A trust evaluation-based permission dynamic adjustment method and system

Abstract

The application discloses a kind of based on trust evaluation's permission dynamic adjustment method and system, belong to system security field.The present application is to solve the problem that existing trust evaluation scheme cannot effectively deal with the transformation of user behavior state, the user behavior data obtained is preprocessed and user behavior feature is extracted, the weight of user behavior feature is calculated using fuzzy analytic hierarchy process FAHP, and the normalized matrix is obtained in combination with user behavior feature and weight;A DDPG model based on deep deterministic policy gradient is constructed, and the DDPG model is trained according to the trust evaluation of the user based on the normalized matrix;The trained DDPG model is used to evaluate the trust of the user based on the user behavior data;According to the trust evaluation result, the user's permission is dynamically adjusted.The present application can effectively evaluate the trust of the user dynamically, and flexibly adjust the user's permission according to the evaluation result, thereby improving the security and reliability of the system.

Description

Technical Field

[0001] This invention belongs to the field of system security, and in particular relates to a method and system for dynamic adjustment of permissions based on trust assessment. Background Technology

[0002] In today's digital age, information security has become a primary consideration across all sectors. Traditional static trust assessment methods are no longer sufficient to meet the security needs of dynamic and complex network environments. Therefore, an increasing number of studies are focusing on how to achieve dynamic trust assessment of various behaviors and decisions within a system, and how to take corresponding measures to address threats based on the assessment results.

[0003] Reinforcement learning, as a trial-and-error learning method, learns the optimal policy through continuous interaction with the environment. DDPG (Deep Deterministic Policy Gradient), a type of deep reinforcement learning, combines the representational power of deep neural networks with the stability of deterministic policy gradient methods, making it suitable for scenarios involving continuous actions and state spaces. However, traditional DDPG methods often require large amounts of sample data and training time, and are highly sensitive to parameter initialization and adjustment, limiting their application in real-world scenarios.

[0004] Meanwhile, FAHP (Fuzzy Analytic Hierarchy Process), as an effective tool for fuzzy logic and multi-criteria decision-making, has been widely applied in various fields. It quantifies and compares multiple evaluation factors and indicators through fuzzy logic and hierarchical analysis to arrive at the final decision result. However, traditional FAHP methods may suffer from problems such as unreasonable parameter settings and difficulty in accurately measuring fuzzy factors, limiting their application in the field of information security. Summary of the Invention

[0005] The purpose of this invention is to address the problem that existing trust assessment schemes cannot effectively cope with changes in user behavior states, and to provide a more accurate and efficient dynamic permission adjustment scheme. By combining deep reinforcement learning and hierarchical analysis, it can effectively and dynamically assess the user's trust status and flexibly adjust the user's permissions based on the assessment results, thereby improving the security and reliability of the system.

[0006] The technical solution adopted by the present invention to achieve the above objectives is as follows:

[0007] A method for dynamically adjusting permissions based on trust assessment includes the following steps:

[0008] Obtain user behavior data;

[0009] User behavior data is preprocessed to obtain standardized data;

[0010] Extracting user behavior features from standardized data;

[0011] The weights of user behavior features are calculated using the fuzzy hierarchical analysis method (FAHP), and a normalized matrix is ​​obtained by combining the user behavior features and their weights.

[0012] Construct a DDPG model based on deep deterministic policy gradient, which is trained to evaluate user trust based on a normalized matrix;

[0013] The trained DDPG model is used to assess user trust based on user behavior data.

[0014] User permissions are dynamically adjusted based on trust assessment results.

[0015] Furthermore, methods for preprocessing user behavior data include: cleaning the user behavior data, handling missing and outlier values, and performing normalization and standardization.

[0016] Furthermore, the method for extracting user behavior features from standardized data includes: extracting user behavior sequences from standardized data, calculating the covariance of the user behavior sequences, and selecting the sequence with the largest covariance to extract user behavior features.

[0017] Furthermore, the steps for calculating the weights of user behavior features using the FAHP method include:

[0018] Classify user behavior characteristics by trust attributes;

[0019] The trust attribute is divided into several trust evidences, and an evidence matrix is ​​constructed.

[0020] By comparing the importance of any two pieces of trust evidence in the evidence matrix, an initial judgment matrix is ​​obtained;

[0021] Transform the initial judgment matrix into a fuzzy consistent matrix;

[0022] Calculate the weight vector of each trust evidence based on the fuzzy consistency matrix, and construct the weight matrix, which represents the weights of user behavior features.

[0023] Furthermore, the normalized matrix is ​​obtained by combining user behavior features and weights. This means that the evidence matrix and the weight matrix are multiplied to obtain the normalized matrix, and the values ​​on the diagonal of the normalized matrix are attribute evaluation value vectors.

[0024] Furthermore, the DDPG model includes an Actor network and a Critic network. The Actor network outputs corresponding actions, i.e., user permission adjustment strategies, based on the input state. The Actor network comprises an input layer, hidden layers, and an output layer. The input layer receives the normalized matrix, the hidden layers consist of a multilayer perceptron, two hidden layers, and the ReLU activation function, and the output layer outputs continuous action values. The Critic network evaluates the value of the actions output by the Actor network, outputting a Q-value. The Critic network also includes an input layer, hidden layers, and an output layer. The input layer receives the combination of state and action, the hidden layers consist of a multilayer perceptron, two hidden layers, and the ReLU activation function, and the output layer outputs the Q-value.

[0025] Furthermore, during training, the DDPG model uses an experience replay pool to store a quadruple of normalized matrix, action, reward, and next state, trains by randomly sampling batches, and uses a soft update mechanism to update the Actor network and Critic network.

[0026] Furthermore, the update rule for the Critic network is: to minimize the mean squared error loss function of the Q value; the update rule for the Actor network is: to optimize the policy by using the gradient calculated by the Critic network to maximize the Q value.

[0027] Furthermore, dynamically adjusting user permissions based on trust assessment results includes: allowing access to resources if a user is assessed as trustworthy; and denying access requests if a user is assessed as untrustworthy.

[0028] A dynamic permission adjustment system based on trust assessment includes:

[0029] The data acquisition module is used to acquire user behavior data;

[0030] The data preprocessing module is used to preprocess user behavior data to obtain standardized data;

[0031] The feature extraction module is used to extract user behavior features from standardized data;

[0032] The FAHP module is used to calculate the weights of user behavior features using the FAHP method, and to obtain a normalized matrix by combining user behavior features and weights.

[0033] The DDPG model is used to evaluate user trust based on user behavior data after training on a normalized matrix.

[0034] The access control module is used to dynamically adjust user permissions based on trust assessment results.

[0035] Compared with the prior art, the positive effects of the present invention are as follows:

[0036] 1. Enhanced Real-Time and Dynamic Performance: Traditional insider threat detection methods are often based on static rules or models, which cannot effectively cope with dynamic changes in user behavior. This invention employs a dynamic factor assessment and trust adjustment method for permissions, enabling real-time monitoring and evaluation of user behavioral characteristics and dynamic adjustment of permissions based on real-time conditions, thus improving the system's real-time and dynamic performance.

[0037] 2. Accuracy and Refinement: This invention combines the FAHP and DDPG reinforcement learning methods. By weighing and evaluating user behavior characteristics, it can more accurately determine a user's trust level and adjust permissions accordingly. The introduction of FAHP determines the importance weights of different indicators (e.g., user behavior characteristics, system log information) for trust assessment. FAHP combines expert knowledge and objective data to assign weights to each indicator, thus establishing a hierarchical relationship between indicators. This invention can more accurately assess trust, fully considering the impact of multiple factors on the decision-making result, improving the accuracy and credibility of the assessment. A deep reinforcement learning model is constructed using the DDPG algorithm. The weights determined by FAHP are used as additional input to the weight matrix generated by FAHP, thereby dynamically adjusting the trust assessment model. This allows the system to perform trust assessments in dynamic environments and adjust and optimize based on real-time data, improving the system's adaptability and robustness. Compared to traditional methods, it can more finely distinguish user trust levels, improving detection accuracy.

[0038] 3. Enhanced Intelligence and Adaptability: Traditional internal threat detection methods often rely on manually set rules or static models, lacking intelligence and adaptability. This invention utilizes the DDPG reinforcement learning method, which dynamically adjusts model parameters based on real-time system feedback and user behavior data, giving the system intelligence and adaptability to better adapt to complex and changing network environments and user behaviors. The weights determined by FAHP remain stable throughout this process, serving as an important basis for evaluation metrics; the FAHP method provides accurate estimates of metric weights. The method of this invention can be generalized to different trust assessment scenarios, exhibiting strong versatility and flexibility, and has wide applicability in various practical applications. Attached Figure Description

[0039] Figure 1 This is a flowchart illustrating the dynamic adjustment of permissions based on trust assessment in this embodiment. Detailed Implementation

[0040] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, a detailed description is provided below in conjunction with the accompanying drawings.

[0041] This invention specifically discloses a method and system for dynamically adjusting permissions based on trust assessment, the process of which is as follows: Figure 1 As shown, the main steps include:

[0042] 1. Obtain user behavior data through the data acquisition module.

[0043] User behavior data mainly includes users' basic information, permissions, historical behaviors (login / logout, device plugging / unplugging, email sending / receiving, file operations, web browsing, data upload / download, etc.), frequently used locations, number of failed login attempts, and other information.

[0044] 2. Data preprocessing is performed using the data preprocessing module.

[0045] The acquired user behavior data is cleaned, missing and outlier values ​​are removed, and normalization and standardization are performed to scale the feature values ​​to the same scale range, which ensures the consistency and comparability of the data.

[0046] 3. Extract behavioral features using the feature extraction module.

[0047] User behavior sequences are extracted from the preprocessed standardized data. The covariance of the user behavior sequences is calculated, and the sequence with the largest covariance is selected to extract user behavior features in order to comprehensively capture the behavior patterns of users and the system.

[0048] 4. Conduct hierarchical analysis of trust factors using the FAHP module.

[0049] 1) Trust Attribute Classification: Divide user behavior characteristics into different trust attributes.

[0050] 2) Hierarchical Division: The trust attribute is divided into several trust evidences, forming an evidence matrix, represented as E = (e ij ) n×m , where e ij This represents the value of the j-th trust evidence under the i-th trust attribute. The matrix has dimensions n×m, where n is the number of trust attributes and m is the number of trust evidences under each trust attribute. If there is insufficient trust evidence under some attributes, it is padded with 0.

[0051] 3) The hierarchical analysis yields the normalized matrix:

[0052] In the evidence matrix E = (e ij ) n×m In the context of comparing the importance of any two pieces of trust evidence, for any two pieces of trust evidence e... i and e j Determine e i Relative to e j Whether it is more important or not, the element values ​​of EQ are set according to the comparison results to obtain the initial judgment matrix EQ = (eij ) m×m Among them, the initial judgment matrix element e ij The calculation formula is as follows:

[0053] eq ij ={1, if e i >e j ;0, otherwise}

[0054] The initial judgment matrix EQ is transformed into a fuzzy consistency matrix Q = (q ij ) m×m , where q ij The calculation formula is as follows: q ij =(eq ij +eq ji ) / 2; where q ij It is the i-th row and j-th column, representing the importance of item i to item j; q ji The value in row j and column i represents the importance of item j to item i. This formula performs symmetrical processing on the values ​​of i and j, and the calculation makes the fuzzy consistency matrix reflect the balance of the relative relationship between i and j, avoiding the deviation that may be caused by one-way judgment.

[0055] Calculate the weight vector ω = (ω1, ω2, ..., ω) for each piece of trust evidence. m ) T , where ω i The calculation formula is as follows:

[0056] The weight matrix W = (ω) is formed using the weight vector ω of the obtained trust evidence. ij ) m×n , where ω ij It represents the weight of the j-th trust evidence under the i-th trust attribute, and represents the final weight vector of n trust attributes.

[0057] By combining the weight matrix W with the obtained evidence matrix E, a new normalized matrix F is obtained, i.e., F = E × W. This matrix represents the comprehensive evaluation value of each trust attribute, and the values ​​on the diagonal are the attribute evaluation value vector F = (f1, f2, ..., f...). n ).

[0058] 5. Trust assessment using the DDPG model

[0059] The normalized matrix obtained above is input into the DDPG model. Through training, the policy network and value network are continuously optimized to improve the accuracy and dynamic adjustment capability of trust assessment. The trained DDPG model is then used to assess user trust.

[0060] The DDPG model mainly consists of an Actor network and a Critic network. The Actor network outputs corresponding actions based on the input state, i.e., the strategy for adjusting user permissions. The Actor network includes an input layer, hidden layers, and an output layer. The input layer receives the normalized matrix, the hidden layer consists of a multilayer perceptron (MLP), two hidden layers (each with 256 neurons), and the ReLU activation function, and the output layer outputs continuous action values, typically using a linear activation function.

[0061] The Critic network is used to evaluate the value of the actions output by the Actor network, outputting a Q-value that represents the expected reward given a state and action. The Critic network consists of an input layer, hidden layers, and an output layer. The input layer receives the combination of state and action; the hidden layers consist of a multilayer perceptron (MLP), two hidden layers (each with 256 neurons), and the ReLU activation function; the output layer outputs the Q-value, typically using a linear activation function.

[0062] During training, the DDPG model uses a replay buffer to store a quadruple of state (i.e., normalized matrix), action, reward, and next state, which improves sample efficiency. Random batches are selected for training to update the Actor and Critic networks. A soft update mechanism is used to maintain the target Actor and Critic networks. The Critic network update rule is to minimize the mean squared error loss function of the Q-value. The Actor network update rule is to optimize the policy using the gradients calculated by the Critic network to maximize the Q-value; that is, the Actor network is updated based on the feedback from the Critic network.

[0063] 6. Adjust permissions through the access control module.

[0064] User permissions are dynamically adjusted based on trust assessment results. If a user is assessed as trustworthy, access to resources is allowed; otherwise, access requests are denied to ensure system security.

[0065] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for dynamically adjusting permissions based on trust assessment, characterized in that, Includes the following steps: Obtain user behavior data; User behavior data is preprocessed to obtain standardized data; Extracting user behavior features from standardized data; The weights of user behavior features are calculated using the fuzzy hierarchical analysis method (FAHP), and a normalized matrix is ​​obtained by combining the user behavior features and their weights. Construct a DDPG model based on deep deterministic policy gradient, which is trained to evaluate user trust based on a normalized matrix; The trained DDPG model is used to assess user trust based on user behavior data. User permissions are dynamically adjusted based on trust assessment results.

2. The method as described in claim 1, characterized in that, Methods for preprocessing user behavior data include: cleaning the user behavior data, handling missing and outlier values, and performing normalization and standardization.

3. The method as described in claim 1, characterized in that, Methods for extracting user behavior features from standardized data include: extracting user behavior sequences from standardized data, calculating the covariance of the user behavior sequences, and selecting the sequence with the largest covariance to extract user behavior features.

4. The method as described in claim 1, characterized in that, The steps for calculating the weights of user behavior features using the FAHP method include: Classify user behavior characteristics by trust attributes; The trust attribute is divided into several trust evidences, and an evidence matrix is ​​constructed. By comparing the importance of any two pieces of trust evidence in the evidence matrix, an initial judgment matrix is ​​obtained; Transform the initial judgment matrix into a fuzzy consistent matrix; Calculate the weight vector of each trust evidence based on the fuzzy consistency matrix, and construct the weight matrix, which represents the weights of user behavior features.

5. The method as described in claim 1, characterized in that, The normalized matrix is ​​obtained by combining user behavior features and weights. This means that the evidence matrix and the weight matrix are multiplied to obtain the normalized matrix, and the values ​​on the diagonal of the normalized matrix are attribute evaluation value vectors.

6. The method as described in claim 1, characterized in that, The DDPG model includes an Actor network and a Critic network. The Actor network outputs corresponding actions, i.e., user permission adjustment strategies, based on the input state. The Actor network consists of an input layer, hidden layers, and an output layer. The input layer receives the normalized matrix, the hidden layers consist of a multilayer perceptron, two hidden layers, and the ReLU activation function, and the output layer outputs continuous action values. The Critic network evaluates the value of the actions output by the Actor network, outputting a Q-value. The Critic network also includes an input layer, hidden layers, and an output layer. The input layer receives the combination of state and action, the hidden layers consist of a multilayer perceptron, two hidden layers, and the ReLU activation function, and the output layer outputs the Q-value.

7. The method as described in claim 6, characterized in that, During training, the DDPG model uses an experience replay pool to store a quadruple of normalized matrix, action, reward, and next state. Training is performed by randomly sampling batches, and a soft update mechanism is used to update the Actor network and Critic network.

8. The method as described in claim 7, characterized in that, The update rule for the Critic network is to minimize the mean squared error loss function of the Q value; the update rule for the Actor network is to optimize the policy by using the gradient calculated by the Critic network to maximize the Q value.

9. The method as described in claim 1, characterized in that, Dynamically adjusting user permissions based on trust assessment results includes: allowing access to resources if a user is assessed as trustworthy; and denying access requests if a user is assessed as untrustworthy.

10. A dynamic permission adjustment system based on trust assessment, implementing the method described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to acquire user behavior data; The data preprocessing module is used to preprocess user behavior data to obtain standardized data; The feature extraction module is used to extract user behavior features from standardized data; The FAHP module is used to calculate the weights of user behavior features using the FAHP method, and to obtain a normalized matrix by combining user behavior features and weights. The DDPG model is used to evaluate user trust based on user behavior data after training on a normalized matrix. The access control module is used to dynamically adjust user permissions based on trust assessment results.

Images