial equipment is evaluated to obtain the model decision result.

[0085] The model decision result includes passing the real-time access request or rejecting the real-time access request. The real-time access request can be an access request initiated by the requesting party to the industrial device in real time. The access request corresponds to the access behavior of the industrial device in the complex and changeable industrial network.

[0086] S102: If it is determined that the model decision result meets the model update condition, the target behavior model is updated again to obtain a new target behavior model, and based on the new target behavior model, the real-time access request of the industrial device is evaluated to determine whether the real-time access request is approved.

[0087] Specifically, in order to implement the evaluation of real-time access requests for industrial equipment, it is first necessary to obtain a target behavior model for evaluating real-time access requests.

[0088] The target behavior model can be obtained by training the behavior model based on the training data set using a supervised learning algorithm. The behavior model can be a machine learning model, such as a model based on a random forest algorithm.

[0089] The specific process of using the supervised learning algorithm to train the behavior model based on the training data set to obtain the target behavior model can be as follows: Figure 2 As shown in steps S201-S205 in .

[0090] S201, collecting access data of various industrial devices by means of mirrored traffic.

[0091] The access data may be an access request initiated by a requesting party to the industrial device.

[0092] Specifically, during the normal use of industrial equipment, access data of each industrial equipment is collected by mirroring traffic, so that the access behavior of each industrial equipment can be analyzed without affecting the normal use of the industrial equipment.

[0093] S202: Process the access data based on the data preprocessing method and the data format of the behavior model to obtain first training data.

[0094] Among them, the preprocessing method may include noise removal, data standardization, data formatting and other processing, so as to improve the data quality of the first training data, reduce redundant data in the first training data, and help improve the training effect of subsequent behavior models.

[0095] The data format of the behavior model can be predefined. The data format of the behavior model can also be called a training data format.

[0096] In the embodiment of the present application, the access data of the industrial equipment can be divided into two categories, including first category data and second category data.

[0097] The first type of data is used to reflect the characteristics of business operation, such as requester, access role, access object, operation type, operation variable, variable value, etc. In other words, the first type of data is business operation characteristics.

[0098] The second type of data mentioned above is used to reflect the characteristics of the network status (such as the industrial network status), such as the source Internet Protocol (English: Internet Protocol, abbreviated as IP), the target IP, the protocol type, the request time, the access frequency, etc. In other words, the second type of data is the network status characteristics.

[0099] Therefore, in the data format of the behavior model, the first type of data (i.e., business operation characteristics) and the second type of data (i.e., network status characteristics) can be used as the characteristics of the supervised learning data, and the request results corresponding to the access requests can be used as the labels of the supervised learning data. That is, the business operation characteristics and the network status characteristics are used as the characteristics in the training data format, and the request results are used as the labels in the training data format.

[0100] Taking an industrial Ethernet communication protocol (English: Process Field Network, abbreviated as Profinet) used in the field of industrial automation as an example, the data format and examples of the behavior mode can be shown in the following Table 1:

[0101] Table 1

[0102]

[0103]

[0104] As shown in Table 1 above, key fields such as requester, access role, access object, operation type, operation variable, variable value, etc. are used as business operation characteristics, key fields such as source IP, target IP, protocol type, request time, access frequency, etc. are used as network status characteristics, and access permission is used as the request result, so as to form the data format of the behavior model based on the business operation characteristics, network status characteristics and request results.

[0105] Based on the above data format, the first training data obtained satisfies the data format of the behavior model, so that the behavior model can correctly understand and process the first training data, so as to maximize the potential of the behavior model and improve the accuracy and reliability of the processing results of the behavior model. In addition, based on the business operation characteristics, network status characteristics and the data format of the request result, the behavior model can take into account the impact of the business operation characteristics and network status characteristics in the access data on the request result, so that it can better learn, which helps to better improve the training effect of the behavior model, so that the model performance of the target behavior model obtained can be improved.

[0106] Then, based on the data preprocessing method and the data format of the behavior model, the access data is processed to obtain the first training data, which can be:

[0107] First, based on the data preprocessing method, the collected access data is processed, and the access data after the data preprocessing method is saved as historical behavior data. Then, the business processing features and network status features are extracted from the access requests in the historical behavior data, and the business processing features and network status features are used as the features of the supervised learning data. At the same time, the corresponding request results are extracted from the access response data corresponding to the access requests in the historical behavior data, and the request results are used as the labels of the supervised learning data. The features of the supervised learning data and the labels of the supervised learning data are then combined to obtain the first training data.

[0108] S203: Convert the static access policy into second training data.

[0109] In order to supplement the first training data, a series of static access policies in the traditional industrial equipment access control method can be converted into the second training data.

[0110] Since the static access policy is based on expert experience and knowledge of industry rules, it can reflect the typical pattern of access requests for industrial equipment. Therefore, the second training data formed based on the static access policy can effectively supplement the first training data, and can also reflect the typical pattern of access requests for industrial equipment, so that the target behavior model obtained based on the second training data can be more in line with the actual needs of the business.

[0111] Taking the static access policy as role-based access control as an example, the role (i.e., access role) and operation authority (i.e., operation authority) for accessing an industrial robot (i.e., access object) are shown in Table 2 below:

[0112] Table 2

[0113]

[0114] As shown in Table 2 above, the access role of a maintenance worker can have all access rights, such as starting and stopping equipment, setting tasks, modifying modes, adjusting parameters, reading data, and deleting data; the access role of an operator can set tasks and adjust the operating status, such as setting tasks, modifying modes, and adjusting parameters; the access role of an engineer can evaluate the equipment status based on the operating data, such as reading data.

[0115] The training data rule constructed based on the above role-based access control (i.e., static access policy) is: if the access role is consistent with the operation permission, the request result is marked as access allowed (i.e., access request approved); if the access role is inconsistent with the operation permission, the request result is marked as access denied (i.e., access request denied). Then, the access role and operation permission can be used as the features of the supervised learning data, and the corresponding request results can be used as the labels of the supervised learning data. The features of the supervised learning data and the labels of the supervised learning data are then combined to obtain the second training data. Among them, the operation permission is obtained based on the access object and the operation type.

[0116] Exemplarily, the training data rules constructed based on the above role-based access control (ie, static access policy) may be as shown in Table 3 below:

[0117] Table 3

[0118] Requester Access Roles Access Object Operation Type Request results Employee A Maintenance personnel Industrial Robots Start and stop equipment Access Granted Employee B Operator Industrial Robots Start and stop equipment access denied Employee C engineer Industrial Robots Setting up the task access denied

[0119] Since the maintenance worker (i.e., the access role) has all access rights to the industrial robot (i.e., the access object), such as starting the device, as shown in Table 3 above, when the access role is maintenance worker, the access object is the industrial robot, and the operation type is to start and stop the device, the corresponding request result is access permission. The same is true for the operator and engineer shown in Table 3 above, which will not be repeated here.

[0120] S204: Merge the first training data and the second training data to obtain a training data set.

[0121] After obtaining the first training data and the second training data, the first training data and the second training data are merged to form a complete behavior model training data set.

[0122] The above-mentioned merging of the first training data and the second training data can be that the first training data is before the second training data, or the second training data is before the first training data, or the first training data and the second training data are cross-merged, but it is not limited to this, and the specific merging method of the first training data and the second training data can be adjusted according to the specific application scenario.

[0123] S205, based on the training data set, using a supervised learning algorithm to train the behavior model to obtain a target behavior model.

[0124] Based on the training data set obtained in step S204, the behavior model is trained using a supervised learning algorithm to obtain the optimal target behavior model at the current stage, so as to identify typical access behaviors of different requesters, different industrial equipment, and different time periods based on the target behavior model.

[0125] In the process of training the behavior model using a supervised learning algorithm based on a training data set, it is necessary to select parameters for the behavior model so that the obtained target behavior model is the optimal behavior model.

[0126] The selection principles of the above parameter selection may include balancing accuracy and computational cost, preventing overfitting, and enhancing model robustness, but are not limited to these and may be adjusted according to specific application scenarios.

[0127] Taking the model based on the random forest algorithm as an example, the selection principle of the above parameter selection can be as follows:

[0128] (1) Balancing accuracy and computational cost: Considering the resource constraints in industrial scenarios, while ensuring the stability and generalization ability of the model (i.e., behavioral model), the "number of decision trees" and "maximum depth of the tree" in the random forest algorithm are controlled to avoid the consumption of computing resources caused by excessive calculations.

[0129] (2) Preventing overfitting: Access control of industrial equipment may involve a large number of specific rules and a small number of abnormal behaviors. By setting reasonable "minimum number of samples of internal nodes" and "minimum number of samples of leaf nodes" for the random forest algorithm, it can be ensured that the model (i.e., behavioral model) will not make overfitting decisions due to a small number of special samples (i.e., a small number of abnormal behaviors).

[0130] (3) Enhance model robustness: The access behaviors of different industrial equipment are somewhat random. The "maximum number of features considered at each split" and "whether to use self-service sampling" in the random forest algorithm are used to control the diversity of the tree, thereby improving the model's (i.e., behavioral model's) predictive ability for different feature combinations.

[0131] Through the above method, the optimal behavior model of the current stage, namely the target behavior model, is obtained based on steps S201S-205, so as to facilitate the subsequent evaluation of the real-time access requests of industrial equipment based on the target behavior model and make the evaluation results (ie, the model decision results) as accurate as possible.

[0132] Optionally, the aforementioned target behavior module can be obtained by training the behavior model based on the training data set using a supervised learning algorithm, and can also be obtained only through steps S201, S202 and S205. Specifically, firstly, the access data of each industrial device is collected by mirroring traffic; then, based on the data preprocessing method and the data format of the behavior model, the access data is processed to obtain the first training data; then, the first training data is used as the training data set, and then, based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

[0133] Optionally, the aforementioned training of the behavior model based on the training data set using a supervised learning algorithm to obtain the target behavior module can also be obtained only through steps S203 and S205. Specifically, the static access policy is converted into a second training data, and the second training data is used as the training data set, and then based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

[0134] But optimally, the target behavior model is obtained through steps S201, S202, S203, S204, and S205 so that the model performance of the target behavior model is optimal.

[0135] Furthermore, after the target behavior model is obtained, the real-time access request of the industrial device is evaluated based on the target behavior model to obtain a model decision result of whether the real-time access request is approved.

[0136] Specifically, first, a real-time access request of industrial equipment is received. Then, based on the data preprocessing method and the data format of the target behavior model, the access request is processed to obtain the data to be predicted, thereby improving the data quality of the data to be predicted and making the obtained data to be predicted conform to the data format of the target behavior model, so that the target behavior model can correctly process the data to be predicted to ensure the accuracy of the model decision result.

[0137] The above data preprocessing method is consistent with the data preprocessing method in the above step S202, and the data format of the above target behavior model is consistent with the data format of the behavior model in the above step S202, which will not be repeated here.

[0138] Then, the data to be predicted is processed through the target behavior model to obtain the model decision result, so that the corresponding action can be performed later according to the model decision result.

[0139] The above-mentioned processing of the data to be predicted by the target behavior model to obtain the model decision result can be: the data to be predicted is input into the target behavior model, and the target behavior model outputs the model decision result of passing the real-time access request, or outputs the model decision result of rejecting the real-time access request.

[0140] However, considering the serious problems such as serious safety accidents, equipment damage or data leakage that may be caused by access control of industrial equipment, in the process of performing corresponding operations according to the model decision results, the model decision results can be reviewed first, and then the final decision results can be determined based on the comparison between the review results and the model decision results, so as to perform corresponding actions based on the final decision results.

[0141] Specifically, after obtaining the model decision result, the model decision result is reviewed to obtain the review result corresponding to the real-time access request, and then it is determined whether the review result is consistent with the model decision result.

[0142] If it is determined that the audit result is consistent with the model decision result, then the model decision result is determined to be the final decision result, that is, based on the final decision result (that is, the model decision result), a first response instruction is generated, and then the corresponding action is executed according to the first response instruction.

[0143] The generation of the first response instruction based on the final decision result (i.e., the model decision result) can be generated by a management module. The management module is responsible for generating a response instruction (such as a first response instruction) for establishing and disconnecting a communication path between the requester and the industrial device.

[0144] Specifically, if the final decision result (i.e., the model decision result) indicates that the real-time access request is passed, that is, the requesting party is granted access rights to the industrial device, a third response instruction is generated by the management module. The third response instruction may include credentials for accessing resources and information indicating that access is allowed.

[0145] If the final decision result (i.e., the model decision result) indicates that the real-time access request is denied, that is, the access right of the requesting party to the industrial device is denied, a fourth response instruction is generated by the management module. The fourth response instruction may include a signal for cutting off the communication path between the requesting party and the industrial device, and information indicating the access denial.

[0146] Furthermore, the first response instruction is the third response instruction, or the fourth response instruction. When the final decision result (i.e., the model decision result) indicates that the real-time access request is passed, the first response instruction is the third response instruction; when the final decision result (i.e., the model decision result) indicates that the real-time access request is rejected, the first response instruction is the fourth response instruction.

[0147] The above-mentioned execution of the corresponding action according to the first response instruction can be performed by an execution module. The execution module is responsible for enabling and terminating the connection between the requester and the industrial device.

[0148] Specifically, if the first response instruction includes information indicating that access is allowed (ie, the first response instruction is the third response instruction), the real-time access request is forwarded through the execution module.

[0149] If the first response instruction includes information indicating access denial (ie, the first response instruction is the fourth response instruction), the real-time access request is discarded through the execution module.

[0150] Optionally, after obtaining the model decision result, the model decision result is reviewed to obtain the review result corresponding to the real-time access request, and then, it is determined whether the review result is consistent with the model decision result.

[0151] If it is determined that the audit result is inconsistent with the model decision result, the final decision result is obtained based on the audit result, that is, the final decision result is modified based on the audit result to ensure the accuracy of the final decision result. Then, based on the final decision result, a second response instruction is generated, and the corresponding operation is performed based on the second response instruction.

[0152] The above-mentioned specific process of generating a second response instruction based on the final decision result and executing a corresponding operation based on the second response instruction is consistent with the above-mentioned specific process of generating a first response instruction based on the final decision result (i.e., the model decision result) and then executing a corresponding action according to the first response instruction, and will not be repeated here.

[0153] Through the above method, after obtaining the model decision result, the model decision result is further audited to obtain the audit result corresponding to the real-time access request, further ensuring the accuracy of the final decision. Then, when the audit result is consistent with the model decision result, a first response instruction is generated based on the model decision result, and then the corresponding operation is performed based on the first response instruction; when the audit result is inconsistent with the model decision result, the final decision result is obtained based on the audit result, and then the second response instruction is generated based on the final decision result to perform the corresponding operation, avoiding the execution of the corresponding operation based on the wrong model decision result, thereby further ensuring the accuracy of subsequent operations and avoiding serious consequences such as safety accidents, equipment damage or data leakage caused by incorrect operations on access requests to industrial equipment.

[0154] Furthermore, after the model decision result is obtained in step S101, it is determined whether the model decision result meets the precondition. If it meets the model update condition, the target behavior model is updated again to obtain a new target behavior model.

[0155] Specifically, the model decision results are audited to obtain the audit results corresponding to the real-time access requests, which can further improve the accuracy of the final results and avoid serious safety accidents, equipment damage or data leakage caused by access control of industrial equipment.

[0156] If it is determined that the audit result is inconsistent with the model decision result, it means that the model decision result is inaccurate. The real-time access request and the audit result are saved as the first training data, and the historical decision accuracy of the target behavior model is updated. The historical decision accuracy can be calculated by the following formula:

[0157]

[0158] Among them, A represents the historical decision accuracy; Sum represents the number of correct model decisions, that is, the number of accurate model decision results; Num represents the total number of model decisions, that is, the total number of times the target behavior model is used to obtain the model decision results.

[0159] Then determine whether the updated historical decision accuracy is lower than an accuracy threshold, which may be a minimum performance standard acceptable to the business, such as 85%.

[0160] If it is determined that the updated historical decision accuracy is lower than the accuracy threshold, the target behavior model is updated, and the updated new target behavior model is obtained. Exemplarily, the historical decision accuracy of the target behavior model is 80%, and the accuracy threshold is 85%. At this time, the historical decision accuracy is lower than the accuracy threshold, which triggers the update of the target behavior model.

[0161] Therefore, the above-mentioned model update condition may be that the audit result is inconsistent with the model decision result, and the historical decision accuracy is lower than the accuracy threshold, but it is not limited to this and can be flexibly adjusted according to the specific application scenario.

[0162] Through the above method, after the audit result is inconsistent with the model decision result, the historical decision accuracy of the target behavior model is updated, and then the update of the target behavior model is triggered only when the updated historical decision accuracy is not lower than the accuracy threshold, so that the update timing of the target behavior model is more accurate, so that it can adapt well to the access requests of dynamically changing industrial equipment.

[0163] Optionally, the updating of the target behavior model is triggered to obtain an updated new target behavior model. The updating of the target behavior model can be implemented in the following manner to obtain an updated new target behavior model.

[0164] Specifically, first data to be trained is obtained. Then, based on the data preprocessing method and the data format of the target behavior model, the first data to be trained is processed to obtain second data to be trained, so that the data quality of the second data to be trained is improved, and the second data to be trained conforms to the data format of the target behavior model, so that when a new training data set obtained based on the second data to be trained is used to train the target behavior model, the target behavior model can correctly understand the new training data set, which helps to improve the performance effect of the obtained new target behavior model.

[0165] The above data preprocessing method is consistent with the data preprocessing method in the above step S202, and the data format of the above target behavior model is consistent with the data format of the behavior model in the above step S202, which will not be repeated here.

[0166] Next, the second data to be trained and the training data set are merged to obtain a new training data set; based on the new training data set, the target behavior model is retrained to obtain an updated new target behavior model, so that the new training data set includes real-time access requests whose audit results are inconsistent with the model decision results. Therefore, in the training process of the target behavior model, the actual situation (i.e., real-time access requests and audit results) corresponding to the error situation (i.e., real-time access requests and model decision results) can be taken into account, so that the new target behavior model can take into account the current access situation of the industrial equipment, thereby further improving the performance of the new target behavior model.

[0167] In the embodiment of the present application, the above-mentioned training process of training the target behavior model based on the new training data set to obtain the updated new target behavior model is consistent with the training process of training the behavior model based on the training data set using a supervised learning algorithm in the aforementioned step S205 to obtain the target behavior model, and will not be repeated here.

[0168] Further, after the new target behavior model is obtained, the real-time access request of the industrial device is evaluated based on the new target behavior model to determine whether the real-time access request is approved.

[0169] In the embodiment of the present application, the above-mentioned specific process of evaluating the real-time access request of industrial equipment based on the new target behavior model to determine whether to pass the real-time access request is consistent with the specific process of evaluating the real-time access request of industrial equipment based on the target behavior model in the aforementioned step S101 to obtain the model decision result of whether to allow the real-time access request to pass, and will not be repeated here.

[0170] In summary, the following problems exist in the prior art:

[0171] (1) Existing industrial equipment access control models are mainly considered from the perspective of IT security, focusing on preventing data leakage and network attacks. They are irrelevant to the actual operation process and status of industrial equipment. They are unable to timely detect physical risks caused by improper permission settings or operation errors, and lack real-time monitoring and feedback mechanisms for access behavior and equipment status.

[0172] (2) Current industrial equipment access control mainly relies on boundary-based access control models such as firewalls, access control lists, and role-based access control. It lacks a continuous verification mechanism and is difficult to monitor and dynamically verify the security of access requests in real time, which cannot meet the needs of continuous authentication in industrial network environments.

[0173] (3) The existing industrial equipment access control model relies on static access policies and cannot be dynamically adjusted according to actual network behaviors and threats. It cannot identify changes in the access behaviors of industrial equipment in complex and ever-changing industrial networks, and thus cannot accurately distinguish between legitimate access and potential threats, resulting in security risks in the industrial networks corresponding to industrial equipment.

[0174] The access control method proposed in this application solves the problems in (1)(2)(3) above.

[0175] In an embodiment of the present application, when processing the collected access data of each industrial device, key fields of business operation characteristics and network status characteristics are extracted as features of supervised learning data to obtain first training data. After establishing a target behavior model using a training data set obtained based on the first training data, the learned rules are not limited to a single IT security or OT security access strategy, but take into account threats such as data leakage prevention and network attacks, while taking into account the stable operation of industrial equipment (such as the actual operating traffic and status of industrial equipment). It can promptly discover physical risks caused by improper permission settings or operational errors, and meets the access control needs in industrial scenarios.

[0176] Then, based on the historical access request traffic (i.e., the access data collected from each industrial device) and the static access policy, a training data set for training the behavior model is constructed, and the behavior model is trained using a supervised learning algorithm to obtain a target behavior model. The target behavior model is used to continuously monitor the changing access request behavior (i.e., real-time access requests), thereby achieving continuous verification of access requests for industrial equipment. The security of access requests can be monitored and dynamically verified in real time, meeting the needs of continuous authentication in industrial network environments, making up for the shortcomings of boundary-based access control models in traditional industrial fields, and effectively identifying and preventing abnormal behaviors or potential attacks, thereby improving the overall security line of the industrial network environment.

[0177] Furthermore, after the model decision result obtained after the target behavior model evaluates the real-time access request meets the model update condition, that is, the model decision result is inconsistent with the audit result, and the updated historical decision accuracy is lower than the accuracy threshold, the target behavior model is updated again, and then based on the updated new target behavior model, the real-time access request of the industrial equipment is evaluated to determine whether the real-time access request is passed, thereby having a real-time monitoring and feedback mechanism for access behavior and device status, so that the access control method proposed in the embodiment of the present application is adaptable to new access modes and behavioral characteristics, and can accurately identify changes in the access behavior of industrial equipment in complex and changeable industrial networks, so as to accurately distinguish between legitimate access and potential threats, thereby improving the security of the industrial network corresponding to the industrial equipment, and improving the practicality of the industrial equipment in complex scenarios, and avoiding dependence on the decision results of the machine learning model (that is, the model decision results), so that the reliability of the decision is improved.

[0178] The technical solution of this application is further explained below in conjunction with a specific application process.

[0179] like Figure 3 The figure shows a schematic diagram of the processing process of the access control method, which realizes dynamic access control of industrial equipment based on the flow collection and analysis unit, the behavior model construction unit, the real-time monitoring response unit and the model feedback update unit. Among them, the flow analysis unit includes a collection module and a preprocessing module; the behavior model construction unit includes a training data set module and a training module; the real-time detection response unit includes a receiving module, a decision module, a management module and an execution module.

[0180] First, in the collection module in the traffic collection and analysis unit, during the normal use of industrial equipment, the access data of each industrial equipment is collected by mirroring the traffic, and the collected access data is transmitted to the preprocessing module in the traffic collection and analysis unit, so that the preprocessing module processes the access data.

[0181] In the preprocessing module in the traffic collection and analysis unit, the access data transmitted by the acquisition module is received. Then, based on the data preprocessing method and the data format of the behavior model, the access data is processed to obtain the first training data. The first training data is then transmitted to the training data set module in the behavior model construction unit, so that the training data set module obtains the training data set for training the behavior model based on the first training data.

[0182] In the training data set module in the behavior model construction unit, the static access policy is converted into the second training data, and the first training data transmitted by the preprocessing module in the traffic collection and analysis unit is received. The first training data and the second training data are merged to obtain a training data set for training the behavior model. The training data set is then transmitted to the training module in the behavior model construction unit, so that the training module trains the behavior model based on the training data set.

[0183] In the training module in the behavior model construction unit, the training data set transmitted by the training data set module is received. Then, based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain a target behavior model. The target behavior model is then transmitted to the decision module in the real-time monitoring response unit, so that the decision module can evaluate the access request of the device (i.e., industrial device) in the industrial field network in real time based on the target behavior model.

[0184] In the receiving module in the real-time monitoring response unit, the access request of the industrial equipment is received in real time, that is, the access request sent by the requesting party in real time (that is, the real-time access request) is received, and the real-time access request is processed based on the data preprocessing method and the data format of the target behavior model to obtain the data to be predicted. The preprocessed data (that is, the data to be predicted) is then transmitted to the decision module in the real-time monitoring response unit, so that the decision module evaluates the real-time access request based on the data to be predicted.

[0185] In the decision module in the real-time monitoring response unit, the target behavior model transmitted from the training module in the behavior model construction unit is received. Then, the target behavior model processes the prediction data to obtain the model decision result. The model decision result is then transmitted to the management module in the real-time monitoring response unit, so that the management module generates a corresponding response instruction based on the model decision result. At the same time, the model decision result is also transmitted to the module feedback update unit, so that the module feedback update unit determines whether to update the model and whether the model decision result needs to be modified based on the model decision result.

[0186] In the model feedback update unit, the model decision result transmitted by the decision module is audited to obtain the audit result. Then determine whether the audit result is consistent with the model decision result. If it is determined that the audit result is consistent with the model decision result, in the management module in the real-time monitoring response unit, a first response instruction is generated according to the model decision result transmitted by the received decision module. Specifically, if the model decision result indicates that the real-time access request is passed, a third response instruction is generated (the third response instruction includes credentials for accessing resources, and information indicating that access is allowed), and the third response instruction is issued to the execution module in the real-time monitoring response unit; if the model decision result indicates that the real-time access request is rejected, a fourth response instruction is generated (the fourth response instruction includes a signal for cutting off the communication path between the requester and the industrial equipment, and information indicating that access is denied), and the fourth response instruction is issued to the execution module.

[0187] In the model feedback update unit, if it is determined that the audit result is inconsistent with the model decision result, the audit result is transmitted to the management module in the real-time monitoring response unit. Then, in the management module in the real-time monitoring response unit, the decision result finally issued is modified according to the audit result received from the model feedback unit to obtain the final decision result. Then, based on the final decision result, a second response instruction is generated. Specifically, if the final decision result indicates that the real-time access request is passed, a fifth response instruction is generated (the fifth response instruction includes a credential for accessing resources and information indicating that access is allowed), and the fifth response instruction is issued to the execution module in the real-time monitoring response unit; if the final decision result indicates that the real-time access request is rejected, a sixth response instruction is generated (the sixth response instruction includes a signal for cutting off the communication path between the requester and the industrial equipment, and information indicating that access is denied), and the sixth response instruction is issued to the execution module. Among them, the second response instruction is the fifth response instruction or the sixth response instruction.

[0188] In the execution module in the real-time monitoring response unit, the response instruction (such as the third response instruction, the fourth response instruction, the fifth response instruction, and the sixth response instruction) issued by the management module is received. Then, the response operation is performed based on the response instruction. For example, if the response instruction indicates that access is allowed, the access request is forwarded; if the response instruction indicates that access is denied, the access request is discarded.

[0189] In addition, in the model feedback update unit, if it is determined that the audit result is inconsistent with the model decision result, the real-time access request result and the audit result are saved as the first data to be trained, and the historical decision accuracy of the target behavior model is updated. If the updated historical decision accuracy is lower than the accuracy threshold, the target behavior model is retrained based on the first data to be trained and the original training data set to obtain an updated new target behavior model. Based on the new target behavior model, the subsequent real-time access requests of industrial equipment are continuously evaluated.

[0190] Based on the same inventive concept, an access control device is also provided in the embodiment of the present application, such as Figure 4 The figure is a schematic diagram of the structure of an access control device provided by the present application, the device comprising:

[0191] An evaluation module 401 is used to evaluate the real-time access request of the industrial equipment based on the target behavior model to obtain a model decision result;

[0192] The processing module 402 is used to re-update the target behavior model if it is determined that the model decision result meets the model update condition, obtain a new target behavior model, and evaluate the real-time access request of the industrial device based on the new target behavior model to determine whether to pass the real-time access request.

[0193] In a possible implementation, the device further includes a training module, the training module being specifically configured to collect access data of each industrial device by means of mirrored traffic, and to process the access data based on a data preprocessing method and a data format of a behavior model to obtain first training data; and

[0194] Converting the static access strategy into second training data;

[0195] Combining the first training data and the second training data to obtain a training data set;

[0196] Based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

[0197] In a possible implementation, the evaluation module 401 is specifically configured to receive the real-time access request of the industrial device;

[0198] Based on the data preprocessing method and the data format of the target behavior model, the real-time access request is processed to obtain the data to be predicted;

[0199] The data to be predicted is processed by the target behavior model to obtain the model decision result; wherein the model decision result includes passing the real-time access request, or includes rejecting the real-time access request.

[0200] In a possible implementation, the processing module 402 is specifically configured to review the model decision result to obtain a review result corresponding to the real-time access request;

[0201] If it is determined that the model decision result is consistent with the audit result, a first response instruction is generated based on the model decision result, and a corresponding operation is performed based on the first response instruction.

[0202] In one possible implementation, the processing module 402 is specifically used to obtain a final decision result based on the audit result if it is determined that the model decision result is inconsistent with the audit result; generate a second response instruction based on the final decision result; and perform a corresponding operation based on the second response instruction.

[0203] In a possible implementation, the model update condition is that the audit result is inconsistent with the model decision result, and the historical decision accuracy is lower than the accuracy threshold, then the processing module 402 is specifically used to audit the model decision result to obtain the audit result corresponding to the real-time access request;

[0204] If it is determined that the audit result is inconsistent with the model decision result, updating the historical decision accuracy of the target behavior model;

[0205] When the updated historical decision accuracy is lower than the accuracy threshold, the update of the target behavior model is triggered to obtain the updated new target behavior model.

[0206] In a possible implementation, the processing module 402 is specifically configured to save the real-time access request and the audit result as first data to be trained;

[0207] Based on the data preprocessing method and the data format of the target behavior model, the first data to be trained is processed to obtain second data to be trained;

[0208] Merging the second data to be trained with the training data set to obtain a new training data set;

[0209] Based on the new training data set, the target behavior model is retrained to obtain the updated new target behavior model.

[0210] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned access control device. Figure 5 , the electronic equipment includes:

[0211] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0212] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute the access control method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0213] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0214] In one possible design, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0215] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the access control method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0216] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0217] By programming the processor 501, the code corresponding to the access control method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The steps of the access control method of the embodiment shown are as follows: How to design and program the processor 501 is a technique known to those skilled in the art and will not be described in detail here.

[0218] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the access control method discussed above.

[0219] In some possible implementations, various aspects of the access control method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a device, the program code is used to enable the control device to execute the steps of the access control method according to various exemplary implementations of the present application described above in this specification.

[0220] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0221] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0222] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0223] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0224] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An access control method, characterized in that: include: Based on the target behavior model, the real-time access requests of industrial equipment are evaluated to obtain the model decision results; If it is determined that the model decision result meets the model update condition, the target behavior model is updated again to obtain a new target behavior model, and based on the new target behavior model, the real-time access request of the industrial device is evaluated to determine whether the real-time access request is approved.

2. The method according to claim 1, characterized in that Before evaluating the real-time access request of the industrial equipment based on the target behavior model to obtain the model decision result, the method further includes: Collecting access data of each industrial device by mirroring traffic, and processing the access data based on a data preprocessing method and a data format of a behavior model to obtain first training data; and Converting the static access strategy into second training data; Combining the first training data and the second training data to obtain a training data set; Based on the training data set, the behavior model is trained using a supervised learning algorithm to obtain the target behavior model.

3. The method according to claim 1, characterized in that The target behavior model is used to evaluate the real-time access request of the industrial equipment to obtain the model decision result, including: receiving the real-time access request of the industrial device; Based on the data preprocessing method and the data format of the target behavior model, the real-time access request is processed to obtain the data to be predicted; The data to be predicted is processed by the target behavior model to obtain the model decision result; wherein the model decision result includes passing the real-time access request, or includes rejecting the real-time access request.

4. The method according to claim 1, characterized in that After evaluating the real-time access request of the industrial equipment based on the target behavior model and obtaining the model decision result, the method further includes: Reviewing the model decision result to obtain a review result corresponding to the real-time access request; If it is determined that the model decision result is consistent with the audit result, a first response instruction is generated based on the model decision result, and a corresponding operation is performed based on the first response instruction.

5. The method according to claim 4, characterized in that After reviewing the model decision result and obtaining the review result corresponding to the real-time access request, the method further includes: If it is determined that the model decision result is inconsistent with the audit result, a final decision result is obtained based on the audit result; a second response instruction is generated based on the final decision result, and a corresponding operation is performed based on the second response instruction.

6. The method according to claim 1, characterized in that The model update condition is that the audit result is inconsistent with the model decision result, and the historical decision accuracy is lower than the accuracy threshold. If it is determined that the model decision result meets the model update condition, the target behavior model is updated again to obtain a new target behavior model, including: Reviewing the model decision result to obtain the review result corresponding to the real-time access request; If it is determined that the audit result is inconsistent with the model decision result, updating the historical decision accuracy of the target behavior model; When the updated historical decision accuracy is lower than the accuracy threshold, the update of the target behavior model is triggered to obtain the updated new target behavior model.

7. The method according to claim 6, characterized in that The triggering of updating of the target behavior model to obtain the updated new target behavior model includes: Saving the real-time access request and the audit result as first data to be trained; Based on the data preprocessing method and the data format of the target behavior model, the first data to be trained is processed to obtain second data to be trained; Merging the second data to be trained with the training data set to obtain a new training data set; Based on the new training data set, the target behavior model is retrained to obtain the updated new target behavior model.

8. An access control device, characterized in that: include: An evaluation module is used to evaluate the real-time access request of industrial equipment based on the target behavior model to obtain the model decision result; A processing module is used to re-update the target behavior model to obtain a new target behavior model if it is determined that the model decision result meets the model update condition, and evaluate the real-time access request of the industrial device based on the new target behavior model to determine whether to pass the real-time access request.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 7 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.

Images