AI authority intelligent distribution system and method based on behavior prediction

Abstract

The invention discloses an AI authority intelligent distribution system and method based on behavior prediction, and relates to the technical field of authority monitoring management, and the method comprises the steps: collecting a plurality of authority use data records in history; the method comprises the following steps of: constructing a permission co-occurrence graph by taking a plurality of collected historical permission use data records as a substrate and taking a predefined permission unique identifier as a node; according to the permission co-occurrence graph, analyzing the shortest path between permissions, and carrying out operation sequence modeling; performing illegal combination detection and intelligent permission distribution on real-time permission use data records according to operation sequence modeling; acquiring a plurality of real-time permission use data records, constructing a real-time permission co-occurrence graph, analyzing a clustering coefficient of a system module to which the permission belongs in the real-time permission co-occurrence graph, and performing permission risk management; and visually displaying the real-time permission co-occurrence graph. According to the method and the device, the dynamic and intelligent level of authority management is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of authority monitoring and management, and specifically to an AI authority intelligent allocation system and method based on behavior prediction. Background Art

[0002] At a time when information systems and business platforms are widely adopting rights management mechanisms, traditional rights allocation models generally face the following problems: 1. Permissions have multiple dimensions and complex structures, making it difficult for traditional methods to detect highly correlated potential anomalies. This manifests itself as: users often have multiple permissions, with hidden co-occurrence relationships or dependency paths between these permissions. Anomalous behavior is not necessarily the abnormal use of a single permission, but rather a change in the usage pattern of a "combination of permissions." Furthermore, static rules or role permission tables cannot cover these complex situations. 2. Difficulty identifying "soft privilege escalation" or "gradual privilege drift." These are manifested as seemingly normal user behavior, but their behavior paths within the permission graph exhibit unusual combinations or jumps across sensitive modules. Simple whitelists / blacklists cannot capture these subtle anomalies. 3. The permission allocation results lack contextual analysis. This manifests itself as the permission allocation system ignoring the structural coupling between permissions (such as dependency chains and co-occurrence strength). This can lead to some seemingly low-risk permission combinations causing information leakage or configuration changes in actual operations. 4. Lack of a global permission auditing method based on a graph structure. This manifests as the system's inability to understand whether a permission is located in a high-risk central area from the perspective of the "overall graph topology." This results in some key permissions not being protected or monitored. Based on the above practical problems, there is an urgent need for a system and method for intelligent allocation and monitoring of permissions. Summary of the Invention

[0003] The purpose of the present invention is to provide an AI permission intelligent allocation system and method based on behavior prediction to solve the problems raised in the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: an AI permission intelligent allocation method based on behavior prediction, comprising: Step S100: Collect several permission usage data records in the history; the permission usage data records are operation information recorded in the system log after each authorization operation; It should be noted that this application only collects relevant data such as the operation permissions themselves, and does not collect the content of the authorized operations, so there is no need to worry about content leakage; Step S200: construct a permission co-occurrence graph based on a number of collected historical permission usage data records and using predefined permission unique identifiers as nodes; Step S300: Analyze the shortest paths between permissions based on the permission co-occurrence graph, mine permission logic chains based on the shortest paths between permissions, and perform operation sequence modeling; perform illegal combination detection and intelligent permission allocation on real-time permission usage data records based on the operation sequence modeling; Step S400: Acquire multiple real-time permission usage data records, construct a real-time permission co-occurrence graph according to the method described in step S200, calculate the clustering coefficient of the system modules to which the permissions belong in the real-time permission co-occurrence graph, and adjust parameters based on the calculation results; Step S500: Visually display a real-time permission co-occurrence graph; Furthermore, the unique identifier of the permission, the system module to which the permission belongs, and the risk level of the permission are predefined; It should be noted that, generally speaking, the permissions of a system are limited, so setting a unique identifier for the permissions is achievable with existing technologies. The system module to which the permission belongs is used for the subgraph division of the permission. This application is divided by the system module; Generally, the authority risk level can be divided into three broad risk levels: high, medium, and low. Depending on the actual situation, a more refined classification can also be made. According to the permission usage data record, obtain the unique identifier of the desensitized user, the unique identifier of the permission used this time, the time when the operation occurred, and the desensitized session number; The desensitization method may use hash encryption, etc. Furthermore, in step S200, a permission co-occurrence graph is constructed based on the collected historical permission usage data records and the predefined permission unique identifiers as nodes, specifically: Step S201: Based on the collected historical permission usage data records, a permission definition table and a permission usage behavior log table are constructed; the permission definition table includes a predefined permission unique identifier, the system module to which the permission belongs, and the permission risk level; the permission usage behavior log table is constructed based on the permission usage data records over a period of time, and is arranged in descending order according to the time of operation; Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission usage behavior log table, excluding simulated account and system task account behaviors, and unifying the time granularity; the invalid permission items include undefined permission unique identifiers and operation failures; Step S203: Extract all data items from the permission definition table, and treat each item as a node information set of a permission co-occurrence graph, wherein a predefined permission unique identifier is used as a node, and one or more of the system module to which the permission belongs, the permission risk level, and the specific permission type are used as supplementary information of the node; when two different permissions a and b are used simultaneously or similarly by the same user or in the same session, the two different permissions a and b are considered to co-occur once, which is recorded as a connection; traverse the permission usage behavior log table in sequence to complete the construction of the permission co-occurrence graph edge; Step S204: Calculate edge weights based on the normalized co-occurrence frequency method, specifically: w(a,b)=f(a,b) / log[1+f(a)*f(b)]; where w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total number of times permission a is used; f(b) represents the total number of times permission b is used; calculate the edge weights of all edges in sequence; Step S205: Output the constructed authority co-occurrence graph G=(V,E,W); wherein G represents the authority co-occurrence graph identifier; V represents the node set in the authority co-occurrence graph, a, b∈V; E represents the edge set in the authority co-occurrence graph; W represents the edge weight set in the authority co-occurrence graph, w(a,b)∈W.

[0005] Furthermore, in step S300, the shortest path between permissions is analyzed based on the permission co-occurrence graph, permission logic chain mining is performed based on the shortest path between permissions, and operation sequence modeling is performed; based on the operation sequence modeling, illegal combination detection and intelligent permission allocation are performed on the real-time permission usage data records, specifically: According to the authority co-occurrence graph, the shortest path to a node c is: (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ; The Dijkstra algorithm is used to traverse the authority co-occurrence graph G = (V, E, W) to obtain the shortest paths starting from different nodes, calculate the response time of different nodes, and store the authority unique identifiers corresponding to the nodes in the shortest path and the response times of different nodes.

[0006] Furthermore, in step S400, a plurality of real-time permission usage data records are obtained, and a real-time permission co-occurrence graph is constructed according to the method described in step S200. The clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence graph is calculated, and parameter adjustment is performed based on the calculation result, specifically: Step S401: Determine a node in the permission co-occurrence graph based on the permission unique identifier of the currently used permission, search for candidate nodes under the shortest path of the node, and form a permission prediction list based on the descending order of the edge weights between the nodes in the permission co-occurrence graph. When the edge weight between the nodes is greater than the preset authorization threshold, update the system page and actively prompt the user of the current permission range. When the edge weight between the nodes is less than or equal to the preset authorization threshold, the user reserves the required permission for approval, which is manually reviewed by the administrator. It should be noted that if the required permission does not appear in the permission prediction list, it is considered that the in-degree of the node is less than or equal to the preset authorization threshold; Step S402: Acquire real-time permission usage data records, and judge each permission usage data record acquired in real time based on the stored shortest path and the response time of different nodes. Within the response time, if the path between two permissions is greater than a preset maximum path threshold, but a user possesses both permissions, the system determines that the combination is unauthorized and issues a real-time warning. In this embodiment, the paths of the two permissions are calculated by summing and adding the edge weights. The shortest path of a node c is (c->d->g), and its edge weights are w(c, d) and w(d, g). Then the path of the two permissions is L(c,g)=α1*w(c,d)+α2*w(d,g); Among them, α1 and α2 are harmonic coefficients, which are set according to the authority risk level; In this embodiment, the harmonic coefficient of high risk is 0.6, the harmonic coefficient of medium risk is 0.5, and the harmonic coefficient of low risk is 0.4; Furthermore, in step S411, a plurality of real-time permission usage data records are obtained, and a real-time permission co-occurrence graph is constructed according to the method described in step S200; Step S412: Based on the constructed real-time permission co-occurrence graph, for a certain node x, calculate the clustering coefficient C(x), using the formula: C(x)=2e / k(k-1); wherein, e represents the number of edges actually existing between neighboring nodes of node x in the real-time permission co-occurrence graph; k represents the number of neighboring nodes of node x; calculate the clustering coefficients of all nodes in turn, and when the clustering coefficient is greater than a preset clustering threshold, mark the system module to which the permission in the node belongs as a critical module, and make critical adjustments to the authorization threshold and maximum path threshold of the critical module.

[0007] It should be noted that the clustering coefficient C(x) can be used to quantify the criticality of node x in the real-time permission co-occurrence graph, which is used to identify highly sensitive and highly coupled permission groups to enhance permission risk control and intelligent authorization systems. The range of the clustering coefficient C(x) is [0,1]. Furthermore, in step S500, a real-time permission co-occurrence graph is visually displayed, specifically: The real-time permission co-occurrence map is visualized through interactive software, where key modules are marked with different tags; Display additional information of nodes in real time by clicking the mouse; View the shortest paths between different nodes by clicking the mouse; Updates are made regularly.

[0008] AI-powered intelligent permission allocation system based on behavior prediction, including: data collection module, permission co-occurrence map module, intelligent allocation module, key adjustment analysis module and visualization module; The data collection module is used to collect permission usage data records; the permission usage data records are operation information recorded in the system log after each authorization operation; The permission co-occurrence graph module is used to construct a permission co-occurrence graph based on a number of collected historical permission usage data records and predefined permission unique identifiers as nodes; The intelligent allocation module is used to analyze the shortest path between permissions based on the permission co-occurrence graph, mine the permission logic chain based on the shortest path between permissions, and perform operation sequence modeling; based on the operation sequence modeling, it detects illegal combinations of real-time permission usage data records and performs intelligent permission allocation; The key adjustment analysis module is used to obtain real-time permission usage data records, construct a real-time permission co-occurrence map, calculate the clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence map, and adjust parameters according to the calculation results; The visualization module is used to visualize the real-time permission co-occurrence map through interactive software.

[0009] Further, including: The permission co-occurrence graph module includes a permission definition table unit, a permission usage behavior log table unit, a pre-processing unit and a graph construction unit; The permission definition table unit is used to construct a permission definition table based on the permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table unit is used to construct a permission usage behavior log table based on permission usage data records within a period of time, and arrange the operations in descending order according to the time when the operations occurred; The pre-processing unit is used to perform data pre-processing and data calculation, wherein the automatic calculation is performed by a computer program; The graph construction unit is used to construct and output a permission co-occurrence graph based on the acquired node data, edge data and edge weight data.

[0010] Further, including: The real-time permission co-occurrence map is visualized through interactive software, in which key modules are marked with different tags; the supplementary information of the node is displayed in real time by clicking the mouse; and the shortest path between different nodes can be viewed by clicking the mouse.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: the present application significantly improves the dynamics and intelligence level of permission management. By using historical permission usage data to construct a permission co-occurrence graph, and extracting the shortest path and clustering coefficient between permissions through graph calculation, it not only depicts the collaborative relationship and coupling degree between permissions, but also realizes the modeling of the permission logic chain and path risk assessment. Secondly, combined with real-time permission call behavior, the system can automatically determine whether the current request is reasonable, predict the next potential operation, identify unauthorized combinations and issue warnings. At the same time, for highly sensitive permission groups with high clustering coefficients, the system can automatically adjust the authorization threshold and path threshold, thereby enhancing risk control. This method only collects necessary information such as permission items and operation time to ensure user privacy and data compliance. Through the visualization of the graph and human-computer interaction capabilities, it assists operation and maintenance personnel in intuitively understanding the system permission structure and risk distribution. The present application effectively solves the problems of static traditional permission allocation, difficulty in identifying unauthorized behavior, and inability to warn of permission abuse, and has significant application value and promotion prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a schematic diagram of the steps of an AI permission intelligent allocation method based on behavior prediction in the present invention. DETAILED DESCRIPTION

[0013] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0014] Example: Figure 1 As shown, the present invention provides a technical solution, an AI permission intelligent allocation method based on behavior prediction, comprising: Step S100: Collect several permission usage data records in the history; the permission usage data records are operation information recorded in the system log after each authorization operation; It should be noted that this application only collects relevant data such as the operation permissions themselves, and does not collect the content of the authorized operations, so there is no need to worry about content leakage; Predefine the unique identifier of the permission, the system module to which the permission belongs, and the risk level of the permission; It should be noted that, generally speaking, the permissions of a system are limited, so setting a unique identifier for the permissions is achievable with existing technologies. The system module to which the permission belongs is used for the subgraph division of the permission. This application is divided by the system module; Generally, the authority risk level can be divided into three broad risk levels: high, medium, and low. Depending on the actual situation, a more refined classification can also be made. According to the permission usage data record, obtain the unique identifier of the desensitized user, the unique identifier of the permission used this time, the time when the operation occurred, and the desensitized session number; The desensitization method may use hash encryption, etc. Step S200: construct a permission co-occurrence graph based on a number of collected historical permission usage data records and using predefined permission unique identifiers as nodes; Step S201: Based on the collected historical permission usage data records, a permission definition table and a permission usage behavior log table are constructed; the permission definition table includes a predefined permission unique identifier, the system module to which the permission belongs, and the permission risk level; the permission usage behavior log table is constructed based on the permission usage data records over a period of time, and is arranged in descending order according to the time of operation; Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission usage behavior log table, excluding simulated account and system task account behaviors, and unifying the time granularity; the invalid permission items include undefined permission unique identifiers and operation failures; Step S203: Extract all data items from the permission definition table, and treat each item as a node information set of a permission co-occurrence graph, wherein a predefined permission unique identifier is used as a node, and one or more of the system module to which the permission belongs, the permission risk level, and the specific permission type are used as supplementary information of the node; when two different permissions a and b are used simultaneously or similarly by the same user or in the same session, the two different permissions a and b are considered to co-occur once, which is recorded as a connection; traverse the permission usage behavior log table in sequence to complete the construction of the permission co-occurrence graph edge; Step S204: Calculate edge weights based on the normalized co-occurrence frequency method, specifically: w(a,b)=f(a,b) / log[1+f(a)*f(b)]; where w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total number of times permission a is used; f(b) represents the total number of times permission b is used; calculate the edge weights of all edges in sequence; Step S205: Output the constructed authority co-occurrence graph G=(V,E,W); wherein G represents the authority co-occurrence graph identifier; V represents the node set in the authority co-occurrence graph, a, b∈V; E represents the edge set in the authority co-occurrence graph; W represents the edge weight set in the authority co-occurrence graph, w(a,b)∈W.

[0015] Step S300: Analyze the shortest paths between permissions based on the permission co-occurrence graph, mine permission logic chains based on the shortest paths between permissions, and perform operation sequence modeling; perform illegal combination detection and intelligent permission allocation on real-time permission usage data records based on the operation sequence modeling; According to the authority co-occurrence graph, the shortest path to a node c is: (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ; Use the Dijkstra algorithm to traverse the authority co-occurrence graph G = (V, E, W) to obtain the shortest path starting from different nodes, calculate the response time of different nodes, and store the unique authority identifiers corresponding to the nodes in the shortest path and the response time of different nodes; The Dijkstra algorithm is an existing technology and is widely used in graph theory analysis. In this embodiment, the Dijkstra algorithm is used to traverse the authority co-occurrence graph to obtain the shortest paths starting from different nodes. Step S400: Acquire multiple real-time permission usage data records, construct a real-time permission co-occurrence graph according to the method described in step S200, calculate the clustering coefficient of the system modules to which the permissions belong in the real-time permission co-occurrence graph, and adjust parameters based on the calculation results; Step S401: Determine a node in the permission co-occurrence graph based on the permission unique identifier of the currently used permission, search for candidate nodes under the shortest path of the node, and form a permission prediction list based on the descending order of the edge weights between the nodes in the permission co-occurrence graph. When the edge weight between the nodes is greater than the preset authorization threshold, update the system page and actively prompt the user of the current permission range. When the edge weight between the nodes is less than or equal to the preset authorization threshold, the user reserves the required permission for approval, which is manually reviewed by the administrator. It should be noted that if the required permission does not appear in the permission prediction list, it is considered that the in-degree of the node is less than or equal to the preset authorization threshold; Step S402: Obtain real-time permission usage data records, and judge each permission usage data record obtained in real time based on the stored shortest path and the response time of different nodes. Within the response time, when the path of two permissions is greater than the preset maximum path threshold, but a user has both permissions, the system determines it as an unauthorized combination and issues a real-time warning.

[0016] Step S411: Acquire a number of real-time permission usage data records and construct a real-time permission co-occurrence graph according to the method described in step S200; Step S412: Based on the constructed real-time permission co-occurrence graph, for a node x, calculate the clustering coefficient C(x), using the formula: C(x) = 2e / k(k-1); where e represents the actual number of edges between neighboring nodes of node x in the real-time permission co-occurrence graph; and k represents the number of neighboring nodes of node x. Calculate the clustering coefficients of all nodes in sequence. When the clustering coefficient is greater than a preset clustering threshold, mark the system module to which the permission in the node belongs as a critical module, and make critical adjustments to the authorization threshold and maximum path threshold of the critical module. In this embodiment, the method for adjusting the authorization threshold and the maximum path threshold of the key module is specifically as follows: Collect several historical authorization thresholds and maximum path thresholds, and calculate their average μ and standard deviation σ. Adjust the authorization threshold and maximum path threshold for key modules to max(z, μ+σ), where z represents the original parameter value of node x in the real-time permission co-occurrence graph. This method can reasonably adjust the authorization threshold and maximum path threshold of key modules, and solve the problem of permission abuse of the entire system to a certain extent by limiting the review and allocation of key permissions.

[0017] It should be noted that the clustering coefficient C(x) can be used to quantify the criticality of node x in the real-time permission co-occurrence graph, which is used to identify highly sensitive and highly coupled permission groups to enhance permission risk control and intelligent authorization systems. The range of the clustering coefficient C(x) is [0,1]. Step S500: Visually display a real-time permission co-occurrence graph; The real-time permission co-occurrence map is visualized through interactive software, where key modules are marked with different tags; Highlighting allows relevant personnel to intuitively see the importance of permissions, thereby raising their vigilance in real time and avoiding authorization deviations. Topology can also be used to perform permission auditing and monitoring from a global perspective; Display additional information of nodes in real time by clicking the mouse; View the shortest paths between different nodes by clicking the mouse; Updates are made regularly.

[0018] AI-powered intelligent permission allocation system based on behavior prediction, including: data collection module, permission co-occurrence map module, intelligent allocation module, key adjustment analysis module and visualization module; The data collection module is used to collect permission usage data records; permission usage data records are the operation information recorded in the system log after each authorization operation; The permission co-occurrence graph module is used to construct a permission co-occurrence graph based on the collected historical permission usage data records and predefined permission unique identifiers as nodes; The intelligent allocation module is used to analyze the shortest path between permissions based on the permission co-occurrence map, mine the permission logic chain based on the shortest path between permissions, and perform operation sequence modeling; based on the operation sequence modeling, it detects illegal combinations of real-time permission usage data records and performs intelligent permission allocation; The key adjustment analysis module is used to obtain real-time permission usage data records, build a real-time permission co-occurrence map, calculate the clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence map, and adjust parameters based on the calculation results; The visualization module is used to visualize the real-time permission co-occurrence map through interactive software.

[0019] Further, including: The permission co-occurrence graph module includes a permission definition table unit, a permission usage behavior log table unit, a pre-processing unit, and a graph construction unit; The permission definition table unit is used to construct a permission definition table based on the permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table unit is used to construct a permission usage behavior log table based on permission usage data records within a period of time, and arrange the operations in descending order according to the time when the operations occurred; The preprocessing unit is used to perform data preprocessing and data calculation, wherein the automatic calculation is performed by a computer program; The graph construction unit is used to construct and output the authority co-occurrence graph based on the acquired node data, edge data and edge weight data.

[0020] Further, including: The real-time permission co-occurrence map is visualized through interactive software, in which key modules are marked with different tags; the supplementary information of the node is displayed in real time by clicking the mouse; and the shortest path between different nodes can be viewed by clicking the mouse.

[0021] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. An AI-powered intelligent rights allocation method based on behavior prediction, characterized by: include: Step S100: Collect several permission usage data records in the history; the permission usage data records are operation information recorded in the system log after each authorization operation; Step S200: construct a permission co-occurrence graph based on a number of collected historical permission usage data records and using predefined permission unique identifiers as nodes; Step S300: Analyze the shortest paths between permissions based on the permission co-occurrence graph, mine permission logic chains based on the shortest paths between permissions, and perform operation sequence modeling; perform illegal combination detection and intelligent permission allocation on real-time permission usage data records based on the operation sequence modeling; Step S400: Acquire multiple real-time permission usage data records, construct a real-time permission co-occurrence graph according to the method described in step S200, calculate the clustering coefficient of the system modules to which the permissions belong in the real-time permission co-occurrence graph, and adjust parameters based on the calculation results; Step S500: Visually display a real-time permission co-occurrence graph.

2. The AI permission intelligent allocation method based on behavior prediction according to claim 1 is characterized by: include: Predefine the unique identifier of the permission, the system module to which the permission belongs, and the risk level of the permission; According to the permission usage data record, the unique identifier of the desensitized user, the unique identifier of the permission used this time, the time when the operation occurred, and the desensitized session number are obtained.

3. The AI permission intelligent allocation method based on behavior prediction according to claim 2 is characterized by: In step S200, a permission co-occurrence graph is constructed based on the collected historical permission usage data records and the predefined permission unique identifiers as nodes. Specifically, Step S201: Based on the collected historical permission usage data records, a permission definition table and a permission usage behavior log table are constructed; the permission definition table includes a predefined permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table is constructed based on permission usage data records over a period of time and is arranged in descending order based on the time when the operations occurred; Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission usage behavior log table, excluding simulated account and system task account behaviors, and unifying the time granularity; the invalid permission items include undefined permission unique identifiers and operation failures; Step S203: Extract all data items in the permission definition table, and treat each item as a node information set of the permission co-occurrence graph, wherein a predefined permission unique identifier is used as a node, and one or more of the system module to which the permission belongs, the permission risk level, and the specific permission type are used as supplementary information of the node; when two different permissions a and b are used in the same session, the two different permissions a and b are considered to co-occur once, which is recorded as a connection; traverse the permission usage behavior log table in sequence to complete the construction of the permission co-occurrence graph edge; Step S204: Calculate edge weights based on the normalized co-occurrence frequency method, specifically: w(a,b)=f(a,b) / log[1+f(a)*f(b)]; where w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total number of times permission a is used; f(b) represents the total number of times permission b is used; calculate the edge weights of all edges in sequence; Step S205: Output the constructed authority co-occurrence graph G=(V,E,W); wherein G represents the authority co-occurrence graph identifier; V represents the node set in the authority co-occurrence graph, a, b∈V; E represents the edge set in the authority co-occurrence graph; W represents the edge weight set in the authority co-occurrence graph, w(a,b)∈W.

4. The AI permission intelligent allocation method based on behavior prediction according to claim 3 is characterized by: In step S300, the shortest path between permissions is analyzed based on the permission co-occurrence graph, permission logic chain mining is performed based on the shortest path between permissions, and operation sequence modeling is performed. Based on the operation sequence modeling, illegal combination detection and intelligent permission allocation are performed on the real-time permission usage data records, specifically: According to the authority co-occurrence graph, the shortest path to a node c is: (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ; The Dijkstra algorithm is used to traverse the authority co-occurrence graph G = (V, E, W) to obtain the shortest paths starting from different nodes, calculate the response time of different nodes, and store the authority unique identifiers corresponding to the nodes in the shortest path and the response times of different nodes.

5. The AI permission intelligent allocation method based on behavior prediction according to claim 4 is characterized by: Specifically: Step S401: Determine a node in the permission co-occurrence graph based on the permission unique identifier of the currently used permission, search for candidate nodes under the shortest path of the node, and form a permission prediction list based on the descending order of the edge weights between the nodes in the permission co-occurrence graph. When the edge weight between the nodes is greater than the preset authorization threshold, update the system page and actively prompt the user of the current permission range. When the edge weight between the nodes is less than or equal to the preset authorization threshold, the user reserves the required permission for approval, which is manually reviewed by the administrator. Step S402: Obtain real-time permission usage data records, and judge each permission usage data record obtained in real time based on the stored shortest path and the response time of different nodes. Within the response time, when the path of two permissions is greater than the preset maximum path threshold, but a user has both permissions, the system determines it as an unauthorized combination and issues a real-time warning.

6. The AI permission intelligent allocation method based on behavior prediction according to claim 5 is characterized by: In step S400, a number of real-time permission usage data records are obtained, and a real-time permission co-occurrence graph is constructed according to the method described in step S200. The clustering coefficients of the system modules to which the permissions belong in the real-time permission co-occurrence graph are calculated, and parameter adjustments are made based on the calculation results, specifically: Step S411: Acquire a number of real-time permission usage data records and construct a real-time permission co-occurrence graph according to the method described in step S200; Step S412: Based on the constructed real-time permission co-occurrence graph, for a certain node x, calculate the clustering coefficient C(x), using the formula: C(x)=2e / k(k-1); wherein, e represents the actual number of edges between the neighboring nodes of node x in the real-time permission co-occurrence graph; k represents the number of neighboring nodes of node x; calculate the clustering coefficients of all nodes in turn, and when the clustering coefficient is greater than a preset clustering threshold, mark the system module to which the permission in the node belongs as a critical module, and make critical adjustments to the authorization threshold and maximum path threshold of the critical module.

7. The AI permission intelligent allocation method based on behavior prediction according to claim 1 is characterized by: In step S500, a real-time permission co-occurrence graph is visually displayed, specifically: The real-time permission co-occurrence map is visualized through interactive software, where key modules are marked with different tags; Display additional information of nodes in real time by clicking the mouse; View the shortest paths between different nodes by clicking the mouse; Updates are made regularly.

8. An AI-powered intelligent allocation system based on behavior prediction, applying the AI-powered intelligent allocation method based on behavior prediction according to any one of claims 1 to 7, characterized in that: include: Data collection module, permission co-occurrence map module, intelligent allocation module, key adjustment analysis module and visualization module; The data collection module is used to collect permission usage data records; the permission usage data records are operation information recorded in the system log after each authorization operation; The permission co-occurrence graph module is used to construct a permission co-occurrence graph based on a number of collected historical permission usage data records and predefined permission unique identifiers as nodes; The intelligent allocation module is used to analyze the shortest path between permissions based on the permission co-occurrence graph, mine the permission logic chain based on the shortest path between permissions, and perform operation sequence modeling; based on the operation sequence modeling, it detects illegal combinations of real-time permission usage data records and performs intelligent permission allocation; The key adjustment analysis module is used to obtain real-time permission usage data records, construct a real-time permission co-occurrence map, calculate the clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence map, and adjust parameters according to the calculation results; The visualization module is used to visualize the real-time permission co-occurrence map through interactive software.

9. The AI permission intelligent allocation system based on behavior prediction according to claim 8, characterized in that: include: The permission co-occurrence graph module includes a permission definition table unit, a permission usage behavior log table unit, a pre-processing unit and a graph construction unit; The permission definition table unit is used to construct a permission definition table based on the permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table unit is used to construct a permission usage behavior log table based on permission usage data records within a period of time, and arrange the operations in descending order according to the time when the operations occurred; The pre-processing unit is used to perform data pre-processing and data calculation, wherein the automatic calculation is performed by a computer program; The graph construction unit is used to construct and output a permission co-occurrence graph based on the acquired node data, edge data and edge weight data.

10. The AI permission intelligent allocation system based on behavior prediction according to claim 9 is characterized by: include: The real-time permission co-occurrence map is visualized through interactive software, in which key modules are marked with different tags; the supplementary information of the node is displayed in real time by clicking the mouse; and the shortest path between different nodes can be viewed by clicking the mouse.

Images