Refined permission configuration method and device, storage medium and program product

Abstract

The embodiment of the invention discloses a refined permission configuration method and device, a storage medium and a program product. The method comprises the following steps: collecting a multi-modal time sequence data stream of a key sub-component in a target system, and carrying out preprocessing and feature engineering processing on the multi-modal time sequence data stream to generate a multi-modal feature vector set; constructing an anomaly detection model based on the multi-modal feature vector set; collecting current operation data of each key sub-assembly and constructing the current operation data into a to-be-detected data set; inputting the to-be-detected data set into the anomaly detection model to obtain an anomaly detection result and a risk assessment report; based on the anomaly detection result and the risk assessment report, obtaining a comprehensive risk score of each key sub-component; and based on the comprehensive risk score, performing permission adjustment on the key sub-component of the target system. According to the method, the key sub-components are determined and the comprehensive risk scores of the key sub-components are accurately quantified, so that the fine-grained control of the sub-component level of the system is realized, and the refined safety requirement in a complex system is met.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular, to a refined permission configuration method, device, storage medium, and program product. Background Art

[0002] Permission configuration and anomaly detection technologies play a key role in the field of network security. Their main purpose is to protect the system, prevent unauthorized users from accessing system resources, resist various potential security threats, and ensure the security and stability of the system.

[0003] However, in large and complex systems, different sub-components often have different security requirements. Traditional permission configuration and anomaly detection methods expose obvious deficiencies when dealing with such complex systems, lacking the ability to finely control at the sub-component level of the system and being difficult to meet the refined security requirements. Summary of the Invention

[0004] In view of this, embodiments of the present disclosure provide a refined permission configuration method, device, storage medium, and program product, which can achieve fine-grained control at the sub-component level of the system by identifying key sub-components and accurately quantifying the comprehensive risk scores of key sub-components, and meet the refined security requirements in complex systems.

[0005] In a first aspect, embodiments of the present disclosure provide a refined permission configuration method, adopting the following technical solutions:

[0006] Collect multi-modal time series data streams of key sub-components in the target system;

[0007] Perform preprocessing and feature engineering on the multi-modal time series data stream to generate a multi-modal feature vector set;

[0008] Build an anomaly detection model based on the multi-modal feature vector set;

[0009] Collect the current running data of each key sub-component, and build a dataset to be detected based on the current running data;

[0010] Input the dataset to be detected into the anomaly detection model to obtain an anomaly detection result and a risk assessment report;

[0011] Based on the anomaly detection result and the risk assessment report, obtain the comprehensive risk score of each key sub-component;

[0012] Based on the comprehensive risk score, adjust the permissions of the key sub-components of the target system.

[0013] Optionally, the collecting of the multi-modal time series data streams of key sub-components in the target system includes:

[0014] Obtain the component structure data of the target system, and identify the sub-components in the target system based on the component structure data;

[0015] During the operation of the target system, track the actual call relationships and data flow processes among the sub-components to generate dynamic data;

[0016] Combine the component structure data and the dynamic data to filter out the key sub-components, and construct a list of key sub-components and a mapping relationship diagram of the interaction interfaces of the key sub-components;

[0017] Deploy sensor acquisition points based on the list and the mapping relationship diagram, and collect the original data stream based on the sensor acquisition points;

[0018] Synchronize and standardize the original data stream to obtain a multi-modal time series data stream.

[0019] Optionally, preprocess and perform feature engineering on the multi-modal time series data stream to generate a multi-modal feature vector set, including:

[0020] Use the window mechanism to clean the multi-modal time series data stream;

[0021] Use the overlapping sliding window mechanism to divide the cleaned multi-modal time series data stream into multiple data segments;

[0022] Perform standardization processing on each data segment to obtain standardized data segments;

[0023] Extract features from the standardized data segments to generate a feature set;

[0024] Perform feature selection on the feature set to generate a multi-modal feature vector set.

[0025] Optionally, construct an anomaly detection model based on the multi-modal feature vector set, including:

[0026] Construct an initial model, and pre-train the initial model based on the multi-modal feature vector set;

[0027] Construct a feature extractor, and train the feature extractor based on the multi-modal feature vector set with the input requirements of the initial model as the target;

[0028] Integrate the trained feature extractor with the pre-trained initial model to form a complete model;

[0029] Optimize the complete model based on the multi-modal feature vector set to generate an anomaly detection model.

[0030] Optionally, obtaining a comprehensive risk score for each key sub-component based on the anomaly detection result and the risk assessment report, including:

[0031] Based on the anomaly scores and anomaly types of each key sub-component in the anomaly detection result, and the multi-dimensional risk scores of each key sub-component in the risk assessment report, obtaining the basic risk values of each key sub-component;

[0032] According to the anomaly type, counting the occurrence frequency and historical occurrence quantity of the corresponding anomaly events of each key sub-component, and obtaining the current load value of each key sub-component;

[0033] Based on the occurrence frequency, the historical event quantity and the current load value, obtaining the time risk value of each key sub-component;

[0034] Evaluating the importance of each key sub-component in the target system, the degree of dependence on other sub-components, and the sensitivity to the processed data, and obtaining the key level, the dependence factor and the sensitivity level;

[0035] Based on the key level, the dependence factor and the data sensitivity, obtaining the environmental risk value of each key sub-component;

[0036] Based on the basic risk value, the time risk value and the environmental risk value, obtaining the comprehensive risk score of each key sub-component.

[0037] Optionally, the calculation formula of the basic risk value is as follows:

[0038]

[0039] Among them, R b represents the basic risk value of the key sub-component; a represents the anomaly score weight; A represents the anomaly score of the key sub-component; i represents the number of the anomaly type; I represents the total number of the anomaly types of the key sub-component; β i represents the weight of the i-th anomaly type of the key sub-component; T i represents the score of the i-th anomaly type of the key sub-component; γ represents the risk score weight; M represents the weighted average value of the multi-dimensional risk scores of the key sub-component.

[0040] Optionally, based on the comprehensive risk score, adjusting the permissions of the key sub-components of the target system, including:

[0041] Determining the key sub-components with the comprehensive risk score greater than the preset risk threshold as abnormal sub-components;

[0042] Based on the comprehensive risk score, determining the coarse-grained permission level of the abnormal sub-component;

[0043] Query a standard permission template that matches the coarse-grained permission level from a preset template set, and determine the fine-grained permission level of the abnormal sub-component based on the standard permission template;

[0044] Compare the fine-grained permission of the abnormal sub-component with the current permission;

[0045] If they are the same, it is determined that the abnormal sub-component does not need to adjust the permission;

[0046] If they are different, determine the abnormal sub-component as the target sub-component, predict the impact after adjusting the permission of the target sub-component, and obtain the impact result;

[0047] Fine-tune the fine-grained permission of the target sub-component based on the impact result, and construct an access permission list based on the new fine-grained permission;

[0048] Adjust the permissions of each target sub-component based on the access permission list.

[0049] In a second aspect, an embodiment of the present disclosure also provides a refined permission configuration system, which adopts the following technical solutions:

[0050] A data collection module, configured to collect multi-modal time series data streams of key sub-components in a target system;

[0051] A data processing module, configured to perform preprocessing and feature engineering processing on the multi-modal time series data stream to generate a multi-modal feature vector set;

[0052] A model construction module, configured to construct an anomaly detection model based on the multi-modal feature vector set;

[0053] A set construction module, configured to collect the current running data of each key sub-component and construct a data set to be detected based on the current running data;

[0054] An anomaly detection module, configured to input the data set to be detected into the anomaly detection model to obtain an anomaly detection result and a risk assessment report;

[0055] A score acquisition module, configured to obtain a comprehensive risk score of each key sub-component based on the anomaly detection result and the risk assessment report;

[0056] A permission adjustment module, configured to adjust the permissions of key sub-components of the target system based on the comprehensive risk score.

[0057] In a third aspect, an embodiment of the present disclosure also provides a computer device, which adopts the following technical solutions:

[0058] The computer device includes:

[0059] At least one processor; and,

[0060] A memory communicatively connected to the at least one processor; wherein,

[0061] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any one of the above-mentioned refined privilege configuration methods.

[0062] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium storing computer instructions for causing a computer to execute any one of the above-mentioned refined privilege configuration methods.

[0063] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of any one of the above-mentioned methods are implemented.

[0064] The refined privilege configuration method provided by the embodiments of the present disclosure starts from collecting data. The multi-modal time series data stream covers sub-component metrics, network traffic, etc., which belong to side-channel information and other operation data. These rich data reflect the operation status of key sub-components from multiple dimensions and time spans, greatly improving the comprehensiveness of the data and being able to capture potential problems that cannot be discovered by single-modal data or short-time data, which is an important data support for realizing refined privilege configuration. Preprocessing and feature engineering processing improve the data quality to ensure the accuracy and reliability of the data used in subsequent analysis. Since the multi-modal feature vector set synthesizes multi-dimensional and high-quality feature information, the anomaly detection model can make full use of the complementarity of multi-modal data to identify abnormal behaviors from multiple dimensions. Compared with the single-dimensional anomaly detection method, it can more accurately detect complex attack behaviors, including sophisticated attacks such as backdoor attacks that are difficult to detect in the joint learning scenario, thereby improving the accuracy of subsequent privilege adjustment. The currently running data collected in real time can reflect the current actual running status of the target system. Combined with the anomaly detection model, it ensures the timeliness and pertinence of anomaly detection, and based on the output result of the anomaly detection model, accurately quantifies the comprehensive risk score to achieve fine-grained control at the sub-component level of the system. This refined privilege adjustment strategy can effectively address the refined security requirements in complex systems.

[0065] The above description is only an overview of the technical solution of the present disclosure. In order to understand the technical means of the present disclosure more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present disclosure more obvious and understandable, the following preferred embodiments are specifically given and described in detail in conjunction with the drawings as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings required for the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0067] Figure 1 It is a schematic flowchart of the refined permission configuration method provided by the embodiments of the present disclosure;

[0068] Figure 2 It is a schematic flowchart of the multi-modal time series data stream collection method provided by the embodiments of the present disclosure;

[0069] Figure 3 It is a schematic flowchart of the multi-modal feature vector set construction method provided by the embodiments of the present disclosure;

[0070] Figure 4 It is a schematic flowchart of the feature selection method provided by the embodiments of the present disclosure;

[0071] Figure 5 It is a schematic flowchart of the anomaly detection model construction method provided by the embodiments of the present disclosure;

[0072] Figure 6 It is a schematic flowchart of the comprehensive risk score acquisition method provided by the embodiments of the present disclosure;

[0073] Figure 7 It is a schematic flowchart of the permission adjustment method provided by the embodiments of the present disclosure;

[0074] Figure 8 It is a schematic block diagram of the principle of the refined permission configuration system provided by the embodiments of the present disclosure;

[0075] Figure 9 It is a schematic structural diagram of a computer device provided by the embodiments of the present disclosure. Specific embodiments

[0076] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0077] It should be clear that the following uses specific specific examples to illustrate the implementation modes of the present disclosure, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific implementation modes, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present disclosure.

[0078] It should be noted that the following describes various aspects of the embodiments within the scope of the appended claims. It should be obvious that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is only illustrative. Based on the present disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using other structures and / or functionality in addition to one or more of the aspects described herein.

[0079] It also should be noted that the diagrams provided in the following embodiments only illustrate the basic concept of the present disclosure in a schematic manner. The diagrams only show the components related to the present disclosure, rather than being drawn according to the number, shape, and size of the components in actual implementation. The type, quantity, and proportion of each component in its actual implementation can be arbitrarily changed, and the component layout type may also be more complex.

[0080] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0081] Referring to Figure 1 , the present disclosure provides a refined permission configuration method, including the following steps:

[0082] S1: Collect the multi-modal time series data streams of key sub-components in the target system;

[0083] S2: Perform preprocessing and feature engineering processing on the multi-modal time series data streams to generate a multi-modal feature vector set;

[0084] S3: Build an anomaly detection model based on the multi-modal feature vector set;

[0085] S4: Collect the current operation data of each key sub-component, and construct a dataset to be detected based on the current operation data;

[0086] S5: Input the dataset to be detected into the anomaly detection model to obtain the anomaly detection result and the risk assessment report;

[0087] S6: Based on the anomaly detection result and the risk assessment report, obtain the comprehensive risk score of each key sub-component;

[0088] S7: Based on the comprehensive risk score, adjust the permissions of the key sub-components of the target system.

[0089] System components are the various parts that make up a system. It is a relatively broader concept. System sub-components are further subdivided from system components and are smaller units within system components. Moreover, system components can, to a certain extent, independently complete some functions, while the functions of system sub-components are relatively more dependent on the system components to which they belong. For example, for a software system, system components may include a user interface, a database, a network communication module, etc. And system sub-components can be a button module in the user interface or a data table structure module in the database.

[0090] In traditional methods, due to the large number and complex structure of system sub-components, and at the same time, the highly diverse requirements for permission management, it is difficult to achieve fine-grained permission configuration at the sub-component level only by traditional means.

[0091] The fine-grained permission configuration method provided by the present disclosure starts from collecting data. The multi-modal time series data stream covers sub-component metrics, network traffic, etc., which belong to side-channel information and other operation data. These rich data reflect the operation status of key sub-components from multiple dimensions and time spans, greatly improving the comprehensiveness of the data and being able to capture potential problems that cannot be discovered by single-modal data or short-term data. It is an important data support for realizing fine-grained permission configuration. Preprocessing and feature engineering processing improve the data quality to ensure the accuracy and reliability of the data used for subsequent analysis.

[0092] Since the multi-modal feature vector set synthesizes multi-dimensional and high-quality feature information, the anomaly detection model can make full use of the complementarity of multi-modal data to identify abnormal behaviors from multiple dimensions. Compared with single-dimensional anomaly detection methods, it can more accurately detect complex attack behaviors, including sophisticated attacks such as backdoor attacks that are difficult to detect in joint learning scenarios, thereby improving the accuracy of subsequent permission adjustment.

[0093] The currently running data collected in real time can reflect the current actual running state of the target system. Combining with the anomaly detection model ensures the timeliness and pertinence of anomaly detection. Based on the output results of the anomaly detection model, the comprehensive risk score is accurately quantified to achieve fine-grained control at the subsystem component level. This refined permission adjustment strategy can effectively address the refined security requirements in complex systems.

[0094] In S1, referring to Figure 2 the flowchart of the multimodal time series data stream collection method shown, "collecting the multimodal time series data stream of key subcomponents in the target system" includes the following steps:

[0095] S11: Obtain the component structure data of the target system, and identify the subcomponents in the target system based on the component structure data;

[0096] S12: During the operation of the target system, track the actual call relationships and data transfer processes between subcomponents to generate dynamic data;

[0097] S13: Combine the component structure data and the dynamic data to screen out the key subcomponents, and construct a list of key subcomponents and a mapping relationship diagram of the interaction interfaces of key subcomponents;

[0098] S14: Deploy sensor collection points based on the list and the mapping relationship diagram, and collect the original data stream based on the sensor collection points;

[0099] S15: Perform synchronization and standardization processing on the original data stream to obtain the multimodal time series data stream.

[0100] In S11, obtain the component structure data (also known as static data) of the target system. The component structure data is a static description of the composition, mutual relationship, and deployment method of each component in the target system. The component structure data includes system architecture files, deployment configuration information, and dependency diagrams. Among them, the system architecture file is a document that details the high-level design and organizational structure of the target system. It shows the overall framework of the target system from a macroscopic level, including which main components or subsystems the system consists of, the hierarchical relationships, interaction methods, and respective functions of these components or subsystems. The deployment configuration is a detailed description of how the system is installed, deployed, and run in a specific hardware and software environment. The deployment configuration information is a series of parameters that guide the deployment process of the target system in the target environment, including the selection and configuration of servers, the installation paths and versions of software components, network configuration, database connection information, environment variable settings, and other parameters. The dependency diagram is a visual chart used to show the dependency relationships between various components in the target system.

[0101] Use static analysis tools (such as CodeQL or AST analyzers) to parse the component structure data and then identify the sub-components in the target system. Here, the sub-components refer to the most basic components in the target system. The static analysis methods used by these static analysis tools rely on the control flow graph (CFG) and data flow graph (DFG) techniques in program analysis theory, and combine taint analysis methods to identify sub-components. Among them, the control flow graph (CFG) can clearly show the execution order of statements in the program; the data flow graph (DFG) can reflect the flow and changes of data in the program; taint analysis can track the source and propagation path of data. By comprehensively applying these technical methods, sub-components can be identified more accurately.

[0102] In S12, when the target system is running, use instrumentation techniques (such as Dynamic Instrumentation) to track the actual call relationships and data transfer processes between sub-components, so as to obtain dynamic data.

[0103] In S13, in order to focus on the core part that needs permission configuration, combine the component structure data and dynamic data to comprehensively analyze all sub-components in the target system, and screen out sub-components that do not require permission management. These sub-components that do not require permission management usually refer to parts that do not involve sensitive data access and do not participate in key business process control, such as sub-components only used to display system announcements. After screening, determine the key sub-components and generate a complete list of key sub-components. The list of key sub-components includes the functional attributes of each key sub-component (referring to the specific functions and business uses of the key sub-component), call dependencies (indicating other sub-components or external services that the key sub-component depends on during operation), and security levels (referring to the security levels divided according to factors such as the sensitivity of data processed by the sub-component and the impact on system security). Based on the list of key sub-components, establish a mapping relationship graph of the key sub-component interaction interfaces, which can clearly show how each key sub-component is connected and interacts with each other, including information such as call interfaces, data transfer directions, and interaction conditions between sub-components.

[0104] In S14, based on the inventory and the mapping diagram, the deployment of sensor acquisition points and the collection of the original data stream are carried out. The specific deployment plan is carried out according to the characteristics and interaction of the key sub-components: at the computationally intensive key sub-components, performance counters (such as Linux perf) are deployed. Such sub-components usually undertake a large amount of computing tasks during system operation. Through the performance counters, the CPU usage rate, cache hit rate, and instruction execution status can be accurately monitored; for the key sub-components in memory-sensitive areas, memory access detectors (such as PIN tools) are installed. These areas have high requirements for memory access and data storage. The memory access detectors can record in detail the memory access patterns and data flow; while at the position of the key sub-components corresponding to the key hardware interfaces, power consumption monitors (such as RAPL interfaces) are deployed to collect the energy consumption data of the interfaces during operation.

[0105] Each sensor is equipped with a lightweight collection agent (Collector Agent) for real-time acquisition of the original data. The collection agent temporarily stores the collected original data in the local buffer. This local buffering mechanism can not only ensure the real-time nature of the data but also avoid data loss caused by network transmission problems, thus providing a stable and reliable original data stream for subsequent data analysis and processing.

[0106] In S15, after the original data stream is collected from each sensor acquisition point, synchronization and standardization processing are required to obtain a multi-modal time series data stream. In terms of data synchronization, a distributed time synchronization protocol (such as PTP) is adopted to ensure the time consistency of multi-source data. Then, the sliding time window mechanism is used. The typical window size is set to 100 ms, and the original data streams collected from different sensor acquisition points are grouped according to timestamps.

[0107] For the data within each time window, a series of standardization processing operations are performed. First, the data format is unified, and the data from different sources is converted into a unified data structure containing fields such as timestamps, sensor IDs, measurement values, and metadata; second, the sampling rate is normalized, and interpolation or downsampling methods are used to make the sampling frequencies of all data consistent. Among them, the interpolation algorithm uses cubic spline interpolation, which maintains the original data characteristics while ensuring the smoothness of the data; third, the numerical range is standardized, and different types of measurement values are normalized to the [0,1] interval; fourth, data quality control is carried out, and basic data validity checks are carried out to mark or filter out obviously abnormal data points.

[0108] Output a standardized multi-modal time series data stream, whose data structure includes timestamps, with a specific example being "2025-01-24T10:00:00.000Z"; component IDs, such as "component_001"; measurement values, like CPU usage rate of 0.75, memory access patterns presented in array form such as [0.2, 0.3, 0.4], and power consumption of 0.65; metadata includes sampling rate (e.g., 100) and quality score (e.g., 0.95). This standardized data structure ensures data consistency and availability, providing a reliable basis for subsequent feature extraction and anomaly detection. Through this multi-modal data acquisition scheme, it is possible to comprehensively capture the behavioral characteristics of key sub-components, improving the accuracy and reliability of anomaly detection.

[0109] In S2, referring to Figure 3 the flowchart of the multi-modal feature vector set construction method shown, "preprocess and perform feature engineering on the multi-modal time series data stream to generate a multi-modal feature vector set" includes the following steps:

[0110] S21: Use a window mechanism to clean the multi-modal time series data stream;

[0111] S22: Use an overlapping sliding window mechanism to divide the cleaned multi-modal time series data stream into multiple data segments;

[0112] S23: Perform normalization processing on each data segment to obtain normalized data segments;

[0113] S24: Extract features from the normalized data segments to generate a feature set;

[0114] S25: Perform feature selection on the feature set to generate a multi-modal feature vector set.

[0115] In S21, divide the multi-modal time series data stream into multiple types of modal data according to the differences in modalities, and then perform cleaning operations on this data. The cleaning steps mainly cover two aspects: noise reduction and abnormal data processing.

[0116] In the noise reduction step, for each type of modal data, adopt an adaptive median filtering algorithm. This algorithm is processed with the help of a window, and the window size is dynamically adjusted according to the local variance of the data. When the local variance of the data is small and the data is relatively smooth, use a smaller window, which can quickly remove noise; while when the data changes violently and there are edge features, increase the window size, so as to effectively retain the edge information of the data while removing sudden noise.

[0117] Abnormal data processing includes two parts: abnormal data detection and abnormal data repair. The sliding window technique is applied to the denoised modal data, and abnormal detection is carried out on the data within the sliding window, specifically including the detection of out-of-range data points, low-density data points, and short-path data points.

[0118] Among them, detecting out-of-range data points means using a statistical analysis method based on the 3σ criterion to calculate the mean (μ) and standard deviation (σ) of the data within the sliding window, and marking the data points outside the range of μ±3σ as out-of-range data points. This sliding window slides point by point along the time series data, continuously updating the data within the window to calculate the statistics. Detecting low-density data points means detecting based on the local outlier factor (LOF) of density. By evaluating the local density of data points within and around the sliding window, the data points with local density lower than the preset density threshold are identified and determined as low-density data points. Detecting short-path data points means using the isolation forest algorithm. Within the data range covered by the sliding window, decision trees are randomly constructed, and the path lengths of data points in the decision trees are counted. The data points with path lengths shorter than the preset length threshold are determined as short-path data points.

[0119] The three types of abnormal data, namely out-of-range data points, low-density data points, and short-path data points, detected are repaired. Abnormal data repair means processing according to the data type, using methods such as interpolation or replacing with neighboring values to ensure the continuity and reliability of the data.

[0120] In terms of both denoising and abnormal data processing, although the window mechanism is used, the window used in the adaptive median filtering algorithm implements a window size adjustment strategy based on local statistical characteristics, balancing the denoising effect and detail preservation; the sliding window used in the abnormal data processing process can slide point by point along the time series to update the data, and accurately detect abnormal points in the data through various methods. In addition, the abnormal data detection process combines statistical and machine learning methods, improving the detection accuracy through integrated decision-making.

[0121] In S22, the cleaned multi-modal time series data stream is segmented into multiple windows with dynamic lengths using overlapping sliding windows, and there is an overlapping part between each window, so as to realize continuous sampling of the data, and then multiple data segments are obtained. Note that the size of each window will be dynamically set according to the data characteristics of different modalities. For example, a 5-second window is used for CPU usage data, and a 1-second window is used for memory access pattern data. At the same time, the overlap rate between windows is set to 50% to ensure the continuity of features.

[0122] In S23, the normalization process for the data segments includes Min - Max normalization (minimum - maximum normalization), Z - score normalization (Z - score standardization), Robust normalization (robust standardization), and logarithmic transformation. Among them, Min - Max normalization means determining the minimum and maximum values of each data segment, and mapping the values in the data segment to the interval [0, 1] based on the minimum and maximum values; Z - score normalization means obtaining the mean and standard deviation of each data segment, and performing a standardized transformation on the data in the data segment based on the mean and standard deviation, so that the data presents a standard normal distribution with a mean of 0 and a standard deviation of 1, enhancing the comparability between data; Robust normalization means determining the median and interquartile range (IQR, that is, the difference between the upper quartile and the lower quartile) of each data segment, subtracting the median from the data in the data segment, and then dividing by the interquartile range, effectively reducing the influence of outliers on the normalization result and having strong robustness when dealing with data containing outliers; logarithmic transformation means performing a logarithmic transformation on the data segments with power - law distribution characteristics to make them closer to a normal distribution.

[0123] Since the data itself is in dynamic change and its distribution is not fixed, during a series of normalization processes, normalization parameters such as the minimum value, maximum value, mean, standard deviation, median, and interquartile range will be continuously updated to ensure that each normalization method can effectively cope with the dynamic change of the data distribution.

[0124] Through the above - mentioned series of normalization processes, the dimensionality differences between data in different dimensions can be eliminated, and a normalized multi - modal data segment, that is, a standardized data segment, can be generated.

[0125] In S24, rich features are comprehensively extracted from the standardized data segments, covering time - domain and frequency - domain features. Among them, time - domain features include statistical moment features (mean, variance, skewness, kurtosis, etc.), quantile features (quartiles and inter - quantile ranges, etc.), trend features (linear regression coefficients and autocorrelation coefficients, etc.), and morphological features (number of wave peaks, zero - crossing rate, and signal energy, etc.); frequency - domain features include spectrum (obtained through fast Fourier transform (FFT)), main frequency components (power spectral density, frequency - band energy ratio, etc.), spectral statistics (spectral centroid, frequency - band width, etc.), and time - frequency domain joint features (obtained using wavelet transform coefficients). Through these steps, the time - domain and frequency - domain characteristics of the data are considered, ensuring the comprehensiveness and complementarity of the features, and a comprehensive and rich feature set can be generated from the standardized data segments.

[0126] In S25, referring to Figure 4 the flow schematic diagram of the feature selection method shown, "performing feature selection on the feature set to generate a multi - modal feature vector set" includes the following steps:

[0127] S251: Use the Lasso regression algorithm to perform feature screening on the feature set, perform dimensionality reduction on the remaining features after feature screening, and obtain multiple low-dimensional features;

[0128] S252: Obtain the importance value of each low-dimensional feature, and screen out the effective features from all low-dimensional features based on the importance value;

[0129] S253: Construct a multi-modal feature vector set based on the effective features.

[0130] In S251, the Lasso regression algorithm can quickly identify unimportant features in the feature set from the perspective of the model, that is, compress the feature coefficients with minimal impact on the target variable to zero, thereby eliminating these features, reducing the number of features, and reducing the complexity of subsequent calculations. After screening by the Lasso regression algorithm, use the principal component analysis algorithm (such as PCA) to perform dimensionality reduction on the remaining features, convert the high-dimensional data into low-dimensional principal components, retain the main information of the data (the explained variance rate reaches 95%), and at the same time eliminate the possible multi-collinearity problem between features.

[0131] In S252, through the feature importance evaluation based on mutual information (MRMR algorithm), calculate the correlation and redundancy of each low-dimensional feature, perform weighted summation on the correlation and redundancy, and calculate the importance value of the low-dimensional feature. Sort the low-dimensional features in descending order of the importance value, and select the top K low-dimensional features as effective features.

[0132] In S253, the finally output feature vectors will adopt a preset structure to form a multi-modal feature vector set. This structure is a JSON object, which contains four main parts: one is "timestamp", used to record time, such as "2025-01-24T10:00:00.100Z"; the second is "window_id", such as "w001", which can be used to identify the data window; the third is "features", which is further divided into two sub-parts: "time_domain" (time-domain features) and "frequency_domain" (frequency-domain features). "time_domain" contains specific feature arrays such as "statistical_moments" (statistical moment features), "trend_coefficients" (trend coefficients), "morphological_features" (morphological features), etc., and "frequency_domain" contains specific feature arrays such as "spectral_features" (spectral features), "wavelet_coefficients" (wavelet transform coefficients), etc.; the fourth is "feature_importance_scores", which is a set of key-value pairs, where the key is the feature name and the value is the importance value corresponding to the feature. For example, the importance value of "feature_1" is 0.85, and that of "feature_2" is 0.76, etc.

[0133] Based on the above, feature selection adopts a multi-criteria decision-making method, which reduces the feature space dimension while maintaining the feature expression ability.

[0134] In S3, referring to Figure 5 the flow schematic diagram of the abnormal detection model construction method shown, "constructing an abnormal detection model based on the multi-modal feature vector set" includes the following steps:

[0135] S31: Construct an initial model and pre-train the initial model based on the multi-modal feature vector set;

[0136] S32: Construct a feature extractor and train the feature extractor based on the multi-modal feature vector set with the input requirements of the initial model as the goal;

[0137] S33: Integrate the trained feature extractor with the pre-trained initial model to form a complete model;

[0138] S34: Optimize the complete model based on the multi-modal feature vector set to generate an abnormal detection model.

[0139] In S31, the multi-modal feature vector set includes features of multiple modalities. The initial model is a deep learning framework, which includes a feature fusion module, a temporal modeling module, an anomaly detection module, and a risk assessment module. Among them, the feature fusion module is the starting link for the entire initial model to process multi-modal data. It contains an input layer and an attention mechanism layer. As the data entry point, the input layer receives features of multiple modalities and sets independent feature processing branches for each modality. Each branch contains multiple layers of fully connected networks. In these branches, the features within the modality are initially integrated, enabling the feature information of each modality to be initially sorted and processed within its respective branch. After the input layer completes the initial processing, its output is passed to the attention mechanism layer. The core function of the attention mechanism layer is to capture the importance weights between different modalities. It realizes the interactive fusion between modalities through a multi-head self-attention module, deeply mines and fuses the multi-modal features after the initial processing by the input layer, and finally outputs a unified feature representation, that is, the comprehensive fusion feature, so as to fully explore the associations and interactions between different modality features and provide high-quality feature inputs for subsequent modules such as the temporal modeling module.

[0140] The temporal modeling module includes a bidirectional LSTM network layer, a temporal attention layer, a residual connection layer, and a temporal convolutional network layer. When performing temporal modeling, first, the comprehensive fusion feature is input into the bidirectional LSTM network layer. This layer captures long-term temporal dependencies relying on the comprehensive fusion feature. The bidirectional LSTM analyzes the time series data from both the past and future directions, thereby more comprehensively and deeply understanding the temporal information in the data. The output of the bidirectional LSTM network layer is passed to the temporal attention layer, which processes the output of the bidirectional LSTM network layer to identify the feature importance of key time points, helping the initial model focus on the time points that have an important impact on anomaly detection. To ensure stable gradient propagation and feature retention during the training process of the initial model, a residual connection layer is set after the temporal attention layer. By means of residual connection, the common gradient disappearance problem in deep neural networks is alleviated, enabling the initial model to more effectively learn complex temporal patterns. Finally, the data processed by the residual connection layer is input into the temporal convolutional network layer, which uses the flexible receptive field of the TCN to process multi-scale time patterns, capture time dependencies at different scales, and form comprehensive temporal feature data, further enhancing the initial model's processing ability for temporal data.

[0141] The anomaly detection module includes a data reception layer, a behavior modeling layer, a threshold determination layer, an anomaly classification and quantification layer, and a feature extraction layer. The data reception layer, as the entry of the module, receives the comprehensive time-series feature data output from the upstream time-series modeling module, providing the basic data for subsequent anomaly detection. This layer passes the data to the behavior modeling layer. The behavior modeling layer establishes a normal behavior distribution model based on kernel density estimation (KDE). By learning a large amount of normal data, it fits the probability density function of the data, thus mastering the distribution law of normal behavior. Its output result will be sent to the threshold determination layer. The threshold determination layer uses an adaptive threshold algorithm, dynamically adjusts the determination boundary according to historical data, and simultaneously performs multi-scale threshold fusion, comprehensively considering short-term and long-term behavior patterns, realizes confidence interval estimation and gives a credibility score for anomaly determination, so as to judge whether the data is abnormal. The determination result will enter the anomaly classification and quantification layer. This layer distinguishes anomaly patterns such as point anomalies, context anomalies, and collective anomalies, clarifies the anomaly types of each key sub-component (for a key sub-component, its anomaly type may be one or multiple), and calculates the anomaly score and the impact range, determining the degree quantification index of the anomaly of each key sub-component. Finally, the feature extraction layer receives the result of the anomaly classification and quantification layer, summarizes the typical feature patterns of abnormal behaviors, and provides detailed anomaly information for subsequent risk assessment.

[0142] The risk assessment module includes a root cause analysis layer, a baseline establishment layer, an impact calculation layer, a risk scoring layer, and a report output layer. The root cause analysis layer receives the anomaly information from the anomaly detection module, traces the anomaly propagation path and associated impacts, and finds out the root cause of the anomaly. Its analysis result will be combined with the information generated by the baseline establishment layer. The baseline establishment layer establishes a risk assessment baseline based on historical data, serving as a reference standard for measuring the current anomaly risk level. The impact calculation layer receives the outputs of the root cause analysis layer and the baseline establishment layer, and calculates the potential impacts of the current anomaly on various aspects such as system security, performance, and availability. These potential impact data will be passed to the risk scoring layer. The risk scoring layer generates multi-dimensional risk scores based on these data, including security risk scores, performance risk scores, availability risk scores, etc. Finally, the report output layer receives the result of the risk scoring layer and outputs a detailed risk assessment report. The risk assessment report contains a timestamp (used to indicate the generation time of the report), basic information about the anomaly, root cause analysis results, potential impacts, multi-dimensional risk scores, and recommended mitigation measures, etc., providing a comprehensive basis for relevant decisions.

[0143] The multi-modal feature vector set is divided into a training set, a validation set, and a test set according to a certain ratio (for example, 70% training set, 15% validation set, 15% test set). The division process should ensure the randomness and representativeness of the data, so that each data set can reflect the distribution characteristics of the original data.

[0144] Initialize the initial model, randomly set its parameters and basic structure, and determine hyperparameters such as the learning rate and batch size. During training, load multi-modal feature vector data in batches from the training set, input it into the initial model, process it through each layer of the anomaly detection and risk assessment module, calculate the loss function value between the output result and the true label, and update the parameters using backpropagation to improve the performance of the initial model. Subsequently, enter the validation stage, load data from the validation set, input it into the trained initial model, compare the prediction results with the true labels, calculate evaluation metrics such as accuracy, and adjust the hyperparameters or the initial model structure accordingly. Finally, input the data of the test set into the adjusted initial model, calculate various metrics, and objectively evaluate the final performance of the initial model to determine whether it can be put into use. If it can, then train the subsequent feature extractor. If not, then continue to adjust the initial model until it meets the requirements.

[0145] In S32, the feature extractor selects a convolutional neural network (CNN) or a recurrent neural network (RNN) and its variants (LSTM, GRU). Before training the feature extractor, first perform data augmentation on the training set. The data augmentation operation starts from three aspects: the time dimension, the feature dimension, and the modality dimension.

[0146] Regarding the augmentation in the time dimension, one is random cropping. In the time series data in the training set, randomly intercept a certain length of segment. For example, for a power load time series with a duration of 120 time steps, randomly crop a subsequence of 80 - 100 time steps to simulate data situations in different time periods. The second is time warping, which adjusts the time scale of the time series. For example, stretch or shorten the interval of some time steps to change the variation rhythm of the data. The third is noise injection, adding random noise to the time series data. For example, add noise that follows a normal distribution to the temperature data collected by sensors, so that the feature extractor can learn more robust features.

[0147] Regarding the augmentation in the feature dimension, random masking randomly sets the values of some feature dimensions to specific values (such as 0) so that the feature extractor does not overly rely on certain specific features. Feature permutation shuffles the order of the feature dimensions to prevent the feature extractor from relying on the feature order. For example, in multi-feature user behavior data, randomly swap the arrangement order of the features. Scale transformation scales the values of the feature dimensions to change their numerical range to adapt to data of different scales. For example, perform normalization or scaling operations on image pixel values.

[0148] Regarding the enhancement of modal dimensions, randomly discard data of certain modalities to simulate data missing scenarios and improve the performance of the feature extractor when some modalities are missing. Modal mixing is to fuse the data features of different modalities to create new feature combinations. Perspective transformation is to process data from different angles, such as rotating and flipping images, and changing the viewing perspective in 3D model data.

[0149] Perform contrastive learning on the augmented training set to obtain a sample dataset. This step uses the contrastive learning method to construct sample pairs, set the loss function, and implement the memory queue mechanism to enhance the feature representation ability.

[0150] Among them, constructing sample pairs means selecting positive sample pairs and negative sample pairs from the augmented training set. For positive sample pairs, select data with the same time window but different perspectives. For example, in video surveillance data, images from different camera perspectives in the same time frame are used as positive sample pairs. Negative sample pairs are selected from data with different time windows or abnormal samples, such as traffic flow data from different time periods or network traffic data marked as abnormal as negative sample pairs.

[0151] Setting the loss function means combining InfoNCE and triplet loss. InfoNCE makes the feature representations of positive sample pairs closer and those of negative sample pairs farther away; triplet loss further constrains the relative distance relationship between samples to ensure that the feature extractor can better distinguish different samples.

[0152] Implementing the memory queue mechanism means maintaining a dynamic negative sample pool, constantly updating negative samples, adding newly generated negative samples to the queue, and removing old negative samples, so as to improve the efficiency and effect of contrastive learning and enable the feature extractor to learn more diverse negative sample features.

[0153] Optimize the feature extractor using the sample dataset, that is, on the basis of the sample dataset, use methods such as progressive training strategy, multi-level supervision signals, regularization techniques, and learning rate scheduling to optimize the feature extractor.

[0154] Among them, the progressive training strategy means first performing single-modal pre-training using the sample dataset, training the data of each modality separately, and letting the feature extractor learn the unique features of each modality. For example, first pre-train the image data and then pre-train the text data. Then perform multi-modal fine-tuning, jointly training the data of all modalities, so that the feature extractor can learn the associations and complementary information between multi-modal data.

[0155] The multi-level supervision signal refers to the fusion of reconstruction error, prediction error, and contrast loss. The reconstruction error prompts the feature extractor to learn the original features of the data, the prediction error helps it learn the dynamic change rules of the data, and the contrast loss enhances the distinctiveness of the features. By comprehensively utilizing this error information, the performance of the feature extractor is improved.

[0156] The regularization technique means randomly discarding some neurons using Dropout to prevent overfitting. Specifically, L2 regularization is adopted to add a regularization term to the loss function to limit the size of the feature extractor parameters and improve the generalization ability. Label smoothing processes the labels to reduce the overconfidence of the feature extractor in the labels and enhance the robustness of the feature extractor.

[0157] The learning rate scheduling refers to dynamically adjusting the learning rate using the cosine annealing strategy. A larger learning rate is used at the beginning of training to enable the feature extractor to converge quickly. As the training progresses, the learning rate is gradually reduced to allow the feature extractor to more finely adjust the parameters and improve the training effect.

[0158] In S33, when integrating the trained feature extractor with the pre-trained initial model, ensure that the output format and dimension of the feature extractor exactly match the input requirements of the pre-trained initial model. For example, if the initial model requires the input multi-modal feature vector to have a dimension of 512, then the output dimension of the feature extractor should also be adjusted to 512. Connect the output layer of the feature extractor directly to the input layer of the initial model so that the data can flow smoothly from the feature extractor into the initial model. This connection can be achieved by writing code, such as using the corresponding layer connection function in a deep learning framework.

[0159] In S34, fine-tune the complete model based on the training set, use the validation set to monitor the performance during the fine-tuning process, and finally use the test set to comprehensively evaluate the fine-tuned model to generate the final anomaly detection model.

[0160] Based on the above, first construct the initial model and then train the feature extractor. The advantage of doing this is that the core parts of the model (feature fusion module, temporal modeling module, anomaly detection module, and risk assessment module) can be made to have a certain processing ability first. When training the feature extractor, it can be made more targeted to make its output meet the requirements of the subsequent modules, improving the training efficiency and the overall performance of the model. Finally, fuse the initial model with the feature extractor, and ultimately a complete and well-performing anomaly detection model can be obtained, which can effectively perform anomaly detection and risk assessment on multi-modal data.

[0161] In S4, the target system usually runs continuously, and the key sub-components in the system will also generate data in real time during system operation. Collect the current running data of each key sub-component and integrate these data into a comprehensive dataset to be detected.

[0162] In S5, the dataset to be detected is input into the anomaly detection model, and the anomaly detection model outputs the anomaly detection results and a risk assessment report. Among them, the anomaly detection results include the anomaly scores and anomaly types of each key sub-component. In addition to including the multi-dimensional risk score, the risk assessment report can also calculate the confidence level, calculate the contribution degree of features, select the features with a contribution degree greater than the preset importance threshold as important features, and add the confidence level, important features, and the contribution degree of important features to the risk assessment report to facilitate the user to comprehensively understand the detection details.

[0163] In S6, referring to Figure 6 the flowchart of the comprehensive risk score acquisition method shown, "obtaining the comprehensive risk score of each key sub-component based on the anomaly detection results and the risk assessment report" includes the following steps:

[0164] S61: Based on the anomaly scores, anomaly types, and multi-dimensional risk scores of each key sub-component, obtain the basic risk values of each key sub-component;

[0165] S62: According to the anomaly types, count the occurrence frequency and historical occurrence quantity of the corresponding anomaly events of each key sub-component, and obtain the current load value of each key sub-component;

[0166] S63: Based on the occurrence frequency, historical event quantity, and current load value, obtain the time risk value of each key sub-component;

[0167] S64: Evaluate the importance of each key sub-component in the target system, the degree of dependence on other sub-components, and the sensitivity to the processed data, and obtain the key level, dependence factor, and sensitivity level;

[0168] S65: Based on the key level, dependence factor, and data sensitivity, obtain the environmental risk value of each key sub-component;

[0169] S66: Based on the basic risk value, time risk value, and environmental risk value, obtain the comprehensive risk score of each key sub-component.

[0170] In S61, the calculation formula for the basic risk value is as follows:

[0171]

[0172] In Formula 1, R b represents the basic risk value of the key sub-component; a represents the anomaly score weight; A represents the anomaly score of the key sub-component; i represents the number of the anomaly type; I represents the total number of anomaly types of the key sub-component; β i represents the weight of the i-th anomaly type of the key sub-component; T iDenote the score of the i-th abnormal type of the key sub-component. Different abnormal types have different impacts on the target system and corresponding scores will be assigned; γ represents the risk scoring weight; M represents the weighted average of the multi-dimensional risk scores of the key sub-components.

[0173] The calculation of the basic risk value comprehensively considers the key outputs of the anomaly detection model, providing an objective basis for subsequent comprehensive risk assessment.

[0174] In S62, for each key sub-component, count the occurrence times of the abnormal events corresponding to each abnormal type within a preset time range, and then calculate the occurrence frequency. At the same time, count the total occurrence times of the abnormal events corresponding to each abnormal type in the historical records, that is, the historical occurrence quantity. Since excessive load may increase the probability of the key sub-component being abnormal, it is also necessary to count the magnitude of the workload currently borne by the key sub-component, that is, the current load value.

[0175] In S63, the calculation formula of the time risk value is as follows:

[0176]

[0177] In formula 2, R t Denote the time risk value of the key sub-component; q represents the occurrence frequency weight; f i Denote the occurrence frequency of the abnormal event corresponding to the i-th abnormal type of the key sub-component; p represents the occurrence quantity weight; h i Denote the historical occurrence quantity of the abnormal event corresponding to the i-th abnormal type of the key sub-component; l represents the current load value of the key sub-component.

[0178] The assessment of time risk introduces dynamic factors such as the abnormal occurrence frequency, the number of historical events, and the current load value, which can reflect the risk situation of the key sub-component changing with time and operating status in real time, making the risk assessment more timely.

[0179] In S64, according to the impact degree of the key sub-component on the functional integrity and stability of the target system, such as whether it is necessary for the core business process, the size of the damage to the system function during a failure, etc., pre-divide the key levels of each key sub-component. Sort out the data interaction, call relationship, etc. between sub-components, analyze the influence scope and degree on other sub-components when the key sub-component fails, and pre-quantify the dependency factors of each key sub-component. According to the confidentiality and integrity requirements of the data processed by the key sub-component, such as the situation of involving sensitive information, business critical data, etc., evaluate its sensitivity to the processed data, so as to pre-divide the sensitivity levels of each key sub-component.

[0180] In S65, the calculation formula of the environmental risk value is as follows:

[0181] Re = 0.5×c + 0.3×d + 0.2×s; (3)

[0182] In formula (3), R e represents the environmental risk value of the key sub-component; c represents the critical level of the key sub-component; d represents the dependency factor of the key sub-component; s represents the sensitivity level of the key sub-component.

[0183] The assessment of environmental risk takes into account specific factors such as the importance, dependency degree, and data sensitivity of the key sub-component in the target system, conducts risk assessment according to the characteristics of different sub-components, and improves the pertinence and accuracy of risk assessment.

[0184] In S66, the basic risk value, time risk value, and environmental risk value of the key sub-component are weighted and summed to obtain the comprehensive risk score of the key sub-component.

[0185] The above solution comprehensively considers three aspects: basic risk, time risk, and environmental risk, evaluates the risk of key sub-components from multiple dimensions, avoids the limitations of single-factor assessment, and can more comprehensively and accurately reflect the actual risk status of key sub-components. The comprehensive risk score can provide a strong basis for system operation and maintenance, resource allocation, and risk management decision-making, help managers arrange resources more reasonably, take effective risk response measures, and reduce the system operation risk.

[0186] In S7, referring to Figure 7 the process schematic diagram of the permission adjustment method shown, "performing permission adjustment on the key sub-components of the target system based on the comprehensive risk score" includes the following steps:

[0187] S71: Determine the key sub-components with a comprehensive risk score greater than the preset risk threshold as abnormal sub-components;

[0188] S72: Determine the coarse-grained permission level of the abnormal sub-components based on the comprehensive risk score;

[0189] S73: Query the standard permission template matching the coarse-grained permission level from the preset template set, and determine the fine-grained permission level of the abnormal sub-components based on the standard permission template;

[0190] S74: Compare the fine-grained permission of the abnormal sub-components with the current permission; if they are the same, execute S75; if they are different, execute S76;

[0191] S75: Determine that the abnormal sub-components do not need to adjust permissions;

[0192] S76: Determine the abnormal sub-components as target sub-components, predict the impact after permission adjustment of the target sub-components, and obtain the impact result;

[0193] S77: Fine-tune the fine-grained permissions of the target sub-components based on the impact results, and build an access permission list based on the new fine-grained permissions;

[0194] S78: Adjust the permissions of each target sub-component based on the access permission list.

[0195] In S71, set a clear risk threshold in advance, store it in the target system configuration, regularly collect the comprehensive risk scores of each key sub-component of the target system, compare the comprehensive risk score of each key sub-component with the risk threshold, and mark those greater than the risk threshold as abnormal sub-components.

[0196] In S72, establish a correspondence table between the comprehensive risk scores and the coarse-grained permission levels, such as different score ranges corresponding to different levels. According to the comprehensive risk scores of each abnormal sub-component, look up in the correspondence table to determine its coarse-grained permission level.

[0197] In S73, preset a template set that includes standard permission templates corresponding to multiple coarse-grained permission levels. According to the coarse-grained permission level of the abnormal sub-component, find the matching standard permission template in the template set, and match the field values in the template with the specific attributes of the abnormal sub-component (including the type, model, functional attributes, abnormal type, etc.) of the abnormal sub-component to determine the fine-grained permission level. Among them, the field values in each template are formulated by experts according to the actual situation and rules, and the matching method between the standard permission template and the specific attributes of the abnormal sub-component can be carried out using a decision tree algorithm.

[0198] In S74 - S76, accurately obtain the current permission settings of each abnormal sub-component, compare the current permissions with the determined fine-grained permissions, so as to be able to determine whether the current permissions of the abnormal sub-components are reasonable, and thus determine whether the abnormal sub-components need to adjust their permissions. When it is determined that the abnormal sub-component does not need to adjust its permissions, the administrator still needs to be reminded to check the abnormal situation; when it is determined that the abnormal sub-component needs to adjust its permissions, the abnormal sub-component is determined as the target sub-component, and methods such as system simulation and historical data reference are used to predict the impact after the permission adjustment of the target sub-component, and evaluate from aspects such as functional availability, business continuity, and data security to obtain the impact results.

[0199] In S77 and S78, fine-tune the fine-grained permissions of each target sub-component based on the impact results, obtain new fine-grained permissions, and build an access permission list in combination with the identifiers of each target sub-component and their new fine-grained permissions. Adjust the permissions of each target sub-component according to the access permission list. Based on the principle of atomic update, use distributed transaction processing technology during the permission adjustment process to ensure the transactionality and consistency of permission changes and avoid system state inconsistencies caused by partial permission updates.

[0200] After the permission adjustment, continuously monitor performance metrics such as CPU usage changes, memory occupancy trends, response time fluctuations, and throughput impacts to promptly detect the impact of permission adjustment on system performance. Track security metrics such as the number of permission violations, frequency of security incidents, detection of attack attempts, and abnormal behavior patterns to evaluate the system security after permission adjustment and promptly detect potential security threats. Evaluate the impacts of permission adjustment on service availability, functional integrity, user experience, and business latency statistics to ensure that the permission adjustment does not cause serious interference to the business. For high-risk situations (such as permission adjustment may cause system paralysis, etc.), establish a rapid response mechanism and take timely measures to avoid losses.

[0201] Use a reinforcement learning framework to retrain the anomaly detection model regularly to make it adapt to new behavior patterns, improve the accuracy of risk assessment and permission adjustment, optimize the decision-making threshold and permission boundaries, and make the permission policy more precise and effective. Update the anomaly pattern library (the database storing various anomaly patterns) in a timely manner to enhance the target system's ability to identify abnormal behaviors, improve the security of the target system, and dynamically improve the permission template and anomaly detection model, etc., according to the monitoring results after permission adjustment, to improve the accuracy of the permission policy and achieve fine-grained permission control and adaptive policy optimization.

[0202] This dynamic permission configuration mechanism can precisely adjust the permissions of key sub-components according to the real-time risk assessment results. At the same time, through continuous monitoring and optimization, it ensures the balance between security and system performance. This fine-grained permission control and adaptive policy optimization provide a strong guarantee for the security of the target system.

[0203] Refer to Figure 8 , the present disclosure provides a refined permission configuration system, including:

[0204] A data collection module 101 for collecting multi-modal time series data streams of key sub-components in the target system;

[0205] A data processing module 102 for preprocessing and feature engineering processing of the multi-modal time series data streams to generate a multi-modal feature vector set;

[0206] A model construction module 103 for constructing an anomaly detection model based on the multi-modal feature vector set;

[0207] A set construction module 104 for collecting the current running data of each key sub-component and constructing a dataset to be detected based on the current running data;

[0208] An anomaly detection module 105 for inputting the dataset to be detected into the anomaly detection model to obtain an anomaly detection result and a risk assessment report;

[0209] A scoring acquisition module 106, configured to obtain a comprehensive risk score for each key sub-component based on the anomaly detection result and the risk assessment report;

[0210] A permission adjustment module 107, configured to perform permission adjustment on the key sub-components of the target system based on the comprehensive risk score.

[0211] The various change methods and specific examples in the refined permission configuration method provided above also apply to the refined permission configuration system provided by the present disclosure. Through the foregoing detailed description of the refined permission configuration method, those skilled in the art can clearly know the implementation method of the refined permission configuration system. For the sake of brevity of the specification, it will not be elaborated herein.

[0212] According to an embodiment of the present disclosure, a computer device includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0213] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In an embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the computer device executes all or part of the steps of the refined permission configuration method of the foregoing embodiments of the present disclosure.

[0214] Those skilled in the art should understand that, in order to solve the technical problem of how to obtain a good user experience effect, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included in the protection scope of the present disclosure.

[0215] As Figure 9 FIG. is a schematic structural diagram of a computer device provided by an embodiment of the present disclosure. It shows a schematic structural diagram of a computer device suitable for implementing the computer device in the embodiments of the present disclosure. Figure 9 The shown computer device is only an example, and should not bring any limitation to the functions and usage scope of the embodiments of the present disclosure.

[0216] As Figure 9As shown, a computer device may include a processor (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer device are also stored. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0217] Generally, the following devices may be connected to the I / O interface: an input device including, for example, a sensor or a visual information acquisition device, etc.; an output device including, for example, a display screen, etc.; a storage device including, for example, a magnetic tape, a hard disk, etc.; and a communication device. The communication device may allow the computer device to communicate wirelessly or wireline with other devices (such as edge computing devices) to exchange data. Although Figure 9 a computer device with various devices is shown, it should be understood that it is not required to implement or have all the shown devices. Instead, more or fewer devices may be implemented or had.

[0218] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for performing the method shown in the flowchart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication device, or installed from a storage device, or installed from the ROM. When the computer program is executed by the processor, all or part of the steps of the refined permission configuration method of the embodiments of the present disclosure are executed.

[0219] For a detailed description of this embodiment, reference may be made to the corresponding descriptions in the foregoing embodiments, and details are not repeated here.

[0220] A computer-readable storage medium according to an embodiment of the present disclosure stores non-temporary computer-readable instructions thereon. When the non-temporary computer-readable instructions are run by a processor, all or part of the steps of the refined permission configuration methods of the foregoing embodiments of the present disclosure are executed.

[0221] The above-mentioned computer-readable storage medium includes but is not limited to: optical storage media (such as CD-ROMs and DVDs), magneto-optical storage media (such as MOs), magnetic storage media (such as magnetic tapes or external hard drives), media with built-in rewritable non-volatile memories (such as memory cards), and media with built-in ROMs (such as ROM cartridges).

[0222] For a detailed description of this embodiment, reference may be made to the corresponding descriptions in the foregoing embodiments, and details are not repeated here.

[0223] The basic principles of the present disclosure have been described in connection with specific embodiments. However, it should be noted that the advantages, benefits, effects, etc. mentioned in the present disclosure are only examples and not limitations. It cannot be considered that these advantages, benefits, effects, etc. are essential for each embodiment of the present disclosure. Additionally, the specific details disclosed above are only for illustrative and understandable purposes and not for limitation. These details do not limit the present disclosure to necessarily adopting such specific details for implementation.

[0224] In the present disclosure, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of the devices, apparatuses, equipment, and systems involved in the present disclosure are only illustrative examples and do not intend to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open-ended terms meaning "including but not limited to" and can be used interchangeably with each other. The words "or" and "and" used herein refer to the word "and / or" and can be used interchangeably with it, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to" and can be used interchangeably with it.

[0225] In addition, as used herein, the "or" used in the listing of items starting with "at least one" indicates a disjunctive listing. So, for example, the listing of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the term "exemplary" does not mean that the described examples are preferred or better than other examples.

[0226] It should also be noted that in the systems and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present disclosure.

[0227] Various changes, substitutions, and alterations to the technologies described herein can be made without departing from the teachings of the technology defined by the appended claims. Additionally, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and acts described above. Current or later-developed processes, machines, manufactures, compositions of events, means, methods, or acts that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Accordingly, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or acts within their scope.

[0228] The foregoing description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0229] The foregoing description has been presented for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the form disclosed herein. Although several example aspects and embodiments have been discussed above, those skilled in the art will recognize some variations, modifications, alterations, additions, and subcombinations thereof.

Claims

1. A refined permission configuration method, characterized in that, Including: Collecting multi-modal time series data streams of key sub-components in the target system; Performing preprocessing and feature engineering on the multi-modal time series data streams to generate a multi-modal feature vector set; Constructing an anomaly detection model based on the multi-modal feature vector set; Collecting the current operation data of each key sub-component and constructing a dataset to be detected based on the current operation data; Inputting the dataset to be detected into the anomaly detection model to obtain an anomaly detection result and a risk assessment report; Based on the anomaly detection result and the risk assessment report, obtaining the comprehensive risk score of each key sub-component; Based on the comprehensive risk score, adjusting the permissions of the key sub-components of the target system.

2. The refined permission configuration method according to claim 1, wherein The collecting of the multi-modal time series data streams of key sub-components in the target system includes: Obtaining the component structure data of the target system and identifying the sub-components in the target system based on the component structure data; During the operation of the target system, tracking the actual call relationships and data flow processes between sub-components to generate dynamic data; Combining the component structure data and the dynamic data, screening out key sub-components, constructing a list of key sub-components and a mapping relationship diagram of key sub-component interaction interfaces; Deploying sensor collection points based on the list and the mapping relationship diagram, and collecting the original data stream based on the sensor collection points; Performing synchronization and standardization processing on the original data stream to obtain a multi-modal time series data stream.

3. The refined permission configuration method according to claim 1, wherein The performing of preprocessing and feature engineering on the multi-modal time series data streams to generate a multi-modal feature vector set includes: Using a window mechanism to clean the multi-modal time series data streams; Using an overlapping sliding window mechanism to divide the cleaned multi-modal time series data streams into multiple data segments; Performing standardization processing on each data segment to obtain a standardized data segment; Performing feature extraction on the standardized data segment to generate a feature set; Performing feature selection on the feature set to generate a multi-modal feature vector set.

4. The refined permission configuration method according to claim 1, wherein The constructing of an anomaly detection model based on the multi-modal feature vector set includes: Constructing an initial model and pre-training the initial model based on the multi-modal feature vector set; Constructing a feature extractor and training the feature extractor based on the multi-modal feature vector set with the input requirements of the initial model as the target; Integrating the trained feature extractor with the pre-trained initial model to form a complete model; Optimizing the complete model based on the multi-modal feature vector set to generate an anomaly detection model.

5. The refined permission configuration method according to claim 1, wherein The obtaining of the comprehensive risk score of each key sub-component based on the anomaly detection result and the risk assessment report includes: Based on the anomaly scores and anomaly types of each key sub-component in the anomaly detection result, and the multi-dimensional risk scores of each key sub-component in the risk assessment report, obtaining the basic risk values of each key sub-component; According to the anomaly type, counting the occurrence frequency and historical occurrence quantity of the corresponding anomaly events of each key sub-component to obtain the current load value of each key sub-component; Based on the occurrence frequency, the historical event quantity and the current load value, obtaining the time risk value of each key sub-component; Evaluate the importance of each key sub-component in the target system, the degree of dependence on other sub-components, and the sensitivity to the processed data, and obtain the key level, dependence factor, and sensitivity level; Based on the key level, the dependence factor, and the data sensitivity, obtain the environmental risk value of each key sub-component; Based on the basic risk value, the time risk value, and the environmental risk value, obtain the comprehensive risk score of each key sub-component.

6. The refined permission configuration method according to claim 1, wherein The calculation formula of the basic risk value is as follows: Among them, R b represents the basic risk value of the key sub-component; a represents the abnormal score weight; A represents the abnormal score of the key sub-component; i represents the number of the abnormal type; I represents the total number of abnormal types of the key sub-component; β i represents the weight of the i-th abnormal type of the key sub-component; T i represents the score of the i-th abnormal type of the key sub-component; γ represents the risk scoring weight; M represents the weighted average of the multi-dimensional risk scores of the key sub-component.

7. The refined permission configuration method according to claim 1, wherein Based on the comprehensive risk score, adjust the permissions of the key sub-components of the target system, including: Determine the abnormal sub-components whose comprehensive risk score is greater than the preset risk threshold; Based on the comprehensive risk score, determine the coarse-grained permission level of the abnormal sub-components; Query the standard permission template matching the coarse-grained permission level from the preset template set, and determine the fine-grained permission level of the abnormal sub-components based on the standard permission template; Compare the fine-grained permissions of the abnormal sub-components with the current permissions; If they are the same, determine that the abnormal sub-components do not need to adjust permissions; If they are different, determine the abnormal sub-components as target sub-components, predict the impact after the permission adjustment of the target sub-components, and obtain the impact result; Fine-tune the fine-grained permissions of the target sub-components based on the impact result, and construct an access permission list based on the new fine-grained permissions; Adjust the permissions of each target sub-component based on the access permission list.

8. A computer device, characterized in that, The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the refined permission configuration method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, This computer-readable storage medium stores computer instructions for causing a computer to execute the refined permission configuration method according to any one of claims 1-7.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1-7 are implemented.

Images