Risk prediction-based access control method, device, medium and program product

Abstract

Embodiments of the present application provide a risk prediction-based access control method, device, medium and program product, and relate to the technical field of access control. The method comprises: in response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current online feature information of the network access request; obtaining historical online feature information corresponding to the access account from a preset information library; determining a risk prediction score of the network access request based on the historical online feature information and the current online feature information; and performing access control on the network access request according to the risk prediction score. Through collecting online feature information of the user and determining a risk prediction score according to the current online feature and the historical online feature of the user, the embodiments of the present application perform access control according to the risk prediction score, thereby effectively improving the flexibility and reliability of the firewall system for security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, in particular to an access control method and device based on risk prediction, a medium and a program product. BACKGROUND

[0002] Firewall systems usually rely on pre-set static rules for real-time traffic monitoring to identify potential threats and provide security protection. This approach can effectively identify and block known malicious traffic, but it relies too much on static rules, lacks situational awareness and predictive ability, and cannot identify security risks outside the coverage of pre-set rules, resulting in low flexibility and reliability of security protection. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide an access control method, device, medium and program product based on risk prediction, to improve the flexibility and reliability of security protection by the firewall.

[0004] In a first aspect, the embodiments of the present application provide an access control method based on risk prediction, comprising:

[0005] In response to a user's network access request, determining the access account corresponding to the network access request, and extracting the current online feature information of the network access request;

[0006] Obtaining historical online feature information corresponding to the access account from a pre-set information library;

[0007] Determining a risk prediction score of the network access request based on the historical online feature information and the current online feature information;

[0008] According to the risk prediction score, the network access request is controlled.

[0009] In the embodiments of the present application, by collecting the online feature information of the user, and determining the risk prediction score according to the current online feature and the historical online feature of the user, the access control is performed according to the risk prediction score result, which effectively improves the flexibility and reliability of security protection by the firewall system.

[0010] In some possible embodiments, the determining of the risk prediction score of the network access request based on the historical online feature information and the current online feature information comprises:

[0011] Obtaining a feature difference comparison result of the historical online feature information and the current online feature information, and determining the risk prediction score of the network access request based on the feature difference comparison result according to a pre-set scoring rule.

[0012] In the embodiments of the present application, the risk prediction score of the current network access request is determined according to the difference between the historical online features and the current online features, and in combination with a preset scoring rule, thereby further improving the accuracy of risk prediction.

[0013] In some possible embodiments, the current online feature information and the historical online feature information have a plurality of corresponding consistent feature dimensions, and the plurality of feature dimensions include at least one of online time, online location, access network type, access device type, and access protocol type.

[0014] The feature difference comparison result of the historical online feature information and the current online feature information is obtained, and a risk prediction score of the network access request is determined according to a preset scoring rule based on the feature difference comparison result, including:

[0015] Respective feature difference comparison sub-results of the historical online feature information and the current online feature information in each feature dimension are obtained.

[0016] A risk prediction score of the network access request is determined according to a preset scoring rule based on each feature difference comparison sub-result.

[0017] In the embodiments of the present application, the difference between the current online features and the historical online features is obtained according to different feature dimensions, and a risk prediction score of the network access situation is determined according to the difference comparison result of each dimension, thereby further improving the accuracy of risk prediction.

[0018] In some possible embodiments, the risk prediction score of the network access request is determined based on the historical online feature information and the current online feature information, including:

[0019] The resource occupation of the firewall system is obtained, and a target scoring model corresponding to the resource occupation is selected from a plurality of preset scoring models.

[0020] The target scoring model is used to determine the risk prediction score of the network access request based on the historical online feature information and the current online feature information.

[0021] In the embodiments of the present application, different scoring models are dynamically loaded according to the system resource occupation, thereby further improving the efficiency and flexibility of risk prediction.

[0022] In some possible embodiments, in response to the network access request of the user, the access account corresponding to the network access request is determined, and the current online feature information of the network access request is extracted, including:

[0023] In response to a network access request of a user, in a case where it is determined that the network access request meets an access condition based on a preset static rule, an access account corresponding to the network access request is determined, and current online feature information of the network access request is extracted.

[0024] In the embodiments of the present application, by first matching the access request based on the static rule, after it is determined that the access condition corresponding to the static rule is met, online feature information is obtained for risk prediction scoring, thereby further improving the flexibility of the firewall system for security protection.

[0025] In some possible embodiments, the determining of the risk prediction score of the network access request based on the historical online feature information and the current online feature information comprises:

[0026] determining a risk prediction initial score based on the historical online feature information and the current online feature information;

[0027] determining a score credibility weight of the access account, and determining the risk prediction score of the network access request based on the credibility weight and the risk prediction initial score.

[0028] In the embodiments of the present application, by obtaining the score credibility weight of the current access account to comprehensively calculate the risk prediction score of the current network access request, the accuracy of risk prediction is further improved.

[0029] In some possible embodiments, the access control method based on risk prediction further comprises:

[0030] monitoring a storage duration of each piece of historical online feature information in the information library in real time, and performing data cleaning on historical online feature information with a storage duration exceeding a preset duration threshold.

[0031] In the embodiments of the present application, by monitoring the storage duration of the historical online feature information in real time and deleting expired information in time, the accuracy of risk prediction is further improved.

[0032] In a second aspect, the embodiments of the present application provide an access control device based on risk prediction, comprising:

[0033] a request response module configured to determine an access account corresponding to a network access request of a user in response to the network access request, and extract current online feature information of the network access request;

[0034] an information acquisition module configured to acquire historical online feature information corresponding to the access account from a preset information library;

[0035] a risk prediction module, configured to determine a risk prediction score of the network access request based on the historical online feature information and the current online feature information;

[0036] an access control module, configured to perform access control on the network access request according to the risk prediction score.

[0037] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor, when executing the program, can implement the method in any of the embodiments of the first aspect.

[0038] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program, when run by a processor, can implement the method in any of the embodiments of the first aspect.

[0039] In a fifth aspect, a computer program product is provided, which includes a computer program, and the computer program, when executed by a processor, can implement the method in any of the embodiments of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0041] Figure 1 a flowchart of a risk prediction-based access control method provided by the embodiments of the present application;

[0042] Figure 2 a structural diagram of a risk prediction-based access control device provided by the embodiments of the present application;

[0043] Figure 3 a structural diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0045] It should be noted that similar reference numerals and letters refer to like items throughout the accompanying drawings, and once an item is defined in one drawing, it is not necessary to further define and explain it in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are only used to distinguish description, and cannot be understood as indicating or implying relative importance.

[0046] It should be noted that the existing firewall system mainly relies on static rules for real-time traffic monitoring. Due to the lack of context awareness capability, it is unable to dynamically adjust the protection strategy according to the context information such as network activity, time, location, device type, etc., resulting in that the firewall system may fail in some complex attack scenarios, such as advanced persistent threat (APT) or internal threat, etc. Therefore, the existing firewall system has low flexibility and reliability in security protection.

[0047] In view of this, the embodiment of the present application provides a risk prediction based access control method, which continuously collects the online feature information of the user, and performs user online context awareness according to the current online feature and the historical online feature, so as to identify the security risk situation outside the coverage range of the static rules, and effectively improve the flexibility and reliability of the firewall system in security protection.

[0048] As shown in Figure 1 The risk prediction based access control method provided by the embodiment of the present application can include the following steps:

[0049] S1, in response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current online feature information of the network access request.

[0050] It should be noted that the risk prediction based access control method of the embodiment of the present application can be executed by a firewall system. When the user logs in a client to access the data of a business system through a network, the access control needs to be performed by the firewall system.

[0051] Specifically, when the user initiates data access to the business system, the network access request needs to pass through the detection of the firewall system first. After the firewall system receives the network access request of the user, the preset rule is used to extract the online feature information (current online feature information) corresponding to the user. At the same time, the account information (access account) used by the user to log in the system is identified according to the network access request, which is used to query the historical online feature information of the access account.

[0052] S2, obtaining the historical online feature information corresponding to the access account from a preset information database.

[0053] It should be noted that the firewall system is built-in with a module (for example, which can be called a context awareness module) for collecting user online feature information, and the context awareness module can be built-in in the firewall forwarding process, and each time after the traffic is released and forwarded (for example, the traffic is detected based on a preset static rule and is released or intercepted according to the detection result), the online feature information corresponding to the traffic is collected and recorded, and is stored in a preset information library. It can be understood that the collected online feature information can be arranged and stored in the form of user account (access account) as a data unit, and a piece of online feature information can be generated based on each access to the business system.

[0054] Based on this, after receiving the current network access request of the user and extracting the access account thereof, the information library can be queried to obtain the historical online feature information corresponding to the access account (including a plurality of pieces of historical collected online feature information).

[0055] S3, determining a risk prediction score of the network access request based on the historical online feature information and the current online feature information.

[0056] Then, according to the current online feature information and the historical online feature information, a risk prediction score can be determined based on a preset rule.

[0057] Exemplarily, in a training stage, a trained risk prediction score model can be obtained based on pre-collected current online feature sample information, historical online feature sample information, and corresponding risk prediction score label results. Then, in an application stage, the historical online feature information and the current online feature information are input into the trained risk prediction score model to obtain a risk prediction score corresponding to the current network access request output by the risk prediction score model.

[0058] S4, performing access control on the network access request according to the risk prediction score.

[0059] Specifically, the network access request can be controlled according to the risk prediction score. Exemplarily, if the risk prediction score is higher than a preset score threshold, the network access request is allowed to pass through the firewall system (the corresponding packet / traffic is released); otherwise, the network access request is rejected to pass through the firewall system (the corresponding packet / traffic is intercepted), or a network access exception alarm is issued, and whether to allow the network access request is determined by manual intervention.

[0060] Based on this, by collecting the user's online feature information, and according to the user's current online feature and historical online feature, the risk prediction score is predicted, and finally the access control is carried out according to the risk prediction score, so as to realize the risk identification and traffic control of the traffic by departing from the static rule, and the threat behavior can be predicted and defense measures can be taken before it evolves into a real attack, thereby effectively improving the flexibility and reliability of the firewall system for security protection.

[0061] In some possible embodiments, the step S3 of determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information can include:

[0062] S301, obtain the feature difference comparison result of the historical online feature information and the current online feature information, and determine the risk prediction score of the network access request according to the preset scoring rule based on the feature difference comparison result.

[0063] It should be noted that according to the preset scoring rule, the difference degree of the current online feature information and the historical online feature information can be calculated first, and then the risk prediction score of the current network access request is determined based on the corresponding relationship between the difference degree and the score.

[0064] Based on this, by determining the risk prediction score of the current network access request according to the difference between the historical online feature and the current online feature and combining the preset scoring rule, the accuracy of risk prediction is further improved.

[0065] In some possible embodiments, the current online feature information and the historical online feature information have a plurality of corresponding consistent feature dimensions, and the plurality of feature dimensions include at least one of online time, online location, access network type, access device type and access protocol type.

[0066] The step S301 of obtaining the feature difference comparison result of the historical online feature information and the current online feature information, and determining the risk prediction score of the network access request according to the preset scoring rule based on the feature difference comparison result can include:

[0067] S3011, respectively obtain the corresponding feature difference comparison sub result of the historical online feature information and the current online feature information in each feature dimension;

[0068] S3012, determine the risk prediction score of the network access request according to the preset scoring rule based on each feature difference comparison sub result.

[0069] It should be noted that, in order to improve the data alignment and the scoring accuracy, the current online feature information and the historical online feature information can be set to collect information according to the same dimension, and the feature dimension of the online feature information can include one or more of the following: online time (such as online time period every day, for example, 8-12am, 14-18pm, etc.), online location (determined according to IP address, such as a city, a region, etc.), access network type (such as wired / wireless access, LAN access, broadband / fiber access, mobile terminal / personal computer access, etc.), access device type (such as mobile phone, tablet, personal computer, etc.) and access protocol type (such as HTTP, TCP, FTP, etc.). Alternatively, the corresponding online duration, system user traffic throughput rate, new rate, etc. information can also be used as an analysis object.

[0070] In the process of calculating the risk prediction score, the feature dimension can be used as the calculation dimension, and the feature difference comparison sub-result of the historical online feature information and the current online feature information in each feature dimension can be calculated respectively; then the initial score corresponding to each feature difference comparison sub-result is determined according to the preset scoring rule, and finally the initial scores are weighted and averaged to obtain the risk prediction score corresponding to the network access request.

[0071] For example, according to the historical online feature information, it can be determined that the online time of a certain access account is A point to B point every day, the online location is C point, and the access network type is D type; and according to the current online feature information, it is identified that the current online time of the access account is E, which is not within the range of A-B, the online location is F, which is different from C point, and the access network type is G, which is different from D type; then according to the preset rule, it can be determined that the feature difference comparison sub-result of the historical online feature information and the current online feature information in each feature dimension is 100%, and according to the preset scoring rule, the risk prediction score of the network access request is 0, which is lower than the preset threshold (such as 60), so it is determined that the network access request is invalid, and the corresponding message and traffic of the request are intercepted.

[0072] Therefore, by obtaining the difference between the current online feature and the historical online feature according to different feature dimensions, and determining the risk prediction score of the network access according to the difference comparison result of each dimension, the accuracy of risk prediction is further improved.

[0073] In some possible embodiments, step S3, determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information, can include:

[0074] S311, obtaining the resource occupation of the firewall system, selecting a target scoring model corresponding to the resource occupation from a plurality of preset scoring models;

[0075] S312, determining, by using the target scoring model, a risk prediction score of the network access request based on the historical online feature information and the current online feature information.

[0076] It should be noted that in the process of calculating the risk prediction score, different scoring models can be adaptively obtained in real time according to the current resource occupation of the firewall system (including CPU, memory, hard disk, etc.) to perform scoring calculation. Among them, a plurality of scoring models can be pre-configured, and the corresponding resource occupation condition interval range of each scoring model is set, and the corresponding target scoring model is determined according to which interval range the current resource occupation condition is in.

[0077] Exemplarily, when the firewall system resources are relatively abundant (the computing resources are relatively idle), a large data deep analysis model such as clustering analysis and LSTM can be used to calculate the risk prediction score; when the firewall system resources are relatively scarce (the computing resources are relatively busy), a scoring model with relatively low computational complexity can be used, for example, a weighted calculation method according to the difference comparison results of each feature dimension of the current online feature and the historical online feature.

[0078] Based on this, by dynamically loading different scoring models according to the system resource occupation, the efficiency and flexibility of risk prediction are further improved.

[0079] In some possible embodiments, step S1, in response to the network access request of the user, determining the access account corresponding to the network access request, and extracting the current online feature information of the network access request, can include:

[0080] S101, in response to the network access request of the user, in the case where it is judged based on the preset static rule that the network access request meets the access condition, determining the access account corresponding to the network access request, and extracting the current online feature information of the network access request.

[0081] It should be noted that since the access control strategy based on online scenario perception of the embodiments of the present application has a certain ambiguity compared with the relatively absolute access control mode based on static rules, therefore, before using the access control strategy based on online scenario perception, a traffic detection process based on static rules can be performed first.

[0082] Specifically, after receiving the network access request of the user, firstly, the network access request is detected based on preset static rules, and an existing malicious traffic detection (such as blacklist, whitelist matching, etc.) can be used to detect whether the network access request meets the access condition set based on the static rules; if not, the network access request is directly rejected (the corresponding packet / traffic is intercepted), and the access control strategy based on the online scenario perception does not need to be executed; if the access condition set based on the static rules is met, the access control strategy based on the online scenario perception is further executed, and the related processes of steps S1 to S4 are specifically referred to.

[0083] Therefore, by first detecting the access request based on the static rules, after judging that the access condition corresponding to the static rules is met, the online feature information is acquired to perform risk prediction scoring and access control based on the risk prediction score, thereby further improving the security and flexibility of the firewall system for security protection.

[0084] In some possible embodiments, step S3 of determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information can include:

[0085] S321, determining a risk prediction initial score based on the historical online feature information and the current online feature information;

[0086] S322, determining a score credibility weight of the access account, and determining the risk prediction score of the network access request based on the credibility weight and the risk prediction initial score.

[0087] It should be noted that in the process of calculating the risk prediction score of the network access request, the score credibility weight of the current access account can be determined based on the preset credibility evaluation rule, and the final risk prediction score is obtained in combination with the credibility weight.

[0088] For example, the data amount of the historical online feature information currently stored by the access account (the number of historical online feature information is taken as the data amount each time the firewall system generates a piece of historical online feature information) can be acquired, and the score credibility weight of the access account is determined according to the preset correspondence between the data amount and the score credibility weight.

[0089] For example, the number of times of judgment exceptions that the risk prediction access control result of the same access account is inconsistent with the manual judgment access control result can also be recorded, and the score credibility weight of the access account is determined according to the preset correspondence between the number of times and the score credibility weight. Wherein, in the case that each time the risk prediction score is determined to be an abnormal access, and subsequently the manual judgment is a normal access, the number of times of judgment exceptions of the access account is recorded +1.

[0090] Based on this, by acquiring in real time and combining the risk prediction score of the current network access request with the credibility weight of the access account score, the credibility of the risk prediction is further increased, and the reliability of the access control based on the risk prediction is improved.

[0091] In some possible embodiments, the access control method based on risk prediction can further include the following steps.

[0092] S5, real-time monitoring the storage duration of each piece of historical online feature information in the information library, and performing data cleaning on the historical online feature information whose storage duration exceeds a preset duration threshold.

[0093] It should be noted that, in order to ensure that the historical online feature information stored in the information library has high timeliness, an effective storage period can be set, and the stored information exceeding the period can be deleted in time.

[0094] Specifically, the storage time of the historical online feature information is recorded each time the historical online feature information is stored, and then the storage duration of each piece of historical online feature information is monitored in real time according to the storage time, and the historical online feature information is cleaned up when the storage duration exceeds the preset duration threshold.

[0095] Based on this, by monitoring the storage duration of the historical online feature information in real time and deleting the expired information in time, the timeliness of the historical online feature information is improved, which is conducive to improving the accuracy of the risk prediction score calculated based on the historical online feature information, and further improving the accuracy of the access control based on the risk prediction score.

[0096] Please refer to Figure 2 , Figure 2 The composition block diagram of the access control device based on risk prediction provided by some embodiments of the present application is shown. It should be understood that the access control device based on risk prediction corresponds to the above-mentioned Figure 1 method embodiments, and can perform each step involved in the above-mentioned method embodiments. The specific functions of the access control device based on risk prediction can be referred to the description in the above, and the detailed description is appropriately omitted here to avoid repetition.

[0097] Figure 2 The access control device based on risk prediction includes at least one software function module which can be stored in the memory in the form of software or firmware or solidified in the access control device based on risk prediction, and the access control device based on risk prediction includes:

[0098] The request response module 210 is configured to determine the access account corresponding to the network access request of the user and extract the current online feature information of the network access request in response to the network access request of the user.

[0099] Information acquisition module 220 is used to acquire historical internet access feature information corresponding to the access account from a preset information database;

[0100] Risk prediction module 230 is used to determine the risk prediction score of network access requests based on historical internet access characteristics and current internet access characteristics.

[0101] Access control module 240 is used to perform access control on network access requests based on risk prediction scores.

[0102] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention. The access control device based on risk prediction provided by the embodiments of the present invention can implement the access control method based on risk prediction provided by any one of the method embodiments of the present invention.

[0103] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0104] like Figure 3 As shown, some embodiments of this application provide an electronic device 300, which includes: a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320. When the processor 320 reads the program from the memory 310 via a bus 330 and executes the program, it can implement any of the methods included in the above-described risk prediction-based access control method.

[0105] Processor 320 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 320 may be a microprocessor.

[0106] The memory 310 can be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 320 of this disclosure embodiment can be used to execute the instructions in the memory 310 to implement the methods shown above. The memory 310 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0107] Some embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, describes the method described in the method embodiments.

[0108] Some embodiments of the present application also provide a computer program product, which, when running on a computer, causes the computer to perform the method of the method embodiments.

[0109] It should be noted that each of the above-mentioned embodiments of the present application is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0110] In several embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are only schematic. For example, the flowcharts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the devices, methods and computer program products according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from that shown in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0111] In addition, each functional module in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0112] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts of the prior art that make contributions or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0113] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0114] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0115] It should be noted that, in this document, the terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A risk prediction based access control method, characterized in that, The method comprises: in response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current online feature information of the network access request; obtaining historical online feature information corresponding to the access account from a preset information base; determining a risk prediction score of the network access request based on the historical online feature information and the current online feature information; controlling access of the network access request according to the risk prediction score; the method further comprises: determining a risk prediction initial score based on the historical online feature information and the current online feature information; determining a score credibility weight of the access account, and determining the risk prediction score of the network access request based on the score credibility weight and the risk prediction initial score; the method further comprises: obtaining a data amount of the historical online feature information currently stored by the access account, and determining a current score credibility weight of the access account according to a preset corresponding relationship between data amount and score credibility weight; or, recording a number of times of judgment exceptions that the risk prediction access control result of the same access account is inconsistent with the manual judgment access control result, and determining a current score credibility weight of the access account according to a preset corresponding relationship between the number of times and the score credibility weight.

2. The risk prediction based access control method of claim 1, wherein, the method further comprises: obtaining a feature difference comparison result of the historical online feature information and the current online feature information, and determining the risk prediction score of the network access request according to a preset scoring rule based on the feature difference comparison result.

3. The risk prediction based access control method of claim 2, wherein, the current online feature information and the historical online feature information have a plurality of corresponding consistent feature dimensions, and the plurality of feature dimensions include at least one of online time, online location, access network type, access device type and access protocol type; the method further comprises: respectively obtaining a plurality of feature difference comparison sub-results corresponding to the historical online feature information and the current online feature information in each feature dimension; determining the risk prediction score of the network access request according to a preset scoring rule based on the plurality of feature difference comparison sub-results.

4. The risk prediction based access control method of claim 1, wherein, the method further comprises: obtaining a resource occupation condition of a firewall system, and selecting a target scoring model corresponding to the resource occupation condition from a plurality of preset scoring models; determining the risk prediction score of the network access request based on the historical online feature information and the current online feature information by using the target scoring model.

5. The risk prediction based access control method of claim 1, wherein, The method comprises the following steps: In response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current online feature information of the network access request, comprising:

6. The risk prediction based access control method of claim 1, wherein, In response to a network access request of a user, determining an access account corresponding to the network access request, and extracting current online feature information of the network access request, comprising: Further comprising:

7. An electronic device, comprising: Real-time monitoring of the storage time length of each piece of historical online feature information in the information base, and data cleaning of historical online feature information with a storage time length exceeding a preset time length threshold.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is run by the processor to implement the risk prediction based access control method in any one of claims 1-6.

9. A computer program product, characterised in that, The computer readable storage medium stores a computer program, and the computer program is run by the processor to implement the risk prediction based access control method in any one of claims 1-6. The computer program product comprises a computer program, and the computer program is run by the processor to implement the risk prediction based access control method in any one of claims 1-6.

Images