A zero-trust secure data processing method and system

Abstract

The present invention discloses a zero-trust security data processing method and system, which relates to the field of data processing technology. The present invention processes the user's historical access behavior in a time period, extracts behavioral fingerprint features to form a vector representation, and establishes a user's trusted behavior interval index table, which can achieve long-term modeling of individual behavioral characteristics and fine division of trusted segments, significantly improving the ability to identify behavioral evolution trends; in terms of real-time protection, through the dynamic construction of the access request path and the collaborative comparison with other user behaviors in the same interval, it can fully utilize the group behavior consensus and form a multi-source, multi-dimensional behavioral judgment basis, thereby enhancing the accuracy and robustness of risk detection. The present invention realizes the automatic identification and processing of abnormal behavior by constructing a response chain rule set, effectively avoiding the drawbacks of excessive blocking or false positives in traditional strategies.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a zero-trust secure data processing method and system. Background Art

[0002] In today's highly digital and networked environment, the security of data access and interactive behaviors has become a critical safeguard for enterprise information infrastructure. Traditional network security models rely heavily on perimeter protection mechanisms, assuming a security boundary division logic of "trusted inside, untrusted outside." However, with the development of cloud computing, mobile office, and IoT technologies, user access behaviors are becoming increasingly dynamic and decentralized, and traditional security boundaries are gradually becoming ineffective. To address increasingly complex security threats, the zero-trust security architecture has been proposed. Its core concept is "never trust, always verify," emphasizing that no entity (including internal users) is trusted by default, and all access requests must be based on strict verification. However, most current zero-trust implementation plans still rely primarily on static identity authentication and access control policies, lacking in-depth analysis of the dynamic evolution of user behavior, making it difficult to perceive the behavioral risks of users in specific contexts in real time.

[0003] Some existing technologies attempt to incorporate user behavior analysis and behavioral fingerprint modeling to assist in risk identification and access control, but these approaches often focus on static behavioral patterns and anomaly detection models, such as identifying short-term behavioral anomalies based on clustering or rule matching. These approaches often lack contextual understanding and dynamic correction mechanisms when faced with complex, multi-stage, and multi-dimensional access behavior paths, resulting in high false positive rates and limited ability to address new threats. Furthermore, existing methods generally ignore the behavioral synergies between user groups and fail to fully exploit the value of cross-validation between group behavior patterns within similar trust intervals, limiting the robustness and generalization capabilities of behavioral verification systems. Summary of the Invention

[0004] In view of the problems existing in the existing zero-trust security protection system, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is how to enhance the dynamic modeling and response capabilities of user access behavior and effectively improve the level of behavioral security intelligent identification under the zero-trust framework.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In the first aspect, the present invention provides a zero-trust security data processing method, which includes dividing the user's historical access behavior records into multiple behavior time intervals, extracting the behavior fingerprint feature sequence within each behavior time interval, and constructing a behavior time interval fingerprint vector, mapping it to a user trusted behavior interval index table; in the current session, constructing a behavior path sequence with the access request order as the main line; synchronously aggregating other user behavior records in the same trusted interval as the user to form a behavioral collaborative evidence set; constructing a response chain rule set, jointly comparing the current behavior path, the user trusted behavior interval index table and the collaborative evidence set to determine whether it is an abnormal access. If abnormal, the response chain rule is triggered; when path correction is triggered, the structure fragment in the path correction template library is called to reorganize the behavior path and replace the current path behavior segment; the reconstructed behavior path is re-bound to the original behavior time period index.

[0008] As a preferred solution of the zero-trust security data processing method described in the present invention, the behavior time period intervals are divided according to the natural daily cycle and the business operation window.

[0009] As a preferred solution of the zero-trust security data processing method described in the present invention, the construction of the behavior period fingerprint vector includes: extracting a triple sequence consisting of user operation type, resource access level and trigger mechanism in each behavior period interval; according to each triple sequence, recording the number of repeated occurrences and the position order of the first occurrence in the current behavior period to form a combination feature of frequency and time sequence position; aligning the combination feature with the preset behavior attention weight, and generating a behavior priority index based on the importance of the behavior and the degree of advancement in the behavior period; based on the behavior priority index, performing unified coding processing according to the distribution position of the triple sequence to form a behavior period fingerprint vector.

[0010] As a preferred solution of the zero-trust security data processing method described in the present invention, the mapping of the user trusted behavior interval index table includes: calling the archived historical behavior fingerprint library, comparing the similarity of each behavior period fingerprint vector with the period fingerprint vector in the historical behavior fingerprint library, and if it is not less than the preset credibility threshold, outputting the corresponding behavior period index set to form a user trusted behavior interval index table.

[0011] As a preferred solution of the zero-trust security data processing method described in the present invention, the generation of the behavioral collaboration evidence set includes: taking the current user's behavioral path sequence as a reference, retrieving the user set in the same behavioral time period interval within the behavioral time period corresponding to the user trusted behavior interval index table, and extracting the user behavior path set; for each behavioral path in the user behavior path set, constructing a sequence difference vector between the current behavior path; screening behavioral paths that satisfy the sequence difference vector less than the path collaboration threshold to form a preliminary collaboration set; based on all behavioral paths in the preliminary collaboration set, statistically analyzing the behavioral response mode and operation type distribution on each access node to construct a node-level consensus vector set; aligning and screening the node-level consensus vector set and the corresponding node of the current behavior path to generate a behavioral collaboration evidence set.

[0012] As a preferred solution of the zero-trust secure data processing method described in the present invention, the response chain rule set includes freezing, demotion and fallback, and path correction.

[0013] As a preferred solution of the zero-trust security data processing method described in the present invention, each node in the current behavior path is jointly matched with the time period fingerprint vector set covered by the user trusted behavior interval index table and the node consensus features in the collaborative evidence set, the matching type and matching degree of each node are recorded, and a corresponding behavior deviation label list is constructed; the joint matching includes: for each node in the current behavior path, extracting triples and the behavior features of the context nodes in the behavior path; based on the triples and structural positions, screening the time period fingerprint vector set covered by the user trusted behavior interval index table, Select the behavior fragments whose triples are completely consistent and whose context node triples match the adjacent nodes of the current path node, and mark them as trusted path matches; in the node-level consensus vector of the collaborative evidence set, extract the behavior frequency distribution value that matches the current node triple, judge whether the node is in the consensus behavior segment with a frequency higher than the set frequency threshold, and mark them as collaborative support nodes or collaborative missing nodes respectively; if the current node satisfies both the trusted path match and the collaborative support node, establish strong consistency of the node's joint matching state label; if only one of them is met, it is marked as a partial match; if neither is met, it is marked as an abnormal deviation.

[0014] As a preferred solution of the zero-trust security data processing method described in the present invention, the behavior path reorganization includes: searching the path correction template library for candidate template fragments that are compatible with the corresponding segment triple sequence structure; preferentially selecting the template fragments corresponding to the existing behavior time period fingerprint vectors in the user trusted behavior interval index table to replace the correction segment in the original behavior path; splicing the replaced behavior path with the uncorrected segment in the original behavior path, and adjusting the index relationship with the corresponding time period in the user trusted behavior interval index table according to the spliced ​​behavior sequence.

[0015] As a preferred solution of the zero-trust security data processing method described in the present invention, the adjustment includes the index relationship between the corresponding time period in the user trusted behavior interval index table, searching the original bound behavior time period index range in the user trusted behavior interval index table in sequence according to the actual arrangement order of the spliced ​​nodes, and updating the behavior time period index identifier that is consistent with the behavior triplet of the replaced node; if there is a previously unbound node in the spliced ​​segment, the behavior time period fingerprint vector of the adjacent time period is used as a reference to expand the behavior time period range of the corresponding user in the user trusted behavior interval index table.

[0016] In the second aspect, the present invention provides a zero-trust security data processing system, which includes: a fingerprint extraction module, which is used to divide the user's historical access behavior records into multiple behavior time period intervals, extract the behavior fingerprint feature sequence within each behavior time period interval, and construct a behavior time period fingerprint vector, which is mapped to a user trusted behavior interval index table; a path aggregation module, which is used to construct a behavior path sequence in the current session with the access request order as the main line; synchronously aggregate other user behavior records in the same trusted interval as the user to form a behavior collaborative evidence set; an anomaly detection module, which is used to construct a response chain rule set, jointly compare the current behavior path, the user trusted behavior interval index table and the collaborative evidence set, and determine whether it is an abnormal access. If it is abnormal, the response chain rule is triggered; a path correction module, which is used to call the structure fragment in the path correction template library when the path correction is triggered, reorganize the behavior path, and replace the current path behavior segment; the reconstructed behavior path is re-bound to the original behavior time period index.

[0017] The beneficial effects of the present invention are as follows: by periodizing the user's historical access behavior, extracting behavioral fingerprint features to form a vector representation, and establishing a user trusted behavior interval index table, the present invention can achieve long-term modeling of individual behavioral characteristics and fine division of trusted segments, significantly improving the ability to identify behavioral evolution trends; in terms of real-time protection, through the dynamic construction of access request paths and collaborative comparison with other user behaviors in the same interval, it can fully utilize group behavioral consensus and form a multi-source, multi-dimensional behavioral judgment basis, thereby enhancing the accuracy and robustness of risk detection. The present invention realizes the automatic identification and processing of abnormal behavior by constructing a response chain rule set, effectively avoiding the drawbacks of excessive blocking or false positives in traditional strategies.

[0018] In summary, the present invention realizes a more sophisticated, intelligent and recoverable zero-trust security behavior processing process through multi-stage dynamic analysis and intelligent response path design, which has extremely high engineering application value and security protection potential. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of the zero-trust secure data processing method.

[0021] Figure 2 This is a structural diagram of the zero-trust secure data processing system. DETAILED DESCRIPTION

[0022] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0025] As mentioned in the background technology above, some existing technologies attempt to introduce user behavior analysis and behavioral fingerprint modeling to assist in risk identification and access control, but they mostly focus on static behavior patterns and anomaly detection models, such as identifying short-term behavioral anomalies based on clustering or rule matching. When faced with complex, cross-stage, and multi-dimensional access behavior paths, these methods often lack contextual understanding and dynamic correction mechanisms, resulting in high misjudgment rates and limited ability to respond to new threats. At the same time, existing methods also generally ignore the behavioral synergy characteristics between user groups and fail to fully explore the cross-validation value between group behavior patterns within similar trust intervals, limiting the robustness and generalization capabilities of the behavior verification system.

[0026] Figure 1 Flowchart of the zero-trust security data processing method according to an embodiment of the present invention. Figure 1 As shown, the zero-trust secure data processing method includes:

[0027] S1: Divide the user's historical access behavior records into multiple behavior time intervals, extract the behavior fingerprint feature sequence within each behavior time interval, and construct a behavior time interval fingerprint vector, which is mapped to the user's trusted behavior interval index table.

[0028] Behavior time periods are divided based on natural day cycles and business operation windows. Specifically, the division is based on periodic rules in the time dimension. User access behavior records are bounded by natural day cycles and business operation windows, dividing them into multiple relatively independent behavior time periods. Natural day cycles reflect the daily rhythm of user behavior and can generate daily time-based segmentation results for access behavior, reducing the contextual confusion caused by cross-day access. Business operation windows are a set of pre-set business activity time periods, encompassing commonly distributed segments such as the morning peak, midday access period, and nighttime operation period. These enable fine-grained localization of user access behavior. For example, for an enterprise employee, regular login and access behavior is typically concentrated between 9:00 AM and 6:00 PM on weekdays. Therefore, this business period is designated as a "high-density operation window." Using these two segmentation strategies, time period segmentation results with higher behavioral density can be generated, thereby improving the accuracy of subsequent fingerprint feature extraction.

[0029] Preferably, the construction of the behavior period fingerprint vector includes the following steps:

[0030] Step S1.1: In each behavior time interval, extract a triple sequence consisting of user operation type, resource access level, and trigger mechanism.

[0031] The extraction process traverses the event records in the original log in chronological order, and semantically annotates and structures the behavioral content contained in the log to ensure the consistency of triple composition and the accuracy of path hierarchy.

[0032] Step S1.2: For each triple sequence, record the number of recurrences and the order of the first occurrence within the current behavior period to form a combined feature of frequency and temporal position.

[0033] It should be noted that frequency statistics are used to measure the operational intensity of a specific behavior within a time period and can reveal the user's access preferences within the business cycle; the order of first appearance reflects the temporal structure of user behavior and characterizes the forward and backward dependencies in the access path.

[0034] Traditional methods often use access frequency as the primary indicator of behavioral features, ignoring the temporal hierarchy of the operation sequence. However, this invention uses the first appearance order as a characteristic parameter, which can better reflect the stability and structural consistency of user behavior when constructing behavioral pattern features.

[0035] In the process of generating the combined feature vector, the frequency and time sequence corresponding to the triples are respectively formed into a two-dimensional vector set, which is bound with the unique identifier of the triple as the primary key to form a time-sensitive operation feature description.

[0036] Step S1.3: Align the combined features with the preset behavior attention weights, and generate a behavior priority index based on the importance of the behavior and its leading degree in the behavior period (the order of first appearance, i.e., the time sequence).

[0037] Specifically, for the combined features corresponding to each triple, the preset behavior attention weight configuration item is called, and the configuration item is preset and assigned according to the sensitivity of the three dimensions of user operation type, resource access level and trigger mechanism contained in the triple.

[0038] The behavioral attention weight is a set of static parameters, which comes from the security level and permission level assessment set by the business system for various behaviors. It is configurable and targeted.

[0039] During the processing, the behavioral attention weight is mapped to the two dimensions of frequency characteristics and time sequence characteristics respectively to form the frequency weight factor and sequence adjustment factor.

[0040] Subsequently, for each triple, the frequency value and the frequency weight factor are proportionally weighted to generate a frequency-oriented intensity indicator, which is used to reflect the repetition density and attention level of the behavior in this period. At the same time, the first appearance sequence value of the triple and the sequence adjustment factor are multiplied and integrated to generate a sequence-guided priority value, which is used to characterize the degree of precedence of the behavior in the behavior path and its impact on the subsequent operation sequence. To ensure that the priority index takes into account both operation density and structural dominance, the above two values ​​are further weighted and fused to generate a single behavior priority score, which serves as the core indicator for subsequent fingerprint vector sorting.

[0041] In traditional methods, fingerprint feature construction is based only on operation frequency or access path, without considering the risk sensitivity and pre-influence structure of the behavior. However, the present invention uses a calculation mechanism of behavior priority indicators to enable fingerprint vectors to have dynamic sensitivity and controllable judgment thresholds, which helps to improve the accuracy of behavior credibility judgment.

[0042] Step S1.4: Based on the behavior priority index, perform unified coding processing according to the distribution position of the triple sequence to form a behavior time period fingerprint vector.

[0043] Among them, the encoding processing rule adopts a position-aware distributed encoding mode, which assigns high-priority operations to higher-weight position encodings while retaining the edge feature information of low-frequency behaviors.

[0044] Furthermore, the archived historical behavior fingerprint library is called to compare the similarity of each behavior period fingerprint vector with the period fingerprint vector in the historical behavior fingerprint library. If it is not less than the preset credibility threshold, the corresponding behavior period index set is output in chronological order to form a user trusted behavior interval index table.

[0045] S2: In the current session, a behavioral path sequence is constructed based on the order of access requests; the behavioral records of other users in the same trust interval as the user are synchronously aggregated to form a behavioral collaborative evidence set.

[0046] First, an access node includes the system ID of the user accessing, the request type ID, and the response trigger source ID. These three pieces of information are combined in order of access occurrence to form an access node set. The chronological order of access requests is extracted from the request reception time field in the server log, ensuring that the behavioral path maintains a complete sequential execution logic at the structural level. By linearly arranging the order of access requests, a continuous access trajectory of the user in the current session can be constructed, facilitating subsequent semantic consistency comparisons with historical behavior.

[0047] Furthermore, the generation of behavioral collaborative evidence set includes the following steps:

[0048] a. Using the current user's behavior path sequence as a reference, within the behavior period corresponding to the user's trusted behavior interval index table, retrieve the set of users in the same behavior period interval and extract the user behavior path set.

[0049] The judgment of the behavior time interval is based on the time period index of the behavior time fingerprint vector, and other users who are in the same time window and have similar behavior patterns as the current user are quickly located through index mapping.

[0050] Traditional behavioral analysis often uses the entire user's behavior as a background reference, ignoring the temporal density and trust level differences of behavior occurrence, leading to the introduction of a large number of irrelevant behavior paths into collaborative analysis. This invention strictly limits the behavior aggregation process to trusted time intervals and screens for samples whose behavior paths in the user set overlap with the current path at the structural level. This significantly improves the structural consistency and behavioral context alignment of subsequent collaborative evidence.

[0051] b. For each behavior path in the user behavior path set, construct a sequence difference vector between it and the current behavior path.

[0052] In an embodiment of the present invention, the sequence difference vector consists of two parts: one is the structural difference vector, which records the sequential matching offset of the node sets in the two behavior paths; the other is the semantic difference vector, which identifies the behavioral intention deviation between the access operation type and the module level.

[0053] During the difference calculation process, a combined strategy of minimum edit distance and node-level semantic similarity is adopted to achieve a dual-layer difference measurement of paths in the structural and semantic dimensions. Specifically, an ordered sequence of node numbers is constructed for the current behavior path and the candidate behavior path, and a dynamic programming algorithm is applied to calculate the minimum number of operation steps required to transform from one path to another. Operations include insertion, deletion, and replacement. Semantic similarity defines a similarity score based on the node's triple structure. The score is based on a preset business hierarchy semantic tree. For example, the operation types "read" and "browse" are set to medium similarity, those with adjacent hierarchies are set to near similarity, and those with consistent triggering conditions are set to high similarity. If two nodes have different structural positions but a semantic score above the threshold, the replacement cost is reduced, and the weight of the corresponding operation in the minimum edit distance calculation is reduced.

[0054] Finally, the structural difference is measured by the weighted minimum edit distance, and the semantic difference is measured by the average semantic difference in all replacement operations. The two form a two-layer vector, which is output as the sequence difference vector between the current path and the candidate path.

[0055] The present invention introduces access semantic vector calculation based on structural matching, which can effectively avoid collaboration misjudgments caused by interface call differences, thereby improving the accuracy of behavioral collaboration.

[0056] c. Screen the behavioral paths whose sequence difference vector is less than the path synergy threshold to form a preliminary synergy set.

[0057] Among them, when the structural difference and semantic difference corresponding to a certain behavior path are both lower than the path synergy threshold, the path is judged as a candidate path with behavioral synergy and added to the preliminary synergy set.

[0058] The path collaboration threshold is calculated by weighting three indicators: comprehensive behavior density, fingerprint credibility, and access context stability.

[0059] The formation of the preliminary collaborative set ensures that only behavioral sequences that are highly consistent with the current path in both structure and semantics are retained, and noise samples are eliminated.

[0060] d. Based on all behavioral paths in the preliminary collaborative set, the behavioral response patterns and operation type distributions on each access node are counted to construct a node-level consensus vector set.

[0061] The response mode includes multiple dimensions such as response delay distribution, feedback status category, and resource interaction density; the operation type includes system standard behavior labels such as reading, writing, calling, and confirming.

[0062] In the process of constructing the consensus vector, the access nodes at the same structural position in all collaborative paths are clustered and classified, and a set of operation parameters with the highest frequency and the largest weight on the node are extracted to form the corresponding consensus feature vector, which can represent the typical behavior of the access node among trusted collaborative users.

[0063] e. Align and screen the node-level consensus vector set and the corresponding nodes of the current behavior path to generate a behavioral collaboration evidence set.

[0064] Specifically, for each node triple in the node-level consensus vector set, the frequency distribution of its occurrence in the consensus vector is retrieved, and the corresponding structural position sequence is recorded. The position index of the node to be compared in the current path is matched with the structural position of the same triple in the consensus vector set. If the current node structural position is in the high-frequency position segment of the consensus vector, and the characteristics of the previous and next node triplets are consistent with those of the adjacent nodes in the consensus vector, then the corresponding node is determined to meet the structural alignment conditions.

[0065] The screening strategy is executed based on structural alignment conditions, retaining nodes that meet both positional consistency and adjacency feature consistency, while excluding low-quality matching nodes that only match behavioral triples but have inconsistent context structures. Finally, the set of nodes that pass the screening is output as collaborative evidence nodes, and a behavioral collaborative evidence set is constructed based on node occurrence frequency and contextual collaboration strength.

[0066] The behavioral collaboration evidence set refers to the set of all nodes in the current behavioral path that form a consistent structure and behavioral semantic commonality with the consensus nodes in other trusted user paths. It has a clear behavioral consistency label and a trusted collaborative background source, and can be used for subsequent anomaly judgment and path correction strategy triggering.

[0067] In summary, the present invention not only completes the structured record of the current behavior path, but also synchronously aggregates the highly similar user behavior paths in the same trusted time period, forming a high-density, highly consistent collaborative behavior evidence set with structural alignment, behavioral semantic consistency, and collaborative source traceability.

[0068] S3: Build a response chain rule set to jointly compare the current behavior path, the user's trusted behavior interval index table, and the collaborative evidence set to determine whether it is an abnormal access. If it is abnormal, the response chain rule is triggered.

[0069] Among them, the response chain rule set includes freezing, demotion and fallback, and path correction.

[0070] In the embodiment of the present invention, the response chain rule set first processes each node in the behavior path in sequence and serves as a basic analysis unit for determining the behavior deviation.

[0071] Preferably, each node in the current behavior path is jointly matched with the time period fingerprint vector set covered by the user's trusted behavior interval index table and the node consensus features in the collaborative evidence set, and the matching type and matching degree of each node are recorded, and a corresponding behavior deviation label list is constructed.

[0072] The joint matching process includes the following steps:

[0073] S3.1: For each node in the current behavior path, extract the triples and the behavior features of the context nodes in the behavior path.

[0074] To maintain the continuity of the path context structure, we also need to simultaneously extract the triples of the two visited nodes before and after the current node as the contextual behavior features of the corresponding nodes. The combination of the triple ontology and the context sequence can be used for structural consistency identification and semantic environment analysis in the subsequent comparison stage.

[0075] S3.2: Based on the triples and structural positions, in the set of time period fingerprint vectors covered by the user trusted behavior interval index table, select behavior segments whose triples are completely consistent and whose context node triples match the adjacent nodes of the current path node, and mark them as trusted path matches.

[0076] In an embodiment of the present invention, the comparison process compares the node triples with the behavior triples recorded in the fingerprint vector one by one, and further checks whether the previous and next adjacent behaviors of the node in the context exist simultaneously in the structural paragraph of the corresponding fingerprint vector; when the triple bodies are completely consistent and the order of the context nodes remains relatively consistent with the fingerprint structure, the corresponding node is recorded as a trusted path match.

[0077] This operation ensures that the comparison is not limited to single-point behavior, but rather places the node in the original behavior path for examination, effectively filtering out false matches and improving the accuracy of trusted label generation.

[0078] S3.3: In the node-level consensus vector of the collaborative evidence set, extract the behavior frequency distribution value that matches the current node triplet, determine whether the node is in the consensus behavior segment with a frequency higher than the set frequency threshold, and mark it as a collaborative support node or a collaborative missing node respectively.

[0079] If the behavior frequency of the node is higher than the frequency threshold, it is judged as a collaborative support node; if it is lower than the frequency threshold, it is marked as a collaborative missing node. The above judgment logic is based on consensus frequency rather than a single matching number, which enhances the robustness of the collaborative structure in behavioral consistency evaluation.

[0080] S3.4: If the current node satisfies both the trusted path matching item and the collaborative support node, a strong consistency of the joint matching state label of the node is established; if only one of them is met, it is marked as a partial match; if neither of them is met, it is marked as an abnormal deviation.

[0081] When the cumulative number of abnormal deviation nodes in a behavior path exceeds the preset tolerance threshold, the current behavior path will be judged as an abnormal access. At this time, the corresponding action strategy will be selected from the response chain rule set, including temporarily freezing subsequent node requests, rolling back the current path weight to the previous trusted path segment, or triggering path correction to replace the abnormal path segment.

[0082] S4: When path correction is triggered, the structure fragments in the path correction template library are called to reorganize the behavior path and replace the current path segment; the reconstructed behavior path is rebound to the original behavior time period index.

[0083] S4.1: Search the path correction template library for candidate template fragments that are compatible with the corresponding segment triple sequence structure.

[0084] Among them, the judgment criteria for structural compatibility include three dimensions: consistency of node triple content, relative stability of node order, and degree of matching of context boundary nodes. Only when the template fragment reaches the set threshold standards in all three dimensions will it be included in the candidate set.

[0085] S4.2: Prioritize the template segment corresponding to the existing behavior period fingerprint vector in the user's trusted behavior interval index table to replace the correction segment in the original behavior path.

[0086] In an embodiment of the present invention, after obtaining a set of candidate template segments, the behavior period fingerprint vectors recorded in the user's trusted behavior interval index table are used as a screening basis, and template segments that have appeared in the user's historical behavior and are marked as trusted fingerprints are preferentially selected from the candidate templates.

[0087] The present invention's optimization process ensures that the inserted new path segments have historical behavioral support, which not only enhances the credibility of path reorganization but also significantly reduces the probability of the new path being misjudged as abnormal. If there are multiple template segments in the candidate set that meet this condition, then based on the degree of similarity between the node behavior contained in each template segment and the original path structure, priority is given to determining whether the behavior sequence covers the high-frequency position segments in the original trusted path structure, that is, node segments that appear repeatedly in similar positions in multiple historical behavior sequences. If there are multiple candidate segments with similar coverage capabilities, further comparison is made to determine whether the operation types are concentrated in key business processes, and the segment that meets the above criteria is preferentially selected as the final replacement segment.

[0088] Insert the selected template fragment into the correction section of the original behavior path to form a new behavior path structure.

[0089] The insertion operation adheres to the linear structure of path nodes, maintains logical continuity between contextual behavior nodes, and verifies the access order integrity and node semantic consistency of the inserted path. If a path is broken, a node is duplicated, or a response logic conflict occurs after insertion, the current template fragment is abandoned and the next alternative fragment is retried to ensure semantic continuity and structural consistency after the splicing, avoiding path execution anomalies caused by template replacement.

[0090] S4.3: Splice the replaced behavior path with the uncorrected segment in the original behavior path, and adjust the index relationship with the corresponding time period in the user trusted behavior interval index table based on the spliced ​​behavior sequence.

[0091] Furthermore, adjusting the index relationship of the corresponding time period in the user trusted behavior interval index table includes the following two steps:

[0092] First, according to the actual arrangement order of the spliced ​​nodes, the original bound behavior period index range in the user trusted behavior interval index table is retrieved in sequence, and the behavior period index identifier that is consistent with the behavior triplet of the replacement node is updated.

[0093] Specifically, this method retrieves the behavior time range corresponding to each node in the previous user's trusted behavior interval index table based on the actual order of the nodes in the new path. It then sequentially updates the behavior time range identifiers that match the current node triples, ensuring that the index table maintains a consistent mapping relationship with the latest behavior structure. This method not only fixes the incorrect binding associated with the anomalous path segment in the original index but also provides a consistent data foundation for subsequent path verification and behavior trend analysis.

[0094] Finally, if there are previously unbound nodes in the spliced ​​segment, the behavior time period fingerprint vector of the adjacent time period is used as a reference to expand the behavior time period range of the corresponding user in the user trusted behavior interval index table.

[0095] In an embodiment of the present invention, if a behavior node that has not been previously bound in the user's trusted behavior interval index table appears in the path splicing segment, the time period expansion mechanism will be entered. For these new nodes, according to their context position in the splicing path, the behavior time period fingerprint vectors bound to the previous and next nodes of the node are selected as a reference to infer the time period to which the new node may belong, and the new node behavior triplet is appended to the index range of the adjacent time period to achieve dynamic expansion of the behavior time period.

[0096] It should be noted that in the response chain rule set of the present invention, the three strategies are adapted and selected step by step according to the matching result type of each node in the behavior deviation label list. Path correction only operates on path segments with continuous "abnormal deviation" labels. The response methods for other types of nodes are executed by freezing and rolling back. These two methods do not fall into the scope of path structure reorganization and are therefore not included in the scope of the S4 path correction step.

[0097] It should be noted that traditional indexing mechanisms are mostly static binding and lack the ability to adapt to new structural behaviors. The present invention uses an adjacent time period inference strategy to achieve automatic update of the index table after the path structure changes, thereby improving the ability to handle dynamic behavior sequences.

[0098] Through these operations, the present invention not only achieves structural replacement of abnormal path segments but also rebinds paths and fingerprints at the index data layer, providing highly consistent data support for subsequent behavioral analysis and risk perception. This process balances path structure rationality with historical behavioral consistency, establishing an evolvable behavioral path control mechanism.

[0099] Further, such as Figure 2 As shown, this embodiment also provides a zero-trust security data processing system, including: a fingerprint extraction module 100, which is used to divide the user's historical access behavior records into multiple behavior time intervals, extract the behavior fingerprint feature sequence within each behavior time interval, and construct a behavior time interval fingerprint vector, which is mapped to a user trusted behavior interval index table;

[0100] The path aggregation module 200 is used to construct a behavior path sequence in the current session based on the order of access requests; synchronously aggregate the behavior records of other users in the same trust interval as the user to form a behavior collaborative evidence set;

[0101] The anomaly detection module 300 is used to construct a response chain rule set, jointly compare the current behavior path, the user trusted behavior interval index table and the collaborative evidence set, and determine whether it is an abnormal access. If it is abnormal, the response chain rule is triggered;

[0102] The path correction module 400 is used to call the structure fragments in the path correction template library when path correction is triggered, reorganize the behavior path, and replace the current path segment; the reconstructed behavior path is re-bound to the original behavior time period index.

[0103] This embodiment also provides a computer device suitable for the zero-trust security data processing method, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the zero-trust security data processing method proposed in the above embodiment.

[0104] The computer device may be a terminal, comprising a processor, memory, a communication interface, a display, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system and computer programs. The internal memory provides an environment for the operating system and computer programs stored in the non-volatile storage media. The communication interface of the computer device is used to communicate with external terminals via wired or wireless communication. Wireless communication may be achieved via Wi-Fi, a carrier network, NFC (near-field communication), or other technologies. The display of the computer device may be a liquid crystal display or an electronic ink display. The input device may be a touchscreen overlay on the display, buttons, a trackball, or a touchpad on the computer device housing, or an external keyboard, touchpad, or mouse.

[0105] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the zero-trust security data processing method proposed in the above embodiment.

[0106] In summary, the present invention processes the user's historical access behavior into time periods, extracts behavioral fingerprint features to form a vector representation, and establishes a user's trusted behavior interval index table, which can achieve long-term modeling of individual behavioral characteristics and fine division of trusted segments, significantly improving the ability to identify behavioral evolution trends; in terms of real-time protection, through the dynamic construction of access request paths and collaborative comparison with other user behaviors in the same interval, it can fully utilize group behavioral consensus and form a multi-source, multi-dimensional behavioral judgment basis, thereby enhancing the accuracy and robustness of risk detection. The present invention realizes the automatic identification and processing of abnormal behavior by constructing a response chain rule set, effectively avoiding the drawbacks of excessive blocking or false positives in traditional strategies.

[0107] In summary, the present invention realizes a more sophisticated, intelligent and recoverable zero-trust security behavior processing process through multi-stage dynamic analysis and intelligent response path design, which has extremely high engineering application value and security protection potential.

[0108] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A zero-trust secure data processing method, characterized by: include: Divide the user's historical access behavior records into multiple behavior time intervals, extract the behavior fingerprint feature sequence within each behavior time interval, and construct a behavior time interval fingerprint vector, which is mapped to the user's trusted behavior interval index table; In the current session, the behavior path sequence is constructed based on the order of access requests; the behavior records of other users in the same trust interval as the user are synchronously aggregated to form a behavioral collaborative evidence set; Build a response chain rule set to jointly compare the current behavior path, the user's trusted behavior interval index table, and the collaborative evidence set to determine whether it is an abnormal access. If it is abnormal, the response chain rule is triggered; When path correction is triggered, the structure fragment in the path correction template library is called to reorganize the behavior path and replace the current path segment; the reconstructed behavior path is rebound to the original behavior time period index; The response chain rule set includes freezing, demotion and fallback, and path correction; The response chain rule set first processes each node in the behavior path in sequence and uses it as the basic analysis unit for determining behavioral deviations. Each node in the current behavior path is matched with the time period fingerprint vector set covered by the user's trusted behavior interval index table and the node consensus features in the collaborative evidence set. The matching type and matching degree of each node are recorded, and a corresponding behavior deviation label list is constructed. When the accumulated abnormal deviation nodes in the behavior path exceed the preset tolerance threshold, the current behavior path will be judged as abnormal access, and the corresponding operation strategy will be selected from the response chain rule set, including temporarily freezing subsequent node requests, rolling back the current path weight to the previous trusted path segment, or triggering path correction to structurally replace the abnormal path segment.

2. The zero-trust secure data processing method according to claim 1, wherein: The behavior time periods are divided according to natural day cycles and business operation windows.

3. The zero-trust secure data processing method according to claim 2, wherein: The construction of the behavior period fingerprint vector includes: In each behavior time interval, extract a triple sequence consisting of user operation type, resource access level, and trigger mechanism; For each triple sequence, record the number of recurrences and the order of the first occurrence within the current behavior period to form a combined feature of frequency and temporal position; Align the combined features with the preset behavior attention weights, and generate behavior priority indicators based on the importance of the behavior and its leading degree in the behavior period; Based on the behavior priority index, unified coding processing is performed according to the distribution position of the triple sequence to form the behavior period fingerprint vector.

4. The zero-trust secure data processing method according to claim 3, wherein: The mapping of the user trusted behavior interval index table includes: The archived historical behavior fingerprint library is called to compare the similarity of each behavior period fingerprint vector with the period fingerprint vector in the historical behavior fingerprint library. If it is not less than the preset credibility threshold, the corresponding behavior period index set is output to form the user's trusted behavior interval index table.

5. The zero-trust secure data processing method according to claim 1, wherein: The generation of the behavioral coordination evidence set includes: Using the current user's behavior path sequence as a reference, within the behavior period corresponding to the user's trusted behavior interval index table, retrieve the set of users in the same behavior period interval and extract the user behavior path set; For each behavior path in the user behavior path set, construct a sequence difference vector between it and the current behavior path; Screen the behavioral paths that satisfy the sequence difference vector less than the path synergy threshold to form a preliminary synergy set; Based on all the behavior paths in the preliminary collaborative set, the behavioral response patterns and operation type distributions on each access node are counted to construct a node-level consensus vector set; Based on the node-level consensus vector set and the corresponding nodes of the current behavior path, alignment screening is performed to generate a behavioral collaboration evidence set.

6. The zero-trust secure data processing method according to claim 1, wherein: The joint matching includes: For each node in the current behavior path, extract the triples and the behavior features of the context nodes in the behavior path; Based on the triples and structural positions, in the time period fingerprint vector set covered by the user trusted behavior interval index table, behavior segments with completely consistent triples and whose context node triples match the adjacent nodes of the current path node are screened and marked as trusted path matches; In the node-level consensus vector of the collaborative evidence set, the behavior frequency distribution value matching the current node triple is extracted to determine whether the node is in the consensus behavior segment with a frequency higher than the set frequency threshold, and the nodes are marked as collaborative support nodes or collaborative missing nodes respectively; If the current node satisfies both the trusted path matching item and the collaborative support node, a strong consistency of the joint matching state label of the node is established; if only one of them is met, it is marked as a partial match; if neither of them is met, it is marked as an abnormal deviation.

7. The zero-trust secure data processing method according to claim 1, wherein: The behavior path reorganization includes: Retrieve candidate template fragments in the path correction template library that are compatible with the triple sequence structure of the corresponding segment; Prioritize the template segment corresponding to the existing behavior time period fingerprint vector in the user's trusted behavior interval index table to replace the correction segment in the original behavior path; The replaced behavior path is spliced ​​with the uncorrected segment in the original behavior path, and the index relationship with the corresponding time period in the user's trusted behavior interval index table is adjusted according to the spliced ​​behavior sequence.

8. The zero-trust secure data processing method according to claim 7, wherein: The index relationship between the adjustment and the corresponding time period in the user trusted behavior interval index table includes: According to the actual arrangement order of the spliced ​​nodes, the original bound behavior time period index range in the user trusted behavior interval index table is retrieved in sequence, and the behavior time period index identifier that is consistent with the behavior triple of the replacement node is updated; If there are previously unbound nodes in the spliced ​​segment, the behavior time period fingerprint vector of the adjacent time period is used as a reference to expand the behavior time period range of the corresponding user in the user trusted behavior interval index table.

9. A zero-trust secure data processing system, based on the zero-trust secure data processing method according to any one of claims 1 to 8, characterized in that: Also includes: Fingerprint extraction module, which is used to divide the user's historical access behavior records into multiple behavior time intervals, extract the behavior fingerprint feature sequence within each behavior time interval, and construct the behavior time interval fingerprint vector, mapping it to the user's trusted behavior interval index table; The path aggregation module is used to construct a behavioral path sequence in the current session based on the order of access requests; it also synchronously aggregates the behavioral records of other users in the same trust interval as the user to form a behavioral collaborative evidence set; The anomaly detection module is used to build a response chain rule set, jointly compare the current behavior path, the user's trusted behavior interval index table, and the collaborative evidence set to determine whether it is an abnormal access. If it is abnormal, the response chain rule is triggered; The path correction module is used to call the structure fragments in the path correction template library when path correction is triggered, reorganize the behavior path, and replace the current path segment; the reconstructed behavior path is re-bound to the original behavior time period index; The response chain rule set includes freezing, demotion and fallback, and path correction; The response chain rule set first processes each node in the behavior path in sequence and uses it as the basic analysis unit for determining behavioral deviations. Each node in the current behavior path is matched with the time period fingerprint vector set covered by the user's trusted behavior interval index table and the node consensus features in the collaborative evidence set. The matching type and matching degree of each node are recorded, and a corresponding behavior deviation label list is constructed. When the accumulated abnormal deviation nodes in the behavior path exceed the preset tolerance threshold, the current behavior path will be judged as abnormal access, and the corresponding operation strategy will be selected from the response chain rule set, including temporarily freezing subsequent node requests, rolling back the current path weight to the previous trusted path segment, or triggering path correction to structurally replace the abnormal path segment.

Images