User authority management method and device

Abstract

The invention discloses a user authority management method and device. The method comprises the steps that first user information of a target user and multiple groups of first operation information for processing multiple services in a target time period are acquired, and each service corresponds to one group of operation information; determining a first user attribute feature and a first security attribute feature set of each group of operation information, wherein the set comprises security attribute features of a plurality of security dimensions; forming a first operation feature set by each first security attribute feature set and the first user attribute feature; analyzing each first operation feature set by using a pre-trained security level classification model to obtain a first security level of each group of operation information; and determining a target security credit score of the target user according to the weight coefficient of each first security level and the quantity of the corresponding operation information, and adjusting the operation authority of the target user accordingly. According to the method and the device, the technical problem that the data security is easily influenced due to the lack of pertinence of user permission management of the current data management system is solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a user authority management method and device. Background Art

[0002] The challenges of big data security management are becoming increasingly prominent, especially in the reasonable allocation of data management and operator permissions, account password security, and operator security awareness and skills. In the big data environment, due to the huge amount of data, diverse types, and high processing complexity, security incidents may be caused by a variety of reasons, including but not limited to accidental misoperation, malicious internal operations, and external attacks. Existing technologies have limitations in personnel operation risk assessment, such as lack of flexibility and intelligence in permission allocation, cumbersome and inefficient security audit processes, and untimely response to security incidents. These problems may lead to security incidents such as data leakage, tampering, and loss, which will have a serious impact on the business operations, reputation, and compliance of enterprises.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a user rights management method and device to at least solve the technical problem that the current data management system lacks pertinence in the management of user rights and is prone to affect data security.

[0005] According to one aspect of an embodiment of the present application, a user authority management method is provided, including: obtaining first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple businesses in a target system within a target time period, wherein one business corresponds to a group of first operation information; determining a first user attribute feature corresponding to the first user information, and determining a first security attribute feature set corresponding to each group of first operation information, and combining each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; analyzing each first operation feature set using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information; determining a target security credit score of the target user based on a weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level; and adjusting the target user's operation authority for the target system based on the target security credit score.

[0006] Optionally, obtaining the first user information of the target user and multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period includes: obtaining the first user information of the target user, wherein the first user information includes at least one of the following: age, gender, position, and operation authority; obtaining multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information.

[0007] Optionally, extracting first user attribute features corresponding to the first user information, and extracting a first security attribute feature set corresponding to each group of first operation information, includes: performing data preprocessing on the first user information and multiple groups of first operation information; extracting the first user attribute features corresponding to the preprocessed first user information; determining multiple target security dimensions based on the system type of the target system, and extracting security attribute features of multiple target security dimensions corresponding to each group of preprocessed first operation information to form a first security attribute feature set, wherein the target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability.

[0008] Optionally, the training process of the security level classification model includes: obtaining second user information of multiple users and multiple groups of second operation information corresponding to each user processing multiple businesses in the target system within multiple time periods, wherein one business corresponds to a group of second operation information; performing data preprocessing on the second user information and multiple groups of second operation information; for each user, extracting the second user attribute features corresponding to the user's second user information, and extracting the second security attribute feature set corresponding to each group of second operation information of the user, and combining each second security attribute feature set with the second user attribute features to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of multiple security dimensions; using all second operation feature sets corresponding to multiple users to train a clustering model to obtain a security level classification model.

[0009] Optionally, a clustering model is trained using all second operation feature sets corresponding to multiple users to obtain a security level classification model, including: constructing multiple clustering models with the same structure, and assigning a K value to each clustering model, wherein the multiple clustering models all use the K-means algorithm, and different clustering models correspond to different K values; for each clustering model, all second operation feature sets are input into the clustering model to determine the operation vector corresponding to each second operation feature set; the clustering model randomly determines K operation vectors as cluster centers according to the corresponding K values, and performs the following iterative process until the algorithm converges: clustering all operation vectors according to the K cluster centers to obtain K clusters; for each cluster, determining multiple operation vectors in the cluster; The center point of the vector is a new cluster center; when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the number of iterations reaches a preset threshold, the algorithm is determined to be converged and the clustering model training is completed; for each trained clustering model, multiple clusters obtained by clustering all operation vectors by the clustering model are determined; for each cluster, the variance of multiple operation vectors in the cluster is determined, and the threshold interval corresponding to the variance is determined from multiple preset threshold intervals, wherein each threshold interval corresponds to a preset security level; for each security level, the number of clusters corresponding to the security level is determined, and the standard deviation of the number of clusters corresponding to each security level is determined; the clustering model with the smallest corresponding standard deviation is determined as the security level classification model.

[0010] Optionally, a first number of abnormal operations of the target user within a target time period is obtained, and a second number of abnormal operations of all users within the target time period is obtained, the ratio of the first number to the second number is determined, and the difference between 1 and the ratio is determined as the security probability tendency of the target user; the weight coefficient corresponding to each first security level is determined from a preset weight coefficient table, and the number of first operation information corresponding to each first security level is normalized; the weight coefficient corresponding to each first security level is used to perform weighted summation on the normalized number of first operation information corresponding to each first security level to obtain a basic security score; the product of the security probability tendency and the basic security score is determined as the target security credit score of the target user.

[0011] Optionally, adjusting the target user's operating authority to the target system based on the target security credit score includes: determining a target operating authority level corresponding to the target security credit score from a preset authority management table, wherein the authority management table stores operating authority levels corresponding to different security credit score intervals, and a larger security credit score interval corresponds to a higher operating authority level; and adjusting the target user's operating authority to the target system based on the target operating authority level.

[0012] According to another aspect of an embodiment of the present application, a user authority management device is also provided, including: an acquisition module, used to acquire first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple businesses in a target system within a target time period, wherein one business corresponds to a group of first operation information; a feature determination module, used to determine the first user attribute feature corresponding to the first user information, and determine the first security attribute feature set corresponding to each group of first operation information, and form each first security attribute feature set and the first user attribute feature into a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; an analysis module, used to analyze each first operation feature set using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information; a scoring module, used to determine a target security credit score of the target user based on a weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level; an adjustment module, used to adjust the target user's operation authority for the target system based on the target security credit score.

[0013] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising: a computer program, wherein the computer program implements the above-mentioned user authority management method when executed by a processor.

[0014] According to another aspect of an embodiment of the present application, an electronic device is further provided, the electronic device comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned user authority management method through the computer program.

[0015] In an embodiment of the present application, a user rights management method is provided. The method further realizes refined management of user rights by obtaining the first user information (such as identity, position, etc.) of the target user and the operation information for multiple businesses within a specific time period, combining multiple security dimension features of user attributes and operation attributes. This rights adjustment mechanism based on security credit score can more accurately match the user's rights and their operation risk level, avoid a one-size-fits-all rights allocation method, and improve the rationality and efficiency of rights management. In addition, a pre-trained security level classification model is used to perform real-time analysis on the user's operation feature set, dynamically evaluate the security level of the operation, and calculate the user's security credit score based on this. This dynamic evaluation mechanism can timely reflect changes in user behavior. , thereby quickly adjusting permissions and enhancing the system's security response capabilities. By quantifying user attribute features and operation attribute features and combining them into an operation feature set, and then using the security level classification model to analyze these features, it is not only possible to identify high-risk operations, but also to distinguish operations of different risk levels through quantitative security level scoring, which is of great significance for security auditing and risk control. In addition, through the weight calculation of security level and number of operations, the target security credit score is obtained. This scoring mechanism establishes a security credit portrait for the user, enabling security managers to implement differentiated permission management strategies based on the user's security credit status, thereby solving the technical problem that the current data management system lacks pertinence in the management of user permissions and is prone to affect data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 is a flowchart of an optional user rights management method according to an embodiment of the present application;

[0018] Figure 2 is a schematic structural diagram of an optional user rights management device according to an embodiment of the present application;

[0019] Figure 3 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] Example 1

[0023] According to an embodiment of the present application, a user authority management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Figure 1 is a flowchart of a user rights management method provided in accordance with an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0025] Step S102, obtaining first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple services in a target system within a target time period, wherein one service corresponds to one group of first operation information;

[0026] Step S104, determining the first user attribute feature corresponding to the first user information, and determining the first security attribute feature set corresponding to each set of first operation information, and combining each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions;

[0027] Step S106, analyzing each first operation feature set using a pre-trained security level classification model to obtain a first security level corresponding to each set of first operation information;

[0028] Step S108, determining a target security credit score of the target user according to a weight coefficient corresponding to each first security level and the amount of first operation information corresponding to each first security level;

[0029] Step S110, adjusting the target user's operating authority to the target system according to the target security credit score.

[0030] The following describes each step of the user rights management method in conjunction with a specific implementation process.

[0031] First, first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple services in a target system within a target time period are obtained, wherein one service corresponds to one group of first operation information. The specific process may take the following steps:

[0032] Obtain the first user information of the target user, wherein the first user information includes at least one of the following: age, gender, position, and operating authority. This information helps to understand the basic background of the user and their role and authority level in the system, and is the basis for building a user security credit portrait; and obtain multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information. This step ensures that the system can fully cover the user's activities in the target system and provide data support for subsequent analysis.

[0033] After obtaining the first user information, determine the first user attribute feature corresponding to the first user information, and determine the first security attribute feature set corresponding to each set of first operation information. The first security attribute feature set includes security attribute features of multiple security dimensions. Each first security attribute feature set and the first user attribute feature are combined into a first operation feature set. The specific steps of this process can be performed in the following manner:

[0034] Data preprocessing is performed on the first user information and multiple groups of first operation information. The preprocessing process may also include filling in missing data, processing of abnormal values, and data conversion, so that data of different formats can be processed uniformly; then, first user attribute features corresponding to the preprocessed first user information are extracted. These features reflect the user's personal attributes, such as age, which may affect his familiarity with new technologies, and position and operation authority, which are directly related to the type and scope of operations that he may perform in the system; then, multiple target security dimensions are determined according to the system type of the target system (such as financial transactions, e-commerce, cloud computing, etc.), wherein the target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authenticatability, data non-repudiation, and data auditability. Different system types may focus on different security dimensions. For example, financial transaction systems may pay more attention to data security and integrity, while cloud computing environments may pay more attention to data availability and auditability. Then, security attribute features of multiple target security dimensions corresponding to each group of preprocessed first operation information are extracted to form a first security attribute feature set. For example, in a financial transaction system, the number of login attempts in the authentication log information and the abnormal transaction records in the transaction log can be used as important features for evaluating data security and integrity. Finally, the extracted first user attribute features are combined with the first security attribute feature set corresponding to each group of first operation information to form a first operation feature set. This set includes user personal attributes and security behavior information in specific business operations, providing a comprehensive analysis perspective for subsequent user risk behavior assessment.

[0035] As an optional implementation, if the target system is used in the field of network security monitoring, the target security dimensions may include: confidentiality, authentication and non-repudiation, availability and auditability, among which: confidentiality is used to ensure access control of sensitive information and prevent unauthorized access; integrity is used to prevent data tampering and ensure the authenticity and accuracy of log records; authentication and non-repudiation are used to track and verify each operation to ensure the traceability and authenticity of the operation; availability is used to ensure access to log data at any time and quickly respond to security incidents; auditability is used to record detailed operation information for post-audit and analysis.

[0036] If the target system is used in the field of financial transactions, the target security dimensions may include: confidentiality, integrity, authentication, non-repudiation and auditability, among which: confidentiality: protect the privacy of transaction and user data, and prevent information leakage; integrity: ensure the accuracy and consistency of transaction data, and prevent data tampering; authentication and non-repudiation: review of operations to ensure the legality and non-repudiation of transactions; auditability: track the transaction process to facilitate supervision and compliance inspections.

[0037] If the target system is used in an e-commerce platform, the target security dimensions may include: confidentiality, authentication, auditability and integrity, among which: confidentiality is used to protect user personal information and transaction records; authentication is used to identify the user's identity and prevent unauthorized access and operation; auditability is used to monitor user behavior and prevent fraud; integrity is used to ensure the accuracy of product information and transaction records.

[0038] If the target system is used in a cloud computing environment, the target security dimensions may include: confidentiality, integrity, and auditability, where: confidentiality is used to protect customer data privacy; integrity is used to ensure the accuracy of cloud service data and operations; auditability is used to record user activities in the cloud environment for management and security review.

[0039] After obtaining the above feature set, each first operation feature set is analyzed using a pre-trained security level classification model to obtain the first security level corresponding to each group of first operation information.

[0040] As an optional implementation, the training process of the security level classification model may take the following steps:

[0041] S1, obtaining second user information of multiple users and multiple sets of second operation information corresponding to each user processing multiple businesses in the target system in multiple time periods, wherein one business corresponds to one set of second operation information;

[0042] S2, performing data preprocessing on the second user information and the multiple sets of second operation information;

[0043] S3, for each user, extract the second user attribute feature corresponding to the second user information of the user, and extract the second security attribute feature set corresponding to each set of second operation information of the user, and combine each second security attribute feature set and the second user attribute feature to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of multiple security dimensions;

[0044] S4, training a clustering model using all second operation feature sets corresponding to multiple users to obtain a security level classification model.

[0045] As an optional implementation, the clustering model is trained using all second operation feature sets corresponding to multiple users to obtain a security level classification model, which can be performed using the following steps:

[0046] S1, construct multiple clustering models with the same structure, and assign a K value to each clustering model, wherein multiple clustering models all use the K-means algorithm, and different clustering models correspond to different K values;

[0047] In order to find the optimal number of clusters, multiple clustering models using the K-means algorithm are created. Each model has the same structure but is assigned a different K value (i.e., a different number of clusters). Different K values ​​will affect the final classification results. By comparing multiple models, the most appropriate K value can be determined.

[0048] S2, for each clustering model, input all second operation feature sets into the clustering model, and determine the operation vector corresponding to each second operation feature set;

[0049] The second operation feature set extracted from the user information and operation data is input into each clustering model, and each feature set is converted into an operation vector, the dimension of which corresponds to the security attribute feature, so that the model can calculate the distance and perform clustering.

[0050] S3, the clustering model randomly determines K operation vectors as cluster centers according to the corresponding K values, and performs the following iterative process until the algorithm converges: cluster all operation vectors according to the K cluster centers to obtain K clusters;

[0051] In each clustering model, K operation vectors are randomly selected as the initial cluster centers. The algorithm calculates the distance between each operation vector and all cluster centers based on the current cluster center, and assigns each operation vector to the cluster with the nearest cluster center. In this way, all operation vectors are divided into K clusters.

[0052] S4, for each cluster, determine the center point of multiple operation vectors in the cluster as a new cluster center;

[0053] S5, when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the number of iterations reaches a preset threshold, it is determined that the algorithm converges and the clustering model training is completed;

[0054] S6, for each trained clustering model, determining a plurality of clusters obtained by clustering all operation vectors by the clustering model;

[0055] S7, for each cluster, determining the variance of multiple operation vectors in the cluster, and determining a threshold interval corresponding to the variance from multiple preset threshold intervals, wherein each threshold interval corresponds to a preset security level;

[0056] The variance of all operation vectors in each cluster relative to the cluster center is calculated. The variance can measure the dispersion of data points in the cluster. The security level corresponding to each cluster can be determined by the variance and the preset threshold range.

[0057] S8, for each security level, determining the number of clusters corresponding to the security level, and determining the standard deviation of the number of clusters corresponding to each security level;

[0058] S9, determining the clustering model with the smallest corresponding standard deviation as the security level classification model.

[0059] The smallest standard deviation means that the distribution of the number of clusters is the most stable, and therefore, the model is the most reliable in classifying users of different security levels.

[0060] After the security level classification model is trained through the above process, the model is used to analyze each set of first operation features to obtain the first security level corresponding to each set of first operation information, and the target security credit score of the target user is determined according to the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level. The process can be performed in the following steps:

[0061] Obtain a first number of abnormal operations of the target user within a target time period, and obtain a second number of abnormal operations of all users within the target time period. Abnormal operations may include but are not limited to high-risk operations, data leakage attempts, unauthorized access, etc., and then determine the ratio of the first number to the second number. The ratio reflects the relative frequency of abnormal operations of the target user, and determine the difference between 1 and the ratio as the security probability tendency of the target user. The closer the security probability tendency value is to 1, the safer the behavior of the target user is, and the lower the frequency of abnormal operations is; determine the weight coefficient corresponding to each first security level from a preset weight coefficient table. The weight coefficient reflects the importance of operations of different risk levels in the calculation of security credit points. The importance of the first security level is determined, and the number of first operation information corresponding to each first security level is normalized to ensure that the difference in the number of operation information under different security levels will not cause an imbalance in the score, and to avoid that the more operations, the higher the score; the weight coefficient corresponding to each first security level is used to weighted sum the normalized number of first operation information corresponding to each first security level to obtain a basic security score; the product of the security probability tendency and the basic security score is determined as the target security credit score of the target user. This score combines the target user's abnormal operation frequency and the operation type risk weight in a specific time period, and can more accurately reflect the user's security credit status.

[0062] According to different security dimensions and scenarios, the weight coefficient can be adjusted to better adapt to changing business needs and security challenges, and by flexibly focusing on different risk factors, a personalized and precise assessment of user behavior risks can be achieved. For example, when the company faces an increased threat of external network attacks, the weight of abnormal behaviors (high risk level) detected by security analysis tools can be increased to more strictly control user permissions; when internal security training becomes an important means to improve the overall security level, the weight of security awareness assessment (low risk level) can be adjusted accordingly to encourage users to actively participate in training and improve security awareness.

[0063] After obtaining the above-mentioned target security credit score, adjusting the target user's operating authority to the target system according to the target security credit score, the process may include the following steps: determining the target operating authority level corresponding to the target security credit score from a preset authority management table, wherein the authority management table stores operating authority levels corresponding to different security credit score intervals, and a larger security credit score interval corresponds to a higher operating authority level; and then adjusting the target user's operating authority to the target system according to the target operating authority level.

[0064] For example, for users with higher scores, their access rights can be appropriately relaxed and the approval process can be simplified; while for users with lower scores, their permissions need to be restricted and audit supervision needs to be strengthened, thereby effectively reducing big data security risks.

[0065] In an embodiment of the present application, a user authority management method is provided. The method obtains the first user information (such as identity, position, etc.) of the target user and the operation information for multiple businesses within a specific time period, and combines multiple security dimension characteristics of user attributes and operation attributes to further achieve refined management of user authority. This authority adjustment mechanism based on security credit scoring can more accurately match the user's authority with his or her operation risk level, avoids a one-size-fits-all authority allocation method, and improves the rationality and efficiency of authority management. In addition, the pre-trained security level classification model is used to perform real-time analysis on the user operation feature set, dynamically evaluate the security level of the operation, and calculate the user's security credit score based on this. This dynamic evaluation mechanism can promptly reflect changes in user behavior, thereby quickly adjusting permissions and enhancing the system's security response capabilities. By quantifying user attribute features and operation attribute features and combining them into an operation feature set, and then using the security level classification model to analyze these features, it is not only possible to identify high-risk operations, but also to distinguish operations of different risk levels through quantitative security level scoring, which is of great significance for security auditing and risk control. In addition, the target security credit score is obtained through weighted calculation of security level and number of operations. This scoring mechanism establishes a security credit portrait for the user, enabling security managers to implement differentiated permission management strategies based on the user's security credit status, thereby solving the technical problem that the current data management system lacks targeted management of user permissions and is prone to affect data security.

[0066] Example 2

[0067] According to an embodiment of the present application, a user rights management device for implementing the user rights management method in embodiment 1 is also provided. Figure 2 As shown, the user rights management device at least includes: an acquisition module 21, a feature determination module 22, an analysis module 23, a scoring module 24 and an adjustment module 25, wherein:

[0068] The acquisition module 21 is used to acquire first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple services in the target system within a target time period, wherein one service corresponds to one group of first operation information;

[0069] The feature determination module 22 is used to determine the first user attribute feature corresponding to the first user information, and determine the first security attribute feature set corresponding to each set of first operation information, and combine each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions;

[0070] An analysis module 23 is used to analyze each first operation feature set using a pre-trained security level classification model to obtain a first security level corresponding to each set of first operation information;

[0071] A scoring module 24, configured to determine a target security credit score of the target user according to a weight coefficient corresponding to each first security level and the amount of first operation information corresponding to each first security level;

[0072] The adjustment module 25 is used to adjust the target user's operating authority to the target system according to the target security credit score.

[0073] The functions of each module of the user authority management device are described below in conjunction with a specific implementation process.

[0074] First, the acquisition module acquires the first user information of the target user and multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period, wherein one business corresponds to one group of first operation information. The specific process can take the following steps:

[0075] Obtain the first user information of the target user, wherein the first user information includes at least one of the following: age, gender, position, and operating authority. This information helps to understand the basic background of the user and their role and authority level in the system, and is the basis for building a user security credit portrait; and obtain multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information. This step ensures that the system can fully cover the user's activities in the target system and provide data support for subsequent analysis.

[0076] After obtaining the first user information, the feature determination module determines the first user attribute feature corresponding to the first user information, and determines the first security attribute feature set corresponding to each set of first operation information. The first security attribute feature set includes security attribute features of multiple security dimensions. Each first security attribute feature set and the first user attribute feature form a first operation feature set. The specific steps of this process can be performed in the following manner:

[0077] Data preprocessing is performed on the first user information and multiple groups of first operation information. The preprocessing process may also include filling in missing data, processing of abnormal values, and data conversion, so that data of different formats can be processed uniformly; then, first user attribute features corresponding to the preprocessed first user information are extracted. These features reflect the user's personal attributes, such as age, which may affect his familiarity with new technologies, and position and operation authority, which are directly related to the type and scope of operations that he may perform in the system; then, multiple target security dimensions are determined according to the system type of the target system (such as financial transactions, e-commerce, cloud computing, etc.), wherein the target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authenticatability, data non-repudiation, and data auditability. Different system types may focus on different security dimensions. For example, financial transaction systems may pay more attention to data security and integrity, while cloud computing environments may pay more attention to data availability and auditability. Then, security attribute features of multiple target security dimensions corresponding to each group of preprocessed first operation information are extracted to form a first security attribute feature set. For example, in a financial transaction system, the number of login attempts in the authentication log information and the abnormal transaction records in the transaction log can be used as important features for evaluating data security and integrity. Finally, the extracted first user attribute features are combined with the first security attribute feature set corresponding to each group of first operation information to form a first operation feature set. This set includes user personal attributes and security behavior information in specific business operations, providing a comprehensive analysis perspective for subsequent user risk behavior assessment.

[0078] After obtaining the above feature set, the analysis module uses the pre-trained security level classification model to analyze each first operation feature set to obtain the first security level corresponding to each group of first operation information.

[0079] As an optional implementation, the training process of the security level classification model may take the following steps:

[0080] S1, obtaining second user information of multiple users and multiple sets of second operation information corresponding to each user processing multiple businesses in the target system in multiple time periods, wherein one business corresponds to one set of second operation information;

[0081] S2, performing data preprocessing on the second user information and the multiple sets of second operation information;

[0082] S3, for each user, extract the second user attribute feature corresponding to the second user information of the user, and extract the second security attribute feature set corresponding to each set of second operation information of the user, and combine each second security attribute feature set and the second user attribute feature to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of multiple security dimensions;

[0083] S4, training a clustering model using all second operation feature sets corresponding to multiple users to obtain a security level classification model.

[0084] As an optional implementation, the clustering model is trained using all second operation feature sets corresponding to multiple users to obtain a security level classification model, which can be performed using the following steps:

[0085] S1, construct multiple clustering models with the same structure, and assign a K value to each clustering model, wherein multiple clustering models all use the K-means algorithm, and different clustering models correspond to different K values;

[0086] S2, for each clustering model, input all second operation feature sets into the clustering model, and determine the operation vector corresponding to each second operation feature set;

[0087] S3, the clustering model randomly determines K operation vectors as cluster centers according to the corresponding K values, and performs the following iterative process until the algorithm converges: cluster all operation vectors according to the K cluster centers to obtain K clusters;

[0088] S4, for each cluster, determine the center point of multiple operation vectors in the cluster as a new cluster center;

[0089] S5, when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the number of iterations reaches a preset threshold, it is determined that the algorithm converges and the clustering model training is completed;

[0090] S6, for each trained clustering model, determining a plurality of clusters obtained by clustering all operation vectors by the clustering model;

[0091] S7, for each cluster, determining the variance of multiple operation vectors in the cluster, and determining a threshold interval corresponding to the variance from multiple preset threshold intervals, wherein each threshold interval corresponds to a preset security level;

[0092] S8, for each security level, determining the number of clusters corresponding to the security level, and determining the standard deviation of the number of clusters corresponding to each security level;

[0093] S9, determining the clustering model with the smallest corresponding standard deviation as the security level classification model.

[0094] After the security level classification model is trained through the above process, the model is used to analyze each set of first operation features to obtain the first security level corresponding to each set of first operation information. The scoring module determines the target security credit score of the target user based on the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level. The process can be carried out in the following steps:

[0095] Obtain a first number of abnormal operations of the target user within a target time period, and obtain a second number of abnormal operations of all users within the target time period, determine the ratio of the first number to the second number, and determine the difference between 1 and the ratio as the security probability tendency of the target user; determine the weight coefficient corresponding to each first security level from a preset weight coefficient table, and normalize the number of first operation information corresponding to each first security level; use the weight coefficient corresponding to each first security level to perform weighted summation on the normalized number of first operation information corresponding to each first security level to obtain a basic security score; determine the product of the security probability tendency and the basic security score as the target security credit score of the target user.

[0096] After obtaining the above-mentioned target security credit score, the adjustment module adjusts the target user's operating authority to the target system according to the target security credit score. The process may include the following steps: determining the target operating authority level corresponding to the target security credit score from a preset authority management table, wherein the authority management table stores operating authority levels corresponding to different security credit score intervals, and a larger security credit score interval corresponds to a higher operating authority level; and then adjusting the target user's operating authority to the target system according to the target operating authority level.

[0097] It should be noted that each module in the user authority management device in the embodiment of the present application corresponds one-to-one to each implementation step of the user authority management method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be repeated here.

[0098] Example 3

[0099] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein the computer program implements the user authority management method in Example 1 when executed by a processor.

[0100] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the user authority management method in Example 1 by running the computer program.

[0101] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the user authority management method in Example 1 is executed when the computer program is running.

[0102] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the user authority management method in Example 1 through the computer program.

[0103] Specifically, when the computer program is running, the following steps are executed: obtaining the first user information of the target user and multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within the target time period, wherein one business corresponds to a group of first operation information; determining the first user attribute feature corresponding to the first user information, and determining the first security attribute feature set corresponding to each group of first operation information, and combining each first security attribute feature set with the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; using a pre-trained security level classification model to analyze each first operation feature set to obtain a first security level corresponding to each group of first operation information; determining the target security credit score of the target user based on the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level; and adjusting the target user's operating authority for the target system based on the target security credit score.

[0104] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 3 FIG. 1 shows a hardware structure block diagram of an electronic device for implementing a user rights management method. Figure 3 As shown, the electronic device 30 may include one or more (302a, 302b, ..., 302n are used to illustrate) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 3The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown.

[0105] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 30. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0106] The memory 304 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the user rights management method in the embodiment of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 304 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 304 may further include a memory remotely arranged relative to the processor 302, and these remote memories may be connected to the electronic device 30 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0107] The transmission device 306 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 30. In one example, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0108] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 30 .

[0109] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.

[0110] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0113] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0115] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A user rights management method, characterized in that: include: Acquire first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple services in a target system within a target time period, wherein one service corresponds to one group of first operation information; Determine a first user attribute feature corresponding to the first user information, and determine a first security attribute feature set corresponding to each set of the first operation information, and combine each of the first security attribute feature sets and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; Analyze each of the first operation feature sets using a pre-trained security level classification model to obtain a first security level corresponding to each set of the first operation information; Determining a target security credit score of the target user according to a weight coefficient corresponding to each of the first security levels and the amount of the first operation information corresponding to each of the first security levels; The target user's operation authority for the target system is adjusted according to the target security credit score.

2. The method according to claim 1, characterized in that: Acquiring first user information of a target user and multiple sets of first operation information corresponding to the target user processing multiple services in a target system within a target time period, including: Acquire first user information of the target user, wherein the first user information includes at least one of the following: age, gender, position, and operation authority; Acquire multiple groups of first operation information corresponding to the target user processing multiple businesses in the target system within a target time period, wherein each group of the first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information.

3. The method according to claim 1, characterized in that Extracting the first user attribute feature corresponding to the first user information, and extracting the first security attribute feature set corresponding to each set of the first operation information, including: performing data preprocessing on the first user information and the multiple groups of the first operation information; extracting the first user attribute feature corresponding to the preprocessed first user information; Determine multiple target security dimensions based on the system type of the target system, and extract the security attribute features of the multiple target security dimensions corresponding to each group of the first operation information after preprocessing to form the first security attribute feature set, wherein the target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability.

4. The method according to claim 1, characterized in that: The training process of the security level classification model includes: Acquire second user information of multiple users and multiple groups of second operation information corresponding to each user processing multiple businesses in the target system in multiple time periods, wherein one business corresponds to one group of second operation information; performing data preprocessing on the second user information and multiple groups of the second operation information; For each user, extract the second user attribute feature corresponding to the second user information of the user, and extract the second security attribute feature set corresponding to each set of the second operation information of the user, and combine each second security attribute feature set and the second user attribute feature to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of multiple security dimensions; A clustering model is trained using all the second operation feature sets corresponding to multiple users to obtain the security level classification model.

5. The method according to claim 4, characterized in that Training a clustering model using all the second operation feature sets corresponding to a plurality of users to obtain the security level classification model includes: Constructing multiple clustering models with the same structure, and assigning a K value to each of the clustering models, wherein the multiple clustering models all adopt the K-means algorithm, and different clustering models correspond to different K values; For each clustering model, all the second operation feature sets are input into the clustering model to determine the operation vector corresponding to each second operation feature set; the clustering model randomly determines K operation vectors as cluster centers according to the corresponding K value, and performs the following iterative process until the algorithm converges: clustering all the operation vectors according to the K cluster centers to obtain K clusters; for each cluster, determining the center point of multiple operation vectors in the cluster as a new cluster center; when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the number of iterations reaches a preset threshold, it is determined that the algorithm converges and the clustering model training is completed; For each clustering model that has been trained, multiple clusters are determined by clustering all the operation vectors by the clustering model; for each cluster, the variance of multiple operation vectors in the cluster is determined, and a threshold interval corresponding to the variance is determined from multiple preset threshold intervals, wherein each threshold interval corresponds to a preset security level; for each security level, the number of clusters corresponding to the security level is determined, and the standard deviation of the number of clusters corresponding to each security level is determined; The clustering model with the smallest corresponding standard deviation is determined as the security level classification model.

6. The method according to claim 1, characterized in that include: Acquire a first number of abnormal operations of the target user within the target time period, and acquire a second number of abnormal operations of all users within the target time period, determine a ratio of the first number to the second number, and determine a difference between 1 and the ratio as a security probability tendency of the target user; Determine a weight coefficient corresponding to each first security level from a preset weight coefficient table, and normalize the amount of the first operation information corresponding to each first security level; Using the weight coefficient corresponding to each first security level, a weighted sum is performed on the normalized quantity of the first operation information corresponding to each first security level to obtain a basic security score; The product of the security probability tendency and the basic security score is determined as the target security credit score of the target user.

7. The method according to claim 1, characterized in that Adjusting the target user's operation authority over the target system according to the target security credit score includes: Determining a target operation authority level corresponding to the target security credit score from a preset authority management table, wherein the authority management table stores operation authority levels corresponding to different security credit score intervals, and a larger security credit score interval corresponds to a higher operation authority level; The target user's operation authority for the target system is adjusted according to the target operation authority level.

8. A user rights management device, characterized in that: include: An acquisition module, used to acquire first user information of a target user and multiple groups of first operation information corresponding to the target user processing multiple services in a target system within a target time period, wherein one service corresponds to one group of first operation information; a feature determination module, configured to determine a first user attribute feature corresponding to the first user information, and determine a first security attribute feature set corresponding to each set of the first operation information, and combine each of the first security attribute feature sets and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; an analysis module, configured to analyze each of the first operation feature sets using a pre-trained security level classification model to obtain a first security level corresponding to each set of the first operation information; a scoring module, configured to determine a target security credit score of the target user according to a weight coefficient corresponding to each of the first security levels and the amount of the first operation information corresponding to each of the first security levels; An adjustment module is used to adjust the target user's operation authority over the target system according to the target security credit score.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the user rights management method described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the user authority management method according to any one of claims 1 to 7 through the computer program.

Images