Safety baseline trust evaluation method and system based on user behaviors

Abstract

The invention discloses a security baseline trust evaluation method and system based on user behaviors, and relates to the technical field of network security, and the method comprises the steps: collecting behavior data and context awareness data of a user, analyzing the behavior data and context awareness data of the user, and calculating a current trust value of the user; setting an initial security baseline, and comparing the current trust value of the user with the initial security baseline to perform user trust evaluation; and performing permission control on the user based on the current trust value of the user. According to the method, the user behavior data and the context awareness data are collected, the comprehensive data set is constructed and analyzed to calculate the current trust value of the user, the trust value can be adjusted in time when the user behavior is abnormal, potential security threats are avoided, the operation behavior of the user can be evaluated more comprehensively and accurately, and the user experience is improved. By calculating the trust value in real time and dynamically adjusting the access authority of the user, the security of the system is enhanced, and the adaptive capacity in a complex environment is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user behavior-based security baseline trust evaluation method and system. Background Art

[0002] With the rapid development of information technology, the widespread application of computer networks, cloud computing and mobile Internet, traditional security mechanisms are facing new challenges, and information security issues are becoming increasingly prominent. Existing security measures mostly rely on static rules and predefined policies. However, with the dynamic changes in user behavior and the application of situational awareness technology, it is difficult to cope with complex security threats by relying solely on static rules. In recent years, trust assessment technology based on user behavior and situational awareness has gradually become a research hotspot. Existing trust assessment methods still have certain limitations when dealing with complex behavior patterns and multi-dimensional situational awareness data. They fail to comprehensively consider the operating background and situational awareness factors and cannot fully cope with the changing security environment. Summary of the invention

[0003] In view of the problems existing in the above-mentioned existing security baseline trust assessment method and system based on user behavior, the present invention is proposed.

[0004] Therefore, the problem to be solved by the present invention is that the existing trust assessment methods still have certain limitations when processing complex behavior patterns and multi-dimensional situational awareness data, fail to comprehensively consider the operating background and situational awareness factors, and cannot fully cope with the changing security environment.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a security baseline trust assessment method based on user behavior, which includes collecting user behavior data and situational awareness data, analyzing the user behavior data and situational awareness data, and calculating the user's current trust value; setting a preliminary security baseline and comparing the user's current trust value with the preliminary security baseline to perform user trust assessment; performing authority control on the user based on the user's current trust value, and performing risk monitoring and early warning on the user's behavior data and situational awareness data.

[0006] As a preferred solution of the user behavior-based security baseline trust assessment method described in the present invention, the collection of user behavior data and context-awareness data refers to collecting real-time user behavior data and context-awareness data as well as historical user behavior data and context-awareness data and performing data cleaning, deduplication processing and data normalization on the data.

[0007] As a preferred solution of the user behavior-based security baseline trust assessment method of the present invention, wherein: the analysis of user behavior data and context-aware data to calculate the user's comprehensive trust value refers to combining the user behavior data and context-aware data to generate a data set and converting it into a transaction database, where each transaction represents the user's operation behavior under different time periods and context-awareness;

[0008] Initially scan each transaction in the data set, count the number of occurrences of each behavior item and context-aware item, set a frequency threshold Q, filter out behavior items and context-aware items whose occurrences exceed the frequency threshold Q, generate a frequent item list, and sort the frequent items in descending order according to the frequency of occurrence of the item;

[0009] Scan the data set again, insert the frequent items of each transaction into the FP tree according to the order in the list, generate frequent item sets by recursively traversing the FP tree, calculate the data support Z and set the support threshold W, select the frequent item sets above the support threshold W as frequent behavior patterns and store the frequent behavior patterns in the blockchain;

[0010] Extract context-aware data from the behavior pattern as background data and combine it with user operation behavior data to form a complete pattern description. Determine the order of user operation behaviors according to the arrangement order of behavior items in the FP tree, set a natural language description template, fill the identified behavior operations and context-aware data into the template to generate a natural language description sentence and check it through a natural language processing tool;

[0011] Input the text sentence into the sentence parsing tool to generate a sentence parse tree, divide the complete sentence parse tree into several subtrees, each subtree corresponds to a different part of the sentence, extract phrases from the divided subtrees, and optimize the structure of the extracted phrases;

[0012] The phrases extracted from the sentence parse tree are used as text features to extract the operation sequence and time features in the behavior pattern, and the context-aware features in the context-aware data;

[0013] Convert the phrases extracted from the parse tree into tensor representation and define the tensor dimension. Different phrases in the text sentence are used as the first dimension of the tensor, the operation sequence and time information in the behavior pattern are used as the second dimension of the tensor, and the situational awareness data is used as the third dimension of the tensor.

[0014] Initialize a three-dimensional tensor with a shape of (Hin, Win, Din), fill the text features into the tensor according to the Hin dimension, fill the behavior features into the tensor according to the Win dimension, and fill the context-aware features into the tensor according to the Din dimension;

[0015] Calculate the frequency of occurrence of each phrase in the behavior pattern, map the result to the Hin dimension of the tensor, calculate the rarity of each feature in the entire behavior pattern set, map the result to each position of the tensor, and fill the weight value into the corresponding position of the tensor according to the TF-IDF calculation result;

[0016] Apply convolution layer operation to the feature tensor to perform deep feature extraction to generate convolution feature map, initialize ConvLSTM layer, input the feature map generated by convolution layer into ConvLSTM layer, perform cyclic calculation through time step, extract the temporal features of behavior pattern to generate ConvLSTM feature map, splice and integrate the feature maps generated by convolution layer and ConvLSTM layer to form a comprehensive feature representation, perform Flatten operation on the integrated feature map, and flatten the multi-dimensional feature map into a one-dimensional vector;

[0017] Use the LI regularization method to filter features, discretize the filtered continuous eigenvalues, set the discretization interval according to the distribution of the eigenvalues, and map the eigenvalues ​​to the discrete intervals;

[0018] The discretized feature values ​​are combined into a complete feature vector, and the generated feature vector is input into the Bayesian network model for trust value inference, including defining the input nodes of the Bayesian network model as behavior feature nodes and situational awareness feature nodes, defining the output nodes as the trust value of the user behavior, determining the conditional dependency relationship between the input nodes, and establishing a conditional probability table for each node;

[0019] Use Bayesian network tools to build the topology of the Bayesian network, connect nodes and edges into a directed acyclic graph, and represent the conditional dependency of each node through edges;

[0020] Collect historical feature vectors and corresponding trust labels as training data and input them into the Bayesian network model for model training. Evaluate the generalization performance of the model through cross-validation. Tune the Bayesian network structure and parameters according to the evaluation structure to obtain the trained Bayesian network model.

[0021] The real-time user behavior feature vector and the context-aware feature vector are input into the Bayesian network model, which performs forward inference on the input features and calculates the posterior probability distribution of the trust value node.

[0022] The output probability values ​​are sorted, and according to the sorting results, the trust state with the maximum probability is selected as the selection result of the maximum a posteriori probability selection method, and the selected trust state is mapped to the final trust value using a nonlinear mapping method.

[0023] As a preferred solution of the security baseline trust assessment method based on user behavior described in the present invention, wherein: setting a preliminary security baseline and comparing the user's current trust value with the preliminary security baseline to perform user trust assessment refers to calculating the mean and standard deviation of the trust values ​​of historically normal users, and setting the preliminary security baseline based on the calculated mean and standard deviation;

[0024] Compare the current user trust value with the preliminary security baseline to determine the user operation:

[0025] If the current trust value is within the baseline range, it means that the operation is in line with expectations;

[0026] If the current trust value is not within the baseline range, it indicates anomalies and risks.

[0027] As a preferred solution of the security baseline trust assessment method based on user behavior of the present invention, wherein: the permission control of the user based on the user's current trust value includes:

[0028] If the user's trust value is within the baseline range, the user is granted the corresponding operation permissions and access rights. The user can perform the requested operations without restriction, and the user behavior is continuously monitored;

[0029] If the user's trust value is not within the baseline range, the user's access rights will be restricted immediately to prevent the user from performing high-risk operations. The user will be subject to secondary verification and an emergency alert will be issued to the administrator. If the user passes the secondary identity verification, some of the user's permissions will be restored and continuous monitoring will be carried out.

[0030] As a preferred solution of the user behavior-based security baseline trust assessment method described in the present invention, the risk monitoring and early warning of user behavior data and situational awareness data refers to real-time monitoring of user behavior data and situational awareness data, identifying operations that deviate from the security baseline and abnormal situational awareness, and if abnormal situations occur in user behavior data and situational awareness data, an early warning is automatically issued to notify relevant administrators to perform emergency processing. After the emergency processing, the abnormal situations generated are integrated to generate an abnormal report, and the real-time data and abnormal reports generated during the assessment process are stored and access control is implemented.

[0031] As a preferred solution of the user behavior-based security baseline trust assessment method described in the present invention, the storage of real-time data and exception reports generated during the assessment process and the implementation of access control refers to classifying and storing the real-time data collected during the assessment process, including user behavior data, situational awareness data, trust value calculation results, and data and exception reports generated during the risk assessment process, storing the real-time data in a real-time database in chronological order, storing the exception reports in an exception event database, setting access permissions based on the user's role and trust value, and generating access logs after data access.

[0032] Another object of the present invention is to provide a security baseline trust assessment method based on user behavior, which comprises:

[0033] The data collection module is used to collect real-time and historical user behavior data and corresponding context-aware data, and pre-process the collected data;

[0034] Frequent item extraction module, used to filter out high-frequency behavior items and situation-aware items, build FP trees, generate frequent item sets, calculate support, and filter out frequent behavior patterns;

[0035] The feature processing module is used to generate a sentence parsing tree through a sentence parsing tool, extract phrases and structural features in the sentence, and convert the phrases and features into tensor representations;

[0036] A trust value calculation module is used to use a Bayesian network model to perform trust value inference, calculate trust values ​​based on user behavior characteristics and context perception characteristics, perform forward inference on real-time user behavior feature vectors, generate a posterior probability distribution of trust values, and output a final trust value;

[0037] The permission control module is used to determine the normality of user behavior and perform permission control based on the user's current trust value, granting or restricting the user's operation permissions;

[0038] The early warning module is used to monitor user behavior data and situational awareness data in real time, identify operations that deviate from the security baseline and abnormal situational awareness, issue early warnings for abnormal situations and generate abnormal reports, store abnormal reports and real-time data in the database and implement access control.

[0039] A computer device comprises: a memory and a processor; the memory stores a computer program, and the processor implements the steps of a security baseline trust assessment method based on user behavior when executing the computer program.

[0040] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a security baseline trust assessment method based on user behavior.

[0041] The beneficial effects of the present invention are as follows: the present invention collects user behavior data and situational awareness data, constructs a comprehensive data set, and performs analysis to calculate the user's current trust value. The trust value can be adjusted in time when abnormal user behavior occurs to avoid potential security threats. The user's operating behavior can be evaluated more comprehensively and accurately. By calculating the trust value in real time and dynamically adjusting the user's access rights, the security of the system is enhanced and the adaptability in complex environments is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0043] Figure 1 The flowchart of the security baseline trust assessment method based on user behavior is shown in FIG.

[0044] Figure 2 Schematic diagram of the structure of the security baseline trust assessment system based on user behavior. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0046] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0047] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0048] Example 1

[0049] Reference Figure 1 , which is the first embodiment of the present invention, and which provides a security baseline trust assessment method based on user behavior. The security baseline trust assessment method based on user behavior includes:

[0050] S1. Collect user behavior data and situational awareness data, analyze the user behavior data and situational awareness data, and calculate the user's current trust value;

[0051] Specifically, collecting user behavior data and context-aware data refers to collecting real-time user behavior data and context-aware data as well as historical user behavior data and context-aware data and performing data cleaning, deduplication processing and data normalization on the data.

[0052] By collecting real-time user behavior data, the system can obtain the user's current operation behavior in a timely manner and provide immediate information support for trust evaluation. At the same time, the collection of context-aware data provides important background information for user behavior. The system can combine context-aware data to more comprehensively understand the rationality behind user operations. Through the combination of real-time data and context-aware data, the system can more accurately evaluate the credibility of user operations. The collection of historical data provides a basis for the system to establish user behavior patterns and context-aware changes. By analyzing historical data, the system can identify the user's regular operation mode as a reference standard for evaluating current behavior. Historical data can also help the system predict the user's future operation trends and provide a more comprehensive trust evaluation framework.

[0053] Furthermore, the user behavior data and the context-awareness data are analyzed, and the user's comprehensive trust value is calculated by combining the user behavior data and the context-awareness data to generate a data set and converting it into a transaction database, where each transaction represents the user's operation behavior under different time periods and context-awareness;

[0054] Initially scan each transaction in the data set, count the number of occurrences of each behavior item and context-aware item, set a frequency threshold Q, filter out behavior items and context-aware items whose occurrences exceed the frequency threshold Q, generate a frequent item list, and sort the frequent items in descending order by the frequency of occurrence of the item. The threshold Q is set according to the average number of occurrences of behavior items and context-aware items in the data set.

[0055] Scan the data set again, insert the frequent items of each transaction into the FP tree according to the order in the list, and generate frequent item sets by recursively traversing the FP tree. If multiple transactions have the same behavior and context awareness, they share path nodes in the FP tree.

[0056] Calculate data support Z:

[0057]

[0058] In the formula, X is the number of times the item set appears, and C is the total number of transactions;

[0059] Set the support threshold W, filter out frequent item sets above the support threshold W as frequent behavior patterns and store the frequent behavior patterns in the blockchain. Make a preliminary setting based on the system security requirements and data distribution, and make fine adjustments based on the actual application situation.

[0060] Extract context-aware data from the behavior pattern as background data and combine it with user operation behavior data to form a complete pattern description. Use a standard stop word list to remove irrelevant words in the behavior pattern description. Use NLP tools to restore the text and extract stems, and uniformly format the processed behavior description.

[0061] Determine the order of user operation behaviors according to the arrangement order of behavior items in the FP tree, and set the natural language description template:

[0062] Template 1: User logs into the system using [device] at [time];

[0063] Template 2: User uploads a file at [location];

[0064] Template 3: User logs out of the system at [time];

[0065] Fill the identified behavioral operations and situational awareness data into the template to generate natural language description sentences and check them through natural language processing tools (such as Grammarly);

[0066] Input the text sentence into a sentence parsing tool (such as Stanford Parser) to generate a sentence parse tree, divide the complete sentence parse tree into several subtrees, each subtree corresponds to a different part of the sentence, extract phrases from the divided subtrees, and optimize the structure of the extracted phrases, for example, combine adjacent phrases into a complete phrase to enhance its expressive power, and combine "log in to the system" and "upload a file" into "log in to the system and upload a file";

[0067] Use phrases extracted from the sentence parse tree as text features, extract the operation sequence and time features in the behavior pattern, and extract context-aware features (geographic location, device information, network status) from context-aware data;

[0068] The phrases extracted from the parse tree are converted into tensor representations, and the tensor dimensions are defined. Different phrases in the text sentences are used as the first dimension of the tensor to capture the content information in the behavior pattern. The operation sequence and time information in the behavior pattern are used as the second dimension of the tensor. This dimension captures the time point or order information of the behavior. The situational awareness data is used as the third dimension of the tensor to ensure that the environmental context information is retained.

[0069] Initialize a three-dimensional tensor with a shape of (Hin, Win, Din), fill the text features into the tensor according to the Hin dimension, fill the behavior features into the tensor according to the Win dimension, and fill the context-aware features into the tensor according to the Din dimension;

[0070] Calculate the frequency of each phrase in the behavior pattern and map the result to the Hin dimension of the tensor:

[0071]

[0072] Where TF(t,d) is the frequency of term t in document d, f(t,d) is the number of times term t appears in document d, f(k,d) is the number of times term k appears in document d, and k represents a specific term in document d;

[0073] Compute the rarity of each feature in the entire set of behavior patterns and map the results to each position of the tensor:

[0074]

[0075] Where IDF(t,D) is the rarity of term t in the entire document D, df(t) is the number of documents containing term t, and N is the total number of documents in the document set;

[0076] TF-IDF(t,d)=TF(t,d)×IDF(t,D),

[0077] In the formula, TF-IDF(t,d) combines the frequency of occurrence of a term in a document (TF) and its rarity in the entire document set (IDF), and is used to measure the importance of a term in a document. A higher TF-IDF value indicates that term t is more important in document d, and it is relatively rare in the entire document set, and is a feature word with high discrimination.

[0078] According to the TF-IDF calculation results, fill the weight value into the corresponding position of the tensor;

[0079] Apply convolution layer operations to the feature tensor to perform deep feature extraction to generate convolution feature maps, including setting the convolution kernel size and convolution stride, stacking convolution layers multiple times, and gradually extracting higher-level features;

[0080] Initialize the ConvLSTM layer, set the time step number and convolution kernel size of the ConvLSTM layer, and set the time window size of ConvLSTM processing to ensure that the time dependency of user behavior can be captured;

[0081] The feature map generated by the convolution layer is input into the ConvLSTM layer, and the time-series features of the behavior pattern are extracted through cyclic calculations through the time step to generate the ConvLSTM feature map. The feature maps generated by the convolution layer and the ConvLSTM layer are spliced ​​and integrated to form a comprehensive feature representation. The integrated feature map is flattened to flatten the multi-dimensional feature map into a one-dimensional vector, which is convenient for subsequent feature fusion and model input. After the feature map is flattened, each feature is represented as an independent value, which is convenient for model processing;

[0082] ConvLSTM is a deep learning model that combines convolutional layers and LSTM (Long Short-Term Memory Network), which is suitable for processing spatiotemporal sequence data;

[0083] The LI regularization method is used to screen out the features that have the greatest influence on trust assessment. This process will automatically sparse the feature set, retain important features, reduce unnecessary information, and reduce model complexity.

[0084] According to the calculated TF-IDF weights, important feature phrases and context-aware features are retained, the filtered continuous feature values ​​are discretized, and the discretization interval is set according to the distribution of the feature values, and the feature values ​​are mapped to the discrete intervals;

[0085] The discretized eigenvalues ​​are combined into a complete eigenvector, and the generated eigenvector is input into the Bayesian network model for trust value inference, including,

[0086] Define the input nodes of the Bayesian network model as behavior feature nodes and situational awareness feature nodes, define the output node as the trust value of the user behavior, determine the conditional dependency between the input nodes, and establish a conditional probability table for each node to represent the probability distribution of the child node under the given parent node condition. For example, given the device information and operation type, calculate the probability that the trust value is "high trust";

[0087] Use Bayesian network tools to build the topology of the Bayesian network (such as Python's pgmpy, BayesPy, or GeNIe), connect the nodes and edges into a directed acyclic graph, and represent the conditional dependencies of each node through the edges;

[0088] Collect historical feature vectors and corresponding trust labels as training data and input them into the Bayesian network model for model training. Calculate the parameters in the conditional probability table using the maximum likelihood estimation method.

[0089] The generalization performance of the model is evaluated through cross-validation, and the Bayesian network structure and parameters are tuned according to the evaluation results to obtain a trained Bayesian network model;

[0090] The real-time user behavior feature vector and the context-aware feature vector are input into the Bayesian network model, which performs forward inference on the input features and calculates the posterior probability distribution of the trust value node.

[0091] The output probability values ​​are sorted, and according to the sorting results, the trust state with the maximum probability is selected as the selection result of the maximum a posteriori probability selection method, and the selected trust state is mapped to the final trust value using a nonlinear mapping method.

[0092] By combining user behavior data and context-aware data to generate a data set and converting it into a transaction database, the system can capture the user's operation behavior in different situations. This process not only comprehensively covers the user's multi-dimensional data, but also effectively avoids misjudgments that may be caused by a single data source. For example, a user's operation during regular working hours and on a specific device may be trustworthy, while the same operation performed during non-working hours or on an unfamiliar device may pose a security risk. The introduction of the transaction database allows the system to systematically manage and analyze these multi-dimensional data to ensure that all relevant behavior and context-aware information are fully considered. In this way, the system can provide more comprehensive basic data for subsequent frequent item set extraction and trust value calculation to ensure the accuracy and completeness of the analysis. The FP tree can compress the storage path in a large amount of data to ensure that frequent behavior patterns are efficiently identified. Combined with the previous data set construction process, this stage further refines the user behavior and context-aware data to extract key behavior and context-aware combinations. This not only helps the system accurately identify the user's regular operation mode, but also quickly discovers abnormal behaviors that deviate from the regular mode. For example, in an actual security baseline trust assessment scenario, the system can quickly identify the user's abnormal behavior under abnormal context perception through the FP tree and respond in a timely manner. The combination of FP tree and transaction database can effectively avoid data redundancy and ensure the accuracy of frequent item set extraction, thereby providing high-quality input for subsequent trust value calculation and ensuring the accuracy of trust value calculation by identifying important behavior items in different situations. For example, a specific operation may rarely appear in the entire behavior data set, but it plays a key role in the perception of a specific situation;

[0093] TF-IDF can effectively capture this rare but important behavior. Subsequently, the introduction of convolutional layers and ConvLSTM layers enables the system to extract deep features of behavioral patterns from multiple dimensions, including not only spatial features but also temporal dependencies. In actual scenarios, user operation behaviors are often continuous and time-dependent. The combination of convolutional layers and ConvLSTM enables the system to capture the temporal characteristics of these behaviors, further improving the accuracy of trust value assessment. This combination also ensures that the system can still make accurate judgments when faced with complex and dynamically changing operation behaviors. The behavior patterns are converted into standardized text descriptions through natural language processing tools, and further tensor representations are generated. This process ensures the clarity of data expression and consistency of analysis. Natural language processing helps to filter out irrelevant information and ensure that the system focuses on the core content related to security. For example, converting user operation behaviors into standardized sentences and further parsing them into tensors allows the system to conduct a comprehensive analysis of user behavior in multiple dimensions. This tensor structure not only retains the spatiotemporal characteristics of user behavior, but also combines situational awareness data to ensure that environmental context information is retained. In actual scenarios, this data processing method can help the system identify potential risks of abnormal behavior. For example, sensitive operations performed by users at unusual times or locations may be marked as high-risk operations, and the system can respond in a timely manner.

[0094] By combining natural language processing with tensor representation, the system can achieve efficient conversion between structured data and unstructured data, ensuring the depth and breadth of data analysis. By establishing conditional dependencies between behavioral features and situational awareness features, the Bayesian network can accurately infer the user's trust value. This reasoning process takes into account various uncertainties to ensure that the system can still make reasonable assessments when faced with complex behavioral patterns. For example, in actual application scenarios, when certain user operations differ significantly from their regular operations, the Bayesian network can determine the credibility of the behavior through probabilistic inference and make corresponding permission adjustments. This process effectively avoids misjudgments caused by single feature anomalies and improves the robustness of trust assessment. The combination of the Bayesian network and the aforementioned steps enables the system to adaptively adjust the trust assessment strategy when dealing with complex and changing security threats to ensure the overall security of the system.

[0095] S2. Set a preliminary security baseline and compare the user's current trust value with the preliminary security baseline to conduct user trust assessment;

[0096] Specifically, setting a preliminary security baseline and comparing the user's current trust value with the preliminary security baseline to perform user trust assessment means calculating the mean and standard deviation of the trust values ​​of historically normal users, and setting the preliminary security baseline based on the calculated mean and standard deviation. In this embodiment, if the mean of the user's historical trust value is 0.8 and the standard deviation is 0.1, then the baseline range can be set to [0.7, 0.9];

[0097] Compare the current user trust value with the preliminary security baseline to determine the user operation:

[0098] If the current trust value is within the baseline range, it means that the operation is in line with expectations;

[0099] If the current trust value is not within the baseline range, it indicates anomalies and risks.

[0100] In this embodiment, by calculating the mean (such as 0.8) and standard deviation (such as 0.1) of historical normal user trust values, the system can determine a suitable baseline range (such as [0.7, 0.9]). The setting of this baseline range can effectively cover the operation behavior of normal users, and at the same time has sufficient sensitivity to abnormal behaviors that deviate from this range. Compared with the method of setting the baseline by fixed rules or experience in the prior art, the present invention sets the baseline in a data-driven manner, which is more accurate and dynamic, can adapt to the behavioral differences of different user groups, and improves the adaptability and flexibility of the system. By comparing the comprehensive trust value of the current user with the preliminary security baseline, the system can judge in real time whether the user operation meets expectations. If the trust value is within the baseline range, it means that the user operation is consistent with the normal behavior pattern, and the system can grant the operation permission normally. This real-time comparison mechanism enables the system to dynamically adjust the trust assessment of the user to prevent misjudgment caused by changes in historical data. In addition, if the trust value is not within the baseline range, the system can promptly identify potential security threats and take corresponding security measures. This real-time trust value comparison mechanism can improve the security protection capability of the system, especially in the face of high-frequency and complex user operations, it can respond quickly and reduce security risks.

[0101] S3: Control the user's authority based on the user's current trust value, monitor the risk of user behavior data and situational awareness data, and issue early warnings;

[0102] Specifically, the permission control of users based on their current trust value includes:

[0103] If the user's trust value is within the baseline range, the user is granted the corresponding operation permissions and access rights. The user can perform the requested operations without restriction, and the user behavior is continuously monitored;

[0104] If the user's trust value is not within the baseline range, the user's access rights will be restricted immediately to prevent the user from performing high-risk operations. The user will be subject to secondary verification and an emergency alert will be issued to the administrator. If the user passes the secondary identity verification, some of the user's permissions will be restored and continuous monitoring will be carried out.

[0105] Granting or restricting permissions based on user trust values ​​breaks through the limitations of traditional static permission management. Traditional permission management usually relies on preset fixed rules and is difficult to cope with dynamic changes in user behavior. By dynamically adjusting permissions, the present invention can grant operating permissions to users in a timely manner when user behavior is in line with expectations, thereby improving user experience and system operating efficiency; and when user behavior deviates from the baseline, the system can quickly restrict permissions to avoid potential security threats. For example, when the user's trust value is higher than the baseline range, the system allows users to access more functional modules, which not only improves the convenience of operation, but also reduces unnecessary security checks and improves the overall performance of the system. The real-time monitoring mechanism ensures that the system can continue to track user behavior after permission is granted, and promptly detect and respond to possible abnormal operations. When the user's trust value exceeds the baseline range, the system further confirms the user's identity through secondary verification, effectively preventing misjudgment and improving system security. The secondary verification mechanism adds more verification methods on the basis of traditional verification methods, such as two-factor authentication and biometrics, thereby further improving the system's ability to confirm user identity. After the user passes the secondary verification, the system can restore some permissions and continue to monitor user behavior. This design not only enhances the system's fault tolerance, but also improves user protection and management flexibility.

[0106] Furthermore, risk monitoring and early warning of user behavior data and situational awareness data refers to real-time monitoring of user behavior data and situational awareness data, identifying operations and abnormal situational awareness that deviate from the security baseline. If abnormalities occur in user behavior data and situational awareness data, an early warning will be automatically issued to notify relevant administrators to conduct emergency processing. After the emergency processing, the abnormal situations generated will be integrated to generate an abnormal report, and the real-time data and abnormal reports generated during the evaluation process will be stored and access control will be implemented.

[0107] By monitoring user behavior data and situational awareness data in real time, the system can identify potential security risks at the first time. For example, a user attempts to access sensitive resources at an unexpected time or place, which may represent a potential intrusion threat. Through real-time monitoring, the system can promptly detect and respond to these abnormal situations to ensure the overall security of the system. The automatic early warning mechanism ensures that the system can quickly take emergency measures when risks are detected to reduce the incidence of security incidents. By notifying the administrator in a timely manner, the system can achieve a rapid response, thereby effectively preventing the expansion of potential threats. The abnormal report provides the system and administrator with detailed event records and analysis results, which is helpful for subsequent review and optimization of security policies. Through the integration of abnormal situations, the system can summarize and identify common security threat patterns and further improve security protection measures.

[0108] Furthermore, storing the real-time data and exception reports generated during the assessment process and implementing access control means classifying and storing the real-time data collected during the assessment process, including user behavior data, situational awareness data, trust value calculation results, and data and exception reports generated during the risk assessment process, storing the real-time data in a real-time database in chronological order, storing the exception reports in an exception event database, setting access permissions based on the user's role and trust value, and generating access logs after data access.

[0109] By classifying and storing real-time data and exception reports, the system can effectively improve data management efficiency. Real-time data and exception reports usually have different characteristics and usage scenarios. Classified storage helps the system quickly locate required information when processing and accessing data, reducing the complexity of data query. At the same time, classified storage can also improve data security, separate abnormal data from normal data, and facilitate special processing and monitoring of abnormal events. This storage method can effectively avoid data confusion and misuse, provide the system with more refined management methods, and store real-time data in a real-time database to ensure the timeliness and accuracy of the data. By setting access rights based on user roles and trust values, the system can implement a more accurate and dynamic access control mechanism.

[0110] Example 2

[0111] Reference Figure 2 , which is the second embodiment of the present invention, and which is different from the previous embodiment, provides a security baseline trust evaluation system based on user behavior, which includes:

[0112] The data collection module is used to collect real-time and historical user behavior data and corresponding context-aware data, and pre-process the collected data;

[0113] Frequent item extraction module, used to filter out high-frequency behavior items and situation-aware items, build FP trees, generate frequent item sets, calculate support, and filter out frequent behavior patterns;

[0114] The feature processing module is used to generate a sentence parsing tree through a sentence parsing tool, extract phrases and structural features in the sentence, and convert the phrases and features into tensor representations;

[0115] A trust value calculation module is used to use a Bayesian network model to perform trust value inference, calculate trust values ​​based on user behavior characteristics and context perception characteristics, perform forward inference on real-time user behavior feature vectors, generate a posterior probability distribution of trust values, and output a final trust value;

[0116] The permission control module is used to determine the normality of user behavior and perform permission control based on the user's current trust value, granting or restricting the user's operation permissions;

[0117] The early warning module is used to monitor user behavior data and situational awareness data in real time, identify operations that deviate from the security baseline and abnormal situational awareness, issue early warnings for abnormal situations and generate abnormal reports, store abnormal reports and real-time data in the database and implement access control.

[0118] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0119] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0120] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0121] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

Claims

1. A security baseline trust assessment method based on user behavior, characterized by: include, Collect user behavior data and situational awareness data, analyze the user behavior data and situational awareness data, and calculate the user's current trust value; Set a preliminary security baseline and compare the user's current trust value with the preliminary security baseline to conduct user trust assessment; User permissions are controlled based on the user's current trust value, and risk monitoring and early warning are carried out on user behavior data and situational awareness data.

2. The user behavior-based security baseline trust assessment method according to claim 1, characterized in that: The collecting of user behavior data and context-aware data refers to collecting real-time user behavior data and context-aware data as well as historical user behavior data and context-aware data and performing data cleaning, deduplication processing and data normalization on the data.

3. The user behavior-based security baseline trust assessment method according to claim 2, characterized in that: Analyzing the user behavior data and the context-aware data to calculate the user's current trust value refers to combining the user behavior data and the context-aware data to generate a data set and converting it into a transaction database, where each transaction represents the user's operation behavior under different time periods and context-awareness; Initially scan each transaction in the data set, count the number of occurrences of each behavior item and context-aware item, set a frequency threshold Q, filter out behavior items and context-aware items whose occurrences exceed the frequency threshold Q, generate a frequent item list, and sort the frequent items in descending order according to the frequency of occurrence of the item; Scan the data set again, insert the frequent items of each transaction into the FP tree according to the order in the list, generate frequent item sets by recursively traversing the FP tree, calculate the data support Z and set the support threshold W, select the frequent item sets above the support threshold W as frequent behavior patterns and store the frequent behavior patterns in the blockchain; Extract context-aware data from the behavior pattern as background data and combine it with user operation behavior data to form a complete pattern description. Determine the order of user operation behaviors according to the arrangement order of behavior items in the FP tree, set a natural language description template, fill the identified behavior operations and context-aware data into the template to generate a natural language description sentence and check it through a natural language processing tool; Input the text sentence into the sentence parsing tool to generate a sentence parse tree, divide the complete sentence parse tree into several subtrees, each subtree corresponds to a different part of the sentence, extract phrases from the divided subtrees, and optimize the structure of the extracted phrases; The phrases extracted from the sentence parse tree are used as text features to extract the operation sequence and time features in the behavior pattern, and the context-aware features in the context-aware data; Convert the phrases extracted from the parse tree into tensor representation and define the tensor dimension. Different phrases in the text sentence are used as the first dimension of the tensor, the operation sequence and time information in the behavior pattern are used as the second dimension of the tensor, and the situational awareness data is used as the third dimension of the tensor. Initialize a three-dimensional tensor with a shape of (Hin, Win, Din), fill the text features into the tensor according to the Hin dimension, fill the behavior features into the tensor according to the Win dimension, and fill the context-aware features into the tensor according to the Din dimension; Calculate the frequency of occurrence of each phrase in the behavior pattern, map the result to the Hin dimension of the tensor, calculate the rarity of each feature in the entire behavior pattern set, map the result to each position of the tensor, and fill the weight value into the corresponding position of the tensor according to the TF-IDF calculation result; Apply convolution layer operation to the feature tensor to perform deep feature extraction to generate convolution feature map, initialize ConvLSTM layer, input the feature map generated by convolution layer into ConvLSTM layer, perform cyclic calculation through time step, extract the temporal features of behavior pattern to generate ConvLSTM feature map, splice and integrate the feature maps generated by convolution layer and ConvLSTM layer to form a comprehensive feature representation, perform Flatten operation on the integrated feature map, and flatten the multi-dimensional feature map into a one-dimensional vector; Use the LI regularization method to filter features, discretize the filtered continuous eigenvalues, set the discretization interval according to the distribution of the eigenvalues, and map the eigenvalues ​​to the discrete intervals; The discretized feature values ​​are combined into a complete feature vector, and the generated feature vector is input into the Bayesian network model for trust value inference, including defining the input nodes of the Bayesian network model as behavior feature nodes and situational awareness feature nodes, defining the output nodes as the trust value of the user behavior, determining the conditional dependency relationship between the input nodes, and establishing a conditional probability table for each node; Use Bayesian network tools to build the topology of the Bayesian network, connect nodes and edges into a directed acyclic graph, and represent the conditional dependency of each node through edges; Collect historical feature vectors and corresponding trust labels as training data and input them into the Bayesian network model for model training. Evaluate the generalization performance of the model through cross-validation. Tune the Bayesian network structure and parameters according to the evaluation structure to obtain the trained Bayesian network model. The real-time user behavior feature vector and the context-aware feature vector are input into the Bayesian network model, which performs forward inference on the input features and calculates the posterior probability distribution of the trust value node. The output probability values ​​are sorted, and according to the sorting results, the trust state with the maximum probability is selected as the selection result of the maximum a posteriori probability selection method, and the selected trust state is mapped to the final trust value using a nonlinear mapping method.

4. The user behavior-based security baseline trust assessment method according to claim 3, characterized in that: The setting of the preliminary security baseline and comparing the user's current trust value with the preliminary security baseline to perform user trust assessment refers to calculating the mean and standard deviation of the trust values ​​of historically normal users, and setting the preliminary security baseline based on the calculated mean and standard deviation; Compare the current user trust value with the preliminary security baseline to determine the user operation: If the current trust value is within the baseline range, it means that the operation is in line with expectations; If the current trust value is not within the baseline range, it indicates anomalies and risks.

5. The user behavior-based security baseline trust assessment method according to claim 4, characterized in that: The user authority control based on the user's current trust value includes: If the user's trust value is within the baseline range, the user is granted the corresponding operation permissions and access rights. The user can perform the requested operations without restriction, and the user's behavior is continuously monitored; If the user's trust value is not within the baseline range, the user's access rights will be restricted immediately to prevent the user from performing high-risk operations. The user will be subject to secondary verification and an emergency alert will be issued to the administrator. If the user passes the secondary identity verification, some of the user's permissions will be restored and continuous monitoring will be carried out.

6. The user behavior-based security baseline trust assessment method according to claim 5, characterized in that: The risk monitoring and early warning of user behavior data and situational awareness data refers to real-time monitoring of user behavior data and situational awareness data, identifying operations that deviate from the security baseline and abnormal situational awareness, and if abnormal situations occur in user behavior data and situational awareness data, an early warning will be automatically issued to notify relevant administrators to conduct emergency processing. After the emergency processing, the abnormal situations generated will be integrated to generate an abnormal report, and the real-time data and abnormal reports generated during the evaluation process will be stored and access control will be implemented.

7. The user behavior-based security baseline trust assessment method according to claim 6, characterized in that: The storing of the real-time data and exception reports generated during the evaluation process and the implementation of access control refers to classifying and storing the real-time data collected during the evaluation process, including the user's behavior data, situational awareness data, trust value calculation results, and the data and exception reports generated during the risk assessment process, storing the real-time data in chronological order in a real-time database, storing the exception reports in an exception event database, setting access rights based on the user's role and trust value, and generating access logs after data access.

8. A user behavior-based security baseline trust assessment system based on the user behavior-based security baseline trust assessment method according to any one of claims 1 to 7, characterized in that: include, The data collection module is used to collect real-time and historical user behavior data and corresponding context-aware data, and pre-process the collected data; Frequent item extraction module, used to filter out high-frequency behavior items and situation-aware items, build FP trees, generate frequent item sets, calculate support, and filter out frequent behavior patterns; The feature processing module is used to generate a sentence parsing tree through a sentence parsing tool, extract phrases and structural features in the sentence, and convert the phrases and features into tensor representations; A trust value calculation module is used to use a Bayesian network model to perform trust value inference, calculate trust values ​​based on user behavior characteristics and context perception characteristics, perform forward inference on real-time user behavior feature vectors, generate a posterior probability distribution of trust values, and output a final trust value; The permission control module is used to determine the normality of user behavior and perform permission control based on the user's current trust value, granting or restricting the user's operation permissions; The early warning module is used to monitor user behavior data and situational awareness data in real time, identify operations that deviate from the security baseline and abnormal situational awareness, issue early warnings for abnormal situations and generate abnormal reports, store abnormal reports and real-time data in the database and implement access control.

9. A computer device comprising: Memory and processor; The memory stores a computer program, characterized in that: when the processor executes the computer program, the steps of the user behavior-based security baseline trust assessment method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the user behavior-based security baseline trust assessment method according to any one of claims 1 to 7 are implemented.

Images