Network abnormal permission detection and analysis method and device

Abstract

The invention discloses a network abnormal permission detection and analysis method and device. The method comprises the following steps: constructing a user vector by utilizing access information of each user in a two-dimensional wide table; calculating the similarity between every two users in all the users according to the user vectors; organizing graph data by using the similarity of every two users, and performing group division on the users by using a clustering algorithm according to the graph data; mapping the user and the authorized function item, and representing the user as a vector of the function item; calculating the similarity between the user and the group, and judging whether the user is excessively authorized according to the similarity between the user and the group; user unauthorized access detection is carried out through URL address analysis accessed by a user and an obtained user and authorized URL access address mapping table in a service system; for an over-authorized user, an unauthorized access is identified when a function accessed by the user belongs to an over-authorized function. According to the invention, flexible dynamic adjustment can be carried out according to the change of user behaviors, and user permission excess or insufficiency is effectively prevented.

Description

Technical Field

[0001] The present invention belongs to the technical field of network permission analysis, and in particular relates to a method and device for detecting and analyzing abnormal network permissions. Background Art

[0002] In modern information systems, permission management is one of the important links to ensure data security. However, traditional permission management methods have some inherent limitations, which may lead to increased risks of security vulnerabilities and unauthorized access.

[0003] In traditional technologies, permission management systems are often based on static role assignments, which means that once permissions are granted, it is difficult to dynamically adjust them based on changes in user behavior. Internal users may abuse permissions, especially when they have too many permissions, which may lead to internal threats, and traditional systems have limited detection capabilities for such threats. As business complexity increases, a single permission control model is difficult to meet diverse security needs, especially when more fine-grained control of specific operations is required. Although regular manual audits can detect some abnormal permissions, this approach is inefficient and prone to missing details, especially in large-scale systems. In addition, user roles and responsibilities change frequently, and if permissions are not updated in a timely manner, it may lead to problems with excessive or insufficient permissions. Summary of the invention

[0004] To this end, the present invention provides a method and device for detecting and analyzing abnormal network permissions to solve the problems of poor flexibility, difficulty in detecting internal threats, lack of refined control, and need for manual auditing in traditional technologies.

[0005] In order to achieve the above object, the present invention provides the following technical solution: a method for detecting and analyzing abnormal network permissions, comprising:

[0006] According to the set statistical interval, a two-dimensional wide table is constructed according to the access information of users accessing the service system within the statistical interval, and a user vector is constructed using the access information of each user in the two-dimensional wide table;

[0007] Calculating the similarity between any two users among all users based on the user vectors to obtain the similarity between any two users among all users;

[0008] Utilize the similarity of two users among all users to organize graph data, and use a clustering algorithm to divide the users into groups according to the graph data;

[0009] Digitally represent the function items of the business system through the access records of the business system; map the user and the authorized function items, and represent the user as a vector of the function items;

[0010] Calculate the similarity between the user and the group, and determine whether the user is over-authorized based on the similarity between the user and the group;

[0011] Detecting unauthorized access by users through parsing the URL address accessed by the users and the mapping table of users and authorized URL access addresses already acquired in the business system;

[0012] For an over-authorized user, when the function accessed by the user belongs to the over-authorized function, it is identified as unauthorized access.

[0013] As a preferred solution for the network abnormal authority detection and analysis method, in the process of constructing a two-dimensional wide table based on the access information of users accessing the business system within the statistical interval:

[0014] The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value.

[0015] As a preferred solution for the network abnormal permission detection and analysis method, in the process of using the similarity organization diagram data of two users among all users:

[0016] Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users.

[0017] For each pair of nodes in the dataset, an edge object is created using the pre-calculated similarity between the two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object.

[0018] As a preferred solution of the network abnormal authority detection and analysis method, the function item frequency TF and the inverse function item frequency IDF are calculated in the process of digitally representing the function items of the business system through the access records of the business system:

[0019] Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user;

[0020] Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1));

[0021] In the process of representing users as vectors of functional terms:

[0022] The function access of each user within a period of time is represented by the TF-IDF value to form a vector of user access function items.

[0023] As a preferred solution for the abnormal network permission detection and analysis method, the similarity between the user and the group is calculated, and whether the user is over-authorized is determined based on the similarity between the user and the group:

[0024] Average each user vector within the user group to form a functional vector representation of the group;

[0025] Use cosine similarity to calculate the cosine similarity between each user and the group to which they belong; determine whether the user is over-authorized based on the cosine similarity between each user and the group to which they belong;

[0026] Also includes:

[0027] Calculate the outlier value of user cosine similarity, using In principle, user over-authorization warnings are issued;

[0028] For the alarmed users, the generalized Accard coefficient between the user function items and the group function items is calculated one by one. According to the principle of Gaussian distribution, the function items with a standard deviation greater than 3 times the mean value are taken as over-authorized function items, and over-authorized function item alarm processing is performed.

[0029] As a preferred solution for the network abnormal permission detection and analysis method, the user unauthorized access detection process is performed through the URL address parsing accessed by the user and the user and authorized URL access address mapping table already obtained in the business system:

[0030] Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user exceeds the time series analysis result; if the number of visits exceeding the time series prediction reaches the set visit threshold, construct the user's visit behavior on that day into an access behavior vector and calculate the cosine similarity A with the user's access behavior vector in the past week;

[0031] Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week;

[0032] If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued;

[0033] The steps to construct a time series analysis of each user's daily visits include:

[0034] Collect time series data; preprocess time series data; model selection and parameter estimation; model testing and diagnosis; model application and prediction.

[0035] As a preferred solution for the network abnormal permission detection and analysis method, it also includes: when alarms are generated for both user over-authorization and unauthorized access, a security detection mechanism is used to identify the attack source to determine the authenticity of the alarm.

[0036] The present invention also provides a network abnormal authority detection and analysis device, including: a user group division component, an excessive authorization detection component and an unauthorized access detection component;

[0037] The user group segmentation component includes:

[0038] A user vector construction module is used to construct a two-dimensional wide table according to the access information of users accessing the service system within the set statistical interval, and construct a user vector using the access information of each user in the two-dimensional wide table;

[0039] A user similarity calculation module, used to calculate the similarity between any two users among all users according to the user vectors, to obtain the similarity between any two users among all users;

[0040] A graph data organization module, used to organize graph data using the similarity between two users among all users;

[0041] A group division module, used to divide users into groups using a clustering algorithm according to the graph data;

[0042] The over-authorization detection component includes:

[0043] A function item representation module, used to digitally represent the function items of the business system through the access records of the business system;

[0044] A user-function item mapping module is used to map users to authorized function items and represent users as vectors of function items;

[0045] An over-authorization judgment module is used to calculate the similarity between the user and the group, and judge whether the user is over-authorized based on the similarity between the user and the group;

[0046] The unauthorized access detection component includes:

[0047] A user unauthorized access detection module, used to detect user unauthorized access through URL address resolution accessed by the user and a mapping table of users and authorized URL access addresses acquired in the business system;

[0048] The unauthorized access identification module is used to identify unauthorized access for over-authorized users when the function accessed by the user belongs to the over-authorized function.

[0049] As a preferred solution of the network abnormal authority detection and analysis device, in the user vector construction module:

[0050] The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value.

[0051] As a preferred solution for the network abnormal authority detection and analysis device, in the graph data organization module:

[0052] Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users.

[0053] For each pair of nodes in the dataset, an edge object is created using the pre-calculated similarity between the two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object.

[0054] As a preferred solution of the network abnormal authority detection and analysis device, the function item represents the module:

[0055] In the process of digitally representing the function items of the business system through the access records of the business system, the function item frequency TF and the inverse function item frequency IDF are calculated:

[0056] Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user;

[0057] Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1));

[0058] In the user-function item mapping module:

[0059] The function access of each user within a period of time is represented by the TF-IDF value to form a vector of user access function items.

[0060] As a preferred solution of the network abnormal authority detection and analysis device, in the over-authorization judgment module:

[0061] Average each user vector within the user group to form a functional vector representation of the group;

[0062] Use cosine similarity to calculate the cosine similarity between each user and the group to which he belongs; and determine whether the user is over-authorized based on the cosine similarity between each user and the group to which he belongs.

[0063] As a preferred solution of the network abnormal authority detection and analysis device, the excessive authorization detection component also includes:

[0064] The user over-authorization alarm module is used to calculate the abnormal value of the user cosine similarity and use In principle, user over-authorization warnings are issued;

[0065] The function item alarm processing module is used to calculate the generalized accard coefficient between the user function item and the group function item for each alarmed user, and according to the principle of Gaussian distribution, take the function item with a standard deviation greater than 3 times the mean value as the over-authorized function item, and perform over-authorized function item alarm processing.

[0066] As a preferred solution of the network abnormal authority detection and analysis device, in the user overauthorization detection module:

[0067] Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user exceeds the time series analysis result; if the number of visits exceeding the time series prediction reaches the set visit threshold, construct the user's visit behavior on that day into an access behavior vector and calculate the cosine similarity A with the user's access behavior vector in the past week;

[0068] Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week;

[0069] If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued.

[0070] As a preferred solution of the network abnormal authority detection and analysis device, it also includes a discrimination component, and the discrimination component includes:

[0071] The attack source identification module is used to identify the attack source by using the security detection mechanism to determine the authenticity of the alarm when an alarm occurs due to excessive user authorization and unauthorized access.

[0072] The beneficial effects of the present invention are as follows: according to a set statistical interval, a two-dimensional wide table is constructed according to the access information of users accessing the business system within the statistical interval, and a user vector is constructed using the access information of each user in the two-dimensional wide table; according to the user vector, the similarity between two users of all users is calculated to obtain the similarity between two users of all users; the similarity between two users of all users is used to organize graph data, and the users are divided into groups using a clustering algorithm according to the graph data; the function items of the business system are digitally represented through the access records of the business system; the user and the authorized function items are mapped, and the user is represented as a vector of the function item; the similarity between the user and the group is calculated, and whether the user is over-authorized is determined according to the similarity between the user and the group; the user's unauthorized access is detected through the URL address parsing accessed by the user and the user and authorized URL access address mapping table already obtained in the business system; for an over-authorized user, when the function accessed by the user belongs to an over-authorized function, it is identified as an unauthorized access. The present invention can make flexible and dynamic adjustments according to changes in user behavior, effectively preventing excessive or insufficient user rights; effectively detect internal users' abuse of rights, and achieve more fine-grained control over user-specific operations; eliminate the need for manual audits, reduce costs, and make it less likely to miss details. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the drawings required for the implementation methods or the prior art descriptions are briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0074] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0075] Figure 1 A schematic diagram of a flow chart of a method for detecting and analyzing abnormal network permissions provided by an embodiment of the present invention;

[0076] Figure 2 A schematic diagram of the technical architecture of a method for detecting and analyzing abnormal network permissions provided by an embodiment of the present invention;

[0077] Figure 3A schematic diagram of the verification and handling state transition after abnormal permissions are discovered in the network abnormal permissions detection and analysis method provided by an embodiment of the present invention;

[0078] Figure 4 A schematic diagram of the architecture of a network abnormal permission detection and analysis device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0079] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0080] Example 1

[0081] See also Figure 1 and Figure 2 The embodiment of the present invention provides a method for detecting and analyzing abnormal network permissions, comprising the following steps:

[0082] S1. According to a set statistical interval, a two-dimensional wide table is constructed according to access information of users accessing the service system within the statistical interval, and a user vector is constructed using the access information of each user in the two-dimensional wide table;

[0083] S2. Calculate the similarity between any two users among all users based on the user vectors to obtain the similarity between any two users among all users;

[0084] S3, using the similarity of every two users among all users to organize graph data, and using a clustering algorithm to divide the users into groups according to the graph data;

[0085] S4. Digitally represent the function items of the business system through the access records of the business system; map the user and the authorized function items, and represent the user as a vector of the function items;

[0086] S5. Calculate the similarity between the user and the group, and determine whether the user is over-authorized based on the similarity between the user and the group;

[0087] S6, performing user unauthorized access detection by resolving the URL address accessed by the user and the user and authorized URL access address mapping table already obtained in the business system;

[0088] S7. For an over-authorized user, when the function accessed by the user belongs to the over-authorized function, it is identified as unauthorized access.

[0089] In this embodiment, in step S1, during the process of constructing a two-dimensional wide table according to the access information of users accessing the business system within the statistical interval:

[0090] The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value.

[0091] Specifically, a statistical interval is set through the user group segmentation component, generally with a week or a month as the interval unit. The selection of week or month needs to be subdivided according to the frequency of use and confidentiality of the business system. For business systems that are frequently used and have a high degree of confidentiality, the calculation is performed in weeks, and other systems are calculated in months. The URL addresses accessed by all users in the statistical interval are used as column fields, and each user is used as a row field. Each value uses the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value, forming a two-dimensional wide table. The final result is a piece of data for each user, forming a user vector.

[0092] In this embodiment, in step S2, based on the user vector, the cosine distance is used as a formula for similarity calculation to calculate the similarity between two users among all users, and the similarity between two users among all users is obtained. Among them, the cosine distance, also known as cosine similarity, uses the cosine value of the angle between two vectors in the vector space as a measure of the size of the difference between two individuals. The cosine distance uses the cosine value of the angle between two vectors as a measure of the size of the difference between two individuals. Compared with the Euclidean distance, the cosine distance pays more attention to the difference between the two vectors in direction.

[0093] In this embodiment, in step S3, in the process of organizing the graph data using the similarity of every two users among all users:

[0094] Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users.

[0095] For each pair of nodes in the dataset, an edge object is created using the pre-calculated similarity between the two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object.

[0096] In the process of using the clustering algorithm to divide the users into groups according to the graph data, a graph-based clustering algorithm is used. The main advantage of the graph-based clustering algorithm is that it can effectively process large-scale graph structure data because it clusters the graph into smaller subgraphs, thereby reducing the computational complexity. When dividing user groups, the scale of users is generally not particularly large, and the graph data formed is not a large graph, so the algorithm can be used for calculation.

[0097] In this embodiment, over-authorization behavior mainly occurs in scenarios such as improper authorization management of the business system, failure to modify permissions in time due to personnel turnover, and system upgrades or changes. Over-authorization in the business system is reflected in the user being granted authorization that exceeds the position or role. To identify over-authorization behavior, it is necessary to compare the user's authorization data with the group to which they belong. For those who deviate too much from the group's authorized functions, it is necessary to give an early warning reminder to the system administrator, and when the user accesses, it is also necessary to block or deny access based on the evaluation results of over-authorization. Therefore, in step S4, the business system function items must first be digitally represented through the access records of the business system; then, by mapping the user with the authorized function items, the user is represented as a vector of the authorized function items; by calculating the cosine similarity between two users, the similarity of user authorization is calculated; then, a single user is compared with a group user, and for those who deviate too much from the group, an alarm is issued for user over-authorization. In addition, it is also necessary to calculate the average function authorization access vector of the user's group and compare it with the function authorization vector of the over-authorized user to calculate which functions are at risk of over-authorization.

[0098] Among them, in the process of digitally representing the function items of the business system through the access records of the business system, the function item frequency TF and the inverse function item frequency IDF are calculated:

[0099] Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user;

[0100] Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1));

[0101] In the process of representing users as vectors of functional terms:

[0102] The function access of each user within a period of time is represented by the TF-IDF value to form a vector of user access function items.

[0103] In this embodiment, in step S5, the similarity between the user and the group is calculated, and in the process of determining whether the user is over-authorized based on the similarity between the user and the group:

[0104] Average each user vector within the user group to form a functional vector representation of the group;

[0105] Use cosine similarity to calculate the cosine similarity between each user and the group they belong to; determine whether the user is over-authorized based on the cosine similarity between each user and the group they belong to. The greater the similarity, the closer the user is to the group, which means the user is less likely to be over-authorized in terms of authorization; the smaller the similarity, the farther the authorization behavior of the user and the group is, and the greater the possibility of the user being over-authorized.

[0106] Additionally, it includes:

[0107] Calculate the outlier value of user cosine similarity, using In principle, user over-authorization warnings are issued;

[0108] For the alarmed users, the generalized Accard coefficient between the user function items and the group function items is calculated one by one. According to the principle of Gaussian distribution, the function items with a standard deviation greater than 3 times the mean value are taken as over-authorized function items, and over-authorized function item alarm processing is performed.

[0109] Specifically, when the data follows a Gaussian distribution. In principle, if the outlier exceeds 3 times the standard deviation, it can be considered an outlier. The probability is 99.7%, then the distance from the average The probability of a value other than This is a rare event with a low probability. The average and standard deviation of each group are calculated, and the users in the group are compared with the average and standard deviation. For users whose average is less than the average plus 3 times the standard deviation, an over-authorization alarm is issued.

[0110] In this embodiment, in step S6, the user unauthorized access detection process is performed by resolving the URL address accessed by the user and the user and authorized URL access address mapping table already obtained in the business system:

[0111] Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user exceeds the time series analysis result; if the number of visits exceeding the time series prediction reaches the set visit threshold, construct the user's visit behavior on that day into an access behavior vector and calculate the cosine similarity A with the user's access behavior vector in the past week;

[0112] Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week;

[0113] If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued;

[0114] The steps to construct a time series analysis of each user's daily visits include:

[0115] Collect time series data; preprocess time series data; model selection and parameter estimation; model testing and diagnosis; model application and prediction.

[0116] Specifically, the identification and warning of unauthorized access through the unauthorized access detection component are divided into two ways: identification and warning. Unauthorized access identification implements strong verification of unauthorized access through the URL address resolution of the user's access and the user and authorized URL access address mapping table already obtained in the business system; in addition, for over-authorized users, when the function accessed by the user belongs to the over-authorized function, it is also identified as unauthorized access; for system function access requests identified as unauthorized access, the system directly denies the access. In addition to the above two clear unauthorized access identifications, in order to avoid users' unauthorized access behavior as much as possible, by constructing a time series analysis of each user's daily access volume, calculate whether the number of users' current accesses obviously exceeds the time series analysis results. If it obviously exceeds the access volume predicted by the time series, the user's access behavior on the day is constructed into an access behavior vector, and the cosine similarity is calculated with the user's access behavior vector in the past week; the cosine similarity is calculated between the user's current access behavior vector and the access behavior vector of the group in the past week; if both cosine similarities exceed a certain threshold, an unauthorized access behavior warning is issued.

[0117] Among them, the construction of the access behavior vector of the user's access to the system function in the past week, the processing logic and method are the same as the construction method of the system access vector of a single user in a certain interval. In order to improve the calculation efficiency, the vector construction operation of the user in the past week is generally completed during the system idle time after 12 o'clock midnight on the same day, and the construction result is saved in the database, and directly read by query in subsequent calculations. The construction of the access behavior vector of the group's access to the system function in the past week, the processing logic and method are the same as the group vector space construction. The construction steps are to first construct the system access function vector of all users in the past week; then take the average value of all users in the same group to complete the group vector construction.

[0118] Specifically, follow the steps below to build a time series model for user visits:

[0119] 1) Collect time series data. It is necessary to collect time series data accessed by users, which are the values ​​of variables observed at consecutive time points. Ensuring the accuracy and completeness of the data is crucial to building a reliable time series model.

[0120] 2) Data preprocessing. Before building a time series model, it is usually necessary to preprocess the raw data. This may include checking whether the data is stationary. If it is not stationary, it may need to be differentiated to eliminate trends and seasonality. In addition, it is also necessary to check whether the data is white noise, that is, whether there is useful information.

[0121] 3) Model selection and parameter estimation. According to the characteristics and purpose of the data, select a suitable time series model, such as ARIMA. Then use relevant information criteria and parameter estimation methods to determine the optimal parameters of the model.

[0122] 4) Model testing and diagnosis. After the model is established, it is necessary to test and diagnose the model to ensure its validity and predictive ability. This may include using ACF and PACF graphs to test whether the autocorrelation and partial correlation of the model are appropriate, and using ADF tests to check whether the residuals are white noise.

[0123] 5) Model application and prediction. When the model is proven to be effective and can be used for prediction, it can be used to predict future user visits. It should be noted that the prediction results are not absolutely accurate and may be affected by many factors, such as the randomness of the data and the limitations of the model. Therefore, when judging that the user visits are abnormal, a certain range should be increased to reduce false positives.

[0124] In this embodiment, step S7 further includes: when an alarm is generated due to both excessive authorization and unauthorized access by the user, the attack source is identified by using a security detection mechanism to determine the authenticity of the alarm.

[0125] See also Figure 3 ,When the over-authorization detection component and the unauthorized access detection component generate an alarm, the existing ,security detection mechanism is combined to identify the attack source to ,determine the authenticity of the alarm.

[0126] Among them, when an abnormal permission is detected, the corresponding identity, device or application enters an abnormal state. In this state, the system will alarm, and the abnormal identity, device and application will enter a gray observation state, and the administrator will be notified to deal with it. The administrator needs to retrieve the traffic context of the response to the alarm and verify the alarm event through technical means. If no abnormality is found during the detection, the abnormal subject will be adjusted to a normal state after manual confirmation; otherwise, it will enter a lost state. In the lost state, the following things need to be done: report the implemented subject to an external system, such as a trust assessment system; start policy calculation, and perform policy disposal according to the disposal specifications.

[0127] In summary, the embodiment of the present invention constructs a two-dimensional wide table according to the access information of users accessing the business system within the set statistical interval, and constructs a user vector using the access information of each user in the two-dimensional wide table; calculates the similarity between all users according to the user vector to obtain the similarity between all users; organizes graph data using the similarity between all users, and divides users into groups using a clustering algorithm according to the graph data; digitally represents the function items of the business system through the access records of the business system; maps the user to the authorized function items, and represents the user as a vector of the function items; calculates the similarity between the user and the group, and determines whether the user is over-authorized according to the similarity between the user and the group; performs user unauthorized access detection through URL address resolution accessed by the user and a mapping table of user and authorized URL access addresses already obtained in the business system; for over-authorized users, when the function accessed by the user belongs to the over-authorized function, it is identified as unauthorized access. The present invention can make flexible and dynamic adjustments according to changes in user behavior, effectively preventing excessive or insufficient user rights; effectively detect internal users' abuse of rights, and achieve more fine-grained control over user-specific operations; eliminate the need for manual audits, reduce costs, and make it less likely to miss details.

[0128] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0129] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0130] Example 2

[0131] See also Figure 4 , Embodiment 2 of the present invention provides a network abnormal authority detection and analysis device, including: a user group division component, an excessive authorization detection component and an unauthorized access detection component;

[0132] The user group segmentation component includes:

[0133] The user vector construction module 100 is used to construct a two-dimensional wide table according to the access information of users accessing the service system within the set statistical interval, and construct a user vector using the access information of each user in the two-dimensional wide table;

[0134] A user similarity calculation module 200, configured to calculate the similarity between any two users among all users according to the user vectors, and obtain the similarity between any two users among all users;

[0135] A graph data organization module 300, for organizing graph data using the similarities between two users among all users;

[0136] A group division module 400 is used to divide users into groups using a clustering algorithm according to the graph data;

[0137] The over-authorization detection component includes:

[0138] A function item representation module 500, used to digitally represent the function items of the business system through the access records of the business system;

[0139] A user-function item mapping module 600 is used to map users and authorized function items, and represent users as vectors of function items;

[0140] An over-authorization determination module 700 is used to calculate the similarity between the user and the group, and determine whether the user is over-authorized according to the similarity between the user and the group;

[0141] The unauthorized access detection component includes:

[0142] The user unauthorized access detection module 800 is used to detect the user's unauthorized access through the URL address resolution of the user's access and the user and authorized URL access address mapping table already obtained in the business system;

[0143] The unauthorized access identification module 900 is used to identify an unauthorized access for an over-authorized user when the function accessed by the user belongs to an over-authorized function.

[0144] In this embodiment, in the user vector construction module 100:

[0145] The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value.

[0146] In this embodiment, in the graph data organization module 300:

[0147] Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users.

[0148] For each pair of nodes in the dataset, an edge object is created using the pre-calculated similarity between the two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object.

[0149] In this embodiment, the function items represent the following in the module 500:

[0150] In the process of digitally representing the function items of the business system through the access records of the business system, the function item frequency TF and the inverse function item frequency IDF are calculated:

[0151] Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user;

[0152] Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1));

[0153] In the user-function item mapping module 600:

[0154] The function access of each user within a period of time is represented by the TF-IDF value to form a vector of user access function items.

[0155] In this embodiment, in the over-authorization determination module 700:

[0156] Average each user vector within the user group to form a functional vector representation of the group;

[0157] Use cosine similarity to calculate the cosine similarity between each user and the group to which he belongs; and determine whether the user is over-authorized based on the cosine similarity between each user and the group to which he belongs.

[0158] In this embodiment, the excessive authorization detection component further includes:

[0159] The user over-authorization alarm module 010 is used to calculate the abnormal value of the user cosine similarity and use In principle, user over-authorization warnings are issued;

[0160] The function item alarm processing module 011 is used to calculate the generalized accard coefficient between the user function item and the group function item for each alarmed user, and according to the principle of Gaussian distribution, take the function item with a standard deviation greater than 3 times the mean value as the over-authorized function item, and perform over-authorized function item alarm processing.

[0161] In this embodiment, in the user unauthorized detection module 800:

[0162] Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user exceeds the time series analysis result; if the number of visits exceeding the time series prediction reaches the set visit threshold, construct the user's visit behavior on that day into an access behavior vector and calculate the cosine similarity A with the user's access behavior vector in the past week;

[0163] Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week;

[0164] If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued.

[0165] In this embodiment, a discrimination component is also included, and the discrimination component includes:

[0166] The attack source identification module 012 is used to identify the attack source by using the security detection mechanism to determine the authenticity of the alarm when an alarm is generated due to excessive user authorization and unauthorized access.

[0167] It should be noted that the above-mentioned content, such as information interaction and execution process between the modules of the device, is based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects it brings are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown in the previous description of the present application, and will not be repeated here.

[0168] Example 3

[0169] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a network abnormality permission detection and analysis method is stored, and the program code includes instructions for executing a network abnormality permission detection and analysis method of embodiment 1 or any possible implementation method thereof.

[0170] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0171] Example 4

[0172] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0173] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a network abnormality authority detection and analysis method of embodiment 1 or any possible implementation thereof.

[0174] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0175] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital consumer customer line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0176] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0177] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A method for detecting and analyzing abnormal network permissions, characterized in that: include: According to the set statistical interval, a two-dimensional wide table is constructed according to the access information of users accessing the service system within the statistical interval, and a user vector is constructed using the access information of each user in the two-dimensional wide table; Calculating the similarity between any two users among all users based on the user vectors to obtain the similarity between any two users among all users; Utilize the similarity of two users among all users to organize graph data, and use a clustering algorithm to divide the users into groups according to the graph data; Digitally represent the function items of the business system through the access records of the business system; map the user and the authorized function items, and represent the user as a vector of the function items; Calculate the similarity between the user and the group, and determine whether the user is over-authorized based on the similarity between the user and the group; Detecting unauthorized access by users through parsing the URL address accessed by the user and the mapping table of users and authorized URL access addresses already obtained in the business system; For an over-authorized user, when the function accessed by the user belongs to the over-authorized function, it is identified as unauthorized access.

2. A method for detecting and analyzing abnormal network permissions according to claim 1, characterized in that: In the process of constructing a two-dimensional wide table based on the access information of users accessing the business system within the statistical interval: The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value.

3. A method for detecting and analyzing abnormal network permissions according to claim 1, characterized in that: In the process of organizing graph data using the similarity of two users among all users: Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users. For each pair of nodes in the dataset, an edge object is created using the pre-calculated similarity between the two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object.

4. A method for detecting and analyzing abnormal network permissions according to claim 1, characterized in that: In the process of digitally representing the function items of the business system through the access records of the business system, the function item frequency TF and the inverse function item frequency IDF are calculated: Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user; Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1)); In the process of representing users as vectors of functional terms: The function access of each user within a period of time is represented by the TF-IDF value to form a vector of user access function items.

5. A method for detecting and analyzing abnormal network permissions according to claim 4, characterized in that: Calculate the similarity between the user and the group, and determine whether the user is over-authorized based on the similarity between the user and the group: Average each user vector within the user group to form a functional vector representation of the group; Use cosine similarity to calculate the cosine similarity between each user and the group to which they belong; determine whether the user is over-authorized based on the cosine similarity between each user and the group to which they belong; Also includes: Calculate the outlier value of user cosine similarity, using In principle, user over-authorization warnings are issued; For the alarmed users, the generalized Accard coefficient between the user function items and the group function items is calculated one by one. According to the principle of Gaussian distribution, the function items with a standard deviation greater than 3 times the mean value are taken as over-authorized function items, and over-authorized function item alarm processing is performed.

6. A method for detecting and analyzing abnormal network permissions according to claim 1, characterized in that: In the process of detecting user unauthorized access by parsing the URL address accessed by the user and the mapping table of users and authorized URL access addresses already obtained in the business system: Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user currently exceeds the result of the time series analysis; If the number of visits exceeding the time series prediction reaches the set visit volume threshold, the user's visit behavior on that day is constructed into an visit behavior vector, and the cosine similarity A is calculated with the user's visit behavior vector in the past week; Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week; If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued; The steps to construct a time series analysis of each user's daily visits include: Collect time series data; preprocess time series data; model selection and parameter estimation; model testing and diagnosis; model application and prediction.

7. A method for detecting and analyzing abnormal network permissions according to claim 1, characterized in that: Also includes: When alarms are triggered by both excessive user authorization and unauthorized access, the security detection mechanism is used to identify the attack source to determine the authenticity of the alarm.

8. A network abnormal authority detection and analysis device, characterized in that: include: User group classification component, over-authorization detection component, and unauthorized access detection component; The user group segmentation component includes: A user vector construction module is used to construct a two-dimensional wide table according to the access information of users accessing the service system within the set statistical interval, and construct a user vector using the access information of each user in the two-dimensional wide table; A user similarity calculation module, used to calculate the similarity between any two users among all users according to the user vectors, to obtain the similarity between any two users among all users; A graph data organization module, used to organize graph data using the similarity between two users among all users; A group division module, used to divide users into groups using a clustering algorithm according to the graph data; The over-authorization detection component includes: A function item representation module, used to digitally represent the function items of the business system through the access records of the business system; A user-function item mapping module is used to map users to authorized function items and represent users as vectors of function items; An over-authorization judgment module is used to calculate the similarity between the user and the group, and judge whether the user is over-authorized based on the similarity between the user and the group; The unauthorized access detection component includes: A user unauthorized access detection module, used to detect user unauthorized access through URL address resolution accessed by the user and a mapping table of users and authorized URL access addresses acquired in the business system; The unauthorized access identification module is used to identify unauthorized access for over-authorized users when the function accessed by the user belongs to the over-authorized function.

9. A network abnormal authority detection and analysis device according to claim 8, characterized in that: In the user vector construction module: The two-dimensional wide table is formed by taking the URL addresses accessed by all users in the statistical interval as column fields, each user as a row field, and taking the number of times the user accesses the URL address divided by the total number of times the user accesses the system in the statistical interval as the value; In the graph data organization module: Create a graph data structure, which includes node objects and edge objects. The node object represents each user in the data set, and the edge object represents the similarity between two users. For each pair of nodes in the data set, an edge object is created using the pre-calculated similarity between two users, and the pair of node objects with similarity is used as the starting point and end point of the edge object; the edge object contains a similarity value, which indicates the degree of similarity between the node objects connected by the edge object; The functional items represent modules: In the process of digitally representing the function items of the business system through the access records of the business system, the function item frequency TF and the inverse function item frequency IDF are calculated: Function item frequency TF = the number of times a specified function item appears in a specified user's access / the total number of times all function items are accessed by a specified user; Inverse function item frequency IDF = log (total number of users / (number of users accessing the specified function item + 1)); In the user-function item mapping module: The function access of each user within a certain period of time is represented by the TF-IDF value to form a vector of user access function items; In the over-authorization judgment module: Average each user vector within the user group to form a functional vector representation of the group; Use cosine similarity to calculate the cosine similarity between each user and the group to which they belong; determine whether the user is over-authorized based on the cosine similarity between each user and the group to which they belong; The over-authorization detection component further includes: The user over-authorization alarm module is used to calculate the abnormal value of the user cosine similarity and use In principle, user over-authorization warnings are issued; The function item alarm processing module is used to calculate the generalized accard coefficient between the user function item and the group function item for each alarmed user, and according to the Gaussian distribution principle, take the function item with a standard deviation greater than 3 times the mean value as the over-authorized function item, and perform over-authorized function item alarm processing; In the user unauthorized detection module: Construct a time series analysis of each user's daily visits and calculate whether the number of visits by the user currently exceeds the result of the time series analysis; If the number of visits exceeding the time series prediction reaches the set visit volume threshold, the user's visit behavior on that day is constructed into an visit behavior vector, and the cosine similarity A is calculated with the user's visit behavior vector in the past week; Calculate the cosine similarity B based on the user's current access behavior vector and the access behavior vector of the group in the past week; If both cosine similarity A and cosine similarity B exceed the set similarity threshold, an unauthorized access behavior warning is issued.

10. A network abnormal authority detection and analysis device according to claim 9, characterized in that: Also included is a discriminant component, the discriminant component comprising: The attack source identification module is used to identify the attack source by using the security detection mechanism to determine the authenticity of the alarm when an alarm occurs due to excessive user authorization and unauthorized access.

Images