Sensitive operation approval decision-making system and method, readable storage medium and program product

Abstract

The invention discloses a sensitive operation approval decision-making system and method, a readable storage medium and a program product, and relates to the technical field of information security management, and the sensitive operation approval decision-making system comprises an operation application module which is used for obtaining sensitive operation data of a target operator after receiving a sensitive operation request of the target operator; the intelligent approval agent is used for determining the matching degree of the operation content and the application reason as an operation rationality score of the current sensitive operation; the risk assessment agent is used for performing security risk analysis according to the operation content, the operator information and the historical operation data, and generating a security risk score of the current sensitive operation; and the authorization decision agent is used for determining an approval decision score of the current sensitive operation according to the operation rationality score and the security risk score so as to determine an approval result of the current sensitive operation. The examination and approval efficiency and examination and approval accuracy of the sensitive operation of the operator can be improved.

Description

Technical Field

[0001] This application relates to the technical field of information security management, and particularly to a sensitive operation approval decision-making system, method, readable storage medium and program product. Background Art

[0002] Currently, when dealing with system operations involving highly sensitive information, in order to prevent unauthorized access and potential security risks, the vault mode (i.e., the "two-person operation" mode) is usually adopted to ensure the security of sensitive operations.

[0003] However, the existing vault mode relies on manual authorization and approval, which has problems such as slow approval processes, low operation efficiency, and is also prone to misjudgment, as well as the problem of releasing high-risk operations due to human negligence.

[0004] Therefore, the existing approval methods for sensitive operations not only have low approval efficiency but also poor approval accuracy. Summary of the Invention

[0005] The main purpose of this application is to provide a sensitive operation approval decision-making system, method, readable storage medium and program product, aiming to improve the approval efficiency and approval accuracy of sensitive operations of operators.

[0006] To achieve the above object, this application provides a sensitive operation approval decision-making system, and the sensitive operation approval decision-making system includes: An operation application module, configured to obtain sensitive operation data of the target operator after receiving a sensitive operation request of the target operator; the sensitive operation data includes operator information, historical operation data, operation content of the current sensitive operation, and application reason; An intelligent approval agent, whose input end is connected to the first output end of the operation application module, and is configured to determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; A risk assessment agent, whose input end is connected to the second output end of the operation application module, and is configured to perform security risk analysis based on the operation content, the operator information, and the historical operation data to generate a security risk score of the current sensitive operation; An authorization decision-making agent, whose input end is connected to the output end of the intelligent approval agent and the output end of the risk assessment agent, and is configured to determine an approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine an approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

[0007] In one embodiment, the sensitive operation approval decision-making system further includes a natural language processing tool and an operation application matching tool, and the intelligent approval agent is connected to the natural language processing tool and the operation application matching tool; The intelligent approval agent is further configured to: Receive the operation content and the application reason output by the operation application module; Call the natural language processing tool to perform semantic analysis on the operation content and the application reason respectively to determine the operation intention and the key application reason of the current sensitive operation; Call the operation application matching tool to determine the matching degree between the operation intention and the key application reason as the matching degree between the operation content and the application reason.

[0008] In one embodiment, the natural language processing tool is used to: Preprocess the operation content and the application reason to obtain the preprocessed operation content and application reason; Input the preprocessed operation content and application reason into the large language model associated with the natural language processing tool respectively to determine the operation intention and the key application reason of the current sensitive operation.

[0009] In one embodiment, the operation application matching tool is used to: Based on the large language model associated with the operation application matching tool, perform semantic embedding processing on the operation intention and the key application reason to obtain the embedding vector of the operation intention and the embedding vector of the key application reason; Determine the similarity between the embedding vector of the operation intention and the embedding vector of the key application reason as the matching degree between the operation intention and the key application reason.

[0010] In one embodiment, the sensitive operation approval decision-making system further includes a behavior baseline construction tool and an abnormal risk assessment tool, and the risk assessment agent is connected to the behavior baseline construction tool and the abnormal risk assessment tool; The risk assessment agent is further configured to: Receive the operation content, the operator information, and the historical operation data output by the operation application module; Call the behavior baseline construction tool to construct a behavior baseline model of the target operator based on the historical operation data; Call the exception risk assessment tool to perform feature extraction and feature fusion processing on the operation content and the operator information to obtain the current behavior feature vector of the target operator, and input the current behavior feature vector into the behavior baseline model to obtain the reconstruction error of the current sensitive operation; Calculate the absolute value of the difference between the reconstruction error and a preset error threshold to obtain the security risk score of the current sensitive operation.

[0011] In one embodiment, the behavior baseline construction tool is used for: Preprocess the historical operation data to obtain the record data of all historical sensitive operations of the target operator from the historical operation data; Perform feature extraction and feature fusion processing on the record data of each historical sensitive operation to obtain the historical behavior feature vectors of the target operator; Iteratively train a preset deep autoencoder model based on each of the historical behavior feature vectors to obtain the behavior baseline model.

[0012] In one embodiment, the sensitive operation approval decision system further includes a decision support tool and a historical matching tool, and the authorization decision agent is connected to the decision support tool and the historical matching tool; The authorization decision agent is further used for: Obtain the operation rationality score output by the intelligent approval agent and the security risk score output by the risk assessment agent; Call the decision support tool to comprehensively analyze the operation rationality score and the security risk score to obtain the comprehensive decision score of the current sensitive operation; Call the historical matching tool to obtain each historical sensitive operation similar to the current sensitive operation as each target sensitive operation, and determine the total historical decision score based on the comprehensive decision score of each target sensitive operation and the similarity between each target sensitive operation and the current sensitive operation; Perform weighted processing on the comprehensive decision score of the current sensitive operation and the total historical decision score to obtain the approval decision score of the current sensitive operation.

[0013] In one embodiment, the decision support tool is used for: Perform normalization processing on the operation rationality score and the security risk score to obtain the normalized operation rationality score and security risk score; Perform weighted processing on the normalized operation rationality score and security risk score to obtain the comprehensive decision score of the current sensitive operation.

[0014] In one embodiment, the historical matching tool is used for: Determine the operation feature vector of the current sensitive operation; Determine the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation, as the similarity between each historical sensitive operation and the current sensitive operation; According to the similarity between each historical sensitive operation and the current sensitive operation, obtain a preset number of historical sensitive operations in descending order as each target sensitive operation; Determine the weight of each target sensitive operation according to the similarity between each target sensitive operation and the current sensitive operation; Calculate the product of the weight of each target sensitive operation and the comprehensive decision-making score of each target sensitive operation to obtain each historical decision-making sub-score; Calculate the sum of each historical decision-making sub-score to obtain the historical decision-making total score.

[0015] In addition, to achieve the above object, the present application also provides a method for making a decision on the approval of sensitive operations, and the method includes: After receiving a sensitive operation request from a target operator, obtain the sensitive operation data of the target operator; the sensitive operation data includes operator information, historical operation data, the operation content of the current sensitive operation, and the application reason; Determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; Conduct a security risk analysis based on the operation content, the operator information, and the historical operation data to generate a security risk score for the current sensitive operation; Determine the approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

[0016] In addition, to achieve the above object, the present application also provides a readable storage medium, the readable storage medium is a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of the method for making a decision on the approval of sensitive operations as described above are implemented.

[0017] In addition, to achieve the above object, the present application also provides a program product, the program product is a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the method for making a decision on the approval of sensitive operations as described above are implemented.

[0018] The present application provides a sensitive operation approval decision-making system, which includes an operation application module, an intelligent approval agent, a risk assessment agent, and an authorization decision-making agent; the input end of the intelligent approval agent is connected to the first output end of the operation application module, the input end of the risk assessment agent is connected to the second output end of the operation application module, and the input end of the authorization decision-making agent is connected to the output ends of the intelligent approval agent and the risk assessment agent; the operation application module is configured to obtain sensitive operation data of the target operator after receiving a sensitive operation request from the target operator; the sensitive operation data includes operator information, historical operation data, the operation content and application reason of the current sensitive operation; the intelligent approval agent is configured to determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; the risk assessment agent is configured to perform a security risk analysis based on the operation content, operator information, and historical operation data to generate a security risk score of the current sensitive operation; the authorization decision-making agent is configured to determine the approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

[0019] Therefore, by setting up the operation application module, the intelligent approval agent, the risk assessment agent, and the authorization decision-making agent in the present application, when the operator applies for a sensitive operation, the operation application module will automatically obtain relevant sensitive operation data. Further, the intelligent approval agent will determine the matching degree between the operation content and the application reason in the sensitive operation data to automatically complete the evaluation of the rationality of the currently applied sensitive operation and obtain the operation rationality score of the current sensitive operation; at the same time, the risk assessment agent will use the operation content, operator information, and historical operation data in the sensitive operation data to automatically analyze the security of the current sensitive operation to determine the security risk score of the current sensitive operation; then, the authorization decision-making agent can determine the approval decision score of the current sensitive operation by using the operation rationality score and the security risk score, and further determine the approval result of the current sensitive operation.

[0020] In summary, the present application provides a system for automatically approving sensitive operations of operators. Compared with the conventional method that relies on manual authorization for approval, it not only has high approval efficiency, but also comprehensively considers the operation rationality and operation security risk of sensitive operations when making approvals, so as to avoid the problem of releasing high-risk operations to a certain extent. Therefore, the approval accuracy of the technical solution of the present application is also relatively high. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings here are incorporated into the specification and constitute a part of this specification, showing embodiments that conform to the present application, and are used together with the specification to explain the principles of the present application.

[0022] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0023] Figure 1 Schematic diagram of the implementation process of the existing vault mode provided by the embodiments of the present application; Figure 2 Schematic diagram of the module structure of the sensitive operation approval decision-making system provided by the first embodiment of the present application; Figure 3 Overall architecture diagram of the sensitive operation approval decision-making system provided by the first embodiment of the present application; Figure 4 Schematic diagram of the module structure of the sensitive operation approval decision-making system provided by the second embodiment of the present application; Figure 5 Schematic diagram of the module structure of the sensitive operation approval decision-making system provided by the third embodiment of the present application; Figure 6 Schematic diagram of the module structure of the sensitive operation approval decision-making system provided by the fourth embodiment of the present application; Figure 7 Schematic diagram of the process of the sensitive operation approval decision-making method provided by the embodiments of the present application.

[0024] The realization of the purpose of the present application, functional features and advantages will be further described in combination with the embodiments with reference to the accompanying drawings.

[0025] Explanation of the reference numerals in the drawings: 10. Operation application module; 20. Intelligent approval agent; 30. Risk assessment agent; 40. Authorization decision agent; 201. Natural language processing tool; 202. Operation application matching tool; 301. Behavior baseline construction tool; 302. Abnormal risk assessment tool; 401. Decision support tool; 402. Historical matching tool. Detailed implementation manners

[0026] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0027] To better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings in the specification and the specific implementation manners.

[0028] Currently, when dealing with system operations involving highly sensitive information, in order to prevent unauthorized access and potential security risks, the vault mode (i.e., the "two-person operation" mode) is usually adopted to ensure the security of sensitive operations. Among them, the vault mode requires at least two operators with corresponding permissions to cooperate to complete highly sensitive operations, so as to prevent a single person from abusing their permissions and thus protect the highly sensitive information inside the system.

[0029] The implementation process of the existing vault mode can be referred to Figure 1 . When an operator intends to perform a highly sensitive operation on a critical resource, the vault mode will be triggered, and the operator is required to provide the reason for the operation application. After filling in the reason for the application, the operator submits it to the vault authentication module. After receiving the reason for the application, the vault authentication module automatically sends an approval request to the authorized personnel. The content of the request includes the operator's identity information, the operation content to be performed, and the reason for the application. Based on the reason for the application and relevant security policies, the authorized personnel review the operation request and make an approval decision. The approval result is returned to the operator through the vault authentication module. If the approval is passed, the operator will obtain the permission to perform the highly sensitive operation; if the approval is not passed, the operation request will be rejected.

[0030] However, the existing vault mode mainly has the following obvious disadvantages: 1. False judgment problem: The vault approval process completely depends on manual authorization. The authorized personnel need to review the operation application based on their own experience and judgment. Due to the complexity of highly sensitive operations and the large amount of relevant information, the authorized personnel are prone to misjudgment due to negligence or incorrect judgment, thus increasing the security risk. Therefore, this completely human-dependent judgment method is not only prone to subjective biases but may also affect the accuracy of approval due to the large amount of information processing.

[0031] 2. Efficiency problem: Since the approval process requires manual intervention, the approval time is relatively long. In the case of dealing with emergency operations or batch processing, the approval process may not be able to respond in time, resulting in system operation delays and affecting the overall system operation efficiency.

[0032] 3. Security problem. Currently, the vault often conducts audits only after the operation is executed and cannot conduct risk assessments during the operation. This post-audit mode leads to corresponding reviews and handling only after the operation has been executed and the losses have occurred, and cannot effectively prevent and respond to potential highly sensitive operation risks in a timely manner.

[0033] Based on this, the present application proposes a sensitive operation approval decision system for the first embodiment. Please refer to Figure 2, the sensitive operation approval decision-making system may include an operation application module 10, an intelligent approval agent 20, a risk assessment agent 30, and an authorization decision-making agent 40; the input end of the intelligent approval agent 20 is connected to the first output end of the operation application module 10, the input end of the risk assessment agent 30 is connected to the second output end of the operation application module 10, and the input end of the authorization decision-making agent 40 is connected to the output ends of the intelligent approval agent 20 and the risk assessment agent 30; The operation application module 10 is configured to obtain sensitive operation data of the target operator after receiving a sensitive operation request from the target operator; the sensitive operation data includes operator information, historical operation data, the operation content of the current sensitive operation, and the application reason; The intelligent approval agent 20 is configured to determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; The risk assessment agent 30 is configured to perform a security risk analysis based on the operation content, operator information, and historical operation data, and generate a security risk score of the current sensitive operation; The authorization decision-making agent 40 is configured to determine an approval decision score of the current sensitive operation based on the operation rationality score and the security risk score, and determine an approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

[0034] It should be noted that the target operator is the person who needs to apply for a sensitive operation. The number of target operators can be one or multiple, and this embodiment does not make specific limitations in this regard. The current sensitive operation is the sensitive operation applied by the target operator at the current moment. The operation content includes a detailed description of the operation content to be executed, covering the specific behavior of the operation and the objects involved; the application reason includes the description of the application reason proposed by the operator, and this description requires the operator to elaborate on the background and purpose of the operation, that is, to clarify why the operation needs to be executed. The operator information refers to the relevant user information of the target operator, which may include but is not limited to user ID (Identity document), user name, position, department, operation authority, authentication status, operation type, operation target, operation time, and operation source IP (Internet Protocol), etc., and this embodiment does not make specific limitations in this regard; the historical operation data includes all historical operation logs associated with the user ID of the target operator, and each historical operation log should completely record the previous operation content, application reason, operator information, and the final approval result.

[0035] It can be understood that the operation application module 10, as the front-end module of the sensitive operation approval decision-making system, is responsible for collecting sensitive operation requests from operators and obtaining sensitive operation data of operators to be transmitted to the subsequent intelligent approval agent 20 and risk assessment agent 30. Thus, the operation application module 10 provides basic data support for the follow-up. To ensure the comprehensiveness and accuracy of operation application records, the operation application module 10 needs to collect four types of data: operator information, historical operation data, operation content, and application reasons.

[0036] In a feasible implementation manner, to ensure data integrity and security during the data transmission process of the operation application module 10, the operation application module 10 can structure the obtained data in JSON (JavaScript Object Notation) format and securely transmit the data to the intelligent approval agent 20 and risk assessment agent 30 through a secure interface (such as a TLS (Transport Layer Security) encrypted channel).

[0037] In a feasible implementation manner, during the process of determining the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation, the approval decision score of the current sensitive operation can be first compared with the first preset score and the second preset score; if the approval decision score of the current sensitive operation is greater than or equal to the first preset score, it indicates that the application for the current sensitive operation meets the security standards and business rules of the vault, and most similar historical sensitive operations have passed the approval, then the approval result of the current sensitive operation can be determined as a "approved" decision; if the approval decision score of the current sensitive operation is less than or equal to the second preset score, it indicates that the application for the current sensitive operation does not meet the security standards and business rules of the vault, or most similar historical sensitive operations have been rejected, then the approval result of the current sensitive operation can be determined as a "rejected" decision; if the approval decision score of the current sensitive operation is greater than the second preset score and less than the first preset score, it indicates that the current sensitive operation has a certain degree of rationality, but the risk level is uncertain or controversial, and there is no similar operation or the final decision cannot be judged in historical cases, then the approval result of the current sensitive operation can be determined as a "pending manual review" decision.

[0038] Among them, the first preset score and the second preset score can be dynamically set and adjusted by the authorized decision-making agent 40 according to specific circumstances to adapt to different security policies and business requirements.

[0039] It can be understood that when the approval result of the determined current sensitive operation is a decision of "approved" or "rejected", the target operator can be directly released or rejected to perform the current sensitive operation according to the approval result; when the approval result of the determined current sensitive operation is a decision of "pending manual review", the sensitive operation data and the approval decision score of the current sensitive operation need to be sent to the authorized personnel. After the authorized personnel make a decision, the decision is executed according to the decision result of the authorized personnel, and the decision result of the authorized personnel and the analysis report can be stored in the long-term memory module connected to the authorization decision intelligent agent 40 for future decision-making judgment of the authorization decision intelligent agent 40.

[0040] In this embodiment, by setting up the operation application module 10, the intelligent approval intelligent agent 20, the risk assessment intelligent agent 30, and the authorization decision intelligent agent 40, when an operator applies for a sensitive operation, the operation application module 10 will automatically obtain relevant sensitive operation data. Further, the intelligent approval intelligent agent 20 will determine the matching degree between the operation content and the application reason in the sensitive operation data to automatically complete the evaluation of the rationality of the currently applied sensitive operation and obtain the operation rationality score of the current sensitive operation; at the same time, the risk assessment intelligent agent 30 will use the operation content, operator information, and historical operation data in the sensitive operation data to automatically perform a security analysis on the current sensitive operation to determine the security risk score of the current sensitive operation; afterwards, the authorization decision intelligent agent 40 can determine the approval decision score of the current sensitive operation by using the operation rationality score and the security risk score, and then determine the approval result of the current sensitive operation.

[0041] In summary, this embodiment provides a system for automatically approving sensitive operations of operators. Compared with the conventional technology that relies on manual authorization for approval, not only is the approval efficiency high, but also in this embodiment, when performing approval, the operation rationality and operation security risk of the sensitive operation are comprehensively considered, so that the problem of releasing high-risk operations can be avoided to a certain extent. Therefore, the approval accuracy of this embodiment is also relatively high.

[0042] Exemplarily, to help understand the overall implementation architecture of the sensitive operation approval decision system of this embodiment after combining the above various embodiments, please refer to Figure 3 , specifically: When an operator intends to perform a sensitive operation on a critical resource, the vault authentication will be triggered, and the operator is required to provide the reason for the operation application. After the operator fills in the reason for the application, the operation application module 10 is responsible for receiving the sensitive operation request from the operator and obtaining the sensitive operation data of the operator and transmitting it to the intelligent approval agent 20 and the risk assessment agent 30. The intelligent approval agent 20 determines the matching degree between the operation content in the sensitive operation data and the reason for the application as the operation rationality score of the current sensitive operation. The risk assessment agent 30 performs a security analysis on the current sensitive operation by using the operation content, operator information, and historical operation data in the sensitive operation data to determine the security risk score of the current sensitive operation. The authorization decision agent 40 receives the operation rationality score output by the intelligent approval agent 20 and the security risk score output by the risk assessment agent 30, and uses the two to determine the approval decision score of the current sensitive operation, and then determines the approval result of the current sensitive operation. If the approval result is "approved", the operator can be released to perform the current sensitive operation. If the approval result is "rejected", the operator can be refused to perform the current sensitive operation. If the approval result is "pending review", the sensitive operation data and the approval decision score of the current sensitive operation can be sent to the authorized personnel for manual review.

[0043] Based on the above first embodiment, a second embodiment of the sensitive operation approval decision system of the present application is proposed. In the second embodiment, please refer to Figure 4 , the sensitive operation approval decision system may further include a natural language processing tool 201 and an operation application matching tool 202. The intelligent approval agent 20 is connected to the natural language processing tool 201 and the operation application matching tool 202; The intelligent approval agent 20 is further configured to: Receive the operation content and the reason for the application output by the operation application module 10; Call the natural language processing tool 201 to perform semantic analysis on the operation content and the reason for the application respectively to determine the operation intention and the key reason for the application of the current sensitive operation; Call the operation application matching tool 202 to determine the matching degree between the operation intention and the key reason for the application as the matching degree between the operation content and the reason for the application.

[0044] It should be noted that the operation content describes the specific operation to be performed by the operator, such as "delete the user data table"; the reason for the application explains the reason and rationality for the operator to perform the current sensitive operation, such as "in order to meet the requirements of data privacy protection and rationality, it is necessary to delete the user data table that is no longer used".

[0045] Additionally, it should be noted that the intelligent approval agent 20 can connect to the natural language processing tool 201 and the operation application matching tool 202 through the call interface of a specific API (Application Programming Interface), or can also connect to the natural language processing tool 201 and the operation application matching tool 202 through the call interface of the RPC (Remote Procedure Call) framework, and can also connect to the natural language processing tool 201 and the operation application matching tool 202 through the interface of the middleware. This embodiment does not make specific limitations on this.

[0046] It can be understood that the intelligent approval agent 20 realizes the full automation process of operation application parsing, intention recognition, and scoring generation by decomposing the approval task into four subtasks: operation parsing, intention recognition, content matching, and scoring generation, and respectively using the natural language processing tool 201 and the operation application matching tool 202 to execute each subtask.

[0047] In a feasible implementation manner, the natural language processing tool 201 is used for: Preprocess the operation content and the application reason to obtain the preprocessed operation content and application reason; Input the preprocessed operation content and application reason into the large language model associated with the natural language processing tool 201 respectively to determine the operation intention of the current sensitive operation and the key application reason.

[0048] It should be noted that the purpose of preprocessing the operation content and the application reason is to convert the operation content and the application reason into a form that can be processed by a computer. During the process of preprocessing the operation content and the application reason, first, it is necessary to perform word segmentation on the operation content and the application reason to decompose them into basic semantic units. Specifically: the natural language processing tool 201 can use a word segmentation tool and combine the probabilistic statistical method based on the hidden Markov model to perform word segmentation on the operation content and the application reason, so as to segment the operation content and the application reason into words (Tokens), and identify and filter out common Chinese stop words (such as "de", "le", "zai", etc.). Then, the natural language processing tool 201 can use a part-of-speech tagging tool to assign corresponding part-of-speech tags to each Token after word segmentation, such as verb (v), noun (n), adjective (a), preposition (p), etc. These part-of-speech tags provide the necessary syntactic structure information for subsequent intention recognition and extraction of key application reasons.

[0049] Additionally, it should be noted that the large language model associated with the natural language processing tool 201 may include a joint intent recognition sub-model and a key reason extraction sub-model. The joint intent recognition sub-model can extract the operation intent of the operation content, and the key reason extraction sub-model can extract the application key reasons for the application reasons. In the process of inputting the preprocessed operation content and application reasons into the large language model associated with the natural language processing tool 201 to determine the operation intent of the current sensitive operation and the application key reasons, first, the token sequence and its part-of-speech tags after word segmentation are integrated into a standard input format, such as "[delete / v, user / n, data table / n]". Then, the embedding layer in the large language model associated with the natural language processing tool 201 is called to convert the standardized input into a high-dimensional semantic embedding vector, obtaining the semantic embedding vector of the operation content and the semantic embedding vector of the application reasons; among them, the embedding layer of the large language model can map each token into a high-dimensional vector space, and the vectors obtained by mapping can not only contain the semantic information of the words, but also contain their context information in the context. Next, the semantic embedding vector of the operation content and the semantic embedding vector of the application reasons will be input into the joint model associated with the large language model to obtain the intent category and its confidence of the operation content, as well as the key topic and its confidence of the application reasons; after that, using the intent category and its confidence of the operation content, the operation intent of the operation content can be determined, and using the key topic and its confidence of the application reasons, the application key reasons of the application reasons can be determined.

[0050] Among them, the joint model combines a multi-layer perceptron and a Transformer architecture. The input layer of this joint model receives the semantic embedding vectors from the large language model. The hidden layer further extracts complex semantic features and context information through a multi-head self-attention mechanism and a non-linear activation function. The output layer uses the Softmax function (normalized exponential function) to generate the probability distributions of different intent categories and key topics.

[0051] To improve the accuracy of the joint model in the operation application scenario, during the training process of the model, the model can be fine-tuned, and joint training can be performed using the labeled operation intent data set and the application-related reason data set. The model parameters can also be optimized through backpropagation to minimize the cross-entropy loss in the multi-task learning framework. The model can calculate the scores of each intent category and reason topic through the forward propagation process, and use the Softmax function to convert these scores into probability distributions. Each output neuron can represent the confidence of the corresponding category or topic.

[0052] In a feasible implementation manner, the operation application matching tool 202 is used for: Based on the large language model associated with the operation application matching tool 202, perform semantic embedding processing on the operation intention and the key reasons for the application to obtain the embedding vector of the operation intention and the embedding vector of the key reasons for the application; Determine the similarity between the embedding vector of the operation intention and the embedding vector of the key reasons for the application as the matching degree between the operation intention and the key reasons for the application.

[0053] It should be noted that the cosine similarity can be used as the similarity between the embedding vector of the operation intention and the embedding vector of the key reasons for the application. Thus, the process of determining the similarity between the embedding vector of the operation intention and the embedding vector of the key reasons for the application can be expressed as formula 1 below: Formula 1; Wherein, is the similarity between the embedding vector of the operation intention and the embedding vector of the key reasons for the application, is the embedding vector of the operation intention, is the embedding vector of the key reasons for the application, is the norm of the embedding vector of the operation intention, is the norm of the embedding vector of the key reasons for the application.

[0054] In a feasible implementation manner, to improve the long-term optimization ability of the intelligent matching agent 20, the determined operation intention, key reasons for the application, embedding vector of the operation intention, embedding vector of the key reasons for the application, and operation rationality score can be stored in the long-term memory module connected to the intelligent matching agent 20 (a vector database can be used to ensure fast data retrieval and continuous optimization). Through the data storage and management of the long-term memory, the intelligent approval agent 20 can better support future approval processes to optimize the approval efficiency of the intelligent approval agent 20.

[0055] Based on the above first embodiment and / or second embodiment, a third embodiment of the sensitive operation approval decision-making system of the present application is proposed. In the third embodiment, please refer to Figure 5 , the sensitive operation approval decision-making system may further include a behavior baseline construction tool 301 and an abnormal risk assessment tool 302, and the risk assessment agent 30 is connected to the behavior baseline construction tool 301 and the abnormal risk assessment tool 302; The risk assessment agent 30 is further configured to: Receive the operation content, operator information, and historical operation data output by the operation application module; Call the behavior baseline construction tool 301 to construct a behavior baseline model of the target operator based on the historical operation data; Invoke the exception risk assessment tool 302 to perform feature extraction and feature fusion processing on the operation content and operator information, obtain the current behavior feature vector of the target operator, and input the current behavior feature vector into the behavior baseline model to obtain the reconstruction error of the current sensitive operation; Calculate the absolute value of the difference between the reconstruction error and the preset error threshold to obtain the security risk score of the current sensitive operation.

[0056] It should be noted that the preset error threshold can be used as the basis for judging whether the current sensitive operation is abnormal. Specifically, when the reconstruction error is less than or equal to the preset error threshold, it can be regarded as a normal operation; when the reconstruction error is greater than the preset error threshold, it can be regarded as an abnormal operation. The preset error threshold can be a default value or can be flexibly set by the user according to the actual situation. This embodiment does not make specific limitations on this. For example, it can be determined by using the mean and standard deviation of the reconstruction error defined by the behavior baseline model, as well as the coefficient value determined by the risk assessment agent 30. The specific determination process can be expressed by the following formula 2: Formula 2; Among them, is the preset error threshold, is the mean of the reconstruction error defined by the behavior baseline model, is the standard deviation of the reconstruction error defined by the behavior baseline model, and k is the coefficient value determined by the risk assessment agent 30.

[0057] In addition, it should be noted that the current behavior feature vector is used to represent the comprehensive behavior performance of the target operator for the current sensitive operation to be performed in terms of operation type, time, and geographical location. In the process of performing feature extraction and feature fusion processing on the operation content and operator information, three types of features, namely operation features, time features, and geographical features, can be extracted, and then the extracted features are fused to obtain the current behavior feature vector of the target operator.

[0058] In addition, it should be noted that the risk assessment agent 30 can connect to the behavior baseline construction tool 301 and the exception risk assessment tool 302 through a specific API call interface, or can connect to the behavior baseline construction tool 301 and the exception risk assessment tool 302 through the call interface of the RPC framework, or can also connect to the behavior baseline construction tool 301 and the exception risk assessment tool 302 through the interface of the middleware. This embodiment does not make specific limitations on this.

[0059] It can be understood that the risk assessment agent 30 realizes the fully automated process of risk assessment by decomposing the risk assessment task into two subtasks: behavior baseline construction and abnormal risk detection, and using the behavior baseline construction tool 301 and the abnormal risk assessment tool 302 to execute each subtask respectively.

[0060] In a feasible implementation manner, the behavior baseline construction tool 301 is used for: Preprocess the historical operation data to obtain the recorded data of all historical sensitive operations of the target operator from the historical operation data; Perform feature extraction and feature fusion processing on the recorded data of each historical sensitive operation to obtain the historical behavior feature vectors of the target operator; Iteratively train the preset deep autoencoder model based on the historical behavior feature vectors to obtain the behavior baseline model.

[0061] It should be noted that in the process of preprocessing the historical operation data to obtain the recorded data of all historical sensitive operations of the target operator from the historical operation data, the user ID of the target operator can be used first to filter out each historical operation log associated with the user ID from the historical operation data; then, the set sensitive operation determination criteria or rules can be used to analyze whether the operations recorded in each historical operation log associated with the user ID belong to sensitive operations; then, each historical operation log whose recorded operation belongs to a sensitive operation can be used as the recorded data of each historical sensitive operation of the target operator.

[0062] In addition, it should be noted that the historical behavior feature vector is used to represent the comprehensive behavior performance of the target operator for the executed historical sensitive operation in terms of operation type, time, and geographical location. In the process of performing feature extraction and feature fusion processing on the recorded data of each historical sensitive operation to obtain the historical behavior feature vectors of the target operator, three types of features can be extracted: operation features, time features, and geographical features. Among them, the operation features are used to describe the specific operation behavior and its type executed by the user, which can include the operation type and the operation target; the time features are used to describe the time and frequency of the user's operation to reflect the user's time pattern and behavior rule, which can include the operation time and the operation frequency; the geographical features are used to describe the source location of the user's operation and identify whether there is a geographical location anomaly, which can include the geographical location information resolved from the operation source IP address. After the feature extraction process is completed, for any historical sensitive operation, the operation features, time features, and geographical features corresponding to the historical sensitive operation can be standardized to convert data of different scales to the same scale; then, the standardized features can be concatenated to fuse the features and obtain the historical behavior feature vector of the target operator under the historical sensitive operation.

[0063] Furthermore, it should be noted that a deep autoencoder is a neural network structure composed of an encoder and a decoder. It can compress high-dimensional input data into a low-dimensional representation and then reconstruct it back to high-dimensional data from the low-dimensional representation, learning the internal representation of the data by minimizing the reconstruction error. The deep autoencoder is divided into four parts: an input layer, an encoder, a decoder, and an output layer. The input layer is used to receive each historical behavior feature vector; the encoder consists of multiple fully connected networks, and by gradually reducing the number of neurons layer by layer, it can compress the high-dimensional input data (i.e., each historical behavior feature vector) into a low-dimensional space; the structure of the decoder is symmetric to that of the encoder, and it can decode and restore the low-dimensional representation layer by layer to the original high-dimensional data; the dimension of the output layer is the same as that of the input layer and is used to reconstruct each historical behavior feature vector of the input.

[0064] Among them, the deep autoencoder can use the Mean Squared Error (MSE) as the calculation method of the model reconstruction error, and specifically, it can refer to the following formula 3: Formula 3; where n is the total number of each historical behavior feature vector, is the i-th historical behavior feature vector, is the i-th reconstructed output after passing through the encoder and decoder. During the training process, the training objective is to minimize the and reconstruction error between them. To achieve this goal, the deep autoencoder model can adopt the gradient descent optimization algorithm to continuously optimize the parameters of the neural network, thereby reducing the reconstruction error. In this process, the deep autoencoder model can effectively learn the normal operation behavior pattern of users and form the normal behavior baseline of users. Thus, after the model training is completed, the trained model usually has a relatively small reconstruction error for normal operation data. Therefore, the distribution of the reconstruction error can be used as a metric for the user behavior baseline.

[0065] In a feasible implementation manner, after determining the security risk score, the abnormal risk assessment tool 302 can also construct a detailed prompt in the way of prompt engineering according to the security risk score, operation content, and operator information, so as to transmit key information such as the security risk score, operation content, and operation information to the large language model associated with the abnormal risk assessment tool 302. On this basis, the prompt will guide the large language model associated with the abnormal risk assessment tool 302 to generate a natural language text as a risk assessment report to describe the security risk of the current sensitive operation.

[0066] In a feasible implementation, to enhance the long-term optimization ability of the risk assessment agent 30, the determined behavior baseline model, the current behavior feature vector, the security risk score, and the risk assessment report can be stored in the long-term memory module connected to the risk assessment agent 30 (a vector database can be used to ensure fast data retrieval and continuous optimization), so that the risk assessment agent 30 can refer to them for future security risk assessment and optimize the risk assessment strategy.

[0067] Based on the above first, second, and / or third embodiments, a fourth embodiment of the sensitive operation approval decision-making system of the present application is proposed. In the fourth embodiment, please refer to Figure 6 , the sensitive operation approval decision-making system may further include a decision support tool 401 and a historical matching tool 402, and the authorization decision agent 40 is connected to the decision support tool 401 and the historical matching tool 402; The authorization decision agent 40 is further configured to: Obtain the operation rationality score output by the intelligent approval agent and the security risk score output by the risk assessment agent; Invoke the decision support tool 401 to comprehensively analyze the operation rationality score and the security risk score to obtain the comprehensive decision score of the current sensitive operation; Invoke the historical matching tool 402 to obtain each historical sensitive operation similar to the current sensitive operation as each target sensitive operation, and determine the total historical decision score based on the comprehensive decision score of each target sensitive operation and the similarity between each target sensitive operation and the current sensitive operation; Perform a weighted process on the comprehensive decision score of the current sensitive operation and the total historical decision score to obtain the approval decision score of the current sensitive operation.

[0068] It should be noted that when invoking the historical matching tool 402 to obtain each historical sensitive operation similar to the current sensitive operation, if the authorization decision agent 40 is connected to a long-term memory module, the historical matching tool 402 can directly obtain each historical sensitive operation similar to the current sensitive operation from the long-term memory module connected to the authorization decision agent 40; it can also obtain each historical sensitive operation similar to the current sensitive operation from an external database. This embodiment does not make specific limitations on this. The process of performing a weighted process on the comprehensive decision score of the current sensitive operation and the total historical decision score to obtain the approval decision score of the current sensitive operation can be expressed by the following formula 4: Formula 4; Wherein, is the approval decision score of the current sensitive operation, is the comprehensive decision score of the current sensitive operation, is the weight of the comprehensive decision score of the current sensitive operation, is the total historical decision score, is the weight of the total historical decision score. The weight of the comprehensive decision score of the current sensitive operation can be dynamically adjusted by the authorized decision-making agent 40, and its default value is 0.5.

[0069] Additionally, it should be noted that the authorized decision-making agent 40 can connect to the decision support tool 401 and the historical matching tool 402 through a specific API call interface, or connect to the decision support tool 401 and the historical matching tool 402 through the call interface of the RPC framework, or connect to the decision support tool 401 and the historical matching tool 402 through the interface of the middleware. This embodiment does not make specific limitations on this.

[0070] It can be understood that the authorized decision-making agent 40 realizes a fully automated process of comprehensive analysis and decision generation by decomposing the authorized decision-making task into two subtasks: final decision support and historical data comparison, and respectively using the decision support tool 401 and the historical matching tool 402 to execute each subtask.

[0071] In addition, in other embodiments, to obtain the approval result faster, the total historical decision score may not be considered, and the comprehensive decision score of the current sensitive operation may be directly used as the approval decision score of the current sensitive operation.

[0072] In a feasible implementation manner, the decision support tool 401 is used to: Perform standardization processing on the operation rationality score and the security risk score to obtain the standardized operation rationality score and security risk score; Perform weighted processing on the standardized operation rationality score and security risk score to obtain the comprehensive decision score of the current sensitive operation.

[0073] It should be noted that the purpose of standardizing the operation rationality score and the security risk score is to convert the operation rationality score and the security risk score to the same scale range. Since the higher the operation rationality score, the stronger the rationality of the operation; while the higher the security risk score, the more the operation deviates from the normal behavior, that is, the greater the risk degree of the operation. Therefore, in the process of obtaining the comprehensive decision-making score of the current sensitive operation by weighting the standardized operation rationality score and the security risk score, the first decision sub-score can be obtained by calculating the product of the weight corresponding to the operation rationality score and the standardized operation rationality score, and the second decision sub-score can be obtained by calculating the product of the weight corresponding to the security risk score and the complementary value of the standardized security risk score; then calculate the sum of the first decision sub-score and the second decision sub-score, and the comprehensive decision-making score of the current sensitive operation can be obtained, which can be represented by the following formula 5.

[0074] Formula 5; Wherein, is the comprehensive decision-making score of the current sensitive operation, is the operation rationality score, is the weight corresponding to the operation rationality score, is the security risk score, is the complementary value of the security risk score, is the weight corresponding to the security risk score. The weight corresponding to the operation rationality score can be set according to the security policy and business requirements of the system, and the authorization decision-making agent 40 can also dynamically adjust this weight according to the actual scenario . At the initialization of the system, the weight corresponding to the operation rationality score can be default set to 0.5.

[0075] In addition, it should be noted that the comprehensive decision-making score of the current sensitive operation quantifies the rationality and risk degree of the current sensitive operation.

[0076] In a feasible implementation manner, the historical matching tool 402 is used to: Determine the operation feature vector of the current sensitive operation; Determine the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation, as the similarity between each historical sensitive operation and the current sensitive operation; According to the similarity between each historical sensitive operation and the current sensitive operation, in descending order, obtain a preset number of historical sensitive operations as each target sensitive operation; Determine the weights of each target sensitive operation according to the similarity between each target sensitive operation and the current sensitive operation; Calculate the product of the weight of each target sensitive operation and the comprehensive decision-making score of each target sensitive operation itself to obtain each historical decision sub-score; Calculate the sum of each historical decision sub-score to obtain the historical decision total score.

[0077] It should be noted that the operation feature vector of the current sensitive operation can be constructed by using the key features in the application of the current sensitive operation. The key features can include operation type, operation time, operator, application reason, etc. On this basis, when determining the operation feature vector of the current sensitive operation, a detailed prompt can be constructed through prompt engineering, and then the operation application information of the current sensitive operation is passed to the large language model associated with the historical matching tool 402. Thus, the constructed prompt will guide the large language model to generate a standardized natural language text, and convert this text into a high-dimensional semantic vector, which is the operation feature vector of the current sensitive operation.

[0078] In addition, it should be noted that the cosine similarity can be used as the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation. Thus, the process of determining the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation can be expressed as the following formula 6: Formula 6; Where, is the similarity between the operation feature vector of the historical sensitive operation and the operation feature vector of the current sensitive operation, is the operation feature vector of the current sensitive operation, is the operation feature vector of the historical sensitive operation, is the modulus length of the operation feature vector of the current sensitive operation, is the modulus length of the operation feature vector of the historical sensitive operation.

[0079] In addition, it should be noted that the preset quantity can be a default value, such as 10, or can be flexibly set by the user according to the actual situation. This embodiment does not make specific limitations on this. In other feasible implementation manners, each historical sensitive operation with a similarity greater than the preset similarity threshold can also be used as each target sensitive operation. This embodiment does not make specific limitations on this. Among them, the preset similarity threshold is a default value and can also be flexibly set by the user according to the actual situation. This embodiment does not make specific limitations on this.

[0080] In a feasible implementation manner, the process of determining the weights of each target sensitive operation according to the similarity between each target sensitive operation and the current sensitive operation can be expressed by the following formula 7: Formula 7; Wherein, is the weight of the i-th target sensitive operation, is the similarity between the i-th target sensitive operation and the current sensitive operation, is the sum of the similarities between all target sensitive operations and the current sensitive operation, and m is a preset number.

[0081] In a feasible implementation manner, to improve the long-term optimization ability of the authorization decision-making agent 40, the above-determined approval decision score and approval result can be stored in the long-term memory module connected to the authorization decision-making agent 40 (a vector database can be used to ensure fast data retrieval and continuous optimization) for future decision-making judgments of the authorization decision-making agent 40.

[0082] The embodiments of the present application further provide a sensitive operation approval decision method. Please refer to Figure 7 , the sensitive operation approval decision method may include steps S10 to S40: Step S10, after receiving a sensitive operation request from a target operator, obtain the sensitive operation data of the target operator; the sensitive operation data includes operator information, historical operation data, the operation content of the current sensitive operation, and the application reason; Step S20, determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; Step S30, perform a security risk analysis based on the operation content, operator information, and historical operation data to generate a security risk score for the current sensitive operation; Step S40, determine the approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

[0083] In one embodiment, step S20 may include steps S21 to S23: Step S21, receive the operation content and the application reason output by the operation application module; Step S22, call a natural language processing tool to perform semantic analysis on the operation content and the application reason respectively to determine the operation intention and the key application reason of the current sensitive operation; Step S23, call an operation application matching tool to determine the matching degree between the operation intention and the key application reason as the matching degree between the operation content and the application reason.

[0084] In one embodiment, step S22 may include steps S221 to S222: Step S221, preprocess the operation content and application reason to obtain the preprocessed operation content and application reason; Step S222, input the preprocessed operation content and application reason into the large language model associated with the natural language processing tool respectively to determine the operation intention of the current sensitive operation and the key application reason.

[0085] In one embodiment, step S23 may include steps S231 to S232: Step S231, perform semantic embedding processing on the operation intention and the key application reason based on the large language model associated with the operation application matching tool to obtain the embedding vector of the operation intention and the embedding vector of the key application reason; Step S232, determine the similarity between the embedding vector of the operation intention and the embedding vector of the key application reason as the matching degree between the operation intention and the key application reason.

[0086] In one embodiment, S30 may include steps S31 to S34: Step S31, receive the operation content, operator information, and historical operation data output by the operation application module; Step S32, call the behavior baseline construction tool to construct the behavior baseline model of the target operator based on the historical operation data; Step S33, call the abnormal risk assessment tool to perform feature extraction and feature fusion processing on the operation content and operator information to obtain the current behavior feature vector of the target operator, and input the current behavior feature vector into the behavior baseline model to obtain the reconstruction error of the current sensitive operation; Step S34, calculate the absolute value of the difference between the reconstruction error and the preset error threshold to obtain the security risk score of the current sensitive operation.

[0087] In one embodiment, step S34 may include steps S341 to S343: Step S341, preprocess the historical operation data to obtain the record data of all historical sensitive operations of the target operator from the historical operation data; Step S342, perform feature extraction and feature fusion processing on the record data of each historical sensitive operation to obtain the historical behavior feature vectors of the target operator; Step S343, iteratively train the preset deep autoencoder model based on the historical behavior feature vectors to obtain the behavior baseline model.

[0088] In one embodiment, step S40 may include steps S41 to S44: Step S41, obtain the operation rationality score output by the intelligent approval agent and the security risk score output by the risk assessment agent; Step S42, call the decision support tool to comprehensively analyze the operation rationality score and the security risk score, and obtain the comprehensive decision score of the current sensitive operation; Step S43, call the historical matching tool to obtain each historical sensitive operation similar to the current sensitive operation as each target sensitive operation, and determine the total historical decision score based on the comprehensive decision score of each target sensitive operation and the similarity between each target sensitive operation and the current sensitive operation; Step S44, perform weighted processing on the comprehensive decision score of the current sensitive operation and the total historical decision score to obtain the approval decision score of the current sensitive operation.

[0089] In one embodiment, step S42 may include steps S421 to S422: Step S421, perform standardization processing on the operation rationality score and the security risk score to obtain the standardized operation rationality score and security risk score; Step S422, perform weighted processing on the standardized operation rationality score and the security risk score to obtain the comprehensive decision score of the current sensitive operation.

[0090] In one embodiment, step S43 may include steps S431 to S436: Step S431, determine the operation feature vector of the current sensitive operation; Step S432, determine the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation as the similarity between each historical sensitive operation and the current sensitive operation; Step S433, obtain a preset number of historical sensitive operations in descending order according to the similarity between each historical sensitive operation and the current sensitive operation as each target sensitive operation; Step S434, determine the weight of each target sensitive operation according to the similarity between each target sensitive operation and the current sensitive operation; Step S435, calculate the product of the weight of each target sensitive operation and the comprehensive decision score of each target sensitive operation to obtain each historical decision sub-score; Step S436, calculate the sum of each historical decision sub-score to obtain the total historical decision score.

[0091] , The sensitive operation approval decision-making method provided by the embodiments of the present application can improve the approval efficiency and accuracy of sensitive operations of operators. Compared with the prior art, the beneficial effects of the sensitive operation approval decision-making method provided by the embodiments of the present application are the same as those of the sensitive operation approval decision-making system provided by the above embodiments, and will not be elaborated here.

[0092] The embodiments of the present application further provide a computer-readable storage medium storing a computer program that can be run on a processor, and the computer program is used to execute the sensitive operation approval decision-making method in the above embodiments.

[0093] The computer-readable storage medium provided by the embodiments of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, system, or device. The program code included on the computer-readable storage medium can be transmitted by any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0094] The above computer-readable storage medium may be included in the sensitive operation approval decision-making system; or it may exist alone without being assembled into the sensitive operation approval decision-making system.

[0095] The above computer-readable storage medium carries one or more programs, which, when executed by the sensitive operation approval decision-making system, cause the sensitive operation approval decision-making system to: after receiving a sensitive operation request from a target operator, obtain the sensitive operation data of the target operator; the sensitive operation data includes operator information, historical operation data, the operation content and application reason of the current sensitive operation; determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; perform a security risk analysis based on the operation content, operator information and historical operation data to generate a security risk score for the current sensitive operation; determine an approval decision score for the current sensitive operation according to the operation rationality score and the security risk score, and based on the approval decision score of the current sensitive operation, determine the approval result of the current sensitive operation.

[0096] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, execute as a stand-alone software package, execute partially on the user's computer and partially on a remote computer, or execute entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0097] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions denoted in the blocks may occur in a different order than denoted in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0098] The modules involved in the embodiments of this application can be implemented in software or in hardware. In some cases, the name of the module does not constitute a limitation on the unit itself.

[0099] The computer-readable storage medium provided by the embodiments of this application stores computer-readable program instructions for executing the above-mentioned sensitive operation approval decision-making method, which can improve the approval efficiency and accuracy of sensitive operations of operators. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the embodiments of this application are the same as those of the sensitive operation approval decision-making method provided by the above embodiments, and will not be elaborated here.

[0100] The embodiments of this application also provide a computer program product, including a computer program, which implements the steps of the sensitive operation approval decision-making method as described above when executed by a processor.

[0101] The computer program product provided by the embodiments of this application can improve the approval efficiency and accuracy of sensitive operations of operators. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiments of this application are the same as those of the sensitive operation approval decision-making method provided by the above embodiments, and will not be elaborated here.

[0102] The above are only the preferred embodiments of this application, and do not limit the patent scope of this application accordingly. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of this application, or directly or indirectly applied in other related technical fields, shall be similarly included in the patent scope of this application.

Claims

1. A sensitive operation approval decision-making system, characterized in that The sensitive operation approval decision-making system includes: An operation application module, which is used to obtain the sensitive operation data of the target operator after receiving a sensitive operation request from the target operator; the sensitive operation data includes operator information, historical operation data, the operation content and application reason of the current sensitive operation; An intelligent approval agent, the input end of the intelligent approval agent is connected to the first output end of the operation application module, and is used to determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; A risk assessment agent, the input end of the risk assessment agent is connected to the second output end of the operation application module, and is used to perform security risk analysis based on the operation content, the operator information and the historical operation data, and generate the security risk score of the current sensitive operation; An authorization decision-making agent, the input end of the authorization decision-making agent is connected to the output end of the intelligent approval agent and the output end of the risk assessment agent, and is used to determine the approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

2. The sensitive operation approval decision-making system according to claim 1, wherein The sensitive operation approval decision-making system further includes a natural language processing tool and an operation application matching tool, and the intelligent approval agent is connected to the natural language processing tool and the operation application matching tool; The intelligent approval agent is further used for: Receiving the operation content and the application reason output by the operation application module; Invoking the natural language processing tool to perform semantic analysis on the operation content and the application reason respectively to determine the operation intention and application key reason of the current sensitive operation; Invoking the operation application matching tool to determine the matching degree between the operation intention and the application key reason as the matching degree between the operation content and the application reason.

3. The sensitive operation approval decision-making system according to claim 2, wherein The natural language processing tool is used for: Performing preprocessing on the operation content and the application reason to obtain the preprocessed operation content and application reason; Inputting the preprocessed operation content and application reason into the large language model associated with the natural language processing tool respectively to determine the operation intention and application key reason of the current sensitive operation.

4. The sensitive operation approval decision-making system according to claim 2, characterized in that, The operation application matching tool is used for: Performing semantic embedding processing on the operation intention and the application key reason based on the large language model associated with the operation application matching tool to obtain the embedding vector of the operation intention and the embedding vector of the application key reason; Determining the similarity between the embedding vector of the operation intention and the embedding vector of the application key reason as the matching degree between the operation intention and the application key reason.

5. The sensitive operation approval decision-making system according to claim 1, wherein The sensitive operation approval decision-making system further includes a behavior baseline construction tool and an abnormal risk assessment tool, and the risk assessment agent is connected to the behavior baseline construction tool and the abnormal risk assessment tool; The risk assessment agent is further used for: Receive the operation content, the operator information, and the historical operation data output by the operation application module; Call the behavior baseline construction tool to construct a behavior baseline model of the target operator based on the historical operation data; Call the abnormal risk assessment tool to perform feature extraction and feature fusion processing on the operation content and the operator information to obtain the current behavior feature vector of the target operator, and input the current behavior feature vector into the behavior baseline model to obtain the reconstruction error of the current sensitive operation; Calculate the absolute value of the difference between the reconstruction error and a preset error threshold to obtain the security risk score of the current sensitive operation.

6. The sensitive operation approval decision-making system according to claim 5, wherein The behavior baseline construction tool is used for: Preprocess the historical operation data to obtain the record data of all historical sensitive operations of the target operator from the historical operation data; Perform feature extraction and feature fusion processing on the record data of each historical sensitive operation to obtain the respective historical behavior feature vectors of the target operator; Iteratively train a preset deep autoencoder model based on the respective historical behavior feature vectors to obtain the behavior baseline model.

7. The sensitive operation approval decision-making system according to any one of claims 1 to 6, characterized in that, The sensitive operation approval decision system further includes a decision support tool and a historical matching tool, and the authorization decision agent is connected to the decision support tool and the historical matching tool; The authorization decision agent is further used for: Obtain the operation rationality score output by the intelligent approval agent and the security risk score output by the risk assessment agent; Call the decision support tool to comprehensively analyze the operation rationality score and the security risk score to obtain the comprehensive decision score of the current sensitive operation; Call the historical matching tool to obtain each historical sensitive operation similar to the current sensitive operation as each target sensitive operation, and determine the total historical decision score based on the comprehensive decision scores of each target sensitive operation and the similarity between each target sensitive operation and the current sensitive operation; Perform weighted processing on the comprehensive decision score of the current sensitive operation and the total historical decision score to obtain the approval decision score of the current sensitive operation.

8. The sensitive operation approval decision-making system according to claim 7, wherein The decision support tool is used for: Perform standardization processing on the operation rationality score and the security risk score to obtain the operation rationality score and the security risk score after standardization processing; Perform weighted processing on the operation rationality score and the security risk score after standardization processing to obtain the comprehensive decision score of the current sensitive operation.

9. The sensitive operation approval decision-making system according to claim 7, characterized in that, The historical matching tool is used for: Determine the operation feature vector of the current sensitive operation; Determine the similarity between the operation feature vector of each historical sensitive operation recorded in the long-term memory module and the operation feature vector of the current sensitive operation as the similarity between each historical sensitive operation and the current sensitive operation; Obtain a preset number of historical sensitive operations in descending order according to the similarity between each historical sensitive operation and the current sensitive operation as each target sensitive operation; Determine the weights of the target sensitive operations according to the similarity between each of the target sensitive operations and the current sensitive operation; Calculate the product of the weight of each target sensitive operation and the comprehensive decision-making score of each target sensitive operation to obtain each historical decision sub-score; Calculate the sum of the historical decision sub-scores to obtain the total historical decision score.

10. A sensitive operation approval decision-making method, characterized in that The method includes: After receiving a sensitive operation request from a target operator, obtain the sensitive operation data of the target operator; the sensitive operation data includes operator information, historical operation data, the operation content and application reason of the current sensitive operation; Determine the matching degree between the operation content and the application reason as the operation rationality score of the current sensitive operation; Conduct a security risk analysis based on the operation content, the operator information and the historical operation data to generate a security risk score for the current sensitive operation; Determine the approval decision score of the current sensitive operation according to the operation rationality score and the security risk score, and determine the approval result of the current sensitive operation based on the approval decision score of the current sensitive operation.

11. A readable storage medium, characterized in that, The readable storage medium is a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of the sensitive operation approval decision method as claimed in claim 10 are implemented.

12. A program product, characterized in that, The program product is a computer program product, and the computer program product includes a computer program. When the computer program is executed by a processor, the steps of the sensitive operation approval decision method as claimed in claim 10 are implemented.

Images