Risk prediction-based access control method and device, medium and program product

Abstract

The embodiment of the invention provides an access control method and device based on risk prediction, a medium and a program product, and relates to the technical field of access control. The method comprises the following steps: in response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current internet access feature information of the network access request; acquiring historical internet surfing feature information corresponding to the access account from a preset information base; determining a risk prediction score of the network access request based on the historical Internet access feature information and the current Internet access feature information; and performing access control on the network access request according to the risk prediction score. According to the embodiment of the invention, the Internet surfing feature information of the user is collected, and the risk prediction scoring is performed according to the current Internet surfing feature and the historical Internet surfing feature of the user, so that access control is performed according to the risk prediction scoring result, and the flexibility and reliability of security protection of the firewall system are effectively improved.

Description

Technical Field

[0001] The present application relates to the field of access control technology, and in particular, to an access control method, device, medium and program product based on risk prediction. Background Art

[0002] Firewall systems usually rely on pre-set static rules to monitor traffic in real time to identify potential threats and provide security protection. This approach can effectively identify and block known malicious traffic, but it relies too much on static rules, lacks situational awareness and prediction capabilities, and cannot identify security risks outside the coverage of preset rules. The flexibility and reliability of security protection are not high. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide an access control method, device, medium and program product based on risk prediction, so as to improve the flexibility and reliability of firewall security protection.

[0004] In a first aspect, an embodiment of the present application provides an access control method based on risk prediction, comprising:

[0005] In response to a network access request from a user, determining an access account corresponding to the network access request, and extracting current Internet access feature information of the network access request;

[0006] Acquire historical Internet access feature information corresponding to the access account from a preset information database;

[0007] Determine a risk prediction score for the network access request based on the historical online feature information and the current online feature information;

[0008] Access control is performed on the network access request according to the risk prediction score.

[0009] In the embodiment of the present application, by collecting the user's Internet access feature information and performing risk prediction scoring based on the user's current Internet access features and historical Internet access features, access control is performed based on the risk prediction scoring results, thereby effectively improving the flexibility and reliability of the firewall system in performing security protection.

[0010] In some possible embodiments, determining the risk prediction score of the network access request based on the historical Internet access feature information and the current Internet access feature information includes:

[0011] A feature difference comparison result between the historical online feature information and the current online feature information is obtained, and a risk prediction score of the network access request is determined based on the feature difference comparison result and in accordance with a preset scoring rule.

[0012] In the embodiment of the present application, the risk prediction score of the current network access request is determined based on the difference between the historical Internet access characteristics and the current Internet access characteristics in combination with preset scoring rules, thereby further improving the accuracy of risk prediction.

[0013] In some possible embodiments, the current online feature information and the historical online feature information have corresponding and consistent feature dimensions, and the feature dimensions include at least one of online time, online location, access network type, access device type, and access protocol type;

[0014] The obtaining of a feature difference comparison result between the historical online feature information and the current online feature information, and determining a risk prediction score of the network access request based on the feature difference comparison result and according to a preset scoring rule, includes:

[0015] Respectively obtaining feature difference comparison sub-results corresponding to the historical online feature information and the current online feature information in each feature dimension;

[0016] Based on each of the feature difference comparison sub-results, a risk prediction score for the network access request is determined according to a preset scoring rule.

[0017] In an embodiment of the present application, the accuracy of risk prediction is further improved by obtaining the difference between the current Internet access characteristics and the historical Internet access characteristics according to different feature dimensions, and determining the risk prediction score of the network access situation based on the difference comparison results of each dimension.

[0018] In some possible embodiments, determining the risk prediction score of the network access request based on the historical Internet access feature information and the current Internet access feature information includes:

[0019] Obtain resource occupancy of the firewall system, and select a target scoring model corresponding to the resource occupancy from a plurality of preset scoring models;

[0020] The target scoring model is used to determine the risk prediction score of the network access request based on the historical online feature information and the current online feature information.

[0021] In an embodiment of the present application, different scoring models are dynamically loaded according to the system resource usage, thereby further improving the efficiency and flexibility of risk prediction.

[0022] In some possible embodiments, responding to a network access request from a user, determining an access account corresponding to the network access request, and extracting current Internet access feature information of the network access request includes:

[0023] In response to a network access request from a user, if it is determined based on a preset static rule that the network access request meets an access condition, an access account corresponding to the network access request is determined, and current Internet access feature information of the network access request is extracted.

[0024] In an embodiment of the present application, by first matching access requests based on static rules, and then obtaining Internet access feature information for risk prediction scoring after determining whether the access conditions corresponding to the static rules are met, the flexibility of the firewall system in performing security protection is further improved.

[0025] In some possible embodiments, determining the risk prediction score of the network access request based on the historical Internet access feature information and the current Internet access feature information includes:

[0026] Determine an initial risk prediction score based on the historical Internet access feature information and the current Internet access feature information;

[0027] A scoring credibility weight of the access account is determined, and a risk prediction score of the network access request is determined based on the credibility weight and the initial risk prediction score.

[0028] In the embodiment of the present application, the risk prediction score of the current network access request is comprehensively calculated by obtaining the score credibility weight of the current access account, thereby further improving the accuracy of the risk prediction.

[0029] In some possible embodiments, the risk prediction-based access control method further includes:

[0030] The storage time of each piece of historical Internet access characteristic information in the information database is monitored in real time, and the historical Internet access characteristic information whose storage time exceeds a preset time threshold is cleaned up.

[0031] In the embodiment of the present application, the accuracy of risk prediction is further improved by real-time monitoring of the storage duration of historical Internet access feature information and timely deleting expired information.

[0032] In a second aspect, an embodiment of the present application provides an access control device based on risk prediction, comprising:

[0033] A request response module, used to respond to a user's network access request, determine the access account corresponding to the network access request, and extract current Internet access feature information of the network access request;

[0034] An information acquisition module, used to acquire historical Internet access feature information corresponding to the access account from a preset information database;

[0035] A risk prediction module, configured to determine a risk prediction score for the network access request based on the historical Internet access feature information and the current Internet access feature information;

[0036] An access control module is used to perform access control on the network access request according to the risk prediction score.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0039] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A schematic diagram of a process flow of a risk prediction-based access control method provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of the structure of an access control device based on risk prediction provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0045] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0046] It should be noted that the existing firewall system mainly relies on static rules for real-time traffic monitoring. Due to the lack of situational awareness, it is impossible to dynamically adjust the protection strategy according to situational information such as network activity, time, location, device type, etc., which may cause the firewall system to fail in some complex attack scenarios, such as multi-stage attacks (Advanced Persistent Threat, APT) or internal threats. Therefore, the flexibility and reliability of the existing firewall system for security protection are not high.

[0047] To this end, an embodiment of the present application provides an access control method based on risk prediction, which continuously collects users' Internet access feature information and performs user Internet access scenario perception based on current Internet access features and historical Internet access features, thereby identifying security risk situations outside the coverage of static rules and effectively improving the flexibility and reliability of the firewall system for security protection.

[0048] like Figure 1 As shown, the embodiment of the present application provides an access control method based on risk prediction, which may include the following steps:

[0049] S1. In response to a network access request from a user, determine an access account corresponding to the network access request, and extract current Internet access feature information of the network access request.

[0050] It should be noted that the risk prediction-based access control method of the embodiment of the present application can be executed by a firewall system. When a user logs in to a client and accesses data in a business system through a network, access control needs to be performed through a firewall system.

[0051] Specifically, when a user initiates data access to a business system, the network access request must first be detected by the firewall system. When the firewall system receives the user's network access request, it extracts the user's corresponding online feature information (current online feature information) according to the preset rules. At the same time, the account information (access account) used by the user to log in to the system is identified based on the network access request, which is used to query the historical online feature information of the access account.

[0052] S2. Obtain historical Internet access feature information corresponding to the access account from a preset information database.

[0053] It should be noted that the firewall system has a built-in module for collecting user Internet access feature information (for example, it can be called a context-aware module). The context-aware module can be built into the firewall forwarding process. Each time the traffic is released and forwarded (for example, the traffic is detected based on preset static rules and released or intercepted according to the detection results), the Internet access feature information corresponding to the traffic is collected and recorded and stored in a preset information library. It is understandable that the collected Internet access feature information can be sorted and stored with the user account (access account) as the data unit, and an Internet access feature information can be generated based on each access to the business system.

[0054] Based on this, after receiving the user's current network access request and extracting its access account, the information library can be queried to obtain the historical Internet access feature information corresponding to the access account (including several pieces of historically collected Internet access feature information).

[0055] S3. Determine a risk prediction score for the network access request based on historical Internet access feature information and current Internet access feature information.

[0056] Then, according to the current Internet access characteristic information and the historical Internet access characteristic information, risk prediction scoring can be performed based on preset rules.

[0057] Exemplarily, during the training phase, model training can be performed based on pre-collected current Internet access feature sample information, historical Internet access feature sample information, and their corresponding risk prediction score annotation results to obtain a trained risk prediction score model; then during the application phase, the historical Internet access feature information and the current Internet access feature information are input into the trained risk prediction score model to obtain the risk prediction score corresponding to the current network access request output by the risk prediction score model.

[0058] S4. Perform access control on network access requests based on risk prediction scores.

[0059] Specifically, access control can be performed on network access requests based on the risk prediction score. For example, if the risk prediction score is higher than the preset score threshold, the network access request is allowed to pass through the firewall system (the corresponding message / traffic is released); otherwise, the network access request is denied to pass through the firewall system (the corresponding message / traffic is intercepted), or a network access abnormality alarm is issued, and manual intervention is performed to determine whether to allow the network access request.

[0060] Based on this, by collecting users' Internet access feature information, and making risk prediction scores based on users' current and historical Internet access features, and finally performing access control based on the risk prediction scores, we can break away from static rules and implement risk identification and traffic control. Threat behaviors can be predicted and defensive measures can be taken before they evolve into real attacks, thereby effectively improving the flexibility and reliability of the firewall system in providing security protection.

[0061] In some possible embodiments, step S3, determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information, may include:

[0062] S301, obtaining a feature difference comparison result between historical Internet access feature information and current Internet access feature information, and determining a risk prediction score for a network access request based on the feature difference comparison result and according to a preset scoring rule.

[0063] It should be noted that, according to the preset scoring rules, the distinction between the current online feature information and the historical online feature information can be calculated first, and then the risk prediction score of the current network access request can be determined based on the corresponding relationship between the distinction and the score.

[0064] Based on this, the risk prediction score of the current network access request is determined according to the difference between the historical Internet access characteristics and the current Internet access characteristics, and combined with the preset scoring rules, so as to further improve the accuracy of risk prediction.

[0065] In some possible embodiments, the current online feature information and the historical online feature information have corresponding and consistent several feature dimensions, and the several feature dimensions include at least one of online time, online location, access network type, access device type, and access protocol type;

[0066] Step S301, obtaining a feature difference comparison result between historical Internet access feature information and current Internet access feature information, and determining a risk prediction score of a network access request based on the feature difference comparison result and according to a preset scoring rule, may include:

[0067] S3011, respectively obtaining feature difference comparison sub-results corresponding to the historical online feature information and the current online feature information in each feature dimension;

[0068] S3012: Determine a risk prediction score for the network access request based on the feature difference comparison sub-results according to a preset scoring rule.

[0069] It should be noted that, in order to improve the neatness of data and the accuracy of scoring, it can be set that the current Internet access characteristic information and the historical Internet access characteristic information are collected according to the same dimension, wherein the characteristic dimension of the Internet access characteristic information may include one or more of the following: Internet access time (such as daily Internet access time, such as 8-12 o'clock in the morning, 14-18 o'clock in the afternoon, etc.), Internet access location (determined by IP address, such as a certain city, a certain area, etc.), access network type (such as wired / wireless access, LAN access, broadband / fiber access, mobile terminal / personal computer access, etc.), access device type (such as mobile phones, tablets, personal computers, etc.) and access protocol type (such as HTTP, TCP, FTP, etc.). Optionally, the corresponding Internet access duration, system user traffic throughput rate, new creation rate and other information can also be used as analysis objects.

[0070] In the process of calculating the risk prediction score, the feature dimension can be used as the calculation dimension to calculate the feature difference comparison sub-results of the historical Internet access feature information and the current Internet access feature information in each feature dimension; then the initial score corresponding to each feature difference comparison sub-result is determined according to the preset scoring rules, and finally these initial scores are weighted averaged to obtain the risk prediction score corresponding to the network access request.

[0071] For example, based on historical Internet access feature information, it can be determined that the Internet access time of a certain access account is from point A to point B every day, the Internet access location is point C, and the access network type is type D; and based on current Internet access feature information, it is identified that the current Internet access time of the access account is E, which is not within the range of AB, the Internet access location is F, which is different from point C, and the access network type is G, which is different from type D; then according to the preset rules, it can be determined that the feature difference comparison sub-results of the historical Internet access feature information and the current Internet access feature information in each feature dimension are both 100%, and according to the preset scoring rules, it is determined that the risk prediction score of this network access request is 0 points, which is lower than the preset threshold (such as 60 points), so the network access request is determined to be invalid, and the corresponding message and traffic of the request are intercepted.

[0072] Based on this, the differences between current Internet access characteristics and historical Internet access characteristics are obtained according to different feature dimensions, and the risk prediction score of network access is determined according to the difference comparison results of each dimension, thereby further improving the accuracy of risk prediction.

[0073] In some possible embodiments, step S3, determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information, may include:

[0074] S311, obtaining resource occupancy of the firewall system, and selecting a target scoring model corresponding to the resource occupancy from a plurality of preset scoring models;

[0075] S312: Determine the risk prediction score of the network access request based on the historical Internet access feature information and the current Internet access feature information using a target scoring model.

[0076] It should be noted that in the process of calculating the risk prediction score, different scoring models can be adaptively obtained in real time according to the current resource usage of the firewall system (including CPU, memory, hard disk, etc.) to perform score calculation. Among them, multiple scoring models can be pre-configured, and the resource usage ranges corresponding to various scoring models can be set. According to which range the current resource usage is in, the corresponding target scoring model is determined.

[0077] For example, when the firewall system resources are relatively abundant (computing resources are relatively idle), cluster analysis, LSTM and other big data deep analysis models can be used to calculate the risk prediction score; when the firewall system resources are relatively scarce (computing resources are relatively busy), a scoring model with lower computational complexity can be used, such as a weighted calculation method based on the comparison results of the differences in various feature dimensions between the current Internet access characteristics and the historical Internet access characteristics.

[0078] Based on this, different scoring models are dynamically loaded according to the system resource usage, thereby further improving the efficiency and flexibility of risk prediction.

[0079] In some possible embodiments, step S1, in response to a user's network access request, determining an access account corresponding to the network access request, and extracting current Internet access feature information of the network access request, may include:

[0080] S101. In response to a network access request from a user, if it is determined based on a preset static rule that the network access request satisfies an access condition, an access account corresponding to the network access request is determined, and current Internet access feature information of the network access request is extracted.

[0081] It should be noted that since the embodiment of the present application is an access control strategy based on Internet scenario awareness, it has a certain ambiguity compared to the more absolute access control method based on static rules. Therefore, before adopting the access control strategy based on Internet scenario awareness, a traffic detection process based on static rules can be performed first.

[0082] Specifically, after receiving the user's network access request, the network access request is first detected based on the preset static rules. Exemplarily, the existing malicious traffic detection (such as blacklist, whitelist matching, etc.) can be used to detect whether the network access request meets the access conditions set based on the static rules; if not, the network access request is directly rejected (the corresponding message / traffic is intercepted) without executing the access control policy based on Internet access scenario awareness; if it meets the access conditions set based on the static rules, the access control policy based on Internet access scenario awareness is further executed. Please refer to the relevant process of step S1 to step S4 for details.

[0083] Based on this, by first detecting the access request based on static rules, and then obtaining the Internet feature information to perform risk prediction scoring and access control based on the risk prediction scoring after determining whether the access conditions corresponding to the static rules are met, the security and flexibility of the firewall system for security protection are further improved.

[0084] In some possible embodiments, step S3, determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information, may include:

[0085] S321, determining an initial risk prediction score based on historical Internet access feature information and current Internet access feature information;

[0086] S322: Determine the scoring credibility weight of the access account, and determine the risk prediction score of the network access request based on the credibility weight and the initial risk prediction score.

[0087] It should be noted that, in the process of calculating the risk prediction score of the network access request, the score credibility weight of the current access account can be determined based on the preset credibility evaluation rules, and the final risk prediction score can be obtained in combination with the credibility weight.

[0088] Exemplarily, the data volume of the historical Internet access feature information currently stored in the access account can be obtained (each time a historical Internet access feature information is generated through the firewall system, the number of historical Internet access feature information is used as the data volume), and the current score credibility weight of the access account is determined based on the corresponding relationship between the preset data volume and the score credibility weight.

[0089] Exemplarily, the number of abnormal determinations of the same access account where the risk prediction access control result is inconsistent with the manually determined access control result can also be recorded, and the current score credibility weight of the access account can be determined based on the correspondence between the preset number of times and the score credibility weight. In which, each time an abnormal access is determined based on the risk prediction score, and is subsequently manually determined to be a normal access, the number of abnormal determinations for the access account is recorded as +1.

[0090] Based on this, the risk prediction score of the current network access request is comprehensively calculated by obtaining and combining the score credibility weight of the access account in real time, thereby further increasing the credibility of the risk prediction and thus improving the reliability of access control based on risk prediction.

[0091] In some possible embodiments, the risk prediction-based access control method may further include the following steps:

[0092] S5. Monitor the storage duration of each piece of historical Internet access characteristic information in the information database in real time, and clean up the historical Internet access characteristic information whose storage duration exceeds a preset duration threshold.

[0093] It should be noted that in order to ensure that the historical Internet access feature information stored in the information database has a high timeliness, an effective storage period can be set and the stored information that exceeds the period can be deleted in a timely manner.

[0094] Specifically, each time the historical Internet access characteristic information is stored, the corresponding storage time is recorded, and then the storage duration of each piece of historical Internet access characteristic information is monitored in real time according to the storage time. When the storage duration exceeds a preset duration threshold, the data of the piece of historical Internet access characteristic information is cleaned up.

[0095] Based on this, by real-time monitoring of the storage duration of historical Internet feature information and timely deleting expired information, the timeliness of historical Internet feature information can be improved, which is conducive to improving the accuracy of risk prediction scores calculated based on historical Internet feature information, and thus improving the accuracy of access control based on risk prediction scores.

[0096] Please refer to Figure 2 , Figure 2 FIG. 1 is a block diagram showing a composition of an access control device based on risk prediction provided by some embodiments of the present application. It should be understood that the access control device based on risk prediction is similar to the above-mentioned Figure 1 Corresponding to the method embodiment, each step involved in the above method embodiment can be executed. The specific functions of the risk prediction-based access control device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0097] Figure 2 The risk prediction-based access control device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the risk prediction-based access control device, and the risk prediction-based access control device includes:

[0098] The request response module 210 is used to respond to the user's network access request, determine the access account corresponding to the network access request, and extract the current Internet access feature information of the network access request;

[0099] The information acquisition module 220 is used to acquire historical Internet access feature information corresponding to the access account from a preset information database;

[0100] The risk prediction module 230 is used to determine the risk prediction score of the network access request based on the historical Internet access characteristic information and the current Internet access characteristic information;

[0101] The access control module 240 is used to perform access control on network access requests according to the risk prediction score.

[0102] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. The access control device based on risk prediction provided by the embodiment of the present invention can implement the access control method based on risk prediction provided by any method item embodiment of the present invention.

[0103] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0104] like Figure 3 As shown, some embodiments of the present application provide an electronic device 300, which includes: a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320, wherein the processor 320 reads the program from the memory 310 through the bus 330 and executes the program to implement a method of any embodiment of the above-mentioned risk prediction-based access control method.

[0105] Processor 320 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 320 can be a microprocessor.

[0106] The memory 310 may be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 320 of the disclosed embodiment may be used to execute instructions in the memory 310 to implement the method shown above. The memory 310 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0107] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0108] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0109] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0110] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0112] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0113] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0114] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0115] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A risk prediction-based access control method, characterized in that: include: In response to a network access request from a user, determining an access account corresponding to the network access request, and extracting current Internet access feature information of the network access request; Acquire historical Internet access feature information corresponding to the access account from a preset information database; Determine a risk prediction score for the network access request based on the historical online feature information and the current online feature information; Access control is performed on the network access request according to the risk prediction score.

2. The access control method based on risk prediction according to claim 1 is characterized in that: The determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information includes: A feature difference comparison result between the historical online feature information and the current online feature information is obtained, and a risk prediction score of the network access request is determined based on the feature difference comparison result and in accordance with a preset scoring rule.

3. The access control method based on risk prediction according to claim 2 is characterized in that: The current online feature information and the historical online feature information have a number of corresponding and consistent feature dimensions, and the number of feature dimensions include at least one of online time, online location, access network type, access device type, and access protocol type; The obtaining of a feature difference comparison result between the historical online feature information and the current online feature information, and determining a risk prediction score of the network access request based on the feature difference comparison result and according to a preset scoring rule, includes: Respectively obtaining feature difference comparison sub-results corresponding to the historical online feature information and the current online feature information in each feature dimension; Based on each of the feature difference comparison sub-results, a risk prediction score for the network access request is determined according to a preset scoring rule.

4. The access control method based on risk prediction according to claim 1 is characterized in that: The determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information includes: Obtain resource occupancy of the firewall system, and select a target scoring model corresponding to the resource occupancy from a plurality of preset scoring models; The target scoring model is used to determine the risk prediction score of the network access request based on the historical online feature information and the current online feature information.

5. The access control method based on risk prediction according to claim 1 is characterized in that: The step of responding to a network access request from a user, determining an access account corresponding to the network access request, and extracting current Internet access feature information of the network access request includes: In response to a network access request from a user, if it is determined based on a preset static rule that the network access request meets an access condition, an access account corresponding to the network access request is determined, and current Internet access feature information of the network access request is extracted.

6. The access control method based on risk prediction according to claim 1 is characterized in that: The determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information includes: Determine an initial risk prediction score based on the historical Internet access feature information and the current Internet access feature information; Determine a scoring credibility weight of the access account, and determine a risk prediction score of the network access request based on the credibility weight and the initial risk prediction score.

7. The access control method based on risk prediction according to claim 1 is characterized in that: Also includes: The storage time of each piece of historical Internet access characteristic information in the information database is monitored in real time, and the historical Internet access characteristic information whose storage time exceeds a preset time threshold is cleaned up.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the risk prediction-based access control method described in any one of claims 1-7 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the risk prediction-based access control method according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the risk prediction-based access control method described in any one of claims 1 to 7 is implemented.

Images