User rights management method and apparatus

Abstract

The application discloses a user permission management method and device. The method comprises the following steps: obtaining first user information of a target user and a plurality of groups of first operation information for processing a plurality of services in a target time period, each service corresponding to a group of operation information; determining a first user attribute feature and a first security attribute feature set of each group of operation information, the set containing security attribute features of a plurality of security dimensions; combining each first security attribute feature set with the first user attribute feature to form a first operation feature set; analyzing each first operation feature set by using a pre-trained security level classification model to obtain a first security level of each group of operation information; determining a target security credit score of the target user according to a weight coefficient of each first security level and the number of corresponding operation information, and adjusting the operation permission of the target user according to the target security credit score. The application solves the technical problem that the current data management system lacks pertinence in managing user permissions and is easy to affect data security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a user permission management method and device. BACKGROUND

[0002] The challenge of big data security management is increasingly significant, especially in terms of reasonable allocation of data management and operator permissions, account password security, and operator safety awareness and skills. In the big data environment, due to the large amount of data, the variety of data types, and the high complexity of processing, security incidents may be caused by a variety of reasons, including but not limited to accidental misoperation, malicious internal operation, and external attack. The existing technology has limitations in personnel operation risk assessment, such as lack of flexibility and intelligence in permission allocation, cumbersome and inefficient security audit process, and untimely security incident response, which may lead to data leakage, tampering, loss, and other security incidents, causing serious impact on business operation, reputation, and compliance of enterprises.

[0003] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0004] The embodiments of the present application provide a user permission management method and device to at least solve the technical problem that the current data management system lacks pertinence in managing user permissions, which may affect data security.

[0005] According to an aspect of an embodiment of the present application, a user permission management method is provided, comprising: obtaining first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system handled by the target user in a target time period, wherein one business corresponds to one group of first operation information; determining a first user attribute feature corresponding to the first user information, and determining a first security attribute feature set corresponding to each group of first operation information, and combining each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of a plurality of security dimensions; analyzing each first operation feature set by using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information; determining a target security credit score of the target user according to a weight coefficient corresponding to each first security level and a quantity of first operation information corresponding to each first security level; and adjusting operation permissions of the target user on the target system according to the target security credit score.

[0006] Optionally, the first user information of the target user and a plurality of groups of first operation information corresponding to a plurality of businesses in the target system and processed by the target user in a target time period are obtained, including: obtaining the first user information of the target user, wherein the first user information includes at least one of the following: age, gender, position, and operation permission; and obtaining a plurality of groups of first operation information corresponding to a plurality of businesses in the target system and processed by the target user in a target time period, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information.

[0007] Optionally, the first user attribute features corresponding to the first user information are extracted, and a first security attribute feature set corresponding to each group of first operation information is extracted, including: data preprocessing of the first user information and the plurality of groups of first operation information; extracting first user attribute features corresponding to the preprocessed first user information; determining a plurality of target security dimensions according to the system type of the target system, and extracting security attribute features of the plurality of target security dimensions corresponding to each group of preprocessed first operation information to form the first security attribute feature set, wherein the target security dimensions include at least two of the following: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability.

[0008] Optionally, the training process of the security level classification model includes: obtaining second user information of a plurality of users and a plurality of groups of second operation information corresponding to a plurality of businesses in the target system and processed by each user in a plurality of time periods, wherein one business corresponds to one group of second operation information; data preprocessing of the second user information and the plurality of groups of second operation information; for each user, extracting second user attribute features corresponding to the second user information of the user, and extracting a second security attribute feature set corresponding to each group of second operation information of the user, and combining each second security attribute feature set and the second user attribute features to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of a plurality of security dimensions; training a clustering model using all second operation feature sets corresponding to the plurality of users to obtain the security level classification model.

[0009] Optionally, the clustering model is trained by using all the second operation feature sets corresponding to the plurality of users to obtain a security level classification model, including: constructing a plurality of clustering models with the same structure, and assigning a K value to each clustering model, wherein the plurality of clustering models all use the K-means algorithm, and the K values corresponding to different clustering models are different; for each clustering model, input all the second operation feature sets into the clustering model to determine an operation vector corresponding to each second operation feature set; randomly determine K operation vectors as cluster centers according to the corresponding K value by the clustering model, and perform the following iteration process until the algorithm converges: cluster all operation vectors according to the K cluster centers to obtain K clusters; for each cluster, determine the center point of the plurality of operation vectors in the cluster as a new cluster center; when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the iteration number reaches a preset threshold, it is determined that the algorithm converges, and the training of the clustering model is completed; for each completed clustering model, determine the plurality of clusters obtained by clustering all operation vectors by the clustering model; for each cluster, determine the variance of the plurality of operation vectors in the cluster, and determine the threshold interval corresponding to the variance from a plurality of preset threshold intervals, wherein each threshold interval corresponds to a preset security level; for each security level, determine the number of clusters corresponding to the security level, and determine the standard deviation of the number of clusters corresponding to each security level; determine the clustering model with the smallest corresponding standard deviation as the security level classification model.

[0010] Optionally, a first number of abnormal operations of the target user in a target time period is obtained, and a second number of abnormal operations of all users in the target time period is obtained, a ratio of the first number to the second number is determined, and a difference between 1 and the ratio is determined as a security probability tendency of the target user; a weight coefficient corresponding to each first security level is determined from a preset weight coefficient table, and the number of first operation information corresponding to each first security level is normalized; the number of first operation information corresponding to each first security level after normalization is weighted and summed by using the weight coefficient corresponding to each first security level to obtain a basic security score; and the product of the security probability tendency and the basic security score is determined as the target security credit score of the target user.

[0011] Optionally, the operation permission of the target user to the target system is adjusted according to the target security credit score, including: determining a target operation permission level corresponding to the target security credit score from a preset permission management table, wherein the permission management table stores operation permission levels corresponding to different security credit score intervals, and the operation permission level corresponding to a larger security credit score interval is higher; and adjusting the operation permission of the target user to the target system according to the target operation permission level.

[0012] According to another aspect of the embodiments of the present application, a user permission management apparatus is also provided, which comprises: an acquisition module configured to acquire first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of services in a target system and handled by the target user in a target time period, wherein one service corresponds to one group of first operation information; a feature determination module configured to determine a first user attribute feature corresponding to the first user information, and determine a first security attribute feature set corresponding to each group of first operation information, and combine each first security attribute feature set with the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set comprises security attribute features of a plurality of security dimensions; an analysis module configured to analyze each first operation feature set by using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information; a scoring module configured to determine a target security credit score of the target user according to a weight coefficient corresponding to each first security level and a quantity of first operation information corresponding to each first security level; and an adjustment module configured to adjust an operation permission of the target user to the target system according to the target security credit score.

[0013] According to another aspect of the embodiments of the present application, a computer program product is also provided, which comprises: a computer program, wherein the computer program is executed by a processor to implement the above-mentioned user permission management method.

[0014] According to another aspect of the embodiments of the present application, an electronic device is also provided, which comprises: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned user permission management method by using the computer program.

[0015] In the embodiment of the present application, a user permission management method is provided. The method obtains first user information (such as identity, position, etc.) of a target user and operation information of the target user for a plurality of businesses in a specific time period, combines a plurality of security dimension features of user attributes and operation attributes, and further implements fine management of user permissions. This permission adjustment mechanism based on security credit scoring can more accurately match the user's permission with the operation risk level, avoid the one-size-fits-all permission allocation mode, and improve the rationality and efficiency of permission management. In addition, the pre-trained security level classification model is used to analyze the user operation feature set in real time, dynamically evaluate the security level of the operation, and calculate the security credit score of the user based on this. This dynamic evaluation mechanism can timely reflect the changes in user behavior, thereby quickly adjusting the permissions and enhancing the security response capability of the system. Furthermore, the user attribute features and operation attribute features are quantified and combined into an operation feature set, and then the security level classification model is used to analyze these features. This not only can identify high-risk operations, but also can distinguish operations of different risk levels through the quantified score of the security level, which is of great significance for security audit and risk control. Moreover, the target security credit score is obtained by weight calculation of the security level and the number of operations. This scoring mechanism establishes a security credit profile for the user, so that the security management personnel can implement differentiated permission management strategies based on the security credit status of the user, thereby solving the technical problem that the current data management system lacks pertinence in managing user permissions and easily affects data security. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of this application and help to explain the present application together with the specification. The illustrative embodiments of the present application and their description serve to explain the present application. In the drawings:

[0017] Figure 1 FIG. 1 is a flow diagram of an optional user permission management method according to an embodiment of the present application;

[0018] Figure 2 FIG. 2 is a structural diagram of an optional user permission management device according to an embodiment of the present application;

[0019] Figure 3 FIG. 3 is a structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application, so that those skilled in the art can better understand the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", and the like in the description and claims of the present application and the drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0022] Embodiment 1

[0023] According to the embodiments of the present application, a user permission management method is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical sequence is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0024] Figure 1 is a flow diagram of a user permission management method according to an embodiment of the present application, as shown in Figure 1 the method comprises the following steps:

[0025] Step S102, acquiring first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system handled by the target user in a target time period, wherein one business corresponds to one group of first operation information;

[0026] Step S104, determining a first user attribute feature corresponding to the first user information, and determining a first security attribute feature set corresponding to each group of first operation information, and combining each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of a plurality of security dimensions;

[0027] Step S106, each first operation feature set is analyzed by using the pre-trained security level classification model, and a first security level corresponding to each group of first operation information is obtained;

[0028] Step S108, the target security credit score of the target user is determined according to the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level;

[0029] Step S110, the operation permission of the target user to the target system is adjusted according to the target security credit score.

[0030] The steps of the user permission management method will be described in combination with the specific implementation process.

[0031] First, the first user information of the target user and the multiple groups of first operation information corresponding to the multiple businesses in the target system handled by the target user in the target time period are obtained, wherein one business corresponds to one group of first operation information, and the specific process can adopt the following steps:

[0032] The first user information of the target user is obtained, wherein the first user information includes at least one of the following: age, gender, position, operation permission, which helps to understand the basic background of the user and their role and permission level in the system, and is the basis for building a user security credit profile; and multiple groups of first operation information corresponding to multiple businesses in the target system handled by the target user in the target time period are obtained, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information, which ensures that the system can fully cover the activities of the user in the target system and provide data support for subsequent analysis.

[0033] After obtaining the above first user information, the first user attribute features corresponding to the first user information are determined, and the first security attribute feature set corresponding to each group of first operation information is determined, the first security attribute feature set includes multiple security dimension security attribute features, each first security attribute feature set and the first user attribute features form a first operation feature set, and the specific steps of the process can be performed in the following way:

[0034] The first user information and a plurality of groups of first operation information are subjected to data preprocessing. The preprocessing process can also include filling of missing data, processing of abnormal values, and data conversion, so that data in different formats can be uniformly processed. Then, first user attribute features corresponding to the first user information after preprocessing are extracted. These features reflect the personal attributes of the user, such as age, which can affect the user's familiarity with new technology, position, and operation permission, which are directly related to the type and range of operations that the user can perform in the system. Then, a plurality of target security dimensions are determined according to the system type (such as financial transaction, e-commerce, cloud computing, etc.) of the target system. The target security dimensions include at least two of the following: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability. Different system types can focus on different security dimensions. For example, a financial transaction system can place more emphasis on data security and integrity, while a cloud computing environment can focus more on data availability and auditability. Then, a plurality of security attribute features of the target security dimensions corresponding to each group of first operation information after preprocessing are extracted to form a first security attribute feature set. For example, in a financial transaction system, the number of login attempts in the authentication log information and the abnormal transaction records in the transaction log can be used as important features for evaluating data security and integrity. Finally, the first user attribute features and the first security attribute feature set corresponding to each group of first operation information are combined to form a first operation feature set. This set contains personal attributes of the user and security behavior information in specific business operations, providing a comprehensive analysis perspective for subsequent user risk behavior evaluation.

[0035] As an optional implementation, if the target system is used in the field of network security monitoring, the target security dimensions can include confidentiality, authentication and non-repudiation, availability, and auditability. The confidentiality is used to ensure access control of sensitive information and prevent unauthorized access. The integrity is used to prevent data tampering and ensure the authenticity and accuracy of log records. The authentication and non-repudiation are used to track and verify each operation to ensure traceability and authenticity of the operation. The availability is used to ensure timely access to log data and rapid response to security incidents. The auditability is used to record detailed operation information for post-audit and analysis.

[0036] If the target system is used in the field of financial transaction, the target security dimensions can include confidentiality, integrity, authentication, non-repudiation, and auditability. The confidentiality protects the privacy of transaction and user data and prevents information leakage. The integrity ensures the accuracy and consistency of transaction data and prevents data tampering. The authentication and non-repudiation audit the operation to ensure the legality and non-repudiation of the transaction. The auditability tracks the transaction process to facilitate supervision and compliance checks.

[0037] If the target system is used in an e-commerce platform, the target security dimensions can include confidentiality, authentication, auditability and integrity, wherein: the confidentiality is used to protect the user's personal information and transaction records; the authentication is used to verify the user's identity, prevent unauthorized access and operation; the auditability is used to monitor user behavior and prevent fraudulent behavior; the integrity is used to ensure the accuracy of product information and transaction records.

[0038] If the target system is used in a cloud computing environment, the target security dimensions can include confidentiality, integrity and auditability, wherein: the confidentiality is used to protect customer data privacy; the integrity is used to ensure the accuracy of cloud service data and operations; the auditability is used to record user activities in the cloud environment for management and security review.

[0039] After obtaining the above feature set, the pre-trained security level classification model is used to analyze each first operation feature set to obtain a first security level corresponding to each group of first operation information.

[0040] As an optional implementation, the training process of the security level classification model can take the following steps:

[0041] S1, obtaining second user information of a plurality of users and a plurality of groups of second operation information corresponding to a plurality of businesses in the target system processed by each user in a plurality of time periods, wherein one business corresponds to one group of second operation information;

[0042] S2, data preprocessing of the second user information and the plurality of groups of second operation information;

[0043] S3, for each user, extracting second user attribute features corresponding to the second user information of the user, and extracting a second security attribute feature set corresponding to each group of second operation information of the user, each second security attribute feature set and the second user attribute features forming a second operation feature set, wherein the second security attribute feature set includes security attribute features of a plurality of security dimensions;

[0044] S4, training a clustering model using all second operation feature sets corresponding to the plurality of users to obtain a security level classification model.

[0045] As an optional implementation, training a clustering model using all second operation feature sets corresponding to the plurality of users to obtain a security level classification model can be performed using the following steps:

[0046] S1, constructing a plurality of clustering models with the same structure, and assigning a K value to each clustering model, wherein the plurality of clustering models all use K-means algorithm, and different clustering models correspond to different K values;

[0047] Wherein, in order to find the best cluster number, a plurality of clustering models using K-means algorithm are created, each model has the same structure, but is assigned a different K value (i.e. a different number of clusters), and different K values will affect the final classification result. By comparing multiple models, the most appropriate K value can be determined.

[0048] S2, for each clustering model, input all second operation feature sets into the clustering model, and determine the operation vector corresponding to each second operation feature set;

[0049] Wherein, the second operation feature set extracted from the user information and operation data is input into each clustering model, each feature set is converted into an operation vector, and the dimension of the vector corresponds to the security attribute feature, so as to facilitate model calculation distance and clustering.

[0050] S3, randomly determine K operation vectors as cluster centers according to the corresponding K value by the clustering model, and perform the following iteration process until the algorithm converges: cluster all operation vectors according to K cluster centers to obtain K clusters;

[0051] Wherein, in each clustering model, K operation vectors are randomly selected as initial cluster centers, the algorithm will calculate the distance between each operation vector and all cluster centers based on the current cluster center, and each operation vector is assigned to the cluster where the nearest cluster center is located, so that all operation vectors are divided into K clusters.

[0052] S4, for each cluster, determine the center point of the plurality of operation vectors in the cluster as a new cluster center;

[0053] S5, when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the iteration number reaches the preset threshold, it is determined that the algorithm converges, and the clustering model training is completed;

[0054] S6, for each trained clustering model, determine a plurality of clusters obtained by clustering all operation vectors by the clustering model;

[0055] S7, for each cluster, determine the variance of the plurality of operation vectors in the cluster, and determine the threshold interval corresponding to the variance from a plurality of preset threshold intervals, wherein each threshold interval corresponds to a preset security level;

[0056] Wherein, the variance of all operation vectors in each cluster relative to the cluster center is calculated, and the variance can measure the dispersion degree of the data points in the cluster. By the variance and the preset threshold interval, the security level corresponding to each cluster can be determined.

[0057] S8, for each security level, determine the number of clusters corresponding to the security level, and determine the standard deviation of the number of clusters corresponding to each security level;

[0058] S9, determine the cluster model with the minimum standard deviation as the security level classification model.

[0059] The minimum standard deviation means that the distribution of the number of clusters is the most stable, and therefore, the model is the most reliable in classifying users of different security levels.

[0060] After training the security level classification model through the above process, the model is used to analyze each first operation feature set, to obtain the first security level corresponding to each group of first operation information, and to determine the target security credit score of the target user according to the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level. This process can be performed using the following steps:

[0061] The first number of abnormal operations of the target user in the target time period is obtained, and the second number of abnormal operations of all users in the target time period is obtained. Abnormal operations can include, but are not limited to, high-risk operations, data leakage attempts, unauthorized access, etc. Then, the ratio of the first number to the second number is determined, which reflects the relative frequency of the target user's abnormal operations. The difference between 1 and the ratio is determined as the security probability tendency of the target user. The closer the security probability tendency value is to 1, the safer the target user's behavior is, and the lower the frequency of abnormal operations is. The weight coefficient corresponding to each first security level is determined from a pre-set weight coefficient table, which reflects the importance of different risk level operations in the calculation of security credit points. The number of first operation information corresponding to each first security level is normalized to ensure that the difference in the number of operation information under different security levels does not cause an imbalance in the score, and to avoid the situation where the more the number of operations, the higher the score. The weight coefficient corresponding to each first security level is used to weight and sum the number of first operation information corresponding to each first security level after normalization, to obtain a basic security score. The product of the security probability tendency and the basic security score is determined as the target security credit score of the target user. This score combines the results of the abnormal operation frequency and the operation type risk weight of the target user in a specific time period, and can more accurately reflect the user's security credit status.

[0062] According to different security dimensions and scenarios, the weight coefficient can be adjusted to better adapt to changing business needs and security challenges. By flexibly focusing on different risk factors, personalized and precise assessment of user behavior risk can be achieved. For example, when a company faces increasing threats of external network attacks, the weight of abnormal behaviors (high-risk level) detected by the security analysis tool can be increased to more strictly control user permissions; when internal security training becomes an important means to improve overall security level, the weight of security awareness assessment (low-risk level) can be adjusted accordingly to encourage users to actively participate in training and improve security awareness.

[0063] After obtaining the target security credit score, the operation permission of the target user on the target system is adjusted according to the target security credit score. The process can include the following steps: determining the target operation permission level corresponding to the target security credit score from a preset permission management table, wherein the permission management table stores operation permission levels corresponding to different security credit score intervals, and the operation permission level corresponding to a larger security credit score interval is higher; and adjusting the operation permission of the target user on the target system according to the target operation permission level.

[0064] For example, for users with high scores, their access permissions can be appropriately relaxed, and the approval process can be simplified; for users with low scores, their permissions need to be restricted, and audit supervision needs to be strengthened, thereby effectively reducing the security risks of big data.

[0065] In the embodiments of the present application, a user permission management method is provided. The method obtains the first user information (such as identity, position, etc.) of a target user and the operation information of the target user on multiple businesses in a specific time period, and combines the user attributes and the operation attributes of multiple security dimension features, thereby further implementing fine management of user permissions. This permission adjustment mechanism based on security credit score can more accurately match the permissions of users with their operation risk levels, avoid the one-size-fits-all permission allocation method, and improve the rationality and efficiency of permission management. In addition, the pre-trained security level classification model is used to analyze the user operation feature set in real time, dynamically assess the security level of the operation, and calculate the security credit score of the user based on this. This dynamic assessment mechanism can timely reflect the changes in user behavior, thereby quickly adjusting the permissions and enhancing the security response capability of the system. Furthermore, the user attribute features and the operation attribute features are quantified and combined into an operation feature set, and then the security level classification model is used to analyze these features. This not only enables the identification of high-risk operations, but also distinguishes operations of different risk levels through the quantitative scoring of security levels. This is of great significance for security audit and risk control. Moreover, the target security credit score is obtained through the weight calculation of the security level and the number of operations. This scoring mechanism establishes a security credit profile for the user, enabling security management personnel to implement differentiated permission management strategies based on the security credit status of the user, thereby solving the technical problem that the current data management system lacks pertinence in managing user permissions and is prone to affecting data security.

[0066] Embodiment 2

[0067] According to the embodiments of the present application, a user permission management apparatus for implementing the user permission management method in Embodiment 1 is also provided. As shown in FIG. 2, the user permission management apparatus at least includes an obtaining module 21, a feature determination module 22, an analysis module 23, a scoring module 24, and an adjustment module 25. Figure 2 The obtaining module 21 is configured to obtain the first user information (such as identity, position, etc.) of a target user and the operation information of the target user on multiple businesses in a specific time period.

[0068] The acquisition module 21 is configured to acquire first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system handled by the target user in a target time period, wherein one business corresponds to one group of first operation information;

[0069] The feature determination module 22 is configured to determine a first user attribute feature corresponding to the first user information, and determine a first security attribute feature set corresponding to each group of first operation information, and combine each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of a plurality of security dimensions;

[0070] The analysis module 23 is configured to analyze each first operation feature set by using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information.

[0071] The scoring module 24 is configured to determine a target security credit score of the target user according to a weight coefficient corresponding to each first security level and a quantity of first operation information corresponding to each first security level.

[0072] The adjustment module 25 is configured to adjust an operation permission of the target user to the target system according to the target security credit score.

[0073] The functions of each module of the user permission management device will be described in detail in combination with a specific implementation process.

[0074] First, the acquisition module acquires first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system handled by the target user in a target time period, wherein one business corresponds to one group of first operation information, and the specific process can take the following steps:

[0075] The first user information of the target user is acquired, wherein the first user information includes at least one of the following: age, gender, position, operation permission, which helps to understand the basic background of the user and their role and permission level in the system, and is the basis for building a user security credit profile; and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system handled by the target user in a target time period are acquired, wherein each group of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information, which ensures that the system can fully cover the activities of the user in the target system and provide data support for subsequent analysis.

[0076] After obtaining the first user information, the feature determination module determines the first user attribute feature corresponding to the first user information, and determines a first security attribute feature set corresponding to each group of first operation information, the first security attribute feature set including security attribute features of multiple security dimensions, and each first security attribute feature set and the first user attribute feature form a first operation feature set. The process can be performed in the following manner:

[0077] The first user information and the multiple groups of first operation information are preprocessed, which can also include filling of missing data, processing of abnormal values, and data conversion, so that data of different formats can be uniformly processed. Then, the first user attribute feature corresponding to the preprocessed first user information is extracted, which reflects the personal attributes of the user, such as age, which can affect the familiarity with new technology, and position and operation authority, which are directly related to the types and ranges of operations that the user can perform in the system. Then, multiple target security dimensions are determined according to the system type of the target system (such as financial transaction, e-commerce, cloud computing, etc.), wherein the target security dimensions include at least two of the following: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability. Different system types can focus on different security dimensions, such as financial transaction systems that may focus more on data security and integrity, and cloud computing environments that may focus more on data availability and auditability. Then, the security attribute features of the multiple target security dimensions corresponding to each group of preprocessed first operation information are extracted to form a first security attribute feature set. For example, in a financial transaction system, the number of login attempts in the authentication log information and the abnormal transaction records in the transaction log can be used as important features for evaluating data security and integrity. Finally, the extracted first user attribute feature and the first security attribute feature set corresponding to each group of first operation information are combined to form a first operation feature set, which includes personal attributes of the user and security behavior information in specific business operations, providing a comprehensive analysis perspective for subsequent user risk behavior evaluation.

[0078] After obtaining the above feature set, the analysis module analyzes each first operation feature set using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information.

[0079] As an optional implementation, the training process of the security level classification model can include the following steps:

[0080] S1, obtaining second user information of multiple users and multiple groups of second operation information corresponding to multiple businesses in a target system processed by each user in multiple time periods, wherein one business corresponds to one group of second operation information;

[0081] S2, data pre-processing is performed on the second user information and the plurality of sets of second operation information;

[0082] S3, for each user, a second user attribute feature corresponding to the second user information of the user is extracted, and a second security attribute feature set corresponding to each set of second operation information of the user is extracted, and each second security attribute feature set and the second user attribute feature form a second operation feature set, wherein the second security attribute feature set includes security attribute features of a plurality of security dimensions;

[0083] S4, training a clustering model by using all second operation feature sets corresponding to a plurality of users to obtain a security level classification model.

[0084] As an optional implementation, training a clustering model by using all second operation feature sets corresponding to a plurality of users to obtain a security level classification model can be performed by the following steps:

[0085] S1, a plurality of clustering models with the same structure are constructed, and each clustering model is assigned a K value, wherein the plurality of clustering models all use K-means algorithm, and different clustering models correspond to different K values;

[0086] S2, for each clustering model, all second operation feature sets are input into the clustering model to determine an operation vector corresponding to each second operation feature set;

[0087] S3, the clustering model randomly determines K operation vectors as cluster centers according to the corresponding K value, and performs the following iteration process until the algorithm converges: clustering all operation vectors according to the K cluster centers to obtain K clusters;

[0088] S4, for each cluster, the center point of the plurality of operation vectors in the cluster is determined as a new cluster center;

[0089] S5, when the newly determined K cluster centers are the same as the K cluster centers determined last time, or the iteration number reaches a preset threshold, it is determined that the algorithm converges, and the clustering model training is completed;

[0090] S6, for each trained clustering model, a plurality of clusters obtained by clustering all operation vectors by the clustering model are determined;

[0091] S7, for each cluster, the variance of the plurality of operation vectors in the cluster is determined, and a threshold interval corresponding to the variance is determined from a plurality of preset threshold intervals, wherein each threshold interval corresponds to a preset security level;

[0092] S8, for each security level, the number of clusters corresponding to the security level is determined, and the standard deviation of the number of clusters corresponding to each security level is determined;

[0093] S9, determine the cluster model corresponding to the minimum standard deviation as the security level classification model.

[0094] After the security level classification model is trained through the above process, the model is used to analyze each first operation feature set, and the first security level corresponding to each group of first operation information is obtained. The scoring module determines the target security credit score of the target user according to the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level. The process can be performed by the following steps:

[0095] The first number of abnormal operations of the target user in the target time period is obtained, and the second number of abnormal operations of all users in the target time period is obtained. The ratio of the first number to the second number is determined, and the difference between 1 and the ratio is determined as the security probability tendency of the target user. The weight coefficient corresponding to each first security level is determined from the preset weight coefficient table, and the number of first operation information corresponding to each first security level is normalized. The weight coefficient corresponding to each first security level is used to weight and sum the number of first operation information corresponding to each first security level after normalization to obtain a basic security score. The product of the security probability tendency and the basic security score is determined as the target security credit score of the target user.

[0096] After obtaining the target security credit score, the adjustment module adjusts the operation permission of the target user on the target system according to the target security credit score. The process can include the following steps: determining the target operation permission level corresponding to the target security credit score from the preset permission management table, wherein the permission management table stores operation permission levels corresponding to different security credit score intervals, and the operation permission level corresponding to a larger security credit score interval is higher; and adjusting the operation permission of the target user on the target system according to the target operation permission level.

[0097] It should be noted that the modules in the user permission management device in the embodiments of the present application correspond one by one to the implementation steps of the user permission management method in Embodiment 1. Since Embodiment 1 has been described in detail, the details not embodied in this embodiment can be referred to Embodiment 1, and will not be described in detail here.

[0098] Embodiment 3

[0099] According to the embodiments of the present application, a computer program product is also provided, which includes a computer program. When the computer program is executed by a processor, the user permission management method in Embodiment 1 is implemented.

[0100] According to an embodiment of the present application, a non-transitory storage medium is also provided, which includes a stored computer program, wherein a device in which the non-transitory storage medium is located executes the user authority management method in embodiment 1 by running the computer program.

[0101] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the computer program executes the user authority management method in embodiment 1 when running.

[0102] According to an embodiment of the present application, an electronic device is also provided, which includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the user authority management method in embodiment 1 by running the computer program.

[0103] Specifically, the computer program executes the following steps when running: obtaining first user information of a target user and a plurality of groups of first operation information corresponding to a plurality of businesses in a target system and processed by the target user in a target time period, wherein one business corresponds to one group of first operation information; determining a first user attribute feature corresponding to the first user information, and determining a first security attribute feature set corresponding to each group of first operation information, and combining each first security attribute feature set and the first user attribute feature to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of a plurality of security dimensions; analyzing each first operation feature set by using a pre-trained security level classification model to obtain a first security level corresponding to each group of first operation information; determining a target security credit score of the target user according to a weight coefficient corresponding to each first security level and a quantity of first operation information corresponding to each first security level; and adjusting an operation authority of the target user on the target system according to the target security credit score.

[0104] As an optional implementation, the electronic device can exist in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 3 A hardware structure block diagram of an electronic device for implementing a user authority management method is shown. As shown in Figure 3 The electronic device 30 can include one or more processors 302 (the processor 302 can include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 3The illustrated structure is merely schematic and does not impose a limitation on the structure of the electronic device described above. For example, the electronic device 30 can further include more or less components than those shown, or have a different configuration of components than those shown. Figure 3 Figure 3 The illustrated structure is merely schematic and does not impose a limitation on the structure of the electronic device described above. For example, the electronic device 30 can further include more or less components than those shown, or have a different configuration of components than those shown.

[0105] It should be noted that the one or more processors 302 and / or other data processing circuitry described above can be referred to herein generally as "data processing circuitry". The data processing circuitry can be embodied in whole or in part as software, hardware, firmware, or any combination thereof. Furthermore, the data processing circuitry can be a single standalone processing module, or incorporated in whole or in part within any one of the other elements of the electronic device 30. As referred to in embodiments of the present application, the data processing circuitry acts as a processor to control, for example, the selection of the variable resistance terminal path connected to the interface.

[0106] The memory 304 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the user permission management method in embodiments of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, i.e. implements the vulnerability detection method of the application program described above. The memory 304 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 304 can further include a memory remotely arranged with respect to the processor 302, which can be connected to the electronic device 30 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0107] The transmission device 306 is configured to receive or send data via a network. Specific examples of the network can include a wireless network provided by a communication provider of the electronic device 30. In one example, the transmission device 306 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (RF) module, which is configured to communicate with the Internet in a wireless manner.

[0108] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the electronic device 30.

[0109] The above-mentioned example numbers are merely for description, and do not represent the advantages and disadvantages of the examples.

[0110] ​In the above-described embodiments of the present application, the description of each embodiment focuses on different aspects, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0111] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of units can be a logical function division, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, and can be electrical or other forms.

[0112] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0113] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0114] If the integrated unit is realized in the form of software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part of the prior art that makes a contribution or the whole or part of the technical solutions can be embodied in the form of software product, which is stored in a storage medium and includes a plurality of instructions for making a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the embodiments of the present application. The foregoing storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and various program code storage media.

[0115] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be regarded as the protection scope of the present application.

Claims

1. A user access control method, characterized in that, include: Obtain the first user information of the target user and multiple sets of first operation information corresponding to the target user processing multiple services in the target system within the target time period, wherein one service corresponds to one set of first operation information; Determining the first user attribute feature corresponding to the first user information and determining the first security attribute feature set corresponding to each group of the first operation information includes: performing data preprocessing on the first user information and multiple groups of the first operation information; extracting the first user attribute feature corresponding to the preprocessed first user information; determining multiple target security dimensions based on the system type of the target system, and extracting the security attribute features of multiple target security dimensions corresponding to each group of the preprocessed first operation information to form the first security attribute feature set, wherein the target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability; Each of the first security attribute feature sets and the first user attribute feature sets are combined to form a first operation feature set, wherein the first security attribute feature set includes security attribute features of multiple security dimensions; The first security level is obtained by analyzing each set of first operation features using a pre-trained security level classification model. The target security credit score of the target user is determined based on the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level, including: obtaining a first number of abnormal operations of the target user within a target time period, and obtaining a second number of abnormal operations of all users within the target time period; determining the ratio of the first number to the second number; and determining the difference between 1 and the ratio as the security probability tendency of the target user; determining the weight coefficient corresponding to each first security level from a preset weight coefficient table, and normalizing the number of first operation information corresponding to each first security level; using the weight coefficient corresponding to each first security level to perform a weighted summation of the normalized number of first operation information corresponding to each first security level to obtain a basic security score; and determining the product of the security probability tendency and the basic security score as the target security credit score of the target user. Adjust the target user's access permissions to the target system based on the target security credit score.

2. The method according to claim 1, characterized in that, Obtain the target user's first user information and multiple sets of first operation information corresponding to the target user's processing of multiple services within the target system within a target time period, including: Obtain first user information of the target user, wherein the first user information includes at least one of the following: age, gender, job title, and operation permissions; Obtain multiple sets of first operation information corresponding to the target user's processing of multiple services within the target system within a target time period, wherein each set of first operation information includes at least one of the following: system log information, operation log information, authentication log information, and audit log information.

3. The method according to claim 1, characterized in that, The training process of the security level classification model includes: Acquire second user information of multiple users and multiple sets of second operation information corresponding to each user processing multiple services in the target system within multiple time periods, wherein one service corresponds to one set of second operation information; Data preprocessing is performed on the second user information and multiple sets of the second operation information; For each user, extract the second user attribute features corresponding to the second user information of the user, and extract the second security attribute feature set corresponding to each group of the second operation information of the user. Combine each second security attribute feature set with the second user attribute features to form a second operation feature set, wherein the second security attribute feature set includes security attribute features of multiple security dimensions. The security level classification model is obtained by training a clustering model using all the second operation feature sets corresponding to multiple users.

4. The method according to claim 3, characterized in that, The security level classification model is obtained by training a clustering model using all the second operation feature sets corresponding to multiple users, including: Multiple clustering models with identical structures are constructed, and a K value is assigned to each clustering model. The multiple clustering models all use the K-means algorithm, and the K values ​​corresponding to different clustering models are different. For each clustering model, all the second operational feature sets are input into the clustering model to determine the operational vector corresponding to each second operational feature set; the clustering model randomly determines K operational vectors as cluster centers based on the corresponding K value, and performs the following iterative process until the algorithm converges: cluster all the operational vectors based on the K cluster centers to obtain K clusters; for each cluster, determine the center point of multiple operational vectors in the cluster as a new cluster center; when the newly determined K cluster centers are the same as the previously determined K cluster centers, or when the number of iterations reaches a preset threshold, the algorithm is determined to have converged, and the clustering model training is completed; For each trained clustering model, determine multiple clusters obtained by the clustering model from clustering all the operation vectors; for each cluster, determine the variance of multiple operation vectors in the cluster, and determine the threshold interval corresponding to the variance from multiple preset threshold intervals, wherein each threshold interval corresponds to a preset security level; for each security level, determine the number of clusters corresponding to the security level, and determine the standard deviation of the number of clusters corresponding to each security level. The clustering model with the smallest standard deviation is determined as the security level classification model.

5. The method according to claim 1, characterized in that, Adjusting the target user's access permissions to the target system based on the target security credit score includes: The target operation permission level corresponding to the target security credit score is determined from the preset permission management table. The permission management table stores the operation permission levels corresponding to different security credit score ranges. The larger the security credit score range, the higher the operation permission level. Adjust the target user's access permissions to the target system based on the target access permission level.

6. A user access control device, characterized in that, include: The acquisition module is used to acquire the first user information of the target user and multiple sets of first operation information corresponding to the target user processing multiple services in the target system within the target time period, wherein one service corresponds to one set of first operation information; The feature determination module is used to determine the first user attribute feature corresponding to the first user information and to determine the first security attribute feature set corresponding to each group of the first operation information. This includes: preprocessing the first user information and multiple groups of the first operation information; extracting the first user attribute feature corresponding to the preprocessed first user information; determining multiple target security dimensions based on the system type of the target system, and extracting the security attribute features of the multiple target security dimensions corresponding to each group of the preprocessed first operation information to form the first security attribute feature set. The target security dimensions include at least two of the following categories: data security, data integrity, data availability, data authentication, data non-repudiation, and data auditability. The feature determination module is also used to combine each first security attribute feature set with the first user attribute feature to form a first operation feature set. The first security attribute feature set includes security attribute features of multiple security dimensions. The analysis module is used to analyze each of the first operation feature sets using a pre-trained security level classification model to obtain the first security level corresponding to each group of first operation information. The scoring module is used to determine the target security credit score of the target user based on the weight coefficient corresponding to each first security level and the number of first operation information corresponding to each first security level. The module includes: obtaining a first number of abnormal operations by the target user within a target time period, and obtaining a second number of abnormal operations by all users within the target time period; determining the ratio of the first number to the second number; and determining the difference between 1 and the ratio as the security probability tendency of the target user; determining the weight coefficient corresponding to each first security level from a preset weight coefficient table, and normalizing the number of first operation information corresponding to each first security level; using the weight coefficient corresponding to each first security level to perform a weighted summation of the normalized number of first operation information corresponding to each first security level to obtain a basic security score; and determining the product of the security probability tendency and the basic security score as the target security credit score of the target user. The adjustment module is used to adjust the target user's operation permissions on the target system based on the target security credit score.

7. A computer program product, characterized in that, include: A computer program, wherein when executed by a processor, the computer program implements the user rights management method according to any one of claims 1 to 5.

8. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the user rights management method of any one of claims 1 to 5 through the computer program.

Images