A Server Access Control Method and System Based on Network Security Protection

Abstract

The present invention discloses a server access control method and system based on network security protection, comprising: dividing the server data content into a public area and a restricted area; obtaining all access terminals that access the server, dividing them into a public area and a restricted area based on the access history of the access terminals, and connecting all newly accessed access terminals to the public area; collecting the access behavior of the newly accessed access terminals in the public area in real time, matching it with the historical abnormal behavior in the database, and making an abnormality judgment based on the matching results; and dividing the newly accessed access terminals into different security levels based on the abnormality judgment results, and implementing different security measures. The advantages of the present invention are: by analyzing the characteristics of abnormal behavior and matching abnormal behavior, security threats can be effectively prevented. Through differentiated management, real-time monitoring and traffic restriction, the stability and security of the server are guaranteed.

Description

Technical Field

[0001] The present invention relates to security protection technology, and in particular to a server access control method and system based on network security protection. Background Art

[0002] A server access control method and system based on network security protection divides server data into public and restricted areas. The public area stores public resources, while the restricted area stores sensitive data or private files. For all terminals accessing the server, the system divides them into public and restricted areas based on access history records, and assigns newly accessed terminals to the public area by default. By collecting the access behavior of newly accessed terminals in public areas in real time, the system can compare it with historical abnormal behavior data to determine whether there is a trend of abnormal access. The system will classify the terminal into security levels based on the judgment results and take corresponding security measures. This method helps improve the overall security of the server by dynamically evaluating the behavior, history records and security levels of the access terminals, effectively preventing the leakage of sensitive data and illegal access.

[0003] Currently, server access control methods available on the market primarily include identity authentication, role control, policy control, and network control. Identity authentication confirms the terminal's identity through the terminal name, password, token, or biometrics. Common methods include single-password authentication, two-factor authentication, and multi-factor authentication. Role-based access control simplifies large-scale permission management by assigning roles to terminals and granting access rights based on these roles. Policy-based access control determines terminal access rights to resources based on pre-set access policies. Policies can be set based on multiple dimensions, such as time and location. These methods are often used in combination to form a multi-layered security defense to ensure reasonable and secure access to server resources. Summary of the Invention

[0004] To improve existing server access control methods, a server access control method and system based on network security protection is provided. This method divides public and restricted areas, monitors the access behavior of access terminals, promptly detects anomalies, and classifies them into security levels. Based on the anomaly detection results, corresponding security measures are taken to ensure data security.

[0005] In order to achieve the above objects, the technical solution adopted by the present invention is:

[0006] A server access control method based on network security protection, characterized by comprising:

[0007] Divide the server data content into a public area and a restricted area, where the public area stores public resources, information or files, and the restricted area stores sensitive data and private files;

[0008] Obtain all access terminals that access the server, divide them into public areas and restricted areas based on their access history, and connect all newly connected access terminals to the public area;

[0009] Collect access behavior of newly connected terminals in public areas in real time, match it with historical abnormal behavior in the database, and make abnormal judgments based on the matching results;

[0010] Based on the abnormality judgment results, the newly connected access terminals are divided into different security levels and different security measures are taken.

[0011] Preferably, the server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files, specifically including:

[0012] The public area of the server is open to all non-prohibited terminals;

[0013] The restricted area of the server is only accessible to trusted access terminals and general access terminals that have passed server authentication.

[0014] Preferably, the acquiring of all access terminals that have accessed the server, dividing them into public areas and restricted areas based on access history of the access terminals, and connecting all newly accessed access terminals to the public area specifically includes:

[0015] Obtain all access terminals that access the server and query their access history data in the database;

[0016] If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data;

[0017] If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

[0018] Preferably, the real-time collection of access behaviors of newly accessed access terminals in public areas, matching with historical abnormal behaviors in a database, and performing abnormality judgment based on the matching results specifically include:

[0019] Based on the historical abnormal data in the database, obtain the access behavior patterns when abnormal access terminals occur and build an abnormal behavior model;

[0020] Based on the abnormal behavior model, analyze the access behavior of access terminals collected in real time and perform feature matching between the access behavior of access terminals and abnormal access behavior;

[0021] Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormality of the current access terminal is determined.

[0022] Preferably, the process of obtaining access behavior patterns when an abnormality occurs in an access terminal based on historical abnormality data in a database and constructing an abnormal behavior model specifically includes:

[0023] Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs;

[0024] Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ;

[0025] Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern.

[0026] Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector;

[0027] The solution formula is:

[0028]

[0029] in, It is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation. It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. is the reconstruction error term, which measures the accuracy of reconstructing the data through the dictionary D and coefficient a.

[0030] Preferably, analyzing the access behavior of the access terminal collected in real time based on the abnormal behavior model and obtaining the matching degree between the access behavior of the access terminal and the abnormal access behavior specifically includes:

[0031] Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data;

[0032] Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is:

[0033]

[0034] in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on , sign() is the sign function, which converts the projection value into a binary hash value;

[0035] Use hash values to bucket the data, storing similar data in the same bucket.

[0036] Hash the access behavior data collected in real time, map it to the hash space, and search for the historical access data bucket with the same hash value.

[0037] By calculating the cosine similarity between the hash value of the real-time access data and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained.

[0038] Preferably, the method of classifying the newly connected access terminal into different security levels based on the abnormality judgment result and taking different security measures specifically includes:

[0039] Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals;

[0040] Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of the server;

[0041] For general terminal access behavior, it is allowed to directly access the data content in the restricted area of the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged;

[0042] Access behavior of unknown terminals, allowing access to data content in public areas of the server, and real-time monitoring during access;

[0043] For prohibited terminals, access to the server is not allowed and their access behavior is completely prohibited. If prohibited terminal access is detected, it will be intercepted immediately.

[0044] Furthermore, a server access control system based on network security protection is characterized by comprising:

[0045] Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing;

[0046] Abnormal access model building module: The abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data;

[0047] Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of newly accessed access terminals in the public area, match it with the abnormal behavior model, and determine the abnormal behavior of each access terminal;

[0048] Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal;

[0049] Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

[0050] Compared with the prior art, the advantages of the present invention are:

[0051] Newly connected access terminals are automatically assigned to public areas, reducing potential risks to unknown terminals. By monitoring their behavior in real time, anomalies can be detected promptly to prevent malicious access or data leaks. Secondly, based on analysis of historical access records, the system can accurately determine which terminals are likely to exhibit abnormal behavior, thereby improving its ability to provide early warning of potential threats. By comparing the access behavior of newly connected terminals with historical abnormal behavior, the system can accurately identify abnormal behavior and conduct dynamic security assessments based on the degree of abnormality, classifying them into different security levels and taking appropriate security measures. This method, based on behavioral analysis and historical data comparison, not only improves the ability to prevent unknown threats, but also enhances the speed and accuracy of response to security incidents, effectively reducing the risk of data leaks and attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of server access control for the method and system proposed in the present invention;

[0053] Figure 2 A schematic diagram of server area division for the method and system proposed in the present invention;

[0054] Figure 3 A schematic diagram of the division of access terminals of the method and system proposed in the present invention;

[0055] Figure 4 A schematic diagram of abnormal behavior judgment of the method and system proposed in the present invention;

[0056] Figure 5 A schematic diagram of constructing an abnormal behavior model of the method and system proposed in the present invention;

[0057] Figure 6A schematic diagram of abnormal behavior matching of the method and system proposed in the present invention;

[0058] Figure 7 A schematic diagram of the safety measures of the method and system proposed in the present invention;

[0059] Figure 8 This is a diagram of the architecture of the electronic equipment in this solution;

[0060] Figure 9 This is a schematic diagram of the computer-readable storage medium structure in this solution. DETAILED DESCRIPTION

[0061] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are merely examples, and those skilled in the art may conceive of other obvious variations.

[0062] A server access control system based on network security protection, comprising:

[0063] Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing;

[0064] Abnormal access model building module: The abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data;

[0065] Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of newly accessed access terminals in the public area, match it with the abnormal behavior model, and determine the abnormal behavior of each access terminal;

[0066] Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal;

[0067] Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

[0068] See Figure 1 As shown, a server access control method based on network security protection includes:

[0069] Step 1: Divide the server data content into a public area and a restricted area. The public area stores public resources, information, or files, while the restricted area stores sensitive data and private files.

[0070] Step 2: Obtain all access terminals that have accessed the server, divide them into public areas and restricted areas based on their access history, and connect all newly accessed access terminals to the public area;

[0071] Step 3: Collect the access behavior of newly connected access terminals in public areas in real time, match it with historical abnormal behavior in the database, and make abnormality judgments based on the matching results;

[0072] Step 4: Based on the abnormality judgment results, the newly connected access terminal is divided into different security levels and different security measures are implemented.

[0073] See Figure 2 As shown, the server data content is divided into a public area and a restricted area. The public area stores public resources, information or files, and the restricted area stores sensitive data and private files, including:

[0074] The public area of the server is open to all non-prohibited terminals;

[0075] The restricted area of the server is only accessible to trusted access terminals and general access terminals that have passed server authentication.

[0076] See Figure 3 As shown, all access terminals that access the server are obtained, and based on the access history of the access terminals, they are divided into public areas and restricted areas. All newly accessed access terminals are connected to the public area, specifically including:

[0077] Obtain all access terminals that access the server and query their access history data in the database;

[0078] If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data;

[0079] If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

[0080] See Figure 4 As shown, the access behavior of newly connected access terminals in public areas is collected in real time and matched with historical abnormal behaviors in the database. The abnormality judgment is made based on the matching results. Specifically, the following are included:

[0081] Based on the historical abnormal data in the database, obtain the access behavior patterns when abnormal access terminals occur and build an abnormal behavior model;

[0082] Based on the abnormal behavior model, analyze the access behavior of access terminals collected in real time and perform feature matching between the access behavior of access terminals and abnormal access behavior;

[0083] Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormality of the current access terminal is determined.

[0084] Specifically, during the feature extraction process, an excessive number of features may be generated, resulting in an excessively high dimensionality of the feature space. High-dimensional data not only increases computational complexity but can also lead to the "curse of dimensionality," where excessive features lead to inefficient computation and model instability, which in turn affects matching performance. Feature selection methods, such as L1 regularization and decision tree importance assessment, can be used to filter out the most important features for anomaly detection and prevent the negative impact of high-dimensional features on model performance.

[0085] See Figure 5 As shown, based on the historical abnormal data in the database, the access behavior patterns when abnormal access terminals occur are obtained, and the abnormal behavior model is constructed, which specifically includes:

[0086] Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs;

[0087] Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ;

[0088] Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern.

[0089] Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector;

[0090] The solution formula is:

[0091]

[0092] in, It is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation, which is specifically expressed as: , It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. The reconstruction error term measures the accuracy of reconstructing the data through the dictionary D and coefficient a. The reconstruction error is minimized by finding a dictionary D and a sparse vector so that all data points can be sparsely represented by the basis vector of the dictionary D.

[0093] It is understandable that the goal of sparse coding is to produce sparse coefficients, but sometimes the sparsity constraint is too strong, that is, too large. Parameters can lead to oversimplification of the model, making it unable to effectively represent the complexity of the data. Especially when dealing with noisy or complex data, the sparsity constraint can be adjusted according to the characteristics of the data instead of using a fixed sparsity threshold. Adaptive sparse coding methods adjust the sparsity requirements according to the different levels of the data.

[0094] See Figure 6 Based on the abnormal behavior model, the access behavior of the access terminal collected in real time is analyzed to obtain the matching degree between the access terminal access behavior and the abnormal access behavior. Specifically, it includes:

[0095] Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data;

[0096] Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is:

[0097]

[0098] in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on the ,sign() is the sign function, which converts the projection value into a binary hash value. For the local sensitive hashing of cosine similarity, a random hyperplane is used to map the data points to a low-dimensional space. The hash value is usually binary. The core of this process is to segment the data space through a hyperplane.

[0099] Based on the feature vectors of all abnormal access data in the abnormal behavior model, they are mapped to a low-dimensional hash space through a family of locality-sensitive hash functions;

[0100] Use hash values to bucket the data, storing similar data in the same bucket.

[0101] Hash the access behavior data collected in real time, map it to the hash space, and search for the historical access data bucket with the same hash value.

[0102] By calculating the cosine similarity between the hash value of the real-time access data and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained.

[0103] It is understandable that in a hash function, the number and size of hash buckets will affect the final approximate search results. How to choose the appropriate bucket size is not explained. It should be selected based on the distribution of the data and the required accuracy. If the data points are relatively dense, a smaller parameter value can be selected, while if the data is relatively dispersed, a larger parameter value should be selected.

[0104] See Figure 7 As shown, based on the abnormality judgment results, the newly connected access terminal is divided into different security levels and different security measures are taken, including:

[0105] Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals;

[0106] Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of the server;

[0107] For general terminal access behavior, it is allowed to directly access the data content in the restricted area of the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged;

[0108] Access behavior of unknown terminals, allowing access to data content in public areas of the server, and real-time monitoring during access;

[0109] For prohibited terminals, access to the server is not allowed and their access behavior is completely prohibited. If prohibited terminal access is detected, it will be intercepted immediately.

[0110] Furthermore, the method according to the embodiment of the present application can also be used with the aid of Figure 8 The electronic device architecture shown in FIG. Figure 8 As shown, the electronic device 500 may include a bus 501, one or more CPUs 502, a read-only memory (ROM) 503, a random access memory (RAM) 504, a communication port 505 connected to a network, an input / output component 506, a hard disk 507, etc. The storage device in the electronic device 500, such as the ROM 503 or the hard disk 507, may store a server access control method and system based on network security protection provided by the present application. The electronic device 500 may also include a terminal interface 508. Of course, Figure 7 The architecture shown is only exemplary and can be omitted according to actual needs when implementing different devices. Figure 7 One or more components of an electronic device are shown.

[0111] Figure 9This is a schematic diagram of the computer-readable storage medium structure provided by an embodiment of the present application. Figure 9 As shown, a computer-readable storage medium 600 according to one embodiment of the present application is shown. Computer-readable instructions are stored on the computer-readable storage medium 600. When the computer-readable instructions are executed by the processor, a server access control method and system based on network security protection according to an embodiment of the present application described with reference to the above figures can be executed. The storage medium 600 includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0112] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0113] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A server access control method based on network security protection, characterized in that: include: Divide the server data content into a public area and a restricted area, where the public area stores public resources, information or files, and the restricted area stores sensitive data and private files; Obtain all access terminals that access the server, divide them into public areas and restricted areas based on their access history, and connect all newly connected access terminals to the public area; Based on the historical abnormal data in the database, obtain the parameter data of the access terminal when the abnormal access occurs; Based on the obtained parameter data, the request features of each access terminal are mapped into a high-dimensional sparse vector through the bag-of-words model. For each time window t, the access record is represented as a vector ; Based on the normal access record data in the database, a dictionary D containing several dictionary atoms is trained through dictionary learning in sparse coding. Each dictionary atom represents a normal access behavior pattern. Based on the obtained dictionary D, each access record x is represented as a sparse vector a by solving the formula, so that the vector The reconstruction error between the dictionary D is minimized, and the abnormal behavior model is constructed based on the sparse vector; The solution formula is: ,in, It is a sparsity constraint term, which makes the non-zero coefficients in a as small as possible to achieve sparse representation. It is a hyperparameter that balances reconstruction error and sparsity, and determines the trade-off between sparsity and reconstruction accuracy. is the reconstruction error term, which measures the accuracy of reconstructing the data through the dictionary D and coefficient a; Based on the access data of the current access terminal, convert it into a high-dimensional sparse vector in the same format as the training data; Through local sensitive hashing, based on the obtained high-dimensional sparse vector, cosine similarity is used to obtain a similarity measure, and based on the similarity measure, a local sensitive hash function family is obtained. The local sensitive hash function formula is: ,in, is a sparse vector, is a random vector and The dimensions are the same, generally speaking, is randomly generated from a standard normal distribution, is a vector In the hyperplane The projection value on , sign() is the sign function, which converts the projection value into a binary hash value; Use hash values to bucket the data, storing similar data in the same bucket. Hash the access behavior data collected in real time, map it to the hash space, and search for the historical access data bucket with the same hash value. By calculating the cosine similarity between the hash value of the real-time access data and the hash value of the abnormal data, the matching degree between the current new access terminal access behavior and the abnormal access behavior is obtained; Based on the matching degree between the access behavior of the access terminal and the abnormal access behavior, the abnormality of the current access terminal is judged; Based on the abnormality judgment results, the newly connected access terminals are divided into different security levels and different security measures are taken.

2. A server access control method based on network security protection according to claim 1, characterized in that: The server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files, specifically including: The public area of the server is open to all non-prohibited terminals; The restricted area of the server is only accessible to trusted access terminals and common access terminals that have passed server authentication.

3. A server access control method based on network security protection according to claim 1, characterized in that: The acquiring of all access terminals that have accessed the server, dividing the access terminals into public areas and restricted areas based on their access histories, and accessing all newly accessed access terminals to the public area specifically includes: Obtain all access terminals that access the server and query their access history data in the database; If it is an access terminal that has visited before, the corresponding access area is opened to it based on the security level of the access terminal in the historical data; If there is no historical data, it is a newly connected access terminal and the public area is opened to it.

4. A server access control method based on network security protection according to claim 1, characterized in that: The method of classifying the newly connected access terminal into different security levels based on the abnormality judgment result and taking different security measures specifically includes: Based on the obtained abnormal access matching degree of the access terminal, different access terminals are divided into trusted terminals, general terminals, unknown terminals, and prohibited terminals; Perform basic access authentication on the access behavior of trusted terminals to ensure their legal identity and record their access behavior, allowing them to directly access the data content in the restricted area of the server; For general terminal access behavior, it is allowed to directly access the data content in the restricted area of the server, and the access behavior is randomly checked during the access period. Based on the abnormal behavior model, the legitimacy of the access is judged; Access behavior of unknown terminals, allowing access to data content in public areas of the server, and real-time monitoring during access; For prohibited terminals, access to the server is not allowed and their access behavior is completely prohibited. If prohibited terminal access is detected, it will be intercepted immediately.

5. A server access control system based on network security protection, used to implement a server access control method based on network security protection according to any one of claims 1 to 4, characterized in that: include: Access request collection module: The access request collection module is mainly used to monitor and collect all requests for accessing the server and send them to subsequent modules for request processing; Abnormal access model building module: The abnormal access model building module is mainly used to obtain abnormal access behavior feature data based on historical abnormal access data; Access behavior matching module: The access behavior matching module is mainly used to obtain the access behavior of newly accessed access terminals in the public area, match it with the abnormal behavior model, and determine the abnormal behavior of each access terminal; Security level module: The security level module is mainly used to grant different access rights to access terminals with different security ratings based on the matching degree between the access behavior and abnormal behavior of each access terminal; Processor: The processor is mainly used for constructing abnormal access models and comparing behavioral features.

6. An electronic device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a server access control method based on network security protection as described in any one of claims 1-4.

7. A computer-readable storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by a processor, a server access control method based on network security protection according to any one of claims 1 to 4 is implemented.

Images