Resource access control method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a resource access control method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining authority request information of a target object; the permission request information is used for requesting to access a resource set, and the resource set comprises a plurality of to-be-accessed resources expected to be accessed by the target object; performing object behavior analysis according to the permission request information through a trained analysis model to obtain a behavior analysis result of the target object on each to-be-accessed resource in the plurality of to-be-accessed resources, and adjusting the access permission of the target object on each to-be-accessed resource according to the behavior analysis result of the target object on each to-be-accessed resource; according to the access permission of the target object to each to-be-accessed resource, the access of the target object to the resource set is controlled, and the problem of permission abuse or internal threat caused by static permission allocation in related technologies is solved.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of information security technology, and in particular, to a resource access control method, device, storage medium, and electronic device. Background Art

[0002] Information security and network security are two crucial aspects in modern society, and permission management plays a vital role in information security and network security. It involves controlling and limiting the access of objects to system resources, data, and functions, ensuring that only authorized objects can perform specific operations, effectively protecting sensitive data, preventing abuse and misoperation, improving system stability and security, and improving operational efficiency.

[0003] At present, the main permission management technologies include access control list, role-based access control, attribute-based access control, policy-based access control and behavior-based access control. These technologies are based on static configuration strategies to achieve permission management capabilities, have a certain lag, and are based on a single factor to control permissions.

[0004] However, once permissions are assigned, they are usually not automatically adjusted according to changes in object information. The current static permission allocation method based on a single factor is difficult to adapt to instant changes in object behavior and cannot effectively respond to abnormal behavior or attacks, which in turn leads to problems of permission abuse or internal threats. Summary of the invention

[0005] The embodiments of the present application provide a resource access control method, device, storage medium and electronic device to at least solve the problem of static permission allocation in related technologies leading to permission abuse or internal threats.

[0006] According to one aspect of an embodiment of the present application, a resource access control method is provided, comprising: obtaining permission request information of a target object; the permission request information is used to request access to a resource set, the resource set including a plurality of resources to be accessed that the target object expects to access; performing object behavior analysis based on the permission request information through a trained analysis model to obtain a behavior analysis result of the target object for each of the plurality of resources to be accessed, and adjusting the target object's access rights to each resource to be accessed based on the behavior analysis result of the target object for each resource to be accessed; and controlling the target object's access to the resource set based on the target object's access rights to each resource to be accessed.

[0007] According to another aspect of an embodiment of the present application, a resource access control device is provided, comprising: a request acquisition module, used to obtain permission request information of a target object; the permission request information is used to request access to a resource set, and the resource set includes a plurality of resources to be accessed that the target object expects to access; a permission allocation module, used to perform object behavior analysis based on the permission request information through a trained analysis model, to obtain a behavior analysis result of the target object for each of the plurality of resources to be accessed, and to adjust the target object's access rights to each resource to be accessed based on the behavior analysis result of the target object for each resource to be accessed; and an access control module, used to control the target object's access to the resource set based on the target object's access rights to each resource to be accessed.

[0008] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned resource access control method when running.

[0009] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the resource access control method through the computer program.

[0010] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which implements the steps in any of the above resource access control method embodiments when executed by a processor.

[0011] Through the embodiments of the present application, through the trained analysis model, object behavior analysis is performed according to the permission request information, and the behavior analysis results of the target object for each resource to be accessed in the resource set are obtained, which can effectively identify normal behavior and abnormal behavior (such as abuse of authority and internal threat behavior). Once abnormal behavior is detected, the target object's access rights to each resource to be accessed are adjusted according to the behavior analysis results of the target object for each resource to be accessed, thereby dynamically allocating access rights to each resource to be accessed. The difference from the traditional static permission management method is that it only performs permission management based on a single element, avoiding the lag of static permission management, achieving instant adjustment of permissions, preventing unauthorized or suspicious activities, and reducing the risk of data leakage and permission abuse. The above dynamic permission adjustment method is to perform separate behavior analysis and permission control on each resource to be accessed in the resource set, which can achieve refined permission control, effectively respond to abnormal behavior or attacks, and solve the problem of static permission allocation leading to permission abuse or internal threats in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a hardware structure block diagram of an optional resource access control method of an embodiment of the present application;

[0013] Figure 2 is a flowchart of an optional resource access control method according to an embodiment of the present application;

[0014] Figure 3 is a schematic diagram of the structure of an optional terminal device according to an embodiment of the present application;

[0015] Figure 4 is a structural diagram of an optional analysis model according to an embodiment of the present application;

[0016] Figure 5 is a training flow chart of an optional analysis model according to an embodiment of the present application;

[0017] Figure 6 is a structural block diagram of an optional resource access control device according to an embodiment of the present application;

[0018] Figure 7 It is a structural block diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] According to one aspect of an embodiment of the present application, a resource access control method is provided. Optionally, in this embodiment, the resource access control method can be applied to Figure 1 In the hardware environment composed of the terminal device 102 and the server 104 shown in FIG. Figure 1 As shown, the server 104 is connected to the terminal device 102 via a network, and can be used to provide services (such as application services, etc.) for the terminal or a client installed on the terminal. A database can be set on the server or independently of the server to provide data storage services for the server 104. Cloud computing and / or edge computing services can be configured on the server or independently of the server to provide data computing services for the server 104.

[0022] The network may include but is not limited to at least one of the following: wired network, wireless network. The wired network may include but is not limited to at least one of the following: wide area network, metropolitan area network, local area network, and the wireless network may include but is not limited to at least one of the following: WIFI, Bluetooth. The terminal device 102 may not be limited to a PC, a mobile phone, a tablet computer, or other devices.

[0023] Current permission management technologies such as role-based access control (RBAC) and attribute-based access control (ABAC) usually rely on static permission settings and are difficult to adapt to instant changes in object behavior. To solve the above problems, the embodiments of the present application adopt an AI-based dynamic permission management method. Compared with traditional static rules and policies, AI-based dynamic permission management identifies threats and anomalies by learning a large amount of information and behavior patterns of objects. It can detect subtle abnormal behaviors, complex attack patterns and internal threats better than systems that rely solely on predefined rules (such as traditional SIEM), reduce the risk of false positives and missed reports, and can dynamically adjust permission policies based on real-time behavior data, providing higher flexibility and security.

[0024] The resource access control method of the embodiment of the present application can be executed by the terminal device 102, or can be executed by the server 104 and the terminal device 102 together. Taking the resource access control method of the embodiment executed by the terminal device 102 as an example, Figure 2 is a flow chart of an optional resource access control method according to an embodiment of the present application, such as Figure 2 As shown, the process of the method may include the following steps:

[0025] Step S202, obtaining permission request information of the target object; the permission request information is used to request access to a resource set, and the resource set includes a plurality of to-be-accessed resources that the target object desires to access.

[0026] The target object refers to the entity that requests to access the system resources of the terminal device or perform specific operations. This entity can be a user of the system (such as an employee, customer, external partner, etc.) or a component or service inside the terminal device (such as an application requesting to access a database).

[0027] Permission request information is the signal or data sent by the target object when it requests access to a specific resource. Permission request information usually includes the identity of the requester, the resource identifier requested for access, the type of access requested (such as read, write, execute), the time of the request, geographic location information, device information used, etc. Permission request information is used to analyze the context and purpose of the request to determine whether and under what conditions the requester should be granted access rights.

[0028] Resource set refers to a collection of one or more resources to be accessed, which can be data files, databases, applications, system functions, etc. A resource set can be a combination of all resources required to perform a specific task or operation. For example, completing a financial report may require access to a financial database, report template files, and data processing software, which constitute a resource set.

[0029] A resource waiting to be accessed refers to a single resource in a resource collection waiting to be accessed. Each resource waiting to be accessed has its own specific permission settings, which control who can access it and how to access it.

[0030] Optionally, the terminal device monitors the permission request information of the target object in real time, and collects data including the object ID, requested resources, access time, geographic location, device used, etc.

[0031] Step S204, using the trained analysis model, perform object behavior analysis based on the permission request information to obtain the behavior analysis results of the target object for each of the multiple resources to be accessed, and adjust the target object's access rights to each resource to be accessed based on the behavior analysis results of the target object for each resource to be accessed.

[0032] Among them, the analysis model is an artificial intelligence-based model trained by a machine learning algorithm and used to analyze object behavior and request patterns. The analysis model will learn normal behavior patterns and abnormal behavior characteristics, and can determine whether the request conforms to the known behavior pattern based on real-time permission request information, thereby identifying potential anomalies or security risks, and adjusting the target object's access rights to each resource to be accessed based on the behavior analysis results of the target object for each resource to be accessed. The analysis model can be an object statistical model, regression model, or neural network established using a machine learning algorithm. The trained and verified analysis model can be directly deployed and applied to monitor the behavior of the target object in real time and dynamically adjust permissions.

[0033] The behavior analysis result is the intermediate result obtained after the analysis model processes the permission request information, which reflects the degree of match between the target object's access request and the established normal behavior pattern. For example, the behavior analysis result can be the score of abnormal behavior, the determination of whether it is abnormal, the type of abnormal behavior (such as abuse of authority, access at abnormal times, etc.), and the risk level of abnormal behavior. If the match is low, it may indicate abnormal behavior or potential risk. If the behavior analysis result represents an abnormality, the analysis model adjusts the target object's access rights to the resource to be accessed based on the current network environment information, the resource information of the resource to be accessed, and the basic object information of the target object. Among them, the access rights adjusted by the analysis model can be any of the following: allowing access, denying access, reducing the permission level, freezing access, adding additional verification, etc.

[0034] Optionally, the terminal device inputs the permission request information into a trained analysis model, which extracts key features from the permission request information, such as the object's historical behavior, access frequency, access time, etc. The analysis model analyzes the normality of the current permission request information based on the patterns learned from historical data, and obtains behavioral analysis results, indicating the degree of abnormality or risk level of the request; the analysis model determines whether access permissions need to be adjusted based on predetermined anomaly detection thresholds and rules. If it is an abnormal request, the analysis model will immediately adjust the target object's access permissions to specific resources, such as lowering the permission level, freezing access, adding additional verification steps, etc. If it is a normal request, the analysis model outputs the original access permissions of the target object.

[0035] In some embodiments, Figure 3 FIG. 1 is a schematic diagram of the structure of a terminal device in an embodiment. Figure 3 The terminal device includes an information and behavior analysis module, a dynamic authority adjustment module, an alarm module, an audit module, and a user interface module.

[0036] Among them, the information and behavior analysis module refers to an AI-based intelligent analysis module used for data collection, model updating and object behavior monitoring. It collects object information and behavior, such as object identity information, object behavior logs, access request records, context information, resource attributes, security event logs, object roles and permissions, historical behavior data, system configuration policies, etc., and cleans, integrates and standardizes the collected data. It then extracts and selects behavior-based features, behavior pattern features, context features and abnormal features, and then uses machine learning algorithms to establish analysis models. The trained and verified analysis models can be directly deployed and applied for real-time monitoring of object behavior and dynamic adjustment of permissions.

[0037] The dynamic permission adjustment module refers to an AI-based intelligent policy adjustment module, which is used to make dynamic adjustments to the current object permissions based on the information reported by the information and behavior analysis module and the previous permission policy of this object, such as triggering permission downgrade or temporary freezing, and reporting information to provide data sources for the alarm audit module and user interface module.

[0038] The alarm module is used to define alarm rules and response strategies, set alarm types and alarm thresholds, provide alarm rules and response strategies, and serve as the communication hub of the module to send notifications to the user interface and audit module. After the alarm is triggered, the alarm message will be notified to relevant personnel via email, SMS, system messages, etc.

[0039] The audit module is used to collect and store audit data, such as login logs, access logs, permission change logs, object access time, access content, operation results, security events in the system, etc., and conduct audit analysis to generate audit reports containing detailed records of abnormal behavior, handling measures and results to identify potential security issues or violations.

[0040] The user interface module includes an administrator console interface and a user feedback interface. The administrator console interface can view security events and alarms and policy adjustment information issued by the system. The user feedback interface is used to provide users with a communication and feedback channel.

[0041] Specifically, the information and behavior analysis module monitors the target object information and behavior in real time, obtains the alarm rules of the alarm module in real time, makes a comprehensive judgment on the current behavior of the target object, and issues an early warning to the dynamic strategy module when abnormal behavior is detected. The dynamic strategy module makes a preliminary judgment based on the judgment basis, target object behavior, and current strategy provided by the information and behavior module. After confirming the abnormal behavior, the corresponding strategy of the comprehensive alarm module processes the current behavior, such as reducing the target object's authority or freezing the target object, and sends the current abnormal behavior and the processing that has been made to the alarm module. After receiving the alarm information, the alarm module pushes prompt information to the administrator console and user interface, and the administrator can handle it appropriately based on the information; at the same time, the alarm module pushes the current security event to the audit module and marks it. The audit module collects system-related data, conducts audit analysis regularly, and generates audit reports.

[0042] The above-mentioned AI-based dynamic permission management method can more effectively cope with modern complex security challenges. It not only improves the adaptability and security of the system, but also provides more refined control and stronger auditing capabilities, making the AI-based dynamic permission management method have obvious advantages in protecting information systems, responding to internal threats and meeting compliance requirements.

[0043] Step S206: Control the target object's access to the resource set according to the target object's access rights to each resource to be accessed.

[0044] Optionally, the terminal device dynamically controls the target object's access to the resource set according to the adjusted access rights of each resource to be accessed.

[0045] For example, the terminal device allows the target object to access the resource set access permission to represent the resource to be accessed that is allowed to be accessed, and denies the target object to access the resource set access permission to represent the resource to be accessed that is denied to be accessed.

[0046] For example, the terminal device allows the target object to access the resources to be accessed, and the centralized access rights represent the resources to be accessed that are allowed to be accessed. For the resources to be accessed with other access rights, the target object is required to perform additional identity authentication or authorization confirmation, such as entering a one-time password, biometric verification, answering security questions, etc., and the target object is allowed to access the resources to be accessed that have passed the additional verification.

[0047] For example, the terminal device may also allow the target object to access all the resources to be accessed in the resource set when the access rights of most of the resources to be accessed in the resource set are to allow access.

[0048] For example, the terminal device can also mark key resources in the resource set. Key resources refer to resources whose access permissions in the resource set must be allowed access. Only when the access permissions of key resources are allowed access can other resources to be accessed in the resource set be accessed; if the access permissions of key resources are other permissions except allowed access, even if the access permissions of other resources to be accessed in the resource set are allowed access, any resources to be accessed in the resource set cannot be accessed.

[0049] Through the above steps S202 to S206, the object behavior analysis is performed according to the permission request information through the trained analysis model, and the behavior analysis results of the target object for each resource to be accessed in the resource set are obtained, which can effectively identify normal behavior and abnormal behavior (such as abuse of authority and internal threat behavior). Once abnormal behavior is detected, the target object's access rights to each resource to be accessed are adjusted according to the behavior analysis results of the target object for each resource to be accessed, thereby dynamically allocating access rights to each resource to be accessed. The difference from the traditional static permission management method is that the permission management is only based on a single element, avoiding the lag of static permission management, achieving instant adjustment of permissions, preventing unauthorized or suspicious activities, and reducing the risk of data leakage and permission abuse. The above dynamic permission adjustment method is to perform separate behavior analysis and permission control on each resource to be accessed in the resource set, which can achieve refined permission control, effectively respond to abnormal behavior or attacks, and solve the problem of static permission allocation leading to permission abuse or internal threats in related technologies.

[0050] In an exemplary embodiment, the permission request information includes resource information corresponding to each resource to be accessed, object basic information, network environment information, and historical access information and object behavior information of the target object to each resource to be accessed.

[0051] The resource information corresponding to each resource to be accessed refers to a detailed description of each resource to be accessed, for example, the resource information includes the resource type, sensitivity, importance and minimum permission level required for the resource to be accessed.

[0052] Object basic information refers to the basic attributes of the target object. For example, object basic information includes the object's identity, role, permission level, department, and historical behavior pattern. For system components, object basic information includes component type, version, function, and other information.

[0053] Network environment information refers to the network conditions under which the target object accesses the resource to be accessed. For example, network environment information includes the time, location, device information, network environment, etc. of the permission request information.

[0054] The historical access information of the target object to each resource to be accessed refers to the target object's past access records to each resource to be accessed. For example, the historical access information includes the target object's historical access records, security time, etc.

[0055] The target object's object behavior information for each resource to be accessed refers to the behavior characteristics of the target object. Object behavior information can be extracted from behavior logs and behavior data. For example, object behavior information includes the specific operation type (read, write, delete) of the permission request information initiated by the target object, the frequency of the request (whether the same resource is requested multiple times in a short period of time), and whether it is abnormal (whether there is a detailed deviation from the normal behavior).

[0056] In some embodiments, Figure 4 is a structural diagram of an analysis model in an embodiment, such as Figure 4 As shown, the analysis model includes an abnormal behavior recognition model.

[0057] Among them, the abnormal behavior recognition model refers to a machine learning model or algorithm used to identify and classify abnormal models in object behavior. The abnormal behavior recognition model can detect behaviors that deviate from the normal model by learning and understanding the characteristics and rules of normal behavior, thereby discovering security threats or illegal operations. In the embodiment of the present application, the abnormal behavior recognition model first needs to learn and establish a statistical model of the normal behavior of the object through a large amount of historical data. The historical data may include the object login time, operation frequency, type of access resources, operation type (read, write, delete, etc.), network environment information (such as IP address, device type), etc. The abnormal behavior recognition model will analyze the historical data, identify the habits and rules of specific objects, and establish a "behavioral baseline". When it is detected that the object operation is significantly different from the previously established behavioral baseline, or shows potential signs of malicious activity (such as frequent attempts to access highly sensitive resources, operations at abnormal times, access initiated from uncommon geographical locations, etc.), the abnormal behavior recognition model will mark the abnormal behavior.

[0058] In some embodiments, object behavior analysis is performed according to permission request information using a trained analysis model to obtain a behavior analysis result of the target object on each of the multiple resources to be accessed, including the following steps:

[0059] 1. Extract the basic permission characteristics of the target object for each resource to be accessed from the basic object information corresponding to each resource to be accessed; extract the behavior characteristics of the target object for each resource to be accessed from the object behavior information of the target object for each resource to be accessed; extract the context characteristics of the target object for each resource to be accessed from the resource information, network environment information corresponding to each resource to be accessed and the historical access information of the target object for each resource to be accessed; the context characteristics of the target object for each resource to be accessed represent the network environment required for the target object to access each resource to be accessed, the resource attributes of each resource to be accessed and the historical access records of the target object.

[0060] Among them, basic permission features refer to permission-related features extracted from the basic object information of the target object, including the role, permission level, department, etc. of the target object, which are used to characterize the target object's access qualifications or permission basis for specific resources.

[0061] Behavioral characteristics refer to the characteristics obtained from the object behavior information of the target object for each resource to be accessed, such as operation type (read, write, delete), operation frequency, operation time, operation sequence, etc., which reflect the behavioral habits and patterns of the target object.

[0062] Contextual features refer to the features extracted by combining resource information, network environment information, and historical access information of the target object to describe the environmental conditions and historical background when the target object accesses each resource to be accessed. Specifically, they include the network location, device type, resource attributes, and analysis results of historical access records when accessing resources.

[0063] Optionally, the terminal device obtains permission request information initiated by the target object, the permission request information including resource information corresponding to each resource to be accessed, object basic information, network environment information, and historical access information and object behavior information of the target object for each resource to be accessed, cleans, integrates, and standardizes the permission request information, and extracts basic permission features of the target object for each resource to be accessed from the object basic information corresponding to each resource to be accessed; extracts behavior features of the target object for each resource to be accessed from the object behavior information of the target object for each resource to be accessed; and extracts context features of the target object for each resource to be accessed from the resource information corresponding to each resource to be accessed, network environment information, and historical access information of the target object for each resource to be accessed.

[0064] 2. Through the trained abnormal behavior recognition model, based on the basic permission characteristics, context characteristics and behavior characteristics of the target object for each resource to be accessed, the behavior of the target object for each resource to be accessed is analyzed to obtain the behavior analysis results of the target object for each resource to be accessed.

[0065] Alternatively, if Figure 4 As shown, the terminal device inputs the target object's basic permission features, context features, and behavior features for each resource to be accessed into the trained abnormal behavior recognition model. The abnormal behavior recognition model analyzes the input feature vector in real time, and calculates the target object's behavior score or probability for each resource to be accessed through internal weight adjustment and pattern matching to determine the normality of the behavior; when the abnormal behavior score output by the abnormal behavior recognition model exceeds the preset threshold, the abnormal behavior recognition model identifies the behavior as abnormal behavior, and outputs the target object's behavior analysis results for each resource to be accessed, including the score of the abnormal behavior, the determination of whether it is abnormal, the type of abnormal behavior (such as abuse of authority, access at abnormal times, etc.), and the risk level of the abnormal behavior.

[0066] Through this embodiment, by considering the basic permission characteristics, context characteristics and behavior characteristics of the target object, a personalized security policy can be generated for each target object. That is, when different target objects access the same resource, they may face different access controls according to their behavior patterns and network environments, thereby improving the pertinence and effectiveness of the security policy.

[0067] In an exemplary embodiment, Figure 4 As shown, the analysis model also includes a permission adjustment model.

[0068] Among them, the permission adjustment model is a machine learning model or algorithm used to make intelligent decisions on changes to the access rights of target objects. The permission adjustment model automatically adjusts the access rights of target objects based on the real-time behavior analysis results of the target objects, historical permission usage, security policies, and other relevant factors to enhance security and adapt to the dynamic security environment. Specifically, the permission adjustment model receives the behavior analysis results from the abnormal behavior recognition model, and combines the basic permission features, context features, and behavior features of the target object to calculate in real time whether the current permission status needs to be adjusted, as well as the specific method of adjustment. For example, if the model determines that the behavior pattern and context information of the target object show a high risk, it may recommend immediately reducing the access rights of the target object or suspending the permissions for certain sensitive operations.

[0069] In some embodiments, the permission adjustment model can also determine the magnitude and duration of permission adjustments based on built-in policies and rules. For example, for low-risk abnormal behavior, the model may only add additional verification steps; while for high-risk situations, the model may recommend immediately freezing object access rights until manual review confirms that they are correct.

[0070] In some embodiments, adjusting the target object's access rights to each resource to be accessed according to the behavior analysis result of the target object on each resource to be accessed includes:

[0071] 1. For a first resource to be accessed whose behavior is characterized by normal behavior as indicated by the behavior analysis result, based on the basic permission characteristics of the target object to the first resource to be accessed, adjusting the access permission of the target object to the first resource to be accessed.

[0072] The first resource to be accessed refers to a resource that is judged as a normal behavior by the abnormal behavior recognition model based on the behavior analysis results. For the first resource to be accessed, the permission adjustment model is mainly based on the basic permission characteristics of the target object, and usually does not impose strict restrictions on access rights.

[0073] Optionally, for the first resource to be accessed, the terminal device uses a permission adjustment model to evaluate whether the current permission setting is reasonable and whether it needs to be optimized or adjusted based on the basic permission characteristics of the target object to the first resource to be accessed (such as object role, permission level, etc.). For example, if the target object attempts to access a resource with lower sensitivity, and the behavior analysis results show that its behavior pattern is normal, the permission adjustment model confirms that its access rights do not need to be changed, or simplifies the verification process while ensuring safety.

[0074] 2. For the second resource to be accessed whose behavior is characterized by abnormal behavior as indicated by the behavior analysis results, the permission adjustment result of the second resource to be accessed is obtained through the trained permission adjustment model based on the basic permission characteristics, context characteristics and behavior characteristics of the target object for the second resource to be accessed.

[0075] The second resource to be accessed refers to a resource that is judged as abnormal by the abnormal behavior recognition model based on the behavior analysis results, and may involve high-risk operations or access. For the second resource to be accessed, the permission adjustment model comprehensively considers the basic permission characteristics, context characteristics, and behavior characteristics of the target object to adjust the access rights in a more comprehensive and intelligent way.

[0076] The permission adjustment result refers to the permission change suggestion given by the permission adjustment model after analyzing the access behavior of the second resource to be accessed.

[0077] Optionally, for the second resource to be accessed, the terminal device uses a trained permission adjustment model to perform an in-depth analysis of the basic permission characteristics (object role, permission level, etc.), context characteristics (access time, geographic location, device type, etc.) and behavioral characteristics (operation frequency, operation type, operation history, etc.) of the second resource to be accessed based on the target object, and calculates a permission adjustment result, such as restricting access, adding verification steps, temporarily freezing permissions, etc.

[0078] 3. Adjust the access permission of the second resource to be accessed according to the permission adjustment result of the second resource to be accessed.

[0079] Optionally, the terminal device adjusts the target object's access rights to the second resource to be accessed according to the permission adjustment result for the second resource to be accessed output by the permission adjustment model. For example, if the permission adjustment model recommends restricting access, the terminal device modifies the access control list of the resource accordingly to block or restrict the target object's access.

[0080] Through this embodiment, for the first resource to be accessed that is identified as normal behavior, the permission setting is dynamically optimized based on the basic permission characteristics of the target object to ensure the accuracy and efficiency of permission allocation, while reducing obstacles to the normal work process of legitimate target objects. For the second resource to be accessed that is identified as abnormal behavior, the basic permission characteristics, context characteristics and behavior characteristics are comprehensively analyzed through the permission adjustment model, and an immediate response can be made, such as permission downgrade, temporary freezing of access, etc., to effectively prevent potential internal abuse or external attacks and improve the security protection capabilities of the system.

[0081] In an exemplary embodiment, the permission adjustment result output by the permission adjustment model includes the confidence level of the permission adjustment model.

[0082] Among them, the confidence of the permission adjustment model is used to measure the degree of certainty or reliability of the permission adjustment model's suggestions for adjusting the access rights of the target object. The confidence reflects the degree of confidence of the permission adjustment model in the current analysis results. If the confidence is high, it means that the permission adjustment model has a high degree of certainty in determining that the behavior of the target object is abnormal (for the second resource to be accessed) or normal (for the first resource to be accessed), so the proposed permission adjustment suggestions (such as downgrading permissions, freezing access, or optimizing permissions) should be considered reliable and implemented first.

[0083] In some embodiments, adjusting the access permission of the second resource to be accessed according to the permission adjustment result of the second resource to be accessed includes:

[0084] A target preset range in which the result of the permission adjustment of the second resource to be accessed is located is determined from multiple preset ranges; each of the multiple preset ranges corresponds to a confidence interval, and each preset range corresponds to an access permission; according to the access permission corresponding to the target preset range, the access permission of the second resource to be accessed is adjusted so that the access permission of the second resource to be accessed is consistent with the access permission corresponding to the target preset range.

[0085] Among them, multiple preset ranges refer to multiple confidence intervals obtained by dividing the confidence output of the permission adjustment model. Each preset range corresponds to a confidence interval, and each preset range corresponds to a permission adjustment suggestion, that is, each preset range corresponds to an access right. For example, a preset range with a confidence interval of 0.5-0.7 means that the permission adjustment result with a confidence level in the confidence interval is a low-risk permission adjustment suggestion. If the access right corresponding to the preset range is to reduce the access right, the permission adjustment result of the confidence interval is to reduce the access right.

[0086] The target preset range refers to a preset range in which the confidence level of the permission adjustment result of the second resource to be accessed is located among multiple preset ranges.

[0087] Optionally, the terminal device pre-sets multiple preset ranges, each preset range corresponds to a confidence interval, and each preset range corresponds to an access permission. The terminal device obtains the permission adjustment result of the second resource to be accessed output by the permission adjustment model, compares the confidence in the permission adjustment result of the second resource to be accessed with the multiple preset ranges, determines the target preset range in which the confidence in the permission adjustment result of the second resource to be accessed is located from the multiple preset ranges, and adjusts the access permission of the second resource to be accessed according to the access permission corresponding to the target preset range, so that the access permission of the second resource to be accessed is consistent with the access permission corresponding to the target preset range.

[0088] Through this embodiment, multiple preset ranges are preset according to the severity and type of different abnormal behaviors, and different degrees of permission adjustment measures are adopted for each preset range. Compared with the traditional single static permission management strategy, more refined permission control is achieved, which can more accurately respond to security threats. Furthermore, by mapping the confidence of the permission adjustment result to the target preset range, and determining the most appropriate permission adjustment suggestion based on the access rights corresponding to the target preset range, in the face of new or unknown abnormal behaviors, permissions can be adjusted quickly, response time can be reduced, and security can be improved.

[0089] In an exemplary embodiment, the permission adjustment result output by the permission adjustment model includes a permission category label.

[0090] Among them, the permission category label refers to a classification identifier assigned by the permission adjustment model to a specific access request or resource access behavior after analyzing the object behavior and context information. The permission category label can be used to distinguish between normal and abnormal object behavior, as well as different types or risk levels of abnormal behavior. For example, the permission adjustment model may output permission category labels of different categories such as "normal access", "suspicious login", and "high-risk operation". Each permission category label represents a permission category, and each permission category label corresponds to a preset permission adjustment policy. For example, the "normal access" label may correspond to maintaining existing permissions or slightly optimizing policies, while the "high-risk operation" label may trigger more stringent permission control measures such as permission downgrade and temporary access freeze. The permission category labels output by the permission adjustment model can directly guide the terminal device to take appropriate actions.

[0091] In some embodiments, adjusting the access permission of the second resource to be accessed according to the permission adjustment result of the second resource to be accessed includes:

[0092] According to the target permission category label in the permission adjustment result of the second resource to be accessed, the access permission of the second resource to be accessed is adjusted so that the access permission of the second resource to be accessed is consistent with the permission category corresponding to the target permission category label.

[0093] Optionally, the terminal device obtains the permission adjustment result of the second resource to be accessed output by the permission adjustment model, and adjusts the access rights of the second resource to be accessed according to the permission adjustment policy indicated by the target permission category label in the permission adjustment result of the second resource to be accessed, so that the access rights of the second resource to be accessed are consistent with the permission category corresponding to the target permission category label.

[0094] Through this embodiment, permission adjustment strategies are classified using permission category labels. Different from the traditional static permission allocation of a single element, this classification makes permission management more refined and can dynamically adjust access rights in real time according to the nature and potential risks of the behavior, thereby quickly reducing potential harm when attacks or abnormal behaviors occur.

[0095] In an exemplary embodiment, controlling the target object's access to a resource set according to the target object's access rights to each resource to be accessed includes:

[0096] 1. According to the target object's access rights to each resource to be accessed, multiple resources to be accessed in the resource set are divided into first-category resources and second-category resources; the first-category resources include resources to be accessed that are allowed to be accessed by multiple access rights; the second-category resources include resources to be accessed that are denied to be accessed by multiple access rights.

[0097] Optionally, for each to-be-accessed resource in the resource set, the terminal device classifies the to-be-accessed resources for which access is permitted by the access permission representation in the resource set into the first category of resources, and classifies the to-be-accessed resources for which access is denied by the access permission representation in the resource set into the second category of resources.

[0098] 2. Determine the proportion of the number of resources to be accessed in the first category of resources in the resource set. When the proportion is greater than or equal to the preset proportion, allow the target object to access each resource to be accessed in the resource set; when the proportion is less than the preset proportion, deny the target object access to each resource to be accessed in the resource set.

[0099] The preset ratio refers to a preset ratio threshold used to determine whether the target object can access all resources in the resource set.

[0100] Optionally, the terminal device calculates the ratio of the number of first-category resources to the total number of resources in the resource set, and sets a ratio threshold (i.e., preset ratio) for determining the target object's access to the resource set, and compares the ratio of the first-category resources with the preset ratio. If the ratio of the first-category resources is greater than or equal to the preset ratio, the terminal device determines that the target object's access behavior is mainly a safe behavior, and therefore allows the target object to access all resources in the resource set, even if some second-category resources are included. On the contrary, if the ratio of the first-category resources is less than the preset ratio, it means that the target object's access behavior has a high proportion of high-risk behaviors, and the terminal device will deny the target object access to any resources in the resource set to ensure overall security.

[0101] Through this embodiment, the resources in the resource set are divided into first-category resources and second-category resources, the proportion of the first-category resources in the resource set is determined, and compared with the preset proportion. Whether to allow the target object to access all resources in the resource set can be determined by risk quantification. When the proportion of the first-category resources is greater than or equal to the preset proportion, it is considered that the current risk is low and the access permission can be relaxed. Otherwise, it is considered that the current risk is high and the target object is denied access to the resource set. This can effectively prevent the abuse of permissions in high-risk situations.

[0102] In an exemplary embodiment, the training method of the analysis model includes the following steps:

[0103] 1. Obtain multiple training samples; each of the multiple training samples includes a label and historical permission request information of a reference object, the historical permission request information is used to request access to a historical resource set, and the historical resource set includes multiple historical access resources of the reference object's historical access; the label in each training sample is used to mark the association between the historical access rights of each historical access resource in the multiple historical access resources and the object behavior.

[0104] The training sample refers to the data set used to train the model. The training sample contains the information that the model needs to learn so that it can perform specific tasks (such as classification, prediction, etc.). The training sample is used to train a model that can predict or evaluate the relationship between the behavior of the reference object and the historical access rights.

[0105] The reference object refers to the entity that requests to access the system resources of the terminal device or perform a specific operation. This entity can be a user of the system (such as an employee, customer, external partner, etc.) or a component or service inside the terminal device (such as an application requesting to access a database). The reference object and the target object can refer to the same object or different objects.

[0106] Historical permission request information is the historical signal or historical data sent by the reference object when requesting access to a specific resource. Historical permission request information usually includes resource information corresponding to each historical access resource, object basic information, network environment information, and historical access information and object behavior information of the reference object for each historical access resource. Historical permission request information is used to analyze the context and purpose of the request to determine whether and under what conditions the requester should be granted access rights.

[0107] A historical resource set refers to a collection of one or more historical access resources, which can be data files, databases, applications, system functions, etc. A historical resource set can be a combination of all resources required to perform a specific task or operation. For example, completing a financial report may require access to a financial database, report template files, and data processing software, which constitute a resource set.

[0108] Historical access resources refer to a single resource that is waiting to be accessed. Each historical access resource has its own specific permission settings, which control who can access it and how to access it.

[0109] A label refers to a known result or classification associated with each training sample, and is used to annotate the association between the historical access rights and the object behavior of each historical access resource in multiple historical access resources, that is, to indicate which resource access rights are associated with specific behavior patterns.

[0110] Historical access permissions refer to the permission level requested by the reference object when accessing historical resources. Different resources may require different permission levels to access, such as read-only permission, read-write permission, etc.

[0111] Optionally, Figure 5 is a training flow chart of an analysis model in one embodiment, such as Figure 5 As shown, the terminal device collects historical permission request information of the reference object and historical access rights of each historical access resource requested by the historical permission request information. The historical permission request information usually includes resource information corresponding to each historical access resource, object basic information, network environment information, and historical access information and object behavior information of the reference object for each historical access resource. Based on the historical access rights of each historical access resource requested by the historical permission request information, the terminal device generates a label for marking the association between the historical access rights of each historical access resource and the object behavior. The terminal device generates a training sample based on a historical permission request information and the corresponding label, and obtains multiple training samples by the same method.

[0112] 2. Perform object behavior analysis based on the historical permission request information in each training sample through the analysis model to be trained, obtain the behavior analysis results of the reference object for each historical access resource in each training sample, and output the access rights of the reference object to each historical access resource in each training sample based on the behavior analysis results of the reference object for each historical access resource in each training sample.

[0113] Alternatively, if Figure 5As shown, the terminal device performs data preprocessing on the historical permission request information, specifically including data cleaning, data conversion and data segmentation processing, to obtain the preprocessed historical permission request information, and performs feature extraction on the preprocessed historical permission request information, specifically including selection, construction and encoding processing, to obtain the basic permission features, context features and behavior features of the reference object for each historical access resource, and input the basic permission features, context features and behavior features of the reference object for each historical access resource into the analysis model to be trained. The analysis model is trained using a supervised learning algorithm, specifically, the analysis model analyzes the behavior of the reference object for each historical access resource based on the basic permission features, context features and behavior features of the reference object for each historical access resource, and obtains the behavior analysis results of the reference object for each historical access resource. The analysis model determines whether the access rights need to be adjusted according to the predetermined anomaly detection threshold and rules. If it is an abnormal request, the analysis model will immediately adjust the target object's access rights to a specific resource, such as reducing the permission level, freezing access, adding additional verification steps, etc. If it is a normal request, the analysis model outputs the original access rights of the target object.

[0114] 3. According to the difference between the access rights of the reference object to each historical access resource in each training sample and the label of each training sample, the model parameters of the analysis model are adjusted until the training stop condition is met to obtain a trained analysis model.

[0115] Alternatively, if Figure 5 As shown, the terminal device selects accuracy, precision and MSE (mean square error) as evaluation indicators, determines the difference between the access rights of the reference object to each historical access resource in each training sample and the label of each training sample, evaluates the performance of the analysis model based on the difference, tries different hyperparameter combinations through methods such as GridSearch (grid search) to find the hyperparameter settings that optimize the model performance, and continuously adjusts the model parameters and possible feature selection / engineering according to the evaluation results to gradually optimize the performance of the model, repeats the above training, evaluation and adjustment steps until the training stop condition is met (such as the difference is less than the error threshold or the number of iterations reaches the preset maximum number of iterations), obtains multiple trained analysis models, and uses weighted averaging or stacking (stacking) and other technologies to process multiple trained analysis models to obtain the final trained analysis model. The trained analysis model is deployed in practical applications to perform tasks such as object behavior prediction and classification.

[0116] Through this embodiment, by collecting and analyzing the historical permission request information of the reference object, the analysis model can learn the patterns and trends of the object's behavior, and can effectively respond to abnormal behavior or attacks. By predicting the reference object's access rights to each historically accessed resource through the analysis model, more refined permission management can be achieved. This means that only when the object needs to access a certain resource will it be granted the corresponding permission, thereby reducing the risk of permission abuse.

[0117] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0118] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware server, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM (Read-Only Memory) / RAM (Random Access Memory), a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0119] According to another aspect of the embodiments of the present application, a resource access control device is also provided, which is used to implement the resource access control method provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0120] Figure 6 is a structural block diagram of an optional resource access control device according to an embodiment of the present application, such as Figure 6 As shown, the device may include:

[0121] The request acquisition module 601 is used to acquire permission request information of the target object; the permission request information is used to request access to a resource set, and the resource set includes multiple resources to be accessed that the target object expects to access;

[0122] The permission allocation module 602 is used to perform object behavior analysis based on the permission request information by using the trained analysis model to obtain the behavior analysis result of the target object on each of the multiple resources to be accessed, and adjust the access permission of the target object on each resource to be accessed according to the behavior analysis result of the target object on each resource to be accessed;

[0123] The access control module 603 is used to control the target object's access to the resource set according to the target object's access rights to each resource to be accessed.

[0124] In an exemplary embodiment, the permission request information includes resource information, object basic information, network environment information, and historical access information and object behavior information of the target object for each resource to be accessed corresponding to each resource to be accessed; the analysis model includes an abnormal behavior recognition model; the permission allocation module 602 is also used to extract the basic permission characteristics of the target object for each resource to be accessed from the object basic information corresponding to each resource to be accessed; extract the behavior characteristics of the target object for each resource to be accessed from the object behavior information of the target object for each resource to be accessed; extract the context characteristics of the target object for each resource to be accessed from the resource information, network environment information and historical access information of the target object for each resource to be accessed corresponding to each resource to be accessed; the context characteristics of the target object for each resource to be accessed represent the network environment required for the target object to access each resource to be accessed, the resource attributes of each resource to be accessed and the historical access records of the target object; through the trained abnormal behavior recognition model, based on the basic permission characteristics, context characteristics and behavior characteristics of the target object for each resource to be accessed, the behavior analysis result of the target object for each resource to be accessed is obtained.

[0125] In an exemplary embodiment, the analysis model also includes a permission adjustment model, and the permission allocation module 602 is also used to adjust the target object's access rights to the first resource to be accessed, based on the target object's basic permission characteristics for the first resource to be accessed, for a first resource to be accessed whose behavior is characterized by normal behavior as a result of the behavior analysis; for a second resource to be accessed whose behavior is characterized by abnormal behavior as a result of the behavior analysis, obtain the permission adjustment result of the second resource to be accessed based on the target object's basic permission characteristics, context characteristics and behavior characteristics for the second resource to be accessed through a trained permission adjustment model; and adjust the access rights of the second resource to be accessed according to the permission adjustment result of the second resource.

[0126] In an exemplary embodiment, the permission adjustment result output by the permission adjustment model includes the confidence of the permission adjustment model; the permission allocation module 602 is also used to determine the target preset range in which the permission adjustment result of the second resource to be accessed is located from multiple preset ranges; each of the multiple preset ranges corresponds to a confidence interval, and each preset range corresponds to an access right; according to the access right corresponding to the target preset range, the access right of the second resource to be accessed is adjusted so that the access right of the second resource to be accessed is consistent with the access right corresponding to the target preset range.

[0127] In an exemplary embodiment, the permission adjustment result output by the permission adjustment model includes a permission category label; the permission allocation module 602 is also used to adjust the access rights of the second resource to be accessed according to the target permission category label in the permission adjustment result of the second resource to be accessed, so that the access rights of the second resource to be accessed are consistent with the permission category corresponding to the target permission category label.

[0128] In an exemplary embodiment, the access control module 603 is also used to divide multiple resources to be accessed in the resource set into first category resources and second category resources according to the target object's access rights to each resource to be accessed; the first category resources include resources to be accessed for which access is allowed by multiple access rights representations; the second category resources include resources to be accessed for which access is denied by multiple access rights representations; determine the proportion of the number of resources to be accessed in the first category of resources in the resource set, and if the proportion is greater than or equal to a preset proportion, allow the target object to access each resource to be accessed in the resource set; if the proportion is less than the preset proportion, deny the target object access to each resource to be accessed in the resource set.

[0129] In an exemplary embodiment, the permission allocation module 602 is also used to obtain multiple training samples; each of the multiple training samples includes a label and historical permission request information of a reference object, the historical permission request information is used to request access to a historical resource set, and the historical resource set includes multiple historical access resources historically accessed by the reference object; the label in each training sample is used to mark the association between the historical access rights of each historical access resource in the multiple historical access resources and the object behavior; through the analysis model to be trained, object behavior analysis is performed according to the historical permission request information in each training sample to obtain the behavior analysis results of the reference object for each historical access resource in each training sample, and according to the behavior analysis results of the reference object for each historical access resource in each training sample, the access rights of the reference object to each historical access resource in each training sample are output; according to the difference between the access rights of the reference object to each historical access resource in each training sample and the label of each training sample, the model parameters of the analysis model are adjusted until the training stop condition is met to obtain a trained analysis model.

[0130] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware, wherein the hardware environment includes a network environment.

[0131] According to another aspect of the embodiments of the present application, a storage medium is further provided. Optionally, in this embodiment, the storage medium can be used to execute the program code of any of the resource access control methods in the embodiments of the present application.

[0132] Optionally, in this embodiment, the storage medium may be located on at least one network device among a plurality of network devices in the network shown in the above embodiment.

[0133] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, which will not be described in detail in this embodiment.

[0134] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a ROM, a RAM, a mobile hard disk, a magnetic disk, or an optical disk.

[0135] According to another aspect of the embodiments of the present application, a computer program product or a computer program is also provided. Optionally, in this embodiment, the computer program product or the computer program includes a computer instruction, and the processor of the computer device reads the computer instruction from the computer readable storage medium, and the processor executes the computer instruction, so that the computer device performs the steps in any of the above method embodiments.

[0136] Optionally, in this embodiment, the computer program product or computer program may be located on at least one network device among a plurality of network devices in the network shown in the above embodiment.

[0137] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, which will not be described in detail in this embodiment.

[0138] According to another aspect of an embodiment of the present application, an electronic device for implementing the above-mentioned resource access control method is also provided. The electronic device may be a smart device, a server, a terminal, or a combination thereof.

[0139] Figure 7 is a structural block diagram of an optional electronic device according to an embodiment of the present application, such as Figure 7As shown, it includes a processor 702, a communication interface 704, a memory 706 and a communication bus 708, wherein the processor 702, the communication interface 704 and the memory 706 communicate with each other through the communication bus 708, wherein,

[0140] Memory 706, used to store computer programs;

[0141] The processor 702 is used to implement the program code of any of the above-mentioned resource access control methods when executing the computer program stored in the memory 706.

[0142] Optionally, the communication bus may be a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 The communication interface is used for communication between the above electronic device and other devices.

[0143] The memory may include RAM, or may include non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0144] As an example, the memory 706 may include but is not limited to each module in the resource access control device. In addition, it may also include but is not limited to other module units in the resource access control device, which will not be described in detail in this example.

[0145] The above-mentioned processor can be a general-purpose processor, which can include but not be limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processing), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0146] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0147] It can be understood by those skilled in the art that Figure 7 The structure shown is for illustration only. The device for implementing the above-mentioned resource access control method may be a terminal device, which may be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, and other terminal devices. Figure 7 The structure of the electronic device is not limited. Figure 7 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 7 Different configurations shown.

[0148] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0149] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0150] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in any one of the above method embodiments.

[0151] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which can include: a flash drive, ROM, RAM, a magnetic disk or an optical disk, etc.

[0152] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0153] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

[0154] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0155] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0156] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution provided in this embodiment.

[0157] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist physically separately, or at least two units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0158] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A resource access control method, characterized in that: include: Get the permission request information of the target object; The permission request information is used to request access to a resource set, where the resource set includes a plurality of to-be-accessed resources that the target object desires to access; Performing object behavior analysis according to the permission request information through the trained analysis model to obtain a behavior analysis result of the target object on each of the multiple resources to be accessed, and adjusting the access permission of the target object on each of the resources to be accessed according to the behavior analysis result of the target object on each of the resources to be accessed; The target object's access to the resource set is controlled according to the target object's access rights to each resource to be accessed.

2. The method according to claim 1, characterized in that The permission request information includes resource information, object basic information, network environment information corresponding to each resource to be accessed, and historical access information and object behavior information of the target object to each resource to be accessed; the analysis model includes an abnormal behavior recognition model; The object behavior analysis is performed according to the permission request information by using the trained analysis model to obtain the behavior analysis result of the target object on each of the multiple resources to be accessed, including: Extract the basic permission characteristics of the target object for each resource to be accessed from the basic object information corresponding to each resource to be accessed; extract the behavior characteristics of the target object for each resource to be accessed from the object behavior information of the target object for each resource to be accessed; extract the context characteristics of the target object for each resource to be accessed from the resource information corresponding to each resource to be accessed, the network environment information and the historical access information of the target object for each resource to be accessed; the context characteristics of the target object for each resource to be accessed represent the network environment required for the target object to access each resource to be accessed, the resource attributes of each resource to be accessed and the historical access records of the target object; Through the trained abnormal behavior recognition model, based on the basic permission characteristics, context characteristics and behavior characteristics of the target object for each resource to be accessed, the behavior of the target object with respect to each resource to be accessed is analyzed to obtain the behavior analysis result of the target object with respect to each resource to be accessed.

3. The method according to claim 2, characterized in that The analysis model further includes a permission adjustment model, wherein the permission adjustment model adjusts the access permission of the target object to each resource to be accessed according to the behavior analysis result of the target object to each resource to be accessed, including: For a first resource to be accessed whose behavior is characterized by a behavior analysis result as normal, adjusting the target object's access rights to the first resource to be accessed based on a basic permission feature of the target object to the first resource to be accessed; For the second resource to be accessed whose behavior is characterized by abnormal behavior as a result of the behavior analysis, obtaining a permission adjustment result for the second resource to be accessed based on the basic permission features, context features, and behavior features of the target object for the second resource to be accessed by using a trained permission adjustment model; The access permission of the second resource to be accessed is adjusted according to the permission adjustment result of the second resource to be accessed.

4. The method according to claim 3, characterized in that The permission adjustment result output by the permission adjustment model includes the confidence of the permission adjustment model; and adjusting the access permission of the second resource to be accessed according to the permission adjustment result of the second resource to be accessed includes: Determining a target preset range in which the permission adjustment result of the second resource to be accessed is located from a plurality of preset ranges; each of the plurality of preset ranges corresponds to a confidence interval, and each of the preset ranges corresponds to an access permission; According to the access permission corresponding to the target preset range, the access permission of the second resource to be accessed is adjusted so that the access permission of the second resource to be accessed is consistent with the access permission corresponding to the target preset range.

5. The method according to claim 3, characterized in that: The permission adjustment result output by the permission adjustment model includes a permission category label; and adjusting the access permission of the second resource to be accessed according to the permission adjustment result of the second resource to be accessed includes: According to the target permission category label in the permission adjustment result of the second resource to be accessed, the access permission of the second resource to be accessed is adjusted so that the access permission of the second resource to be accessed is consistent with the permission category corresponding to the target permission category label.

6. The method according to claim 1, characterized in that The step of controlling the target object's access to the resource set according to the target object's access rights to each resource to be accessed includes: According to the access rights of the target object to each resource to be accessed, the multiple resources to be accessed in the resource set are divided into first-category resources and second-category resources; the first-category resources include multiple resources to be accessed that are permitted to be accessed by access rights representations; the second-category resources include multiple resources to be accessed that are denied to be accessed by access rights representations; Determine the proportion of the number of resources to be accessed in the first category of resources in the resource set, and when the proportion is greater than or equal to a preset proportion, allow the target object to access each resource to be accessed in the resource set; when the proportion is less than the preset proportion, deny the target object access to each resource to be accessed in the resource set.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Acquire multiple training samples; each of the multiple training samples includes a label and historical permission request information of a reference object, the historical permission request information is used to request access to a historical resource set, the historical resource set includes multiple historical access resources historically accessed by the reference object; the label in each training sample is used to mark the association relationship between the historical access permission of each historical access resource in the multiple historical access resources and the object behavior; By means of the analysis model to be trained, object behavior analysis is performed according to the historical permission request information in each training sample to obtain a behavior analysis result of the reference object on each historical access resource in each training sample, and according to the behavior analysis result of the reference object on each historical access resource in each training sample, the access permission of the reference object on each historical access resource in each training sample is output; According to the difference between the access rights of the reference object to each historical access resource in each training sample and the label of each training sample, the model parameters of the analysis model are adjusted until the training stop condition is met to obtain the trained analysis model.

8. A resource access control device, characterized in that: include: A request acquisition module is used to obtain permission request information of the target object; The permission request information is used to request access to a resource set, where the resource set includes a plurality of to-be-accessed resources that the target object desires to access; a permission allocation module, configured to perform object behavior analysis according to the permission request information through a trained analysis model, obtain a behavior analysis result of the target object on each of the multiple resources to be accessed, and adjust the access permission of the target object on each of the resources to be accessed according to the behavior analysis result of the target object on each of the resources to be accessed; The access control module controls the target object's access to the resource set according to the target object's access rights to each resource to be accessed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of any one of the methods of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images