AI permission intelligent allocation system and method based on behavior prediction

Abstract

The application discloses an AI permission intelligent allocation system and method based on behavior prediction, and relates to the technical field of permission monitoring and management, and comprises the following steps: collecting a plurality of permission use data records in history; taking the collected a plurality of permission use data records in history as a base and taking a pre-defined permission unique identifier as a node to construct a permission co-occurrence graph; analyzing the shortest path between permissions according to the permission co-occurrence graph, and performing operation sequence modeling; performing irregular combination detection and permission intelligent allocation on real-time permission use data records according to the operation sequence modeling; obtaining real-time a plurality of permission use data records, constructing a real-time permission co-occurrence graph, analyzing the clustering coefficient of the system module to which the permission in the real-time permission co-occurrence graph belongs, and performing permission risk management; and visually displaying the real-time permission co-occurrence graph. The application significantly improves the dynamic nature and intelligent level of permission management.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of right monitoring management, and particularly relates to an AI right intelligent allocation system and method based on behavior prediction. BACKGROUND

[0002] At present, the information system and the business platform widely adopt the right management mechanism, and the traditional right allocation mode generally faces the following problems:

[0003] 1. The right dimension is multiple and the structure is complex, and the traditional method is difficult to find the potential abnormality with strong correlation; the performance is that the user often has multiple rights, and there is a hidden co-occurrence relationship or a dependent path among the rights, and the abnormal behavior is not necessarily the abnormal use of a single right, but the change of a "right combination" use mode, in addition, the static rule or the role right table cannot cover these complex situations;

[0004] 2. It is difficult to identify "soft overreach" or "gradual right drift"; the performance is that the user behavior is normal on the surface, but the behavior path in the right graph appears "unconventional combination" or "jump across sensitive modules", at this time, the simple white list / black list cannot capture these subtle abnormalities;

[0005] 3. The right allocation result lacks a context analysis basis; the performance is that the right allocation system ignores the structural coupling (such as the dependent chain and the co-occurrence strength) among the rights; some seemingly low-risk right combinations cause information leakage or configuration change problems in actual operation;

[0006] 4. There is a lack of a global perspective right audit method based on a graph structure; the performance is that the system cannot understand whether a certain right is in a high-risk central area from the perspective of "graph overall topology"; some key rights are not protected or monitored;

[0007] Based on the above actual problems, a system and a method for right intelligent allocation and monitoring are urgently needed. SUMMARY

[0008] The application aims to provide an AI right intelligent allocation system and method based on behavior prediction to solve the problems in the prior art.

[0009] To achieve the above-mentioned purpose, the application provides the following technical scheme: an AI right intelligent allocation method based on behavior prediction, comprising:

[0010] Step S100, a plurality of right use data records in history are collected; the right use data record is operation information recorded in a system log after each authorization operation;

[0011] It should be noted that the present application needs to collect only the operation permission itself and related data, and does not collect the content of the authorized operation, so there is no need to worry about the problem of content leakage;

[0012] Step S200, taking the collected historical several permission usage data records as the basis, taking the pre-defined permission unique identifier as the node, constructing the permission co-occurrence graph;

[0013] Step S300, according to the permission co-occurrence graph, analyzing the shortest path between permissions, based on the shortest path between permissions, performing permission logic chain mining, and performing operation sequence modeling; according to the operation sequence modeling, performing violation combination detection and permission intelligent allocation on real-time permission usage data records;

[0014] Step S400, obtaining real-time several permission usage data records, constructing a real-time permission co-occurrence graph according to the method of step S200, calculating the clustering coefficient of the system module to which the permission in the real-time permission co-occurrence graph belongs, and adjusting the parameters according to the calculation result;

[0015] Step S500, visualizing the real-time permission co-occurrence graph;

[0016] Further, the pre-defined permission unique identifier, the permission belonging to the system module, and the permission risk level;

[0017] It should be noted that, in general, in a system, the permissions are limited, so setting a unique identifier for the permission is achievable in the prior art;

[0018] The permission belonging to the system module is used for subgraph division of the permission, and the present application is divided by system module;

[0019] Generally, the permission risk level can be three general risk levels of high, medium and low, and according to actual conditions, more refined division can also be performed;

[0020] According to the permission usage data record, the unique identifier of the desensitized user, the permission unique identifier used this time, the operation occurrence time and the desensitized session number are obtained;

[0021] The desensitization method can use hash encryption, etc.

[0022] Further, in step S200, taking the collected historical several permission usage data records as the basis, taking the pre-defined permission unique identifier as the node, constructing the permission co-occurrence graph, specifically:

[0023] Step S201, based on a plurality of permission use data records in the collected history, a permission definition table and a permission use behavior log table are constructed; the permission definition table includes a pre-defined permission unique identifier, a permission belonging to a system module and a permission risk level; the permission use behavior log table is constructed according to permission use data records in a period of time, and is arranged in the order of operation occurrence time from early to late;

[0024] Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission use behavior log table, excluding simulation account and system task account behavior, and unifying time granularity; the invalid permission items include an undefined permission unique identifier and an operation failure;

[0025] Step S203, all data items in the permission definition table are extracted, each item is regarded as a node information set of a permission co-occurrence graph, wherein the pre-defined permission unique identifier is regarded as a node, and one or more of a permission belonging to a system module, a permission risk level and a specific permission type are regarded as supplementary information of the node; when two different permissions a and b are used at the same time / near the same user or the same session, it is considered that the two different permissions a and b co-occur once, and is recorded as a connection; the permission use behavior log table is traversed in turn, and the construction of the permission co-occurrence graph is completed.

[0026] Step S204, the edge weight is calculated based on the normalized co-occurrence frequency, specifically:

[0027] w(a,b)=f(a,b) / log[1+f(a)*f(b)]; wherein w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total use times of permission a; f(b) represents the total use times of permission b; the edge weights of all edges are calculated in turn;

[0028] Step S205, output the constructed permission co-occurrence graph G=(V,E,W); wherein G represents the permission co-occurrence graph identifier; V represents the node set in the permission co-occurrence graph, a,b∈V; E represents the edge set in the permission co-occurrence graph; W represents the edge weight set in the permission co-occurrence graph, w(a,b)∈W.

[0029] Further, in step S300, according to the permission co-occurrence graph, the shortest path between permissions is analyzed, the permission logic chain is mined based on the shortest path between permissions, and the operation sequence modeling is performed; according to the operation sequence modeling, the real-time permission use data record is detected for violation combination and the permission intelligent allocation, specifically:

[0030] According to the permission co-occurrence graph, the shortest path of a certain node c is obtained:

[0031] (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ;

[0032] The Dijkstra algorithm is used to traverse the authority co-occurrence graph G = (V, E, W) to obtain the shortest paths starting from different nodes, calculate the response time of different nodes, and store the authority unique identifiers corresponding to the nodes in the shortest path and the response times of different nodes.

[0033] Furthermore, in step S400, a plurality of real-time permission usage data records are obtained, and a real-time permission co-occurrence graph is constructed according to the method described in step S200. The clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence graph is calculated, and parameter adjustment is performed based on the calculation result, specifically:

[0034] Step S401: Determine a node in the permission co-occurrence graph based on the permission unique identifier of the currently used permission, search for candidate nodes under the shortest path of the node, and form a permission prediction list based on the descending order of the edge weights between the nodes in the permission co-occurrence graph. When the edge weight between the nodes is greater than the preset authorization threshold, update the system page and actively prompt the user of the current permission range. When the edge weight between the nodes is less than or equal to the preset authorization threshold, the user reserves the required permission for approval, which is manually reviewed by the administrator.

[0035] It should be noted that if the required permission does not appear in the permission prediction list, it is considered that the in-degree of the node is less than or equal to the preset authorization threshold;

[0036] Step S402: Acquire real-time permission usage data records, and judge each permission usage data record acquired in real time based on the stored shortest path and the response time of different nodes. Within the response time, if the path between two permissions is greater than a preset maximum path threshold, but a user possesses both permissions, the system determines that the combination is unauthorized and issues a real-time warning.

[0037] In this embodiment, the paths of the two permissions are calculated by summing and adding the edge weights. The shortest path of a node c is (c->d->g), and its edge weights are w(c, d) and w(d, g).

[0038] The path of the two permissions is L(c, g) = a1*w(c, d) + a2*w(d, g);

[0039] wherein a1 and a2 are harmonic coefficients, which are set according to the risk level of the permissions;

[0040] In this embodiment, the harmonic coefficient of high risk is 0.6, the harmonic coefficient of medium risk is 0.5, and the harmonic coefficient of low risk is 0.4;

[0041] Further, in step S411, real-time permission usage data records are acquired, and a real-time permission co-occurrence graph is constructed according to the method described in step S200;

[0042] In step S412, based on the constructed real-time permission co-occurrence graph, the clustering coefficient C(x) of a certain node x is calculated, and the formula is: C(x) = 2e / k(k-1); wherein e represents the actual number of edges between the neighbor nodes of node x in the real-time permission co-occurrence graph; k represents the number of neighbor nodes of node x; the clustering coefficients of all nodes are calculated in turn, and when the clustering coefficient is greater than a preset clustering threshold, the system module to which the permissions in the node belong is marked as a key module, and the authorization threshold and the maximum path threshold of the key module are adjusted.

[0043] It should be noted that the clustering coefficient C(x) can quantify the key degree of node x in the real-time permission co-occurrence graph, which is used to identify high-sensitive and high-coupling permission groups to enhance the permission risk control and intelligent authorization system; the range of the clustering coefficient C(x) is [0, 1];

[0044] Further, in step S500, the real-time permission co-occurrence graph is visualized and displayed, specifically:

[0045] The real-time permission co-occurrence graph is visualized and displayed through interactive software, wherein different markers are used to mark key modules;

[0046] The supplementary information of the node is displayed in real time by clicking the mouse;

[0047] The shortest path of different nodes is viewed by clicking the mouse;

[0048] Regularly update.

[0049] The AI permission intelligent allocation system based on behavior prediction includes a data acquisition module, a permission co-occurrence graph module, an intelligent allocation module, a key adjustment analysis module, and a visualization module;

[0050] The data acquisition module is used to acquire permission usage data records; the permission usage data records are operation information recorded in the system log after each authorization operation;

[0051] The permission co-occurrence graph module is configured to construct a permission co-occurrence graph based on a plurality of permission use data records in the collected history, with a predefined permission unique identifier as a node.

[0052] The intelligent allocation module is configured to analyze the shortest path between permissions according to the permission co-occurrence graph, perform permission logic chain mining based on the shortest path between the permissions, and perform operation sequence modeling; and perform violation combination detection and permission intelligent allocation on real-time permission use data records according to the operation sequence modeling.

[0053] The key adjustment analysis module is configured to obtain a plurality of real-time permission use data records, construct a real-time permission co-occurrence graph, calculate the clustering coefficient of the system module to which the permission in the real-time permission co-occurrence graph belongs, and perform parameter adjustment according to the calculation result.

[0054] The visualization module is configured to visually display the real-time permission co-occurrence graph through interactive software.

[0055] Further, comprising:

[0056] The permission co-occurrence graph module includes a permission definition table unit, a permission use behavior log unit, a preprocessing unit, and a graph construction unit.

[0057] The permission definition table unit is configured to construct a permission definition table based on a permission unique identifier, a permission belonging system module, and a permission risk level.

[0058] The permission use behavior log unit is configured to construct a permission use behavior log table according to permission use data records within a period of time, and arrange the operation occurrence time in the order from early to late.

[0059] The preprocessing unit is configured to perform data preprocessing and data calculation, wherein the calculation is performed automatically by a computer program.

[0060] The graph construction unit is configured to construct and output the permission co-occurrence graph based on the obtained node data, edge data, and edge weight data.

[0061] Further, comprising:

[0062] The real-time permission co-occurrence graph is visually displayed through interactive software, wherein different key modules are marked by different markers; the supplementary information of the node is displayed in real time by clicking the mouse; and the shortest path of different nodes is viewed by clicking the mouse.

[0063] Compared with the prior art, the application has the beneficial effects that the dynamicity and intelligent level of the permission management are significantly improved. The historical permission use data is used to construct a permission co-occurrence graph, and the shortest path and clustering coefficient between the permissions are extracted through graph calculation, which not only describes the collaborative relationship and coupling degree between the permissions, but also realizes the modeling of the permission logic chain and the path risk assessment. Secondly, combined with the real-time permission calling behavior, the system can automatically judge whether the current request is reasonable, predict the next potential operation, identify the over-authorization combination and issue a warning. At the same time, for the high-sensitive permission group with high clustering coefficient, the system can automatically adjust the authorization threshold and path threshold, thereby enhancing the risk control. The method only collects necessary information such as permission items and operation time, and guarantees user privacy and data compliance. Through the graph visualization display and human-computer interaction capability, the system permission structure and risk distribution can be intuitively understood by the operation and maintenance personnel. The application effectively solves the problems of static allocation of traditional permissions, difficulty in identifying over-authorization behavior, and inability to predict permission abuse, and has significant application value and promotion prospect. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 FIG. 1 is a step schematic diagram of an AI permission intelligent allocation method based on behavior prediction according to the present application. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0066] Embodiment: as shown in the figure, the present application provides a technical solution, an AI permission intelligent allocation method based on behavior prediction, comprising: Figure 1

[0067] Step S100, collecting a plurality of permission use data records in history; the permission use data record is the operation information recorded in the system log after each authorization operation;

[0068] It should be noted that the present application only needs to collect the operation permission itself and related data, and does not collect the content of the authorization operation, so there is no need to worry about the problem of content leakage;

[0069] Predefining permission unique identifier, permission belonging system module and permission risk level;

[0070] It should be noted that, in general, the permissions in a system are limited, so setting a unique identifier for the permission is a function that can be realized by the prior art; ​

[0071] The system module to which the permission belongs is used for subgraph division of the permission, and the system module is divided by the application;

[0072] The general risk levels of the permissions can be high, medium and low, and more refined division can be performed according to actual conditions.

[0073] According to the permission use data record, the unique identifier of the desensitized user, the unique identifier of the permission used this time, the operation occurrence time and the desensitized session number are obtained.

[0074] The desensitization method can use hash encryption and the like.

[0075] Step S200, using the collected historical permission use data records as a basis, using the pre-defined permission unique identifier as a node, constructing a permission co-occurrence graph;

[0076] Step S201, using the collected historical permission use data records as a basis, constructing a permission definition table and a permission use behavior log table; the permission definition table includes a pre-defined permission unique identifier, a permission belonging system module and a permission risk level; the permission use behavior log table is constructed according to permission use data records in a period of time, and is arranged in the order from early to late according to the operation occurrence time.

[0077] Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission use behavior log table, excluding simulation account and system task account behavior and unifying time granularity; the invalid permission items include an undefined permission unique identifier and an operation failure.

[0078] Step S203, extracting all data items in the permission definition table, regarding each item as a node information set of the permission co-occurrence graph, wherein the pre-defined permission unique identifier is used as a node, and the permission belonging system module, the permission risk level and one or more of the specific permission types are used as supplementary information of the node; when two different permissions a and b are used simultaneously / near simultaneously in the same user or the same session, it is considered that the two different permissions a and b co-occur once, which is recorded as a connection; the permission use behavior log table is traversed in turn to complete the construction of the permission co-occurrence graph.

[0079] Step S204, calculating the edge weight based on the normalized co-occurrence frequency, specifically:

[0080] w(a,b)=f(a,b) / log[1+f(a)*f(b)]; where w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total number of times permission a is used; f(b) represents the total number of times permission b is used; calculate the edge weights of all edges in sequence;

[0081] Step S205: Output the constructed authority co-occurrence graph G=(V,E,W); wherein G represents the authority co-occurrence graph identifier; V represents the node set in the authority co-occurrence graph, a, b∈V; E represents the edge set in the authority co-occurrence graph; W represents the edge weight set in the authority co-occurrence graph, w(a,b)∈W.

[0082] Step S300: Analyze the shortest paths between permissions based on the permission co-occurrence graph, mine permission logic chains based on the shortest paths between permissions, and perform operation sequence modeling; perform illegal combination detection and intelligent permission allocation on real-time permission usage data records based on the operation sequence modeling;

[0083] According to the authority co-occurrence graph, the shortest path to a node c is:

[0084] (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ;

[0085] Use the Dijkstra algorithm to traverse the authority co-occurrence graph G = (V, E, W) to obtain the shortest path starting from different nodes, calculate the response time of different nodes, and store the unique authority identifiers corresponding to the nodes in the shortest path and the response time of different nodes;

[0086] The Dijkstra algorithm is an existing technology and is widely used in graph theory analysis. In this embodiment, the Dijkstra algorithm is used to traverse the authority co-occurrence graph to obtain the shortest paths starting from different nodes.

[0087] Step S400: Acquire multiple real-time permission usage data records, construct a real-time permission co-occurrence graph according to the method described in step S200, calculate the clustering coefficient of the system modules to which the permissions belong in the real-time permission co-occurrence graph, and adjust parameters based on the calculation results;

[0088] Step S401, determining a node in the permission co-occurrence graph based on a permission unique identifier of a currently used permission, searching for candidate nodes under a shortest path of the node, arranging edge weights between the nodes in the permission co-occurrence graph in descending order to form a permission prediction list, when the edge weight between the nodes is greater than a preset authorization threshold, updating a system page and actively prompting a user of a current permission range, when the edge weight between the nodes is less than or equal to the preset authorization threshold, reserving the required permission for approval by a user, and manually auditing by an administrator;

[0089] It should be noted that if the required permission does not appear in the permission prediction list, it is considered that the in-degree of the node is less than or equal to the preset authorization threshold for processing;

[0090] Step S402, obtaining real-time permission use data records, judging each real-time permission use data record based on the stored shortest path and response time of different nodes, when the path of two permissions is greater than a preset maximum path threshold within the response time, but a user simultaneously has the two permissions, the system determines that it is an over-authorization combination and performs real-time early warning.

[0091] Step S411, obtaining real-time permission use data records, and constructing a real-time permission co-occurrence graph according to the method in step S200;

[0092] Step S412, based on the constructed real-time permission co-occurrence graph, calculating a clustering coefficient C(x) of a node x, the formula is: C(x)=2e / k(k-1); wherein e represents the actual number of edges between the neighbor nodes of the node x in the real-time permission co-occurrence graph; k represents the number of neighbor nodes of the node x; the clustering coefficients of all nodes are calculated in turn, when the clustering coefficient is greater than a preset clustering threshold, the system module to which the permissions in the node belong is marked as a key module, and the authorization threshold and the maximum path threshold of the key module are key adjusted;

[0093] In this embodiment, the method of key adjusting the authorization threshold and the maximum path threshold of the key module is specifically:

[0094] A plurality of values of the authorization threshold and the maximum path threshold in the history are collected respectively, and the average value μ and the standard deviation σ are calculated; the authorization threshold and the maximum path threshold of the key module are adjusted to max(z, μ+σ); wherein z represents the original parameter value of the node x in the real-time permission co-occurrence graph;

[0095] Through this method, the authorization threshold and the maximum path threshold of the key module can be reasonably adjusted, and by limiting the audit and distribution of key permissions, the problem of permission abuse of the entire system is solved to a certain extent.

[0096] It should be noted that the clustering coefficient C(x) can be used to quantify the criticality of node x in the real-time permission co-occurrence graph, which is used to identify highly sensitive and highly coupled permission groups to enhance permission risk control and intelligent authorization systems. The range of the clustering coefficient C(x) is [0,1].

[0097] Step S500: Visually display a real-time permission co-occurrence graph;

[0098] The real-time permission co-occurrence map is visualized through interactive software, where key modules are marked with different tags;

[0099] Highlighting allows relevant personnel to intuitively see the importance of permissions, thereby raising their vigilance in real time and avoiding authorization deviations.

[0100] Topology can also be used to perform permission auditing and monitoring from a global perspective;

[0101] Display additional information of nodes in real time by clicking the mouse;

[0102] View the shortest paths between different nodes by clicking the mouse;

[0103] Updates are made regularly.

[0104] AI-powered intelligent permission allocation system based on behavior prediction, including: data collection module, permission co-occurrence map module, intelligent allocation module, key adjustment analysis module and visualization module;

[0105] The data collection module is used to collect permission usage data records; permission usage data records are the operation information recorded in the system log after each authorization operation;

[0106] The permission co-occurrence graph module is used to construct a permission co-occurrence graph based on the collected historical permission usage data records and predefined permission unique identifiers as nodes;

[0107] The intelligent allocation module is used to analyze the shortest path between permissions based on the permission co-occurrence map, mine the permission logic chain based on the shortest path between permissions, and perform operation sequence modeling; based on the operation sequence modeling, it detects illegal combinations of real-time permission usage data records and performs intelligent permission allocation;

[0108] The key adjustment analysis module is used to obtain real-time permission usage data records, build a real-time permission co-occurrence map, calculate the clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence map, and adjust parameters based on the calculation results;

[0109] The visualization module is used to visualize the real-time permission co-occurrence map through interactive software.

[0110] Further, including:

[0111] The permission co-occurrence graph module comprises a permission definition table unit, a permission use behavior log table unit, a preprocessing unit and a graph construction unit.

[0112] The permission definition table unit is used to construct a permission definition table based on a permission unique identifier, a permission belonging system module and a permission risk level.

[0113] The permission use behavior log table unit is used to construct a permission use behavior log table according to permission use data records within a period of time, and arrange the operation occurrence time in the order from early to late.

[0114] The preprocessing unit is used for data preprocessing and data calculation, wherein the automatic calculation is performed by a computer program.

[0115] The graph construction unit is used to construct and output the permission co-occurrence graph based on the obtained node data, edge data and edge weight data.

[0116] Further, it comprises:

[0117] The real-time permission co-occurrence graph is visually displayed through the interactive software, wherein the key modules are marked by different markers, the supplementary information of the nodes is displayed in real time by clicking the mouse, and the shortest path of different nodes is viewed by clicking the mouse.

[0118] It is apparent to those skilled in the art that the present application is not limited to the details of the foregoing exemplary embodiments, and the present application can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be considered as exemplary and non-limiting, and the scope of the present application is defined by the appended claims rather than the above description, and all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be considered as limiting the claims involved.

Claims

1. An AI-powered intelligent rights allocation method based on behavior prediction, characterized by: include: Step S100: Collect several permission usage data records in the history; the permission usage data records are operation information recorded in the system log after each authorization operation; Step S200: construct a permission co-occurrence graph based on a number of collected historical permission usage data records and using predefined permission unique identifiers as nodes; Step S300: Analyze the shortest paths between permissions based on the permission co-occurrence graph, mine permission logic chains based on the shortest paths between permissions, and perform operation sequence modeling; perform illegal combination detection and intelligent permission allocation on real-time permission usage data records based on the operation sequence modeling; According to the authority co-occurrence graph, the shortest path to a node c is: (c->d->g); where c, d, and g are different nodes, c, d, g∈V; the operation intervals between nodes c and d and between nodes d and g are obtained by the operation occurrence times of nodes c, d, and g, respectively; the maximum value of the operation intervals between nodes c and d in several historical permission usage data records is taken as the response time t between nodes c and d. cd , according to the above method, the response time t of node d and node g is obtained dg ; Traverse the authority co-occurrence graph G = (V, E, W) using the Dijkstra algorithm to obtain the shortest paths starting from different nodes, calculate the response times of different nodes, and store the authority unique identifiers corresponding to the nodes in the shortest path and the response times of different nodes; Step S400: Acquire multiple real-time permission usage data records, construct a real-time permission co-occurrence graph according to the method described in step S200, calculate the clustering coefficient of the system modules to which the permissions belong in the real-time permission co-occurrence graph, and adjust parameters based on the calculation results; Step S401: Determine a node in the permission co-occurrence graph based on the permission unique identifier of the currently used permission, search for candidate nodes under the shortest path of the node, and form a permission prediction list based on the descending order of the edge weights between the nodes in the permission co-occurrence graph. When the edge weight between the nodes is greater than the preset authorization threshold, update the system page and actively prompt the user of the current permission range. When the edge weight between the nodes is less than or equal to the preset authorization threshold, the user reserves the required permission for approval, which is manually reviewed by the administrator. Step S411: Acquire a number of real-time permission usage data records and construct a real-time permission co-occurrence graph according to the method described in step S200; Step S412: Based on the constructed real-time permission co-occurrence graph, for a node x, calculate the clustering coefficient C(x), using the formula: C(x) = 2e / k(k-1); where e represents the actual number of edges between neighboring nodes of node x in the real-time permission co-occurrence graph; and k represents the number of neighboring nodes of node x. The clustering coefficients of all nodes are calculated sequentially. When the clustering coefficient is greater than a preset clustering threshold, the system module to which the permission in the node belongs is marked as a critical module, and the authorization threshold and maximum path threshold of the critical module are critically adjusted. Step S402: Acquire real-time permission usage data records, and judge each permission usage data record acquired in real time based on the stored shortest path and the response time of different nodes. Within the response time, if the path between two permissions is greater than a preset maximum path threshold, but a user possesses both permissions, the system determines that the combination is unauthorized and issues a real-time warning. Step S500: Visually display a real-time permission co-occurrence graph.

2. The AI ​​permission intelligent allocation method based on behavior prediction according to claim 1 is characterized by: include: Predefine the unique identifier of the permission, the system module to which the permission belongs, and the risk level of the permission; According to the permission usage data record, the unique identifier of the desensitized user, the unique identifier of the permission used this time, the time when the operation occurred, and the desensitized session number are obtained.

3. The AI ​​permission intelligent allocation method based on behavior prediction according to claim 2 is characterized by: In step S200, a permission co-occurrence graph is constructed based on the collected historical permission usage data records and the predefined permission unique identifiers as nodes. Specifically, Step S201: Based on the collected historical permission usage data records, a permission definition table and a permission usage behavior log table are constructed; the permission definition table includes a predefined permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table is constructed based on permission usage data records over a period of time and is arranged in descending order based on the time when the operations occurred; Step S202, data preprocessing; the data preprocessing includes deleting invalid permission items in the permission usage behavior log table, excluding simulated account and system task account behaviors, and unifying the time granularity; the invalid permission items include undefined permission unique identifiers and operation failures; Step S203: Extract all data items in the permission definition table, and treat each item as a node information set of the permission co-occurrence graph, wherein a predefined permission unique identifier is used as a node, and one or more of the system module to which the permission belongs, the permission risk level, and the specific permission type are used as supplementary information of the node; when two different permissions a and b are used in the same session, the two different permissions a and b are considered to co-occur once, which is recorded as a connection; traverse the permission usage behavior log table in sequence to complete the construction of the permission co-occurrence graph edge; Step S204: Calculate edge weights based on the normalized co-occurrence frequency method, specifically: w(a,b)=f(a,b) / log[1+f(a)*f(b)]; where w(a,b) represents the edge weight between two different permissions a and b; f(a,b) represents the number of connections between two different permissions a and b; f(a) represents the total number of times permission a is used; f(b) represents the total number of times permission b is used; calculate the edge weights of all edges in sequence; Step S205: Output the constructed authority co-occurrence graph G=(V,E,W); wherein G represents the authority co-occurrence graph identifier; V represents the node set in the authority co-occurrence graph, a, b∈V; E represents the edge set in the authority co-occurrence graph; W represents the edge weight set in the authority co-occurrence graph, w(a,b)∈W.

4. The AI ​​permission intelligent allocation method based on behavior prediction according to claim 1 is characterized by: In step S500, a real-time permission co-occurrence graph is visually displayed, specifically: The real-time permission co-occurrence map is visualized through interactive software, where key modules are marked with different tags; Display additional information of nodes in real time by clicking the mouse; View the shortest paths between different nodes by clicking the mouse; Updates are made regularly.

5. An AI-powered intelligent allocation system based on behavior prediction, applying the AI-powered intelligent allocation method based on behavior prediction according to any one of claims 1 to 4, characterized in that: include: Data collection module, permission co-occurrence map module, intelligent allocation module, key adjustment analysis module and visualization module; The data collection module is used to collect permission usage data records; the permission usage data records are operation information recorded in the system log after each authorization operation; The permission co-occurrence graph module is used to construct a permission co-occurrence graph based on a number of collected historical permission usage data records and predefined permission unique identifiers as nodes; The intelligent allocation module is used to analyze the shortest path between permissions based on the permission co-occurrence graph, mine the permission logic chain based on the shortest path between permissions, and perform operation sequence modeling; based on the operation sequence modeling, it detects illegal combinations of real-time permission usage data records and performs intelligent permission allocation; The key adjustment analysis module is used to obtain real-time permission usage data records, construct a real-time permission co-occurrence map, calculate the clustering coefficient of the system module to which the permission belongs in the real-time permission co-occurrence map, and adjust parameters according to the calculation results; The visualization module is used to visualize the real-time permission co-occurrence map through interactive software.

6. The AI ​​permission intelligent allocation system based on behavior prediction according to claim 5 is characterized by: include: The permission co-occurrence graph module includes a permission definition table unit, a permission usage behavior log table unit, a pre-processing unit and a graph construction unit; The permission definition table unit is used to construct a permission definition table based on the permission unique identifier, the system module to which the permission belongs, and the permission risk level; The permission usage behavior log table unit is used to construct a permission usage behavior log table based on permission usage data records within a period of time, and arrange the operations in descending order according to the time when the operations occurred; The pre-processing unit is used to perform data pre-processing and data calculation, wherein the automatic calculation is performed by a computer program; The graph construction unit is used to construct and output a permission co-occurrence graph based on the acquired node data, edge data and edge weight data.

7. The AI ​​permission intelligent allocation system based on behavior prediction according to claim 6 is characterized by: include: The real-time permission co-occurrence map is visualized through interactive software, in which key modules are marked with different tags; the supplementary information of the node is displayed in real time by clicking the mouse; and the shortest path between different nodes can be viewed by clicking the mouse.

Images