Node access control method, device, computer equipment and storage medium

Abstract

The present application discloses a node access control method, apparatus, computer device, and storage medium. The method includes: obtaining a network access log, and determining access requests and access request results between multiple nodes and different nodes based on the network access log; constructing an access control graph based on the multiple nodes and access requests, and inputting the access control graph into a trained access control model to output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes; generating access request result features between different nodes based on the access control results and access request results; constructing a target-optimized binary decision tree corresponding to the multiple nodes based on the access request result features; and generating access control rules for access requests between different nodes based on the target-optimized binary decision tree, wherein the access control rules are used to control access rights of access requests between different nodes.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a node access control method, apparatus, computer equipment, and storage medium. Background Art

[0002] The rise of emerging technologies such as edge computing, microservices, and programmable networks is driving the rapid development of digital infrastructure towards openness, elasticity, reliability, and scalability. The number of distributed cloud applications, such as large-scale model training, real-time inference, high-quality streaming services, and big data storage and mining, continues to increase. East-west communication between application instances has become the primary workload in cloud networks.

[0003] In the process of accessing between different nodes, it is necessary to control the access behavior of the nodes. In related technologies, access control for nodes is mainly implemented by static access control lists, role-based predefined rules, etc. However, these solutions have problems such as low efficiency of static rules and insufficient adaptability to dynamic environmental changes. For example, the static access control list solution needs to traverse and match a large number of rules, which has high time complexity and is difficult to cope with large-scale traffic requests in scenarios such as large model training, autonomous driving, and computing power scheduling. For another example, the reasoning ability for unknown access behavior is insufficient. Traditional closed access control methods mostly rely on predefined access control rules, lack the ability to learn and reason about dynamic topology and access behavior patterns, and are difficult to cope with the data sparsity challenges brought about by low-frequency covert attacks.

[0004] Therefore, there are technical problems in the related art of low flexibility and low accuracy in node access control. Summary of the Invention

[0005] The embodiments of the present application provide a node access control method, apparatus, computer equipment, and storage medium, which can achieve accurate and efficient control of access between different nodes.

[0006] To achieve the above objectives, an embodiment of the present application provides a node access control method, including:

[0007] Obtaining a network access log, and determining access requests and access request results between multiple nodes and different nodes based on the network access log;

[0008] constructing an access control graph according to the multiple nodes and the access requests, inputting the access control graph into a trained access control model, and outputting access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to the multiple sample nodes;

[0009] generating access request result features between different nodes according to the access control result and the access request result;

[0010] Constructing a target optimized binary decision tree corresponding to a plurality of nodes according to the access request result characteristics;

[0011] An access control rule for access requests between different nodes is generated according to the target optimized binary decision tree, and the access control rule is used to control access rights of access requests between different nodes.

[0012] To achieve the above objectives, an embodiment of the present application provides a node access control device, including:

[0013] An acquisition module, configured to acquire network access logs and determine access requests and access request results between multiple nodes and different nodes based on the network access logs;

[0014] an input module, configured to construct an access control graph based on the multiple nodes and the access request, input the access control graph into a trained access control model, and output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes;

[0015] A generating module, configured to generate access request result features between different nodes according to the access control result and the access request result;

[0016] A construction module, configured to construct a target optimized binary decision tree corresponding to a plurality of nodes according to the access request result characteristics;

[0017] A rule module is used to generate access control rules for access requests between different nodes based on the target optimized binary decision tree, wherein the access control rules are used to control access rights of access requests between different nodes.

[0018] In some embodiments, the trained access control model includes a trained node embedding sub-model, a trained edge embedding sub-model, and a trained decision sub-model; and the input module is configured to:

[0019] Input the access control graph into the trained node embedding sub-model, and output the corresponding node embedding features after aggregating the neighboring nodes of each node;

[0020] Inputting the access control graph into the trained edge embedding sub-model, and outputting the edge embedding features corresponding to the aggregation of neighbor edges of two different nodes;

[0021] generating corresponding joint access request features between different nodes according to the node embedding features, the edge embedding features and the access request;

[0022] The joint access request feature is input into the trained decision sub-model to output the access control results between different nodes.

[0023] In some embodiments, a generating module is configured to:

[0024] Determine a first weight value corresponding to the access control result and a second weight value corresponding to the access request result;

[0025] Multiplying the first weight value by the access control result to obtain a first processing result;

[0026] Multiplying the second weight value by the access request result to obtain a second processing result;

[0027] The first processing result and the second processing result are added together to obtain access request result features between different nodes.

[0028] In some embodiments, a building block is provided for:

[0029] Determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set;

[0030] Dividing the remaining access request result features in the access request result feature set except the root target node according to the division threshold to obtain two different sub-access request result feature sets;

[0031] Determine a target node in each sub-access request result feature set, and determine a partitioning threshold corresponding to each sub-access request result feature set;

[0032] Dividing the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set to obtain two different updated sub-access request result feature sets;

[0033] Return to execute to determine the target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet the preset division condition, stop dividing the updated each sub-access request result feature set, and obtain the target optimized binary decision tree corresponding to multiple nodes.

[0034] In some embodiments, a building block is provided for:

[0035] Obtaining multiple to-be-selected segmentation thresholds corresponding to the access request result feature set;

[0036] Determine a Gini coefficient corresponding to each sub-access request result feature set after each to-be-selected partitioning threshold is used to partition the remaining access request result features in the access request result feature set;

[0037] Determining a comprehensive Gini coefficient corresponding to each to-be-selected partitioning threshold based on the Gini coefficient corresponding to each to-be-selected partitioning threshold, the number of features corresponding to each sub-access request result feature set, and the number of features corresponding to the access request result feature set;

[0038] The to-be-selected partitioning threshold with the smallest comprehensive Gini coefficient is determined as the partitioning threshold corresponding to the access request result feature set.

[0039] In some embodiments, a building block is provided for:

[0040] Determine a plurality of candidate root target nodes from an access request result feature set corresponding to access request result features between different nodes;

[0041] Determine the first Gini coefficient corresponding to each sub-access request result feature set corresponding to the next level of each candidate root target node;

[0042] Determine a first comprehensive Gini coefficient corresponding to each candidate root target node according to the first Gini coefficient;

[0043] determining a second Gini coefficient corresponding to the access request result feature set according to the number of features corresponding to each sub-access request result feature set;

[0044] The first comprehensive Gini coefficient is subtracted from the second Gini coefficient to obtain a Gini gain value corresponding to each candidate root target node, and the candidate root target node with the largest Gini gain value is determined as the root target node.

[0045] In some embodiments, a building block is provided for:

[0046] Determining the level corresponding to each updated sub-access request result feature set, the number of features in the sub-access request result feature set, the target Gini coefficient and the second comprehensive Gini coefficient;

[0047] When the level is greater than the preset level, or the number of features in the sub-access request result feature set is less than the preset number, or the target Gini coefficient is less than the preset Gini coefficient value, or the second comprehensive Gini coefficient is less than the preset comprehensive Gini coefficient value, it is determined that each of the updated sub-access request result feature sets meets the preset partitioning condition, and the partitioning of each of the updated sub-access request result feature sets is stopped to obtain a target optimized binary decision tree corresponding to multiple nodes.

[0048] In some embodiments, the node access control device further includes a training module for:

[0049] Before inputting the access control graph into the trained access control model and outputting access control results between different nodes, obtaining multiple sample nodes and node access requests and label access results between different sample nodes;

[0050] Constructing a sample access control graph according to the plurality of sample nodes and the node access requests;

[0051] Inputting the sample access control graph into the access control model, and outputting predicted access control results between different sample nodes;

[0052] Determine the corresponding loss value between the label access result and the predicted access control result. When the loss value is not less than the preset loss value, update the access control model and return to execute the input of the sample access control graph into the updated access control model until the loss value is less than the preset loss value to obtain the trained access control model.

[0053] In some embodiments, a training module is used to:

[0054] Determine the label vector corresponding to each predicted access control result;

[0055] Classifying the plurality of predicted access control results according to the label vector to obtain a first classification set and a second classification set;

[0056] determining a target weight coefficient according to the number of first elements in the first classification set and the number of second elements in the second classification set;

[0057] Inputting the sample access control graph into the node embedding sub-model included in the access control model, and outputting the sample node embedding features corresponding to the aggregation of the neighboring sample nodes of each sample node;

[0058] A corresponding loss value between the label access result and the predicted access control result is determined according to the target weight coefficient and the sample node embedding feature.

[0059] In some embodiments, the rules module is configured to:

[0060] Optimizing the binary decision tree according to the target to determine the class label, mask label and value corresponding to each target node;

[0061] Generate a rule entry corresponding to each target node according to the class label, mask label and value corresponding to each target node;

[0062] Access control rules for access requests between different nodes are generated according to the rule entries corresponding to each target node.

[0063] In some embodiments, the node access control includes a control module configured to:

[0064] After generating access control rules between different nodes according to the rule entries corresponding to each target node, when a target access request is received, determining a mask tag corresponding to the target access request;

[0065] Matching the mask tag with the access control rule to obtain a matching result;

[0066] When the matching result indicates that the class label corresponding to the target access request is an accessible category, allowing the target access request to be sent to the target access network node;

[0067] When the matching result indicates that the class label corresponding to the target access request is an inaccessible category, the target access request is refused to be sent to the target access network node.

[0068] In order to achieve the above-mentioned purpose, an embodiment of the present application provides a computer-readable storage medium on the one hand, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the node access control method provided by the embodiment of the present application.

[0069] In order to achieve the above-mentioned objectives, an embodiment of the present application provides a computer device on the one hand, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and when the processor executes the computer program, the node access control method provided in the embodiment of the present application is implemented.

[0070] In an embodiment of the present application, a network access log is obtained, and access requests and access request results between multiple nodes and different nodes are determined based on the network access log; an access control graph is constructed based on the multiple nodes and the access requests, and the access control graph is input into a trained access control model to output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes; access request result features between different nodes are generated based on the access control results and the access request results; a target optimized binary decision tree corresponding to multiple nodes is constructed based on the access request result features; access control rules for access requests between different nodes are generated based on the target optimized binary decision tree, and the access control rules are used to control access rights for access requests between different nodes.

[0071] In this way, by constructing an access control graph that includes multiple nodes and access requests between multiple nodes, and then inputting the access control graph into the trained access control model, the access control results between different nodes are output, where the access control results can describe whether different nodes are accessible. Then, based on the access control results and the access request results, the access request result features between different nodes are generated. In this way, the original access request results of multiple nodes and the access control results output by the trained access control model are integrated to maximize the access relationship between nodes. Then, based on the access request result features, a target optimized binary decision tree corresponding to multiple nodes is constructed, thereby achieving knowledge learning of the trained access control model. Finally, based on the target optimized binary decision tree, access control rules for access requests between different nodes are generated. The access control rules are used to control the access rights of access requests between different nodes. When a node is subsequently accessed, the access control rules can be used to determine whether the node can access the corresponding other nodes. Compared with the static rules set by humans in the related art, the present application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, thereby achieving accurate and efficient control of access between different nodes.

[0072] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be achieved and obtained through the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0074] Figure 1 This is a schematic diagram of the system framework corresponding to the node access control method provided in an embodiment of the present application;

[0075] Figure 2 This is a schematic diagram of a scenario of a node access control method provided by an embodiment of the present application;

[0076] Figure 3 This is a flowchart of a node access control method provided by an embodiment of the present application;

[0077] Figure 4 Schematic diagram of the structure of the access control model after training provided in the embodiment of the present application;

[0078] Figure 5 is a schematic diagram of an access control graph provided by an embodiment of the present application;

[0079] Figure 6 This is a schematic diagram of node aggregation provided by an embodiment of the present application;

[0080] Figure 7 is a schematic diagram of edge aggregation provided by an embodiment of the present application;

[0081] Figure 8 This is a flow chart of the steps included in step 240 provided in an embodiment of the present application;

[0082] Figure 9 This is a schematic diagram of the training process of the access control model provided in the embodiment of the present application;

[0083] Figure 10 This is another flowchart of the node access control method provided by an embodiment of the present application;

[0084] Figure 11 This is a schematic diagram of the structure of the node access control device provided in an embodiment of the present application;

[0085] Figure 12 It is a structural diagram of the computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0086] In order to enable those skilled in the art to better understand the solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0087] It should be noted that in each specific embodiment of the present application, when it comes to the relevant processing of network log data and node access control data, the user's permission or consent will be obtained first, and the collection, use and processing of such data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After the user's separate permission or consent is clearly obtained, the necessary user-related data for the normal operation of the embodiments of the present application will be obtained.

[0088] Some processes described in the specification, claims, and figures include multiple steps that appear in a specific order. However, it should be understood that these steps may be performed in a different order or in parallel. Step numbers are used solely to distinguish between different steps and do not inherently indicate any order of execution. Furthermore, terms such as "first," "second," or "target" are used to distinguish similar objects and are not necessarily intended to describe a specific order or precedence.

[0089] The embodiments of the present application provide a node access control method, device, computer equipment and storage medium. Specifically, the embodiments of the present application will be described from the dimension of the node access control device, and the node access control device can be specifically integrated in a computer device, and the computer device can be a server, or a terminal and other devices. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Among them, the terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, smart home appliance, car terminal, intelligent voice interaction device, aircraft, etc., but is not limited to this.

[0090] Before further explaining the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations:

[0091] Access Control Graph (ACG): An access control graph (ACG) is a graphical model used to describe the access rights of subjects to objects in a system. It is a visualization tool for access control models. It uses nodes and edges in graph theory to visually represent subjects, objects, and the relationships between them. It is commonly used in fields such as computer system security, operating system design, and database management to assist in the analysis and design of access control policies.

[0092] Optimized Binary Decision Tree (OBDT): An Optimized Binary Decision Tree (OBDT) is a type of decision tree model that improves traditional binary decision trees (such as ID3, C4.5, and CART) by introducing optimization algorithms or strategies to improve the tree structure, feature selection, and pruning rules, thereby enhancing model performance (such as classification / regression accuracy, generalization, and computational efficiency). Its core goal is to construct a more compact, efficient, and robust tree structure through optimization, addressing issues such as overfitting, feature selection limitations, and high computational complexity that may exist with traditional decision trees.

[0093] Feature binarization: A data preprocessing technique that converts continuous or discrete feature values ​​into binary values ​​(usually 0 or 1). This conversion simplifies data representation and is particularly suitable for algorithms that require Boolean input (such as logistic regression and support vector machines) or scenarios that emphasize feature existence rather than numerical value.

[0094] Multi-Layer Perceptron (MLP): As a classic feedforward neural network, the performance and applicability of the MLP can be assessed across multiple dimensions. The following analysis examines model capabilities, application scenario suitability, strengths and weaknesses, and areas for improvement, with an overall score (based on a 10-point scale, with higher scores indicating superior performance).

[0095] Weighted Binary Cross-Entropy Loss: It is an extension of the standard binary cross-entropy and solves the class imbalance problem by assigning weights to different classes or samples.

[0096] Knowledge Distillation (KD): Knowledge distillation is a model compression and optimization technique that transfers the "knowledge" of a complex, high-performance model (the teacher model) to a lightweight model (the student model). This significantly reduces the number of parameters and computational cost of the student model while preserving the generalization capabilities of the teacher model. This technology is widely used in scenarios such as deep learning model deployment (on mobile devices and embedded devices) and accelerated inference.

[0097] Gini Coefficient: The Gini coefficient is a statistical indicator that measures the balance or inequality of data distribution. In machine learning, it is used to evaluate the predictive accuracy of classification models (e.g., in decision trees and random forests, it is used to measure the purity of feature splits). The smaller the Gini coefficient, the higher the sample purity (the greater the proportion of samples of the same type).

[0098] The above is a detailed explanation of the relevant terms involved in this application. If other terms are involved later in the text, they will be explained later.

[0099] First, let’s explain the technical problems existing in related technologies:

[0100] The rise of emerging technologies such as edge computing, microservices, and programmable networks is driving the rapid development of digital infrastructure towards openness, elasticity, reliability, and scalability. The number of distributed cloud applications, such as large-scale model training, real-time inference, high-quality streaming services, and big data storage and mining, continues to increase. East-west communication between application instances has become the primary workload in cloud networks.

[0101] In the process of accessing between different nodes, it is necessary to control the access behavior of the nodes. In related technologies, access control for nodes is mainly implemented by static access control lists, role-based predefined rules, etc. However, these solutions have problems such as low efficiency of static rules and insufficient adaptability to dynamic environmental changes. For example, the static access control list solution needs to traverse and match a large number of rules, which has high time complexity and is difficult to cope with large-scale traffic requests in scenarios such as large model training, autonomous driving, and computing power scheduling. For another example, the reasoning ability for unknown access behavior is insufficient. Traditional closed access control methods mostly rely on predefined access control rules, lack the ability to learn and reason about dynamic topology and access behavior patterns, and are difficult to cope with the data sparsity challenges brought about by low-frequency covert attacks.

[0102] Therefore, there are technical problems in the related art of low flexibility and low accuracy in node access control.

[0103] In order to solve the above technical problems, the embodiments of the present application provide a node access control method, apparatus, computer equipment and storage medium. By constructing an access control graph including multiple nodes and access requests between multiple nodes, and then inputting the access control graph into the trained access control model, the access control results between different nodes are output, wherein the access control results can describe whether different nodes are accessible, and then the access request result features between different nodes are generated based on the access control results and the access request results, thereby realizing the fusion of the original access request results of multiple nodes and the access control results output by the trained access control model, so as to maximize the mining of the access relationship between the nodes, and then constructing a target optimized binary decision tree corresponding to multiple nodes based on the access request result features, thereby realizing the knowledge learning of the trained access control model, and finally generating access control rules for access requests between different nodes based on the target optimized binary decision tree, and the access control rules are used to control the access rights of access requests between different nodes. When a node is subsequently accessed, the access control rule can be used to determine whether the node can access the corresponding other nodes. Compared with the artificially set static rules in related technologies, this application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, and thus achieving accurate and efficient control of access between different nodes.

[0104] Specifically, the node access control method, apparatus, computer equipment, and storage medium provided in the embodiments of the present application will be described in detail below.

[0105] See also Figure 1 , Figure 1 Schematic diagram of the system framework corresponding to the node access control method provided in the embodiment of the present application. The node access control method provided in the embodiment of the present application can be applied to this system framework.

[0106] Please refer to the following for details: Figure 1 , Figure 1 1 is a system architecture diagram of the node access control method provided in the embodiment of the present application, which includes a terminal 140, the Internet 130, a gateway 120, a server 110, etc.

[0107] The terminal 140 or the server 110 may be a device that executes the node access control method.

[0108] Terminal 140 includes, but is not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, and the like. Embodiments of the present application can be applied to various scenarios, including, but not limited to, network security and model training. Furthermore, it can be a single device or a combination of multiple devices. For example, multiple desktop computers connected to each other via a local area network and sharing a common display for collaborative operation constitute a terminal 140. Terminal 140 can communicate with Internet 130 in a wired or wireless manner to exchange data.

[0109] Server 110 refers to a computer system that provides certain services to terminal 140. Compared to ordinary terminal 140, server 110 has higher requirements in terms of stability, security, and performance. Server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0110] Gateway 120, also known as a gateway or protocol converter, implements network interconnection at the transport layer and is a computer system or device that performs a conversion function. It acts as a translator between two systems using different communication protocols, data formats, languages, or even completely different architectures. Gateways can also provide filtering and security functions. Messages sent from terminal 140 to server 110 are sent through gateway 120 to the corresponding server 110. Messages sent from server 110 to terminal 140 are also sent through gateway 120 to the corresponding terminal 140.

[0111] The node access control method in the embodiment of the present application can be applied in a variety of scenarios, such as network security, model training, etc. The scenario to which the node access control method in the present application is applied is not limited here.

[0112] See also Figure 2 , Figure 2 This is a scenario diagram of the node access control method provided in an embodiment of the present application.

[0113] First, obtain network access logs. Network access logs include various types, such as access control logs and network flow logs. These logs provide information about access events from subjects to objects, the time of these access events, the attributes of the subjects and objects, and records related to the access requests. Network flow logs typically contain basic information about access behavior within each aggregation interval, such as the five-tuple, the number of flows, the number of ports, and the number of packets and bytes transmitted and received.

[0114] The network access log can then be parsed, with the access subject and access object as nodes, and then the access requests and access requests between different nodes can be obtained. For example, when the access subject issues an access request to the access object, the access request result is the access result of whether the node successfully accesses the corresponding node after issuing the access request.

[0115] Then, the access requests between nodes can be used as edges, and each node can be combined to construct an access control graph.

[0116] The access control graph is then input into the trained access control model, which outputs the access control results between different nodes. The trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes. The trained access control model can extract node features from different nodes in the access control graph, as well as edge features from different edges. Specifically, the trained access control model can aggregate the neighboring nodes of any node in the access control graph to obtain node embedding features, and can also aggregate the neighboring edges of any edge to obtain edge embedding features. Finally, the access control results between different nodes are calculated by combining the node embedding features, edge embedding features, and the original features corresponding to the access request results between different nodes. The access control results can be understood as whether one node can access another node, that is, the legitimacy of the node access.

[0117] Then, based on the access control results and access request results, access request result features between different nodes are generated. For example, access control results and access request results can be aggregated. The access request results contain the actual access status between different nodes, while the access control results contain the predicted access status between different nodes. By aggregating the two, the access relationships between nodes can be enriched to a certain extent, resulting in more data-rich access request result features.

[0118] Finally, a target optimized binary decision tree corresponding to multiple nodes is constructed based on the characteristics of the access request results. Access control rules for access requests between different nodes are generated based on the target optimized binary decision tree. The access control rules are used to control the access rights of access requests between different nodes.

[0119] Among them, the optimized binary decision tree can be understood as a type of decision tree model. During its construction, it can be constructed by binarizing features to achieve the construction of multiple tree nodes. The tree nodes include root nodes and leaf nodes. Each tree node has two branches, one branch for other nodes that can be accessed normally, and the other for other nodes that cannot be accessed. Similarly, after constructing the target optimized binary decision tree, the access relationship between multiple nodes is constructed, and the knowledge distillation learning of the output of the trained access control model is achieved. Finally, access control rules between different nodes are generated based on the target optimized binary decision tree. Subsequent routing devices can control access requests to different nodes based on the access control rules.

[0120] Compared with the artificially set static rules in related technologies, this application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, and thus achieving accurate and efficient control of access between different nodes.

[0121] To learn more about the node access control method provided by the embodiment of this application, please continue to refer to Figure 3 , Figure 3 : is a flowchart of a node access control method provided in an embodiment of the present application. The node access control method may include the following steps:

[0122] Step 210: Obtain network access logs, and determine access requests and access request results between multiple nodes and different nodes based on the network access logs;

[0123] Step 220: construct an access control graph based on the multiple nodes and access requests, input the access control graph into a trained access control model, and output access control results between different nodes, wherein the trained access control model is trained based on the sample access control graphs corresponding to the multiple sample nodes;

[0124] Step 230: Generate access request result features between different nodes based on the access control result and the access request result;

[0125] Step 240: construct a target optimized binary decision tree corresponding to multiple nodes according to the access request result characteristics;

[0126] Step 250: Generate access control rules for access requests between different nodes based on the target optimized binary decision tree. The access control rules are used to control access rights of access requests between different nodes.

[0127] Steps 210 to 250 will be described in detail below.

[0128] In step 210, a network access log is obtained, and access requests and access request results of multiple nodes and between different nodes are determined based on the network access log.

[0129] First, obtain network access logs. Network access logs include various types, such as access control logs and network flow logs. These logs provide information about access events from subjects to objects, the time of these access events, the attributes of the subjects and objects, and records related to the access requests. Network flow logs typically contain basic information about access behavior within each aggregation interval, such as the five-tuple, the number of flows, the number of ports, and the number of packets and bytes transmitted and received.

[0130] The network access log can then be parsed, with the access subject and access object as nodes, and then the access requests and access requests between different nodes can be obtained. For example, when the access subject issues an access request to the access object, the access request result is the access result of whether the node successfully accesses the corresponding node after issuing the access request.

[0131] An access request between different nodes can be expressed as an access request from node i to node j, that is, node i is the access subject, node j is the access object, and the access subject sends an access request to the access object.

[0132] An access dataset can be constructed through access requests and access request results between different nodes. The access dataset can be expressed as: , where D represents the access data set, It can represent the access request from node i to node j. There are m feature dimensions in total, R represents the spatial dimension, Represents the access request result from node i to node j, which can be a label vector generated by one-hot encoding. If , indicating that the access request result from node i to node j is allowed, if , indicating that the access request from node i to node j is not allowed.

[0133] In step 220, an access control graph is constructed based on multiple nodes and access requests, and the access control graph is input into a trained access control model to output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes.

[0134] Among them, each access subject and each access object determined based on the network access log can be used as a node, and the access requests between the access subject and the access object are used as edges to construct an access control graph. The access control graph is then input into the trained access control model, and the access control results between different nodes are output. The access control result is the result of whether the node is allowed to access another node. Among them, the specific training content of the trained access control model will be described later. The trained access control model is trained based on the sample access control graphs corresponding to multiple sample nodes.

[0135] See also Figure 4 , Figure 4 Schematic diagram of the structure of a trained access control model provided in an embodiment of the present application. The trained access control model includes a trained node embedding sub-model, a trained edge embedding sub-model, and a trained decision sub-model. Input data is input into the trained node embedding sub-model and the trained edge embedding sub-model, respectively. The results output by the trained node embedding sub-model and the trained edge embedding sub-model are processed and input into the trained decision sub-model, which then outputs the final result.

[0136] In some implementations, inputting the access control graph into a trained access control model and outputting access control results between different nodes includes:

[0137] (1.1) Input the access control graph into the trained node embedding sub-model and output the corresponding node embedding features after aggregating the neighboring nodes of each node;

[0138] (1.2) Input the access control graph into the trained edge embedding sub-model, and output the edge embedding features corresponding to the aggregation of neighbor edges of two different nodes;

[0139] (1.3) Generate corresponding joint access request features between different nodes based on node embedding features, edge embedding features and access requests;

[0140] (1.4) Input the joint access request features into the trained decision sub-model and output the access control results between different nodes.

[0141] The access control graph is first fed into the trained node embedding sub-model, which outputs the corresponding node embedding features after aggregating each node's neighbor nodes. The trained node embedding sub-model can aggregate each node's neighbor nodes, such as performing mean aggregation, to capture local graph structure information. This reduces the computational complexity of neighbor information aggregation and prevents nodes with a large number of neighbor nodes from dominating the access request process.

[0142] Please refer to the Figure 5 and Figure 6 , Figure 5 This is a schematic diagram of the access control graph provided in an embodiment of the present application. Figure 6 This is a schematic diagram of node aggregation provided in an embodiment of the present application.

[0143] like Figure 5 As shown, the nodes in the access control graph include V1, V2, V3, V4, V5, V6, and V7. The edges between the nodes include e1, e2, e3, e4, e5, e6, e7, e8, e9, and e10.

[0144] For example, let's use the trained node embedding sub-model to process node V4. V4's neighbor nodes mainly include V1, V3, V5, and V7. These neighbor nodes and node V4 can be aggregated to obtain the aggregated node embedding features. Similarly, the trained node embedding sub-model can perform similar processing on other nodes in the access control graph, obtaining the corresponding node embedding features after aggregating the neighbor nodes of each node.

[0145] For example, the current node is , the node corresponds to k neighbor nodes, and the formula for aggregating the current node and k neighbor nodes can be expressed as:

[0146] .in represents the node embedding feature, k is the representation of the neighbor node, i is the representation of the current node, is the substructure graph composed of the current node and neighboring nodes, Represents the embedding of the l-1 layer. In this formula, by embedding the current node and its neighboring nodes and then performing a unified linear transformation, the independent semantics of the current node and its neighboring nodes can be preserved, avoiding information dilution of each node.

[0147] The embedding process for the lth layer can be formulated as:

[0148] Where l represents the layer embedding, GeLu is the activation function, that is, the Gaussian Error Linear Unit, which can enhance the model's ability to fit nonlinear decision boundaries. represents the embedding of the i-th node in the l-th layer, is the weight matrix corresponding to the lth layer, used for linear transformation, Indicates that the splicing operation embeds itself Embedded with aggregated neighbors merge, Represents the mean aggregation of the features of the neighboring nodes of the current node, The bias term of the lth layer, For nodes The original properties of .

[0149] The access control graph is then fed into the trained edge embedding sub-model, which outputs edge embedding features corresponding to the aggregation of neighboring edges between two different nodes. The trained edge embedding sub-model can determine the contextual information corresponding to the edge based on the access control graph, then determine the neighboring edges, and then aggregate the neighboring edges to obtain the corresponding edge embedding features after aggregation.

[0150] Please also refer to Figure 7 , Figure 7 Figure 2 is a schematic diagram of edge aggregation provided by an embodiment of the present application. For example, the trained edge embedding submodel processes edge e8. Edge e8's corresponding neighbor edges are e1, e4, e7, e9, and e10. These neighbor edges and edge e8 can then be aggregated to obtain the aggregated edge embedding features.

[0151] For example, the current edge can be expressed as , the current edge has k neighbor edges, and the formula for aggregating the current edge and k neighbor edges can be expressed as:

[0152] .in, represents the edge embedding feature after aggregation, is the weight matrix corresponding to the lth layer, is the Sigmoid activation function, The bias term of the lth layer, is the output corresponding to the edge in layer l, Indicates that the concatenation operation embeds itself Embedded with aggregated neighbors merge, It is the mean aggregation of the features of the neighboring edges of the current edge.

[0153] Among them, the mean aggregation of the features of the neighboring edges of the current edge can be specifically expressed as:

[0154] .in, is the substructure graph composed of the current edge and neighbor edges, represents the corresponding edge between node q and node p, and k represents the number of neighbor edges.

[0155] After obtaining edge embedding features and node embedding features, we can generate corresponding joint access request features between different nodes based on the node embedding features, edge embedding features, and access requests. For example, we can concatenate the node embedding features, edge embedding features, and access requests to generate corresponding joint access request features between different nodes. This can be expressed as:

[0156] .in Indicates the joint access request characteristics, represents an access request from node i to node j, represents the node embedding feature corresponding to node i, represents the node embedding feature corresponding to node j, represents the edge embedding feature from node i to node j, For splicing operation.

[0157] The benefit of this approach is that it can better utilize potential graph topology information and more deeply explore access relationships between nodes. This not only preserves the corresponding prior knowledge in network access logs, but also integrates the access relationships implicit in the graph structure.

[0158] Finally, the joint access request features are input into the trained decision sub-model, which outputs the access control results between different nodes. For example, the trained decision sub-model is based on a multi-layer perceptron (MLP). The MLP uses a two-layer fully connected architecture to integrate heterogeneous features of users, resources, and access behaviors to achieve end-to-end access authorization legitimacy prediction. The joint access request features can be used as input to output the predicted access control results between different nodes. The specific calculation method is as follows:

[0159] .

[0160] in, Indicates the access control result. is a trainable parameter, softmax is the activation function, and the predicted probability vector of successful access from a node to another node can be obtained by normalizing the category score, which is the access control result between different nodes.

[0161] From the above, we can see that the advantage of doing this is that we can combine edge embedding features and node embedding features to more deeply mine the access relationship between nodes, thereby determining the legitimacy of access between different nodes.

[0162] It should be noted that the trained access control model in this application can be understood as a teacher model. It has a certain degree of complex calculations, so it cannot be deployed on some devices, or it will be subject to certain processing delays when performing node access control. Therefore, in this application, the knowledge output by the trained access control model can be distilled, that is, the predicted access control results can be distilled.

[0163] The training process of the trained access control model in this application will be described later.

[0164] In step 230, access request result features between different nodes are generated according to the access control result and the access request result.

[0165] Access control results and access request results can be fused to generate access request result features between different nodes. Access request results are predictive and incorporate the knowledge output by the trained access control model. Access request results are based on real network access logs. Combining these two yields a more comprehensive representation of accessibility between different nodes.

[0166] In some embodiments, generating access request result features between different nodes based on the access control result and the access request result includes:

[0167] (1.1) Determining a first weight value corresponding to the access control result and a second weight value corresponding to the access request result;

[0168] (1.2) Multiplying the first weight value by the access control result to obtain a first processing result;

[0169] (1.3) Multiplying the second weight value by the access request result to obtain a second processing result;

[0170] (1.4) The first processing result and the second processing result are added together to obtain access request result features between different nodes.

[0171] The access control result can be used as a soft label, and the access request result as a hard label. The fusion of the access control and access request results is weighted. A first weight value corresponding to the access control result and a second weight value corresponding to the access request result can be determined. The first weight value can be understood as controlling the strength of knowledge distillation.

[0172] Then, the first weight value is multiplied by the access control result to obtain the first processing result, and the second weight value is multiplied by the access request result to obtain the second processing result. Finally, the first processing result and the second processing result are added together to obtain the access request result characteristics between different nodes. Specifically, it can be expressed as:

[0173] .in, Represents the result characteristics of the access request between node i and node j, represents the first weight value, , represents the second weight value, Indicates the access control result. Indicates the result of an access request.

[0174] A new access dataset can be generated based on the access request result characteristics between different nodes, which can be expressed as follows: .in, Represents a new access dataset, represents an access request from node i to node j, Represents the characteristics of the access request result between node i and node j.

[0175] This new access dataset can be understood as a training dataset for subsequent student models to perform distillation learning.

[0176] As can be seen from the above, the benefit of doing this is that it can combine the actual access request results and the predicted access control results to generate a new access dataset with richer data, which can increase the amount of knowledge that the subsequent student model can learn.

[0177] In step 240 , a target optimized binary decision tree corresponding to a plurality of nodes is constructed according to the access request result characteristics.

[0178] An optimized binary decision tree is a decision tree model in which each tree node has two branches, representing two categories, represented by either 0 or 1. When this model is applied to a scenario where access requests between nodes are controlled, a node either can access another node or cannot. Therefore, an optimized binary decision tree can be established for multiple nodes to determine whether different nodes are accessible.

[0179] In addition, the constructed target-optimized binary decision tree is equivalent to realizing the distillation learning of the output knowledge of the trained access control model. However, the target-optimized binary decision tree does not require parameter optimization like traditional artificial intelligence models, but only needs to be constructed according to the corresponding rules.

[0180] See also Figure 8 , Figure 8 This is a flow chart of the steps included in step 240 provided in an embodiment of the present application. In some embodiments, constructing a target optimized binary decision tree corresponding to multiple nodes based on the access request result characteristics includes the following steps:

[0181] Step 301: Determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set;

[0182] Step 302: Divide the remaining access request result features in the access request result feature set excluding the root target node according to a division threshold to obtain two different sub-access request result feature sets;

[0183] Step 303: Determine the target node in each sub-access request result feature set, and determine the partition threshold corresponding to each sub-access request result feature set;

[0184] Step 304: Divide the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set, to obtain two different updated sub-access request result feature sets;

[0185] Step 305: Return to the execution to determine the target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet the preset division conditions, stop dividing each updated sub-access request result feature set, and obtain the target optimized binary decision tree corresponding to multiple nodes.

[0186] Steps 301 to 305 will be described in detail below.

[0187] In step 301 , a root target node is determined from an access request result feature set corresponding to access request result features between different nodes, and a partitioning threshold corresponding to the access request result feature set is determined.

[0188] Each access request result feature in the access request result feature may be converted into a data feature in a binary form, which may facilitate subsequent data processing.

[0189] A root target node can be determined from the access request result feature set corresponding to the access request result features between different nodes. The different nodes refer to network nodes, and the root target node refers to the root node of the target optimization binary decision tree to be constructed.

[0190] For the target optimization binary decision tree that needs to be constructed later, we can first determine the partitioning threshold corresponding to each tree node in the target optimization binary decision tree, and determine the target feature corresponding to each tree node in multiple access request result features. Finally, according to the partitioning threshold and target feature of each tree node, the entire access request result feature set can be partitioned.

[0191] In the access request result feature set, for categorical fields, you can directly use their binary value (such as IP protocol type) or use one-hot encoding as the partitioning threshold. For continuous fields, you need to specifically calculate the corresponding partitioning threshold.

[0192] In some implementations, determining a partition threshold corresponding to an access request result feature set includes:

[0193] (1.1) Obtaining multiple to-be-selected segmentation thresholds corresponding to the access request result feature set;

[0194] (1.2) determining the Gini coefficient corresponding to each sub-access request result feature set after each to-be-selected partitioning threshold is used to partition the remaining access request result features in the access request result feature set;

[0195] (1.3) Determine the comprehensive Gini coefficient corresponding to each pending partition threshold based on the Gini coefficient corresponding to each pending partition threshold, the number of features corresponding to each sub-access request result feature set, and the number of features corresponding to the access request result feature set;

[0196] (1.4) The partitioning threshold with the smallest comprehensive Gini coefficient is determined as the partitioning threshold corresponding to the access request result feature set.

[0197] First, a plurality of to-be-selected partitioning thresholds corresponding to the access request result feature set are obtained. For example, the to-be-selected partitioning thresholds can be determined by operations such as equal-width binning and equal-frequency binning.

[0198] Then, the Gini coefficient corresponding to each sub-access request result feature set after each to-be-selected partitioning threshold is used to partition the remaining access request result features in the access request result feature set is determined. The specific calculation method is as follows:

[0199] ;

[0200] .

[0201] in, is the Gini coefficient, is the ratio of the number of access request result features of category k to the total number of access request result feature sets, where k corresponds to category 0 and category 1. Category 0 represents the sub-access request result feature set that cannot be accessed, and category 1 represents the sub-access request result feature set that can be accessed. Therefore, there are two sub-access request result feature sets obtained after the actual division, which can be expressed as and , then there are two Gini coefficients corresponding to each partition threshold to be selected, expressed as and .

[0202] It should be noted that It is determined after dividing the access request result feature set based on the to-be-selected partition threshold, so the Gini coefficient corresponding to each to-be-selected partition threshold can be calculated by the above formula.

[0203] Then, based on the Gini coefficient corresponding to each partition threshold to be selected, the number of features corresponding to each sub-access request result feature set, and the number of features corresponding to the access request result feature set, the comprehensive Gini coefficient corresponding to each partition threshold to be selected is determined. The specific calculation method is:

[0204] .

[0205] in, is the comprehensive Gini coefficient, and They are respectively represented as the Gini coefficients corresponding to the two sub-access request result feature sets after division. and They are respectively expressed as the ratio of the number of access request result features in the two sub-access request result feature sets to the previous access request result feature set. The access request result feature corresponding to the root target node.

[0206] Finally, the partition threshold with the smallest comprehensive Gini coefficient is determined as the partition threshold corresponding to the access request result feature set. The advantage of this is that the partition threshold can be determined more accurately through the Gini coefficient, thereby achieving a more accurate determination of the target optimization binary decision tree.

[0207] It should be noted that the above-described method for determining the partition threshold value can also be applied to the subsequent sub-access request result feature set corresponding to the leaf node, and will not be described in detail here.

[0208] In some embodiments, determining the root target node from the access request result feature set corresponding to the access request result features between different nodes includes:

[0209] (2.1) determining a plurality of candidate root target nodes from an access request result feature set corresponding to access request result features between different nodes;

[0210] (2.2) Determine the first Gini coefficient corresponding to each sub-access request result feature set corresponding to the next level of each candidate root target node;

[0211] (2.3) Determine the first comprehensive Gini coefficient corresponding to each candidate root target node based on the first Gini coefficient;

[0212] (2.4) determining a second Gini coefficient corresponding to the access request result feature set based on the number of features corresponding to each sub-access request result feature set;

[0213] (2.5) Subtract the first comprehensive Gini coefficient from the second Gini coefficient to obtain the Gini gain value corresponding to each candidate root target node, and determine the candidate root target node with the largest Gini gain value as the root target node.

[0214] In this case, multiple candidate root target nodes can be determined from the access request result feature set corresponding to the access request result features between different nodes. Then, the access request result feature is partitioned based on each candidate root target node and a partitioning threshold, thereby obtaining two sub-access request result feature sets corresponding to the next level below the root target node.

[0215] Then, the first Gini coefficient corresponding to each sub-access request result feature set corresponding to the next level of each candidate root target node is determined, wherein the calculation method of the first Gini coefficient is the same as the calculation method of the Gini coefficient above, which will not be repeated here.

[0216] Then, the first comprehensive Gini coefficient corresponding to each candidate root target node is determined based on the first Gini coefficient. The calculation method of the first comprehensive Gini coefficient is the same as the calculation method of the comprehensive Gini coefficient above, which will not be repeated here.

[0217] Then, the second Gini coefficient corresponding to the access request result feature set is determined based on the number of features corresponding to each sub-access request result feature set. The calculation method of the second Gini coefficient is the same as the calculation method of the Gini coefficient above, which will not be repeated here.

[0218] Finally, the second Gini coefficient is subtracted from the first comprehensive Gini coefficient to obtain the Gini gain value corresponding to each candidate root target node, and the candidate root target node with the largest Gini gain value is determined as the root target node. Specifically, it can be expressed as:

[0219] .in, represents the Gini gain value, represents the second Gini coefficient, represents the first comprehensive Gini coefficient, It represents the access request result feature corresponding to the root target node. And the candidate root target node with the largest Gini gain value can be determined as the root target node.

[0220] The advantage of this is that the optimal access request result feature can be determined at each tree node of the optimized binary decision tree, and combined with the partition threshold, the access request result feature set can be partitioned more accurately to obtain the target optimized binary decision tree.

[0221] In step 302, the remaining access request result features excluding the root target node in the access request result feature set are divided according to a division threshold to obtain two different sub-access request result feature sets.

[0222] After determining the partition threshold corresponding to the access request result feature set, the remaining access request result features of the access request result feature set excluding the root target node can be partitioned according to the partition threshold to obtain two different sub-access request result feature sets, namely and , where one sub-access request result feature set indicates that the root target node corresponding to the access request result feature can be accessed, and the other sub-access request result feature set indicates that the root target node corresponding to the access request result feature cannot be accessed.

[0223] In step 303 , a target node is determined in each sub-access request result feature set, and a partitioning threshold corresponding to each sub-access request result feature set is determined.

[0224] Similarly, the partitioning threshold corresponding to each sub-access request result feature set can be determined using the same method for calculating the partitioning threshold in step 301. That is, each sub-access request result feature set is determined as a set to be partitioned, and then the partitioning threshold for each sub-access request result feature set is calculated.

[0225] Then, the target node is determined in each sub-access request result feature set by using the method for determining the access request feature of the leaf node of the optimized binary decision tree in step 301 .

[0226] In step 304, the remaining access request result features in each sub-access request result feature set except for the target node are divided according to the division threshold corresponding to each sub-access request result feature set to obtain two different updated sub-access request result feature sets.

[0227] Similarly, after determining the target node and partitioning threshold for each sub-access request result feature set, the remaining access request result features in each sub-access request result feature set, excluding those for the target node, are partitioned according to the partitioning threshold corresponding to each sub-access request result feature set, resulting in two updated sub-access request result feature sets. One updated sub-access request result feature set contains those access request result features corresponding to the target node that can be accessed, and the other updated sub-access request result feature set contains those access request result features corresponding to the target node that cannot be accessed.

[0228] In step 305, the process returns to determine the target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet the preset division conditions, and the division of each updated sub-access request result feature set is stopped to obtain a target optimized binary decision tree corresponding to multiple nodes.

[0229] Among them, the return execution determines the target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet the preset division conditions, which indicates that the target optimization binary decision tree is generated. At this time, the division of each updated sub-access request result feature set is stopped to obtain the target optimization binary decision tree corresponding to multiple nodes.

[0230] In some embodiments, the process of returning to determine a target node in each sub-access request result feature set until each updated sub-access request result feature set is partitioned to satisfy a preset partitioning condition, stopping the partitioning of each updated sub-access request result feature set, and obtaining a target optimized binary decision tree corresponding to multiple nodes, including:

[0231] (1.1) Determine the level corresponding to each updated sub-access request result feature set, the number of features in the sub-access request result feature set, the target Gini coefficient, and the second comprehensive Gini coefficient;

[0232] (1.2) When the level is greater than the preset level, or the number of features in the sub-access request result feature set is less than the preset number, or the target Gini coefficient is less than the preset Gini coefficient value, or the second comprehensive Gini coefficient is less than the preset comprehensive Gini coefficient value, it is determined that each updated sub-access request result feature set meets the preset partitioning condition, and the partitioning of each updated sub-access request result feature set is stopped to obtain a target optimized binary decision tree corresponding to multiple nodes.

[0233] Among them, the level corresponding to each updated sub-access request result feature set can be determined. This level is also the node depth of the target optimized binary decision tree. If the level is greater than the preset level, in order to avoid excessive splitting, the splitting of the sub-access request result feature set features should be stopped at this time.

[0234] The number of features of each updated sub-access request result feature set may also be determined. For example, when the number of features is less than a preset number, the sub-access request result feature set is stopped from being further divided in order to prevent noise interference from subsequent small samples.

[0235] A target Gini coefficient of each sub-access request result feature set may also be determined. If the target Gini coefficient is less than a preset Gini coefficient value, the splitting of the sub-access request result feature set should be stopped to avoid over-splitting.

[0236] The second comprehensive Gini coefficient of each sub-access request result feature set can also be determined. If the second comprehensive Gini coefficient is less than the preset comprehensive Gini coefficient value, it means that the split cannot significantly improve the purity, the discrimination between data features is low, and meaningful information cannot be obtained through redundant feature splitting. At this time, the splitting of the sub-access request result feature set should be stopped.

[0237] The number of samples of each sub-access request result feature set may also be determined. If the number of samples is less than a preset sample number threshold, the splitting of the sub-access request result feature set should be stopped to prevent small sample noise interference.

[0238] It should be noted that when any of the above-mentioned pre-set partitioning conditions is triggered, the splitting of the sub-access request result feature set should be stopped. This results in a target-optimized binary decision tree. This approach has the advantage of ensuring the data accuracy of the constructed target-optimized binary decision tree.

[0239] In step 250, access control rules for access requests between different nodes are generated according to the target optimized binary decision tree. The access control rules are used to control access rights of access requests between different nodes.

[0240] Among them, the target-optimized binary decision tree is an abstract representation of the characteristics of different access request results, which can be converted into machine-recognizable code, that is, the access control rules for access requests between different nodes. Subsequent computer devices can read the access control rules to achieve access control for different target access requests.

[0241] In some embodiments, generating access control rules for access requests between different nodes based on a target-optimized binary decision tree includes:

[0242] (1.1) Optimize the binary decision tree according to the target to determine the class label, mask label and value corresponding to each target node;

[0243] (1.2) Generate a rule entry corresponding to each target node based on the class label, mask label, and value corresponding to each target node;

[0244] (1.3) Generate access control rules for access requests between different nodes based on the rule entries corresponding to each target node.

[0245] Among them, the class label, mask label and value corresponding to each target node can be determined based on the target optimization binary decision tree. For example, the access request result feature corresponding to each target node can be converted into a mask label (mask), and the class label (classes) can be generated according to the category corresponding to each target node. Then, the corresponding value (value) can be generated for other access request result features associated with the target node.

[0246] A rule entry corresponding to each target node is then generated based on the class label, mask label, and value corresponding to each target node. This forms a triplet of rule entries. By processing each target node, multiple rule entries are generated. Finally, access control rules for access requests between different nodes are generated based on the rule entries corresponding to each target node.

[0247] The advantage of this is that the content contained in the target optimized binary decision tree can be converted into access control rules that can be understood by other devices, so that the access control rules can be quickly read later to implement access control for some target access requests.

[0248] In some implementations, after generating access control rules for access requests between different nodes based on the rule entries corresponding to each target node, the method further includes:

[0249] (2.1) When receiving a target access request, determining a mask tag corresponding to the target access request;

[0250] (2.2) Matching is performed based on the mask label and access control rules to obtain a matching result;

[0251] (2.3) When the matching result indicates that the class label corresponding to the target access request is an accessible class, allowing the target access request to be sent to the target access network node;

[0252] (2.4) When the matching result indicates that the class label corresponding to the target access request is an inaccessible category, the target access request is refused to be sent to the target access network node.

[0253] When a target access request is received, a mask tag corresponding to the target access request is determined, and then the mask tag is matched with the access control rule to obtain a matching result.

[0254] When the matching result indicates that the class label corresponding to the target access request is an accessible category, it means that the target access request has access rights, and the target access request is allowed to be sent to the target access network node.

[0255] When the matching result indicates that the class label corresponding to the target access request is an inaccessible category, it means that the target access request does not have the access permission, and the target access request is refused to be sent to the target access network node.

[0256] The advantage of this is that the target access requests issued by some network nodes can be quickly verified through access control rules to determine whether they have access rights.

[0257] The above content describes the node access control method in this application from the perspective of application. The following will introduce the training process of the trained access control model in this application.

[0258] See also Figure 9 , Figure 9 This is a schematic diagram of the training process of the access control model provided by the embodiment of the present application. In some embodiments, before inputting the access control graph into the trained access control model and outputting the access control results between different nodes, the following steps are also included:

[0259] Step 401: Obtain node access requests and label access results between multiple sample nodes and different sample nodes;

[0260] Step 402: construct a sample access control graph based on multiple sample nodes and node access requests;

[0261] Step 403: Input the sample access control graph into the access control model and output the predicted access control results between different sample nodes;

[0262] Step 404: Determine the corresponding loss value between the label access result and the predicted access control result. When the loss value is not less than the preset loss value, update the access control model and return to execute the input of the sample access control graph into the updated access control model until the loss value is less than the preset loss value to obtain the trained access control model.

[0263] Steps 401 to 404 will be described in detail below.

[0264] In step 401, multiple sample nodes and node access requests and label access results between different sample nodes are obtained.

[0265] Among them, node access requests and label access results between multiple sample nodes and different sample nodes can be obtained. The label access result is the result of whether the node access request is successfully issued between the sample nodes.

[0266] In step 402, a sample access control graph is constructed based on a plurality of sample nodes and node access requests.

[0267] Among them, each sample node can be used as a graph node and the node access request as an edge to construct a sample access control graph.

[0268] In step 403, the sample access control graph is input into the access control model, and the predicted access control results between different sample nodes are output.

[0269] Among them, the access control model includes a node embedding sub-model, an edge embedding sub-model and a decision sub-model. The sample access control graph can be input into the node embedding sub-model, and the sample node embedding features corresponding to the aggregation of the neighbor nodes of each sample node are output; the sample access control graph can be input into the edge embedding sub-model, and the sample edge embedding features corresponding to the aggregation of the neighbor edges of two different sample nodes are output; the corresponding joint request features between different nodes are generated according to the sample node embedding features, sample edge embedding features and node access requests; the joint request features are input into the decision sub-model, and the predicted access control results between different sample nodes are output.

[0270] In step 404, the corresponding loss value between the label access result and the predicted access control result is determined. When the loss value is not less than the preset loss value, the access control model is updated, and the execution is returned to input the sample access control graph into the updated access control model until the loss value is less than the preset loss value, thereby obtaining the trained access control model.

[0271] The loss function determines the corresponding loss between the label access result and the predicted access control result. When the loss value is not less than a preset loss value, the access control model is updated and the sample access control graph is input into the updated access control model. After processing, the corresponding loss value of the updated access control model is obtained. The trained access control model is obtained until the loss value is less than the preset loss value. In other words, the node access control model requires a certain number of training cycles to achieve accurate prediction results.

[0272] In some embodiments, determining a corresponding loss value between a tag access result and a predicted access control result includes:

[0273] (1.1) Determine the label vector corresponding to each predicted access control result;

[0274] (1.2) classifying the multiple predicted access control results according to the label vector to obtain a first classification set and a second classification set;

[0275] (1.3) determining a target weight coefficient based on the number of first elements in the first classification set and the number of second elements in the second classification set;

[0276] (1.4) Input the sample access control graph into the node embedding sub-model included in the access control model, and output the corresponding sample node embedding features after aggregating the neighboring sample nodes of each sample node;

[0277] (1.5) Determine the corresponding loss value between the label access result and the predicted access control result based on the target weight coefficient and the sample node embedding feature.

[0278] Among them, the label vector corresponding to each predicted access control result can be determined. For example, the label vector corresponding to each predicted access control result is ,when When , the predicted access control results are divided into the first classification set In the middle, that is, the positive edge set. When , the predicted access control results are divided into the second classification set In the middle, that is, the negative edge set.

[0279] The target weight coefficient is determined according to the number of first elements in the first classification set and the number of second elements in the second classification set. The specific calculation method is as follows:

[0280] .in, is the target weight coefficient.

[0281] Input the sample access control graph into the node embedding sub-model included in the access control model, and output the corresponding sample node embedding features after aggregating the neighboring sample nodes of each sample node. For example, the sample node embedding feature corresponding to node i is , the sample node embedding feature corresponding to node j is .

[0282] Finally, the corresponding loss value between the label access result and the predicted access control result is determined based on the target weight coefficient and the sample node embedding features. The loss function used can be a weighted binary cross entropy loss function, where the target weight coefficient is the weight coefficient, which is used to alleviate the problem of class imbalance. The specific calculation method is as follows:

[0283] .in For target access request, is the target weight coefficient. It is used to measure the semantic relevance between two sample nodes. If the inner product of the embedding vectors of sample node i and sample node j in the latent space is larger, it is more likely that there is a legal access relationship between the two. It is the sigmoid activation function. By combining the inner product with the activation function, positive and negative samples can be efficiently distinguished.

[0284] In some implementations, an l2 regularization term can be added to the weighted binary cross entropy loss function to limit the weight amplitude to prevent certain features from dominating the model decision, improve the model's generalization ability, and alleviate overfitting. The resulting target loss function is:

[0285] .in, is the preset parameter, and W is the matrix vector corresponding to the access control model.

[0286] From the above content, it can be seen that by training the access control model through the sample access control graph, the trained access control model can accurately determine the legitimacy of access requests between different nodes in the access control graph.

[0287] In an embodiment of the present application, a network access log is obtained, and access requests and access request results between multiple nodes and different nodes are determined based on the network access log; an access control graph is constructed based on the multiple nodes and the access requests, and the access control graph is input into a trained access control model to output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes; access request result features between different nodes are generated based on the access control results and the access request results; a target optimized binary decision tree corresponding to multiple nodes is constructed based on the access request result features; access control rules for access requests between different nodes are generated based on the target optimized binary decision tree, and the access control rules are used to control access rights for access requests between different nodes.

[0288] In this way, by constructing an access control graph that includes multiple nodes and access requests between multiple nodes, and then inputting the access control graph into the trained access control model, the access control results between different nodes are output, where the access control results can describe whether different nodes are accessible. Then, based on the access control results and the access request results, the access request result features between different nodes are generated. In this way, the original access request results of multiple nodes and the access control results output by the trained access control model are integrated to maximize the access relationship between nodes. Then, based on the access request result features, a target optimized binary decision tree corresponding to multiple nodes is constructed, thereby achieving knowledge learning of the trained access control model. Finally, based on the target optimized binary decision tree, access control rules for access requests between different nodes are generated. The access control rules are used to control the access rights of access requests between different nodes. When a node is subsequently accessed, the access control rules can be used to determine whether the node can access the corresponding other nodes. Compared with the static rules set by humans in the related art, the present application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, thereby achieving accurate and efficient control of access between different nodes.

[0289] See also Figure 10 , Figure 10 This is another flowchart of the node access control method provided by an embodiment of the present application. The node access control method may include the following steps:

[0290] Step 501: Obtain network access logs, and determine access requests and access request results between multiple nodes and different nodes based on the network access logs;

[0291] Step 502: Input the access control graph into the trained node embedding sub-model, and output the node embedding features corresponding to each node after aggregating the neighbor nodes.

[0292] Step 503: Input the access control graph into the trained edge embedding sub-model, and output the edge embedding features corresponding to the aggregation of neighbor edges of two different nodes;

[0293] Step 504: Generate corresponding joint access request features between different nodes based on the node embedding features, edge embedding features, and access requests;

[0294] Step 505: Input the joint access request feature into the trained decision sub-model and output the access control result between different nodes;

[0295] Step 506: Generate access request result features between different nodes based on the access control result and the access request result;

[0296] Step 507: Determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set;

[0297] Step 508: Divide the access request result feature set except the root target node according to the division threshold to obtain two different sub-access request result feature sets.

[0298] Step 509: Determine the target node in each sub-access request result feature set, and determine the partition threshold corresponding to each sub-access request result feature set;

[0299] Step 510: Divide the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set, to obtain two different updated sub-access request result feature sets;

[0300] Step 511: Return to the process of determining a target node in each sub-access request result feature set until each updated sub-access request result feature set is partitioned to meet a preset partitioning condition, then stop partitioning each updated sub-access request result feature set to obtain a target optimized binary decision tree corresponding to multiple nodes.

[0301] Step 512: Determine the class label, mask label, and value corresponding to each target node based on the target optimized binary decision tree;

[0302] Step 513: Generate a rule entry corresponding to each target node according to the class label, mask label, and value corresponding to each target node;

[0303] Step 514: Generate access control rules for access requests between different nodes based on the rule entry corresponding to each target node. The access control rules are used to control access rights of access requests between different nodes.

[0304] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the above node access control method, which will not be repeated here.

[0305] See also Figure 11 , Figure 11 Schematic diagram of the structure of the node access control device provided in the embodiment of the present application. The node access control device can execute the above-mentioned node access control method.

[0306] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal. It can be implemented in whole or in part using software, hardware (such as processing circuits or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the functionality of the module or unit.

[0307] The node access control device 600 includes:

[0308] An acquisition module 610 is configured to acquire network access logs and determine access requests and access request results between multiple nodes and different nodes based on the network access logs;

[0309] An input module 620 is configured to construct an access control graph based on multiple nodes and access requests, input the access control graph into a trained access control model, and output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes;

[0310] A generating module 630 is configured to generate access request result features between different nodes based on the access control result and the access request result;

[0311] A construction module 640 is configured to construct a target optimized binary decision tree corresponding to a plurality of nodes according to the access request result characteristics;

[0312] The rule module 650 is used to generate access control rules for access requests between different nodes based on the target optimized binary decision tree. The access control rules are used to control access rights of access requests between different nodes.

[0313] In some embodiments, the trained access control model includes a trained node embedding sub-model, a trained edge embedding sub-model, and a trained decision sub-model; an input module 620 is configured to:

[0314] Input the access control graph into the trained node embedding sub-model, and output the corresponding node embedding features after aggregating the neighboring nodes of each node;

[0315] Input the access control graph into the trained edge embedding sub-model, and output the edge embedding features corresponding to the aggregation of neighbor edges of two different nodes;

[0316] Generate corresponding joint access request features between different nodes based on node embedding features, edge embedding features and access requests;

[0317] The joint access request features are input into the trained decision sub-model to output the access control results between different nodes.

[0318] In some implementations, the generating module 630 is configured to:

[0319] Determine a first weight value corresponding to the access control result and a second weight value corresponding to the access request result;

[0320] Multiplying the first weight value by the access control result to obtain a first processing result;

[0321] Multiplying the second weight value by the access request result to obtain a second processing result;

[0322] The first processing result and the second processing result are added together to obtain the access request result characteristics between different nodes.

[0323] In some embodiments, the construction module 640 is configured to:

[0324] Determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set;

[0325] The remaining access request result features of the access request result feature set excluding the root target node are divided according to the division threshold to obtain two different sub-access request result feature sets;

[0326] Determine a target node in each sub-access request result feature set, and determine a partitioning threshold corresponding to each sub-access request result feature set;

[0327] Divide the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set, to obtain two different updated sub-access request result feature sets;

[0328] Return to execute to determine the target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet the preset division conditions, stop dividing each updated sub-access request result feature set, and obtain the target optimized binary decision tree corresponding to multiple nodes.

[0329] In some embodiments, the construction module 640 is configured to:

[0330] Obtain multiple to-be-selected segmentation thresholds corresponding to the access request result feature set;

[0331] Determine the Gini coefficient corresponding to each sub-access request result feature set after each to-be-selected partitioning threshold is used to partition the remaining access request result features in the access request result feature set;

[0332] Determine the comprehensive Gini coefficient corresponding to each to-be-selected partitioning threshold based on the Gini coefficient corresponding to each to-be-selected partitioning threshold, the number of features corresponding to each sub-access request result feature set, and the number of features corresponding to the access request result feature set;

[0333] The partition threshold to be selected with the smallest comprehensive Gini coefficient is determined as the partition threshold corresponding to the access request result feature set.

[0334] In some embodiments, the construction module 640 is configured to:

[0335] Determine a plurality of candidate root target nodes from an access request result feature set corresponding to access request result features between different nodes;

[0336] Determine the first Gini coefficient corresponding to each sub-access request result feature set corresponding to the next level of each candidate root target node;

[0337] Determine the first comprehensive Gini coefficient corresponding to each candidate root target node according to the first Gini coefficient;

[0338] Determining a second Gini coefficient corresponding to the access request result feature set according to the number of features corresponding to each sub-access request result feature set;

[0339] The first comprehensive Gini coefficient is subtracted from the second Gini coefficient to obtain the Gini gain value corresponding to each candidate root target node, and the candidate root target node with the largest Gini gain value is determined as the root target node.

[0340] In some embodiments, the construction module 640 is configured to:

[0341] Determine the level corresponding to each updated sub-access request result feature set, the number of features in the sub-access request result feature set, the target Gini coefficient and the second comprehensive Gini coefficient;

[0342] When the level is greater than the preset level, or the number of features in the sub-access request result feature set is less than the preset number, or the target Gini coefficient is less than the preset Gini coefficient value, or the second comprehensive Gini coefficient is less than the preset comprehensive Gini coefficient value, it is determined that each updated sub-access request result feature set meets the preset division condition, and the division of each updated sub-access request result feature set is stopped to obtain a target optimized binary decision tree corresponding to multiple nodes.

[0343] In some implementations, the node access control device 600 further includes a training module configured to:

[0344] Before inputting the access control graph into the trained access control model and outputting the access control results between different nodes, obtaining multiple sample nodes and node access requests and label access results between different sample nodes;

[0345] Constructing a sample access control graph based on multiple sample nodes and node access requests;

[0346] Input the sample access control graph into the access control model and output the predicted access control results between different sample nodes;

[0347] Determine the corresponding loss value between the label access result and the predicted access control result. When the loss value is not less than the preset loss value, update the access control model and return to execute the sample access control graph into the updated access control model until the loss value is less than the preset loss value to obtain the trained access control model.

[0348] In some embodiments, a training module is used to:

[0349] Determine the label vector corresponding to each predicted access control result;

[0350] Classifying the plurality of predicted access control results according to the label vector to obtain a first classification set and a second classification set;

[0351] Determining a target weight coefficient according to the number of first elements in the first classification set and the number of second elements in the second classification set;

[0352] Input the sample access control graph into the node embedding sub-model included in the access control model, and output the corresponding sample node embedding features after aggregating the neighboring sample nodes of each sample node;

[0353] The corresponding loss value between the label access result and the predicted access control result is determined based on the target weight coefficient and the sample node embedding features.

[0354] In some embodiments, the rules module 650 is configured to:

[0355] According to the target optimization binary decision tree, the class label, mask label and value corresponding to each target node are determined;

[0356] Generate a rule entry corresponding to each target node according to the class label, mask label and value corresponding to each target node;

[0357] Generate access control rules for access requests between different nodes based on the rule entries corresponding to each target node.

[0358] In some embodiments, the node access control includes a control module configured to:

[0359] After generating access control rules between different nodes according to the rule entries corresponding to each target node, when a target access request is received, determining a mask tag corresponding to the target access request;

[0360] Match according to the mask label and access control rules to obtain the matching result;

[0361] When the matching result indicates that the class label corresponding to the target access request is an accessible class, allowing the target access request to be sent to the target access network node;

[0362] When the matching result indicates that the class label corresponding to the target access request is an inaccessible class, the target access request is refused to be sent to the target access network node.

[0363] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the above node access control method, which will not be repeated here.

[0364] In an embodiment of the present application, the acquisition module 610 acquires a network access log and determines access requests and access request results between multiple nodes and different nodes based on the network access log; the input module 620 constructs an access control graph based on multiple nodes and access requests, and inputs the access control graph into a trained access control model, and outputs access control results between different nodes, wherein the trained access control model is trained based on a sample access control graph corresponding to multiple sample nodes; the generation module 630 generates access request result features between different nodes based on the access control results and access request results; the construction module 640 constructs a target optimized binary decision tree corresponding to multiple nodes based on the access request result features; the rule module 650 generates access control rules for access requests between different nodes based on the target optimized binary decision tree, and the access control rules are used to control access rights of access requests between different nodes.

[0365] In this way, by constructing an access control graph that includes multiple nodes and access requests between multiple nodes, and then inputting the access control graph into the trained access control model, the access control results between different nodes are output, where the access control results can describe whether different nodes are accessible. Then, based on the access control results and the access request results, the access request result features between different nodes are generated. In this way, the original access request results of multiple nodes and the access control results output by the trained access control model are integrated to maximize the access relationship between nodes. Then, based on the access request result features, a target optimized binary decision tree corresponding to multiple nodes is constructed, thereby achieving knowledge learning of the trained access control model. Finally, based on the target optimized binary decision tree, access control rules for access requests between different nodes are generated. The access control rules are used to control the access rights of access requests between different nodes. When a node is subsequently accessed, the access control rules can be used to determine whether the node can access the corresponding other nodes. Compared with the static rules set by humans in the related art, the present application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, thereby achieving accurate and efficient control of access between different nodes.

[0366] The embodiment of the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the node access control method when executing the computer program. The computer device can be a server or a terminal.

[0367] See also Figure 12 , Figure 12 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0368] The processor 701 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0369] The memory 702 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 702 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 702 and is called by the processor 701 to execute the node access control method of the embodiments of this application.

[0370] Input / output interface 703, used to implement information input and output;

[0371] Communication interface 704, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0372] Bus 705 , which transmits information between various components of the device (e.g., processor 701 , memory 702 , input / output interface 703 , and communication interface 704 );

[0373] The processor 701 , the memory 702 , the input / output interface 703 and the communication interface 704 are connected to each other in communication within the device via a bus 705 .

[0374] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned node access control method is implemented.

[0375] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0376] The node access control method, node access control device, computer equipment and storage medium provided in the embodiments of the present application obtain network access logs and determine access requests and access request results of multiple nodes and between different nodes based on the network access logs; construct an access control graph based on the multiple nodes and the access requests, and input the access control graph into a trained access control model to output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes; generate access request result features between different nodes based on the access control results and the access request results; construct a target optimized binary decision tree corresponding to multiple nodes based on the access request result features; and generate access control rules for access requests between different nodes based on the target optimized binary decision tree, wherein the access control rules are used to control access rights of access requests between different nodes.

[0377] In this way, by constructing an access control graph that includes multiple nodes and access requests between multiple nodes, and then inputting the access control graph into the trained access control model, the access control results between different nodes are output, where the access control results can describe whether different nodes are accessible. Then, based on the access control results and the access request results, the access request result features between different nodes are generated. In this way, the original access request results of multiple nodes and the access control results output by the trained access control model are integrated to maximize the access relationship between nodes. Then, based on the access request result features, a target optimized binary decision tree corresponding to multiple nodes is constructed, thereby achieving knowledge learning of the trained access control model. Finally, based on the target optimized binary decision tree, access control rules for access requests between different nodes are generated. The access control rules are used to control the access rights of access requests between different nodes. When a node is subsequently accessed, the access control rules can be used to determine whether the node can access the corresponding other nodes. Compared with the static rules set by humans in the related art, the present application can more deeply explore the access relationship between different nodes, thereby increasing the flexibility and accuracy of access between nodes, thereby achieving accurate and efficient control of access between different nodes.

[0378] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0379] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0380] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0381] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0382] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0383] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0384] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0385] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0386] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0387] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0388] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A node access control method, characterized in that: include: Obtaining a network access log, and determining access requests and access request results between multiple nodes and different nodes based on the network access log; constructing an access control graph according to the multiple nodes and the access requests, inputting the access control graph into a trained access control model, and outputting access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to the multiple sample nodes; generating access request result features between different nodes according to the access control result and the access request result; Determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set; Dividing the remaining access request result features in the access request result feature set except the root target node according to the division threshold to obtain two different sub-access request result feature sets; Determine a target node in each sub-access request result feature set, and determine a partitioning threshold corresponding to each sub-access request result feature set; Dividing the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set to obtain two different updated sub-access request result feature sets; Returning to the execution, determining a target node in each sub-access request result feature set until each updated sub-access request result feature set is partitioned to satisfy a preset partitioning condition, stopping the partitioning of each updated sub-access request result feature set, and obtaining a target optimized binary decision tree corresponding to the plurality of nodes; An access control rule for access requests between different nodes is generated according to the target optimized binary decision tree, and the access control rule is used to control access rights of access requests between different nodes.

2. The node access control method according to claim 1, characterized in that: The trained access control model includes a trained node embedding sub-model, a trained edge embedding sub-model and a trained decision sub-model; Inputting the access control graph into the trained access control model and outputting access control results between different nodes includes: Input the access control graph into the trained node embedding sub-model, and output the corresponding node embedding features after aggregating the neighboring nodes of each node; Inputting the access control graph into the trained edge embedding sub-model, and outputting the edge embedding features corresponding to the aggregation of neighbor edges of two different nodes; generating corresponding joint access request features between different nodes according to the node embedding features, the edge embedding features and the access request; The joint access request feature is input into the trained decision sub-model to output the access control results between different nodes.

3. The node access control method according to claim 1, wherein: Generating access request result features between different nodes according to the access control result and the access request result includes: Determine a first weight value corresponding to the access control result and a second weight value corresponding to the access request result; Multiplying the first weight value by the access control result to obtain a first processing result; Multiplying the second weight value by the access request result to obtain a second processing result; The first processing result and the second processing result are added together to obtain access request result features between different nodes.

4. The node access control method according to claim 1, wherein: The determining of a partitioning threshold corresponding to the access request result feature set includes: Obtaining multiple to-be-selected segmentation thresholds corresponding to the access request result feature set; Determine a Gini coefficient corresponding to each sub-access request result feature set after each to-be-selected partitioning threshold is used to partition the remaining access request result features in the access request result feature set; Determining a comprehensive Gini coefficient corresponding to each to-be-selected partitioning threshold based on the Gini coefficient corresponding to each to-be-selected partitioning threshold, the number of features corresponding to each sub-access request result feature set, and the number of features corresponding to the access request result feature set; The to-be-selected partitioning threshold with the smallest comprehensive Gini coefficient is determined as the partitioning threshold corresponding to the access request result feature set.

5. The node access control method according to claim 1, wherein: Determining the root target node from the access request result feature set corresponding to the access request result features between different nodes includes: Determine a plurality of candidate root target nodes from an access request result feature set corresponding to access request result features between different nodes; Determine the first Gini coefficient corresponding to each sub-access request result feature set corresponding to the next level of each candidate root target node; Determine a first comprehensive Gini coefficient corresponding to each candidate root target node according to the first Gini coefficient; determining a second Gini coefficient corresponding to the access request result feature set according to the number of features corresponding to each sub-access request result feature set; The first comprehensive Gini coefficient is subtracted from the second Gini coefficient to obtain a Gini gain value corresponding to each candidate root target node, and the candidate root target node with the largest Gini gain value is determined as the root target node.

6. The node access control method according to claim 1, characterized in that: The return execution determines a target node in each sub-access request result feature set until each updated sub-access request result feature set is divided to meet a preset division condition, stops dividing each updated sub-access request result feature set, and obtains a target optimized binary decision tree corresponding to multiple nodes, including: Determining the level corresponding to each updated sub-access request result feature set, the number of features in the sub-access request result feature set, the target Gini coefficient and the second comprehensive Gini coefficient; When the level is greater than the preset level, or the number of features in the sub-access request result feature set is less than the preset number, or the target Gini coefficient is less than the preset Gini coefficient value, or the second comprehensive Gini coefficient is less than the preset comprehensive Gini coefficient value, it is determined that each of the updated sub-access request result feature sets meets the preset partitioning condition, and the partitioning of each of the updated sub-access request result feature sets is stopped to obtain a target optimized binary decision tree corresponding to multiple nodes.

7. The node access control method according to claim 1, characterized in that: Before inputting the access control graph into the trained access control model and outputting access control results between different nodes, the method further includes: Obtain node access requests and label access results for multiple sample nodes and between different sample nodes; Constructing a sample access control graph according to the plurality of sample nodes and the node access requests; Inputting the sample access control graph into the access control model, and outputting predicted access control results between different sample nodes; Determine the corresponding loss value between the label access result and the predicted access control result. When the loss value is not less than the preset loss value, update the access control model and return to execute the input of the sample access control graph into the updated access control model until the loss value is less than the preset loss value to obtain the trained access control model.

8. The node access control method according to claim 7, characterized in that: The determining of the corresponding loss value between the tag access result and the predicted access control result includes: Determine the label vector corresponding to each predicted access control result; Classifying the plurality of predicted access control results according to the label vector to obtain a first classification set and a second classification set; determining a target weight coefficient according to the number of first elements in the first classification set and the number of second elements in the second classification set; Inputting the sample access control graph into the node embedding sub-model included in the access control model, and outputting the sample node embedding features corresponding to the aggregation of the neighboring sample nodes of each sample node; A corresponding loss value between the label access result and the predicted access control result is determined according to the target weight coefficient and the sample node embedding feature.

9. The node access control method according to claim 1, characterized in that: The step of optimizing the binary decision tree according to the target to generate access control rules for access requests between different nodes includes: Optimizing the binary decision tree according to the target to determine the class label, mask label and value corresponding to each target node; Generate a rule entry corresponding to each target node according to the class label, mask label and value corresponding to each target node; Access control rules for access requests between different nodes are generated according to the rule entries corresponding to each target node.

10. The node access control method according to claim 9, characterized in that: After generating access control rules for access requests between different nodes according to the rule entries corresponding to each target node, the method further includes: When a target access request is received, determining a mask tag corresponding to the target access request; Matching the mask tag with the access control rule to obtain a matching result; When the matching result indicates that the class label corresponding to the target access request is an accessible category, allowing the target access request to be sent to the target access network node; When the matching result indicates that the class label corresponding to the target access request is an inaccessible category, the target access request is refused to be sent to the target access network node.

11. A node access control device, characterized in that: include: An acquisition module, configured to acquire network access logs and determine access requests and access request results between multiple nodes and different nodes based on the network access logs; an input module, configured to construct an access control graph based on the multiple nodes and the access request, input the access control graph into a trained access control model, and output access control results between different nodes, wherein the trained access control model is trained based on sample access control graphs corresponding to multiple sample nodes; A generating module, configured to generate access request result features between different nodes according to the access control result and the access request result; A construction module is used to determine a root target node from an access request result feature set corresponding to access request result features between different nodes, and determine a partitioning threshold corresponding to the access request result feature set; Dividing the remaining access request result features in the access request result feature set except the root target node according to the division threshold to obtain two different sub-access request result feature sets; Determine a target node in each sub-access request result feature set, and determine a partitioning threshold corresponding to each sub-access request result feature set; Dividing the remaining access request result features in each sub-access request result feature set except for the target node according to the division threshold corresponding to each sub-access request result feature set to obtain two different updated sub-access request result feature sets; Returning to the execution, determining a target node in each sub-access request result feature set until each updated sub-access request result feature set is partitioned to satisfy a preset partitioning condition, stopping the partitioning of each updated sub-access request result feature set, and obtaining a target optimized binary decision tree corresponding to the plurality of nodes; A rule module is used to generate access control rules for access requests between different nodes based on the target optimized binary decision tree, wherein the access control rules are used to control access rights of access requests between different nodes.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the node access control method according to any one of claims 1 to 10.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: When the processor executes the computer program, the node access control method according to any one of claims 1 to 10 is implemented.

Images