Authority dynamic adjustment method and system based on trust evaluation

Abstract

The invention discloses a dynamic authority adjustment method and system based on trust evaluation, and belongs to the field of system security. In order to solve the problem that an existing trust evaluation scheme cannot effectively cope with user behavior state transformation, obtained user behavior data are preprocessed, user behavior characteristics are extracted, the weight of the user behavior characteristics is calculated through a fuzzy analytic hierarchy process (FAHP), and a standardized matrix is obtained in combination with the user behavior characteristics and the weight; constructing a DDPG model based on a depth deterministic strategy gradient, wherein the DDPG model performs trust evaluation training on the user according to the normalized matrix; performing trust evaluation on the user based on the user behavior data by using the trained DDPG model; and dynamically adjusting the user permission according to the trust evaluation result. According to the method, the trust condition of the user can be effectively and dynamically evaluated, and the authority of the user is flexibly adjusted according to the evaluation result, so that the security and reliability of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the field of system security, and in particular relates to a method and system for dynamically adjusting permissions based on trust evaluation. Background Art

[0002] In today's digital age, information security has become the primary consideration in all fields. Traditional static trust assessment methods can no longer meet the security needs in dynamic and complex network environments. Therefore, more and more research has begun to focus on how to achieve dynamic trust assessment of various behaviors and decisions in the system, and how to take corresponding measures to deal with threats based on the assessment results.

[0003] Reinforcement learning, as a method based on trial and error learning, can learn the optimal strategy through continuous interaction with the environment. As a type of deep reinforcement learning, the DDPG (Deep Deterministic Policy Gradient) method combines the representation ability of deep neural networks and the stability of deterministic policy gradient methods, and is suitable for scenarios with continuous actions and state spaces. However, traditional DDPG methods often require a large amount of sample data and training time, and are sensitive to parameter initialization and adjustment, which limits their application in practical scenarios.

[0004] At the same time, the FAHP (Fuzzy Analytic Hierarchy Process) method, as an effective tool for fuzzy logic and multi-criteria decision-making, has been widely used in many fields. It quantifies and compares multiple evaluation factors and indicators through fuzzy logic and hierarchical analysis to obtain the final decision result. However, the traditional FAHP method may have problems such as unreasonable parameter settings and difficulty in accurately measuring fuzzy factors, which limits its application in the field of information security. Summary of the invention

[0005] The purpose of the present invention is to solve the problem that the existing trust assessment scheme cannot effectively cope with the change of user behavior status, and to provide a more accurate and efficient permission dynamic adjustment scheme, which combines deep reinforcement learning and hierarchical analysis method, can effectively dynamically evaluate the user's trust status and flexibly adjust the user's permissions according to the evaluation results, thereby improving the security and reliability of the system.

[0006] The technical solution adopted by the present invention to achieve the above-mentioned purpose is as follows:

[0007] A method for dynamically adjusting permissions based on trust evaluation includes the following steps:

[0008] Obtain user behavior data;

[0009] Preprocess user behavior data to obtain standardized data;

[0010] Extract user behavior characteristics from standardized data;

[0011] The fuzzy analytic hierarchy process (FAHP) is used to calculate the weights of user behavior characteristics, and a normalized matrix is ​​obtained by combining user behavior characteristics and weights.

[0012] Build a DDPG model based on deep deterministic policy gradient, which trains trust evaluation of users according to the normalized matrix;

[0013] Use the trained DDPG model to evaluate user trust based on user behavior data;

[0014] Dynamically adjust user permissions based on trust evaluation results.

[0015] Furthermore, the method for preprocessing the user behavior data includes: cleaning the user behavior data, processing missing values ​​and outliers, and performing normalization and standardization.

[0016] Furthermore, the method for extracting user behavior features from standardized data includes: extracting user behavior sequences from the standardized data, calculating covariance of the user behavior sequences, and selecting a sequence with the largest covariance to extract user behavior features.

[0017] Furthermore, the steps of calculating the weight of the user behavior feature using the FAHP method include:

[0018] Classify user behavior characteristics into trust attributes;

[0019] Divide the trust attributes into several trust evidences and construct an evidence matrix;

[0020] Compare the importance of any two trust evidences in the evidence matrix to obtain the initial judgment matrix;

[0021] Convert the initial judgment matrix into a fuzzy consistent matrix;

[0022] The weight vector of each trust evidence is calculated according to the fuzzy consistency matrix, and the weight matrix, i.e., the weight of the user behavior characteristics, is constructed.

[0023] Furthermore, combining the user behavior characteristics and weights to obtain a normalized matrix means multiplying the evidence matrix by the weight matrix to obtain a normalized matrix, and the values ​​on the diagonal of the normalized matrix are attribute evaluation value vectors.

[0024] Furthermore, the DDPG model includes an Actor network and a Critic network; wherein the Actor network outputs a corresponding action, i.e., a user authority adjustment strategy, according to the input state; the Actor network includes an input layer, a hidden layer, and an output layer, wherein the input layer is used to receive a normalized matrix, the hidden layer includes a multilayer perceptron, two hidden layers, and an activation function ReLU, and the output layer is used to output continuous action values; the Critic network is used to evaluate the value of the action output by the Actor network and output a Q value; the Critic network includes an input layer, a hidden layer, and an output layer, wherein the input layer is used to receive a combination of state and action, the hidden layer includes a multilayer perceptron, two hidden layers, and an activation function ReLU, and the output layer is used to output a Q value.

[0025] Furthermore, during training, the DDPG model uses an experience replay pool to store the quadruple of normalized matrix, action, reward, and next state, trains by randomly sampling batches, and uses a soft update mechanism to update the Actor network and Critic network.

[0026] Furthermore, the update rule of the Critic network is: minimize the mean square error loss function of the Q value; the update rule of the Actor network is: optimize the strategy through the gradient calculated by the Critic network to maximize the Q value.

[0027] Furthermore, dynamically adjusting user permissions according to the trust evaluation result includes: if the user is evaluated as trustworthy, allowing access to resources; if the user is evaluated as untrustworthy, denying the access request.

[0028] A system for dynamically adjusting permissions based on trust evaluation, comprising:

[0029] Data acquisition module, used to obtain user behavior data;

[0030] Data preprocessing module, used to preprocess user behavior data to obtain standardized data;

[0031] Feature extraction module, used to extract user behavior features from standardized data;

[0032] FAHP module, used to calculate the weights of user behavior features using the FAHP method, and to obtain a normalized matrix by combining user behavior features and weights;

[0033] The DDPG model is used to evaluate the trust of users based on user behavior data after training according to the normalized matrix;

[0034] The access control module is used to dynamically adjust user permissions based on trust evaluation results.

[0035] Compared with the prior art, the present invention has the following positive effects:

[0036] 1. Improved real-time and dynamic performance: Traditional internal threat detection methods are often based on static rules or models and cannot effectively respond to dynamic changes in user behavior. However, the present invention uses a method of dynamic factor evaluation trust adjustment authority, which can monitor and evaluate user behavior characteristics in real time and dynamically adjust authority according to real-time conditions, thereby improving the real-time and dynamic performance of the system.

[0037] 2. Accuracy and refinement: The present invention combines the FAHP method and the DDPG reinforcement learning method. By weighing and evaluating the user behavior characteristics, the user's trust level can be judged more accurately and the permissions can be adjusted accordingly. Through the introduction of the FAHP method, the importance weights of different indicators (such as user behavior characteristics, system log information, etc.) for trust evaluation are determined. FAHP can combine expert knowledge and objective data to give the weight of each indicator, thereby establishing a hierarchical relationship between indicators. The present invention can more accurately evaluate trust, fully consider the impact of multiple factors on the decision-making results, and improve the accuracy and credibility of the evaluation. The deep reinforcement learning model is constructed using the DDPG algorithm, and the weights determined by FAHP are used as additional inputs to the weight matrix generated using FAHP, thereby dynamically adjusting the trust evaluation model, so that the system can perform trust evaluation in a dynamic environment, and adjust and optimize according to real-time data, thereby improving the adaptability and robustness of the system. Compared with traditional methods, it can distinguish the trust of users more finely and improve the accuracy of detection.

[0038] 3. Enhanced intelligence and adaptability: Traditional internal threat detection methods often rely on manually set rules or static models, lacking intelligence and adaptability. The present invention utilizes the DDPG reinforcement learning method, which can dynamically adjust model parameters according to real-time system feedback and user behavior data, making the system intelligent and adaptable, and better able to adapt to complex and changeable network environments and user behaviors. The weights determined by FAHP can remain stable in this process. As an important basis for evaluation indicators, the FAHP method provides an accurate estimate of indicator weights. The method of the present invention can be generalized to different trust assessment scenarios, has strong versatility and flexibility, and has wide applicability in various practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The figure is a flow chart of dynamic adjustment of permissions based on trust evaluation in an embodiment. DETAILED DESCRIPTION

[0040] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0041] The embodiment of the present invention specifically discloses a method and system for dynamically adjusting permissions based on trust evaluation, and the process is as follows: Figure 1 As shown, the main steps include:

[0042] 1. Obtain user behavior data through the data acquisition module

[0043] User behavior data mainly includes the user's basic information, permissions, historical behaviors (login and logout, device plugging and unplugging, email sending and receiving, file operations, web browsing, data uploading and downloading, etc.), frequently used locations, number of failed logins, and other information.

[0044] 2. Perform data preprocessing through the data preprocessing module

[0045] The acquired user behavior data is cleaned, missing values ​​and outliers are processed, and normalized and standardized so that the feature values ​​are scaled to the same scale range, which ensures the consistency and comparability of the data.

[0046] 3. Extract behavioral features through feature extraction module

[0047] The user behavior sequence is extracted from the preprocessed standardized data, the covariance of the user behavior sequence is calculated, and the sequence with the largest covariance is selected to extract the user behavior features, so as to comprehensively capture the behavior patterns of users and the system.

[0048] 4. Perform hierarchical analysis of trust factors through the FAHP module

[0049] 1) Trust attribute division: Divide user behavior characteristics into different trust attributes.

[0050] 2) Hierarchical division: Divide the trust attribute into several trust evidences to form an evidence matrix, which is expressed as E = (e ij ) n×m , where e ij Represents the value of the jth trust evidence under the i-th trust attribute. The dimension of the matrix is ​​n×m, where n is the number of trust attributes and m is the number of trust evidence under each trust attribute. If the trust evidence under some attributes is insufficient, it is padded with 0.

[0051] 3) The normalized matrix is ​​obtained by hierarchical analysis:

[0052] In the evidence matrix E = (e ij ) n×m In the comparison, the importance of any two trust evidences is compared. For any two trust evidences e i and e j , judge e i Relative to e j Is it more important? Set the element value of EQ according to the comparison result to obtain the initial judgment matrix EQ = (eij ) m×m Among them, the initial judgment matrix element e ij The calculation formula is as follows:

[0053] eq ij ={1, if e i >e j ; 0, otherwise}

[0054] The initial judgment matrix EQ is converted into a fuzzy consistent matrix Q = (q ij ) m×m , where q ij The calculation formula is as follows: ij =(eq ij +eq ji ) / 2; where q ij is the i-th row and j-th column, indicating the importance of item i to item j; q ji is the jth row and ith column, indicating the importance of item j to item i. This formula performs symmetrical processing on the values ​​of i and j, and the calculation makes the fuzzy consistent matrix reflect the balance of the relative relationship between i and j, thus avoiding the deviation caused by one-way judgment.

[0055] Calculate the weight vector ω of each trust evidence m ) T , where ω i The calculation formula is as follows:

[0056] Use the obtained trust evidence weight vector ω to form a weight matrix W = (ω ij ) m×n , where ω ij is the weight of the jth trust evidence under the ith trust attribute, and represents the final weight vector of n trust attributes.

[0057] The weight matrix W is combined with the obtained evidence matrix E to obtain a new normalized matrix F, that is, F = E × W. This matrix represents the comprehensive evaluation value of each trust attribute, and the value on the diagonal is the attribute evaluation value vector F = (f1, f2, ..., f n ).

[0058] 5. Trust evaluation through DDPG model

[0059] The normalized matrix obtained above is input into the DDPG model, and the policy network and value network are continuously optimized through training to improve the accuracy and dynamic adjustment ability of trust evaluation. The trained DDPG model is used to conduct trust evaluation on users.

[0060] The DDPG model is mainly composed of an Actor network and a Critic network. The Actor network outputs the corresponding action, i.e., the user rights adjustment strategy, according to the input state. The Actor network includes an input layer, a hidden layer, and an output layer. The input layer is used to receive the normalized matrix, the hidden layer includes a multilayer perceptron (MLP), two hidden layers (each with 256 neurons), and an activation function ReLU. The output layer is used to output continuous action values, usually using a linear activation function.

[0061] The Critic network is used to evaluate the value of the action output by the Actor network and output the Q value, which represents the expected return under a given state and action. The Critic network includes an input layer, a hidden layer, and an output layer, where the input layer is used to receive a combination of state and action, the hidden layer includes a multilayer perceptron (MLP), two hidden layers (each with 256 neurons) and an activation function ReLU, and the output layer is used to output the Q value, usually using a linear activation function.

[0062] When training, the DDPG model uses the experience replay buffer to store the state (i.e., normalized matrix), action, reward, and next state quadruplets to improve sample efficiency. Randomly extract batches for training and update the Actor network and Critic network. Use a soft update mechanism to maintain the target Actor and Critic network. The Critic network update rule: minimize the mean square error loss function of the Q value. The Actor network update rule: optimize the strategy through the gradient calculated by the Critic network to maximize the Q value, that is, update the Actor network according to the feedback of the Critic network.

[0063] 6. Adjust permissions through the access control module

[0064] Dynamically adjust user permissions based on trust evaluation results. If the user is evaluated as trustworthy, access to resources is allowed; if not, access requests are denied to ensure system security.

[0065] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A method for dynamically adjusting permissions based on trust evaluation, characterized in that: The following steps are involved: Obtain user behavior data; Preprocess user behavior data to obtain standardized data; Extract user behavior characteristics from standardized data; The fuzzy analytic hierarchy process (FAHP) is used to calculate the weights of user behavior characteristics, and a normalized matrix is ​​obtained by combining user behavior characteristics and weights. Build a DDPG model based on deep deterministic policy gradient, which trains trust evaluation of users according to the normalized matrix; Use the trained DDPG model to evaluate user trust based on user behavior data; Dynamically adjust user permissions based on trust evaluation results.

2. The method according to claim 1, characterized in that Methods for preprocessing user behavior data include: cleaning user behavior data, processing missing values ​​and outliers, and normalizing and standardizing the data.

3. The method according to claim 1, characterized in that The method for extracting user behavior features from standardized data includes: extracting user behavior sequences from the standardized data, calculating covariance of the user behavior sequences, and selecting a sequence with the largest covariance to extract user behavior features.

4. The method according to claim 1, characterized in that The steps to calculate the weights of user behavior features using the FAHP method include: Classify user behavior characteristics into trust attributes; Divide the trust attributes into several trust evidences and construct an evidence matrix; Compare the importance of any two trust evidences in the evidence matrix to obtain the initial judgment matrix; Convert the initial judgment matrix into a fuzzy consistent matrix; The weight vector of each trust evidence is calculated according to the fuzzy consistency matrix, and the weight matrix, i.e., the weight of the user behavior characteristics, is constructed.

5. The method according to claim 1, characterized in that Combining user behavior characteristics and weights to obtain a normalized matrix means multiplying the evidence matrix by the weight matrix to obtain a normalized matrix, and the values ​​on the diagonal of the normalized matrix are attribute evaluation value vectors.

6. The method according to claim 1, characterized in that The DDPG model includes an Actor network and a Critic network; the Actor network outputs the corresponding action, i.e., the user authority adjustment strategy, according to the input state; the Actor network includes an input layer, a hidden layer, and an output layer, wherein the input layer is used to receive a normalized matrix, the hidden layer includes a multilayer perceptron, two hidden layers, and an activation function ReLU, and the output layer is used to output continuous action values; the Critic network is used to evaluate the value of the action output by the Actor network and output a Q value; the Critic network includes an input layer, a hidden layer, and an output layer, wherein the input layer is used to receive a combination of state and action, the hidden layer includes a multilayer perceptron, two hidden layers, and an activation function ReLU, and the output layer is used to output a Q value.

7. The method according to claim 6, characterized in that When training, the DDPG model uses an experience replay pool to store the normalized matrix, action, reward, and next state quadruple, trains by randomly sampling batches, and uses a soft update mechanism to update the Actor network and Critic network.

8. The method according to claim 7, characterized in that The update rule of the Critic network is to minimize the mean square error loss function of the Q value; the update rule of the Actor network is to optimize the strategy through the gradient calculated by the Critic network to maximize the Q value.

9. The method according to claim 1, characterized in that Dynamically adjusting user permissions based on trust evaluation results includes: if the user is evaluated as trustworthy, access to resources is allowed; if the user is evaluated as untrustworthy, the access request is denied.

10. A system for dynamically adjusting permissions based on trust evaluation, implementing the method described in any one of claims 1 to 9, characterized in that: include: Data acquisition module, used to obtain user behavior data; Data preprocessing module, used to preprocess user behavior data to obtain standardized data; Feature extraction module, used to extract user behavior features from standardized data; FAHP module, used to calculate the weights of user behavior features using the FAHP method, and to obtain a normalized matrix by combining user behavior features and weights; The DDPG model is used to evaluate the trust of users based on user behavior data after training according to the normalized matrix; The access control module is used to dynamically adjust user permissions based on trust evaluation results.

Images