Server access control method and system based on network security protection

Abstract

The invention discloses a server access control method and system based on network security protection. The method comprises the following steps: dividing server data content into a public area and a limited area; obtaining all access terminals accessing the server, dividing the access terminals into a public area and a limited area based on the access history of the access terminals, and accessing all newly accessed access terminals into the public area; acquiring an access behavior of a newly accessed access terminal in the public area in real time, matching the access behavior with a historical abnormal behavior in the database, and performing abnormality judgment based on a matching result; and dividing the newly accessed access terminal into different security levels based on an abnormal judgment result, and performing different security measures. The method has the advantages that the abnormal behaviors are matched by analyzing the abnormal behavior characteristics, and security threats are effectively prevented. And through differentiated management, real-time monitoring and flow limitation, the stability and safety of the server are guaranteed.

Description

Technical Field

[0001] The present invention relates to security protection technology, and in particular to a server access control method and system based on network security protection. Background Art

[0002] A server access control method and system based on network security protection, which divides server data into public areas and restricted areas. The public area stores public resources, while the restricted area stores sensitive data or private files. For all terminals accessing the server, the system divides them into public areas and restricted areas based on access history records, and assigns newly accessed terminals to the public area by default. By collecting the access behavior of newly accessed terminals in public areas in real time, the system can compare it with historical abnormal behavior data to determine whether there is a trend of abnormal access. The system will classify the terminal into security levels based on the judgment results and take corresponding security measures. This method helps improve the overall security of the server by dynamically evaluating the behavior, history records and security levels of the access terminals, and effectively prevents sensitive data leakage and illegal access.

[0003] The server access control methods currently available on the market mainly include identity authentication, role control, policy control, and network control. Identity authentication confirms the identity of the terminal through the terminal name, password, token, or biometrics. Common methods include single password authentication, two-factor authentication, and multi-factor authentication. Role-based access control simplifies large-scale permission management by assigning roles to terminals and authorizing access rights based on roles. Policy-based access control determines the terminal's access rights to resources based on preset access policies. Policies can be set based on multiple dimensions such as time and location. The above methods are usually used in combination to form a multi-level security protection to ensure that server resources are accessed reasonably and securely. Summary of the invention

[0004] In order to improve the existing server access control method, a server access control method and system based on network security protection is provided. The method divides the public area and the restricted area, monitors the access behavior of the access terminal, detects anomalies in time and divides the security level. Based on the abnormal judgment results, corresponding security measures are taken to ensure data security.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is: A server access control method based on network security protection, characterized by comprising: Divide the server data content into a public area and a restricted area, where the public area stores public resources, information or files, and the restricted area stores sensitive data and private files; Obtain all access terminals that access the server, divide them into public areas and restricted areas based on their access history, and connect all newly connected access terminals to the public area; Collect the access behavior of newly connected access terminals in public areas in real time, match it with the historical abnormal behavior in the database, and make abnormal judgments based on the matching results; Based on the abnormal judgment results, the newly connected access terminals are divided into different security levels and different security measures are taken.

[0006] Preferably, the server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files, specifically including: The public area of ​​the server is open to all non-prohibited access terminals; The restricted area of ​​the server is only accessible to trusted access terminals and common access terminals that have been authenticated by the server.

[0007] Preferably, the acquiring of all access terminals accessing the server, dividing the access terminals into public areas and restricted areas based on their access history, and connecting all newly accessed access terminals to the public area specifically includes: Obtain all access terminals that access the server and query their access history data in the database; If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data; If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

[0008] Preferably, the real-time collection of access behaviors of newly accessed access terminals in public areas, matching with historical abnormal behaviors in a database, and making abnormality judgment based on the matching results specifically include: Based on the historical abnormal data in the database, obtain the access behavior rules when the access terminal is abnormal, and build an abnormal behavior model; Based on the abnormal behavior model, analyze the access behavior of the access terminal collected in real time, and match the access behavior of the access terminal with the abnormal access behavior; Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormal situation of the current access terminal is determined.

[0009] Preferably, the acquiring of the access behavior rules when the access terminal is abnormal based on the historical abnormal data in the database and the construction of the abnormal behavior model specifically include: Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs; Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ; Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern. Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector; The solution formula is:

[0010] in, is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation. It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. is the reconstruction error term, which measures the accuracy of reconstructing the data through the dictionary D and coefficient a.

[0011] Preferably, the analyzing the access behavior of the access terminal collected in real time based on the abnormal behavior model to obtain the matching degree between the access behavior of the access terminal and the abnormal access behavior specifically includes: Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data; Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is:

[0012] in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on, sign() is the sign function, which converts the projection value into a binary hash value; Use hash values ​​to bucket the data, that is, store similar data in the same bucket; Hash the access behavior data of the access terminal collected in real time, map it to the hash space, and find the historical access data bucket with the same hash value; By calculating the cosine similarity between the hash value of the real-time access data collected and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained.

[0013] Preferably, the method of classifying the newly connected access terminal into different security levels based on the abnormality judgment result and taking different security measures specifically includes: Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals; Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of ​​the server; For general terminal access behavior, it is allowed to directly access the data content in the restricted area of ​​the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged; Access behavior of unknown terminals, allowing access to data content in the public area of ​​the server, and real-time monitoring during access; For prohibited terminals, access to the server is not allowed and access is completely prohibited. If prohibited terminal access is detected, it will be blocked immediately.

[0014] Furthermore, a server access control system based on network security protection is characterized by comprising: Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing; Abnormal access model building module: the abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data; Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of the newly accessed access terminal in the public area, and match it with the abnormal behavior model to determine the abnormal behavior of each access terminal; Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal; Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

[0015] Compared with the prior art, the advantages of the present invention are: Newly connected access terminals are connected to the public area by default, which reduces the potential risk of unknown terminals. At the same time, by monitoring their behavior in real time, anomalies can be detected in time to prevent malicious access or data leakage. Secondly, based on the analysis of historical access records, the system can accurately determine which terminals are likely to exhibit abnormal behavior, thereby improving the early warning capability of potential threats. By comparing the access behavior of newly connected terminals with historical abnormal behavior, the system can accurately identify abnormal behavior, and conduct dynamic security assessments based on the degree of abnormality, divide different security levels, and take corresponding security measures. This method based on behavioral analysis and historical data comparison not only improves the ability to prevent unknown threats, but also enhances the speed and accuracy of response to security incidents, effectively reducing the risk of data leakage and attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of server access control of the method and system proposed by the present invention; Figure 2 A schematic diagram of server area division of the method and system proposed in the present invention; Figure 3 A schematic diagram of the division of access terminals of the method and system proposed by the present invention; Figure 4 A schematic diagram of abnormal behavior judgment of the method and system proposed in the present invention; Figure 5 A schematic diagram of constructing an abnormal behavior model of the method and system proposed in the present invention; Figure 6 A schematic diagram of abnormal behavior matching of the method and system proposed in the present invention; Figure 7 A schematic diagram of the safety measures of the method and system proposed in the present invention; Figure 8 This is a schematic diagram of the electronic device in this solution; Fig. 9 This is a schematic diagram of the computer-readable storage medium structure in this solution. DETAILED DESCRIPTION

[0017] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0018] A server access control system based on network security protection, comprising: Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing; Abnormal access model building module: the abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data; Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of the newly accessed access terminal in the public area, and match it with the abnormal behavior model to determine the abnormal behavior of each access terminal; Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal; Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

[0019] See also Figure 1 As shown, a server access control method based on network security protection includes: Step 1: Divide the server data content into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files; Step 2: Obtain all access terminals that access the server, divide them into public areas and restricted areas based on their access history, and connect all newly accessed access terminals to the public area; Step 3: Collect the access behavior of the newly connected access terminal in the public area in real time, match it with the historical abnormal behavior in the database, and make an abnormal judgment based on the matching results; Step 4: Based on the abnormality judgment result, the newly connected access terminal is divided into different security levels and different security measures are taken.

[0020] See also Figure 2 As shown, the server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files, specifically including: The public area of ​​the server is open to all non-prohibited terminals; The restricted area of ​​the server is only accessible to trusted access terminals and ordinary access terminals that have been authenticated by the server.

[0021] See also Figure 3 As shown, all access terminals accessing the server are obtained, and based on the access history of the access terminals, they are divided into public areas and restricted areas. Accessing all newly accessed access terminals to the public area specifically includes: Obtain all access terminals that access the server and query their access history data in the database; If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data; If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

[0022] See also Figure 4 As shown, the access behavior of newly accessed access terminals in public areas is collected in real time, and matched with historical abnormal behaviors in the database, and abnormal judgment is made based on the matching results, specifically including: Based on the historical abnormal data in the database, obtain the access behavior rules when the access terminal is abnormal, and build an abnormal behavior model; Based on the abnormal behavior model, analyze the access behavior of the access terminal collected in real time, and match the access behavior of the access terminal with the abnormal access behavior; Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormal situation of the current access terminal is determined.

[0023] Specifically, during the feature extraction process, too many features may be generated, resulting in a high dimensionality of the feature space. High-dimensional data not only increases the complexity of calculations, but may also cause "dimensionality disasters", that is, too many features lead to low computational efficiency and model instability, which in turn affects the matching effect. The most important features for anomaly detection can be screened out using feature selection methods to avoid the negative impact of high-dimensional features on model performance, such as L1 regularization and decision tree importance evaluation.

[0024] See also Figure 5 As shown, based on the historical abnormal data in the database, the access behavior rules when the access terminal is abnormal are obtained, and the abnormal behavior model is constructed, which specifically includes: Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs; Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ; Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern. Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector; The solution formula is:

[0025] in, is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation, which is specifically expressed as: , It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. The reconstruction error term measures the accuracy of reconstructing the data through the dictionary D and coefficient a. The reconstruction error is minimized by finding a dictionary D and a sparse vector so that all data points can be sparsely represented by the basis vector of the dictionary D.

[0026] It is understandable that the goal of sparse coding is to produce sparse coefficients, but sometimes the sparsity constraint is too strong, that is, too large. Parameters can lead to oversimplification of the model, which cannot effectively represent the complexity of the data. Especially when dealing with noisy or complex data, the sparsity constraint can be adjusted according to the characteristics of the data instead of using a fixed sparsity threshold. Adaptive sparse coding methods adjust the sparsity requirements according to different levels of data.

[0027] See also Figure 6 , based on the abnormal behavior model, analyze the access behavior of the access terminal collected in real time, and obtain the matching degree between the access behavior of the access terminal and the abnormal access behavior. Specifically include: Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data; Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is:

[0028] in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on the image is, sign() is the sign function, which converts the projection value into a binary hash value. For the local sensitive hashing of cosine similarity, a random hyperplane is used to map the data points to a low-dimensional space. The hash value is usually binary. The core of this process is to divide the data space by a hyperplane. Based on the feature vectors of all abnormal access data in the abnormal behavior model, they are mapped to a low-dimensional hash space through a locality-sensitive hash function family; Use hash values ​​to bucket the data, that is, store similar data in the same bucket; Hash the access behavior data of the access terminal collected in real time, map it to the hash space, and find the historical access data bucket with the same hash value; By calculating the cosine similarity between the hash value of the real-time access data collected and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained.

[0029] It is understandable that in the hash function, the number and size of the hash buckets will affect the final approximate search results. There is no explanation on how to choose the appropriate size of the bucket. It should be selected based on the distribution of the data and the required accuracy. If the data points are dense, a smaller parameter value can be selected, and when the data is more dispersed, a larger parameter value should be selected.

[0030] See also Figure 7 As shown, based on the abnormality judgment result, the newly connected access terminal is divided into different security levels, and different security measures are taken, including: Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals; Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of ​​the server; For general terminal access behavior, it is allowed to directly access the data content in the restricted area of ​​the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged; Access behavior of unknown terminals, allowing access to data content in the public area of ​​the server, and real-time monitoring during access; For prohibited terminals, access to the server is not allowed and access behavior is completely prohibited. If prohibited terminal access is detected, it will be blocked immediately.

[0031] Furthermore, the method according to the embodiment of the present application can also be performed by Figure 8 The electronic device architecture shown in FIG. Figure 8 As shown, the electronic device 500 may include a bus 501, one or more CPUs 502, a read-only memory (ROM) 503, a random access memory (RAM) 504, a communication port 505 connected to a network, an input / output component 506, a hard disk 507, etc. The storage device in the electronic device 500, such as the ROM 503 or the hard disk 507, may store a server access control method and system based on network security protection provided by the present application. The electronic device 500 may also include a terminal interface 508. Of course, Figure 7 The architecture shown is only exemplary and can be omitted according to actual needs when implementing different devices. Figure 7One or more components of an electronic device are shown.

[0032] Fig. 9 Schematic diagram of a computer-readable storage medium structure provided by an embodiment of the present application. Fig. 9 As shown, a computer-readable storage medium 600 according to an embodiment of the present application is shown. Computer-readable instructions are stored on the computer-readable storage medium 600. When the computer-readable instructions are executed by the processor, a server access control method and system based on network security protection according to an embodiment of the present application described with reference to the above figures can be executed. The storage medium 600 includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0033] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The above is a description of a specific embodiment of this specification. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0034] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0035] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A server access control method based on network security protection, characterized in that: include: Divide the server data content into a public area and a restricted area, where the public area stores public resources, information or files, and the restricted area stores sensitive data and private files; Obtain all access terminals that access the server, divide them into public areas and restricted areas based on their access history, and connect all newly connected access terminals to the public area; Collect the access behavior of newly connected access terminals in public areas in real time, match it with the historical abnormal behavior in the database, and make abnormal judgments based on the matching results; Based on the abnormal judgment results, the newly connected access terminals are divided into different security levels and different security measures are taken.

2. A server access control method based on network security protection according to claim 1, characterized in that: The server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files, specifically including: The public area of ​​the server is open to all non-prohibited access terminals; The restricted area of ​​the server is only accessible to trusted access terminals and common access terminals that have been authenticated by the server.

3. A server access control method based on network security protection according to claim 1, characterized in that: The acquiring of all access terminals accessing the server, dividing the access terminals into public areas and restricted areas based on their access history, and accessing all newly accessed access terminals to the public areas specifically includes: Obtain all access terminals that access the server and query their access history data in the database; If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data; If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

4. A server access control method based on network security protection according to claim 1, characterized in that: The real-time collection of access behaviors of newly accessed access terminals in public areas, matching with historical abnormal behaviors in a database, and making abnormality judgment based on the matching results specifically include: Based on the historical abnormal data in the database, obtain the access behavior rules when the access terminal is abnormal, and build an abnormal behavior model; Based on the abnormal behavior model, analyze the access behavior of the access terminal collected in real time, and match the access behavior of the access terminal with the abnormal access behavior; Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormal situation of the current access terminal is determined.

5. A server access control method based on network security protection according to claim 4, characterized in that: The method of obtaining the access behavior rules when the access terminal is abnormal based on the historical abnormal data in the database and constructing the abnormal behavior model specifically includes: Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs; Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ; Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern. Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector; The solution formula is: ;in, is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation. It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. is the reconstruction error term, which measures the accuracy of reconstructing the data through the dictionary D and coefficient a.

6. A server access control method based on network security protection according to claim 4, characterized in that: The analyzing the access behavior of the access terminal collected in real time based on the abnormal behavior model and obtaining the matching degree between the access behavior of the access terminal and the abnormal access behavior specifically includes: Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data; Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is: ;in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on, sign() is the sign function, which converts the projection value into a binary hash value; Use hash values ​​to bucket the data, that is, store similar data in the same bucket; Hash the access behavior data of the access terminal collected in real time, map it to the hash space, and find the historical access data bucket with the same hash value; By calculating the cosine similarity between the hash value of the real-time access data collected and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained.

7. A server access control method based on network security protection according to claim 1, characterized in that: The method of classifying the newly connected access terminal into different security levels based on the abnormality judgment result and taking different security measures specifically includes: Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals; Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of ​​the server; For general terminal access behavior, it is allowed to directly access the data content in the restricted area of ​​the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged; Access behavior of unknown terminals, allowing access to data content in the public area of ​​the server, and real-time monitoring during access; For prohibited terminals, access to the server is not allowed and access is completely prohibited. If prohibited terminal access is detected, it will be blocked immediately.

8. A server access control system based on network security protection, used to implement a server access control method based on network security protection as described in any one of claims 1 to 7, characterized in that: include: Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing; Abnormal access model building module: the abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data; Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of the newly accessed access terminal in the public area, and match it with the abnormal behavior model to determine the abnormal behavior of each access terminal; Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal; Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

9. An electronic device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a server access control method based on network security protection as described in any one of claims 1-7.

10. A computer-readable storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by a processor, a server access control method based on network security protection described in any one of claims 1 to 7 is implemented.

Images