Zero-trust persistent trust evaluation method and device, electronic equipment and readable medium

Abstract

The invention relates to a zero-trust continuous trust evaluation method and device, electronic equipment and a readable medium. The method comprises the steps that when an access request of a user is received, target log information of the user is acquired, and a preset prompt word is acquired; inputting the target log information and the cue word into a large model, performing trust evaluation on the user based on the target log information through the large model, and structurally outputting a target trust evaluation result of the user under the guidance of the cue word through the large model; and responding to the access request according to the target trust evaluation result. According to the scheme provided by the invention, the problems of mass data processing difficulty, accuracy and efficiency balance difficulty and insufficient adaptability to novel threats can be effectively solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a zero-trust continuous trust assessment method, device, electronic device, and readable medium. Background Art

[0002] With the rapid development of information technology, enterprises face increasingly complex network security challenges. Zero Trust, a new generation of security concepts, has emerged. Zero Trust emphasizes the principle of "never trust, always verify," requiring identity authentication for every access request to ensure that only authorized users can access specific resources. The Zero Trust Log Center can record and view various log types, including user login logs, access logs, and administrator logs. These logs contain a wealth of information, making log analysis particularly important for ongoing user trust assessment in a Zero Trust network environment.

[0003] In related technologies, log analysis often relies on manual screening and rule writing methods. However, this method faces many problems, including but not limited to: the difficulty of processing massive data, the difficulty of balancing accuracy and efficiency, and the lack of adaptability to new threats. Summary of the Invention

[0004] In order to solve or partially solve the problems existing in the relevant technologies, the present application provides a zero-trust continuous trust assessment method, device, electronic device and readable medium, which can effectively solve the problems of massive data processing, the balance between accuracy and efficiency, and the lack of adaptability to new threats.

[0005] A first aspect of the present application provides a zero-trust continuous trust assessment method, the method comprising: When receiving a user's access request, obtaining the user's target log information and a preset prompt word; Inputting the target log information and the prompt word into a large model, so as to perform a trust evaluation on the user based on the target log information through the large model, and outputting a target trust evaluation result of the user in a structured manner through the large model under the guidance of the prompt word; The access request is responded to according to the target trust evaluation result.

[0006] In one embodiment, before inputting the target log information and the prompt word into the large model, the method further includes: Inputting the target log information and the prompt word into a pre-trained log encoder to encode the target log information through the log encoder to obtain a target log feature matrix, and encoding the prompt word through the log encoder to obtain a target prompt word feature matrix; The target log feature matrix and the target prompt word feature matrix are spliced together to obtain a target spliced feature matrix.

[0007] In one embodiment, the large model includes a base large model and a pre-trained log analysis expert network, the target log information includes target sub-logs of different categories, and the target log feature matrix includes target embedding matrices of the target sub-logs of different categories; inputting the target log information and the prompt word into the large model, performing a trust assessment on the user based on the target log information by the large model, and outputting a structured target trust assessment result of the user by the large model under the guidance of the prompt word, includes: Inputting the target splicing feature matrix into the base large model, so as to perform a trust evaluation on the user based on the target log feature matrix in the target splicing feature matrix by the base large model, and obtain an initial trust evaluation result of the user; and Inputting the target embedding matrices of the target sub-logs of different categories into the log analysis expert network, so as to analyze the network security situation of the target sub-logs of different categories based on the target embedding matrices of the target sub-logs of different categories by the log analysis expert network to obtain target analysis results; The target analysis result is adopted by the large model to adjust the initial trust evaluation result, and the target trust evaluation result of the user is structuredly output by the large model under the guidance of the target prompt word feature matrix in the target splicing feature matrix.

[0008] In one embodiment, the target sub-logs of different categories include basic user information, terminal environment information, security warning information, and user behavior information, and the log analysis expert network includes basic user information analysis experts, terminal environment information analysis experts, security warning information analysis experts, and user behavior information analysis experts; The target embedding matrices of the target logs of different categories are input into the log analysis expert network, so that the network security situation of the target logs of different categories is analyzed by the log analysis expert network based on the target embedding matrices of the target logs of different categories to obtain target analysis results, including: Inputting the target embedding matrix of the user basic information into the user basic information analysis expert, so that the user basic information analysis expert analyzes the network security situation of the user basic information based on the target embedding matrix of the user basic information to obtain a first analysis result; and inputting the target embedding matrix of the terminal environment information into the terminal environment information analysis expert, so that the terminal environment information analysis expert analyzes the network security situation of the terminal environment information based on the target embedding matrix of the terminal environment information to obtain a second analysis result; and inputting the target embedding matrix of the security alert information into the security alert information analysis expert, so that the security alert information analysis expert analyzes the network security situation of the security alert information based on the target embedding matrix of the security alert information to obtain a third analysis result; and inputting the target embedding matrix of the user behavior information into the user behavior information analysis expert, so that the user behavior information analysis expert analyzes the network security situation of the user behavior information based on the target embedding matrix of the user behavior information to obtain a fourth analysis result; The first analysis result, the second analysis result, the third analysis result and the fourth analysis result are spliced together to obtain a target analysis result.

[0009] In one embodiment, the target trust evaluation result includes a security reputation level and a security reputation evaluation; and responding to the access request based on the target trust evaluation result includes: If the security reputation level indicates normal or good, then the user's access request is allowed, and corresponding access rights are allocated to the user based on the security reputation evaluation; or If the security reputation level indicates high risk or suspicion, the user's access request is rejected.

[0010] In one embodiment, the log encoder includes an embedding module and a transformer encoder, wherein the transformer encoder includes a plurality of cascaded transformer modules; the log encoder is trained in the following manner: Acquire multiple sample log information; wherein each of the sample log information includes annotation information; Inputting each of the sample log information into the embedding module, so as to encode each of the sample log information through the embedding module to obtain an embedding tensor of each of the sample log information; Inputting each of the embedding tensors into the multiple transformer modules, so as to extract high-order information of each of the sample log information based on each of the embedding tensors through the multiple transformer modules to obtain a first sample log feature matrix of each of the sample log information; Inputting each of the first sample log feature matrices and the prompt words into a base large model, so as to output a first sample trust evaluation result of each of the sample log information in a structured manner based on each of the first sample log feature matrices and the prompt words through the base large model; Calculating a first cross entropy loss between the first sample trust evaluation result and the labeled information belonging to the same sample log information; The first cross entropy loss is used to update the parameters of the log encoder through reverse gradient propagation until the first cross entropy loss is less than or equal to a first loss threshold, thereby obtaining a trained log encoder.

[0011] In one embodiment, each of the sample log information includes sample sub-logs of different categories; the log analysis expert network is trained in the following manner: Encoding each of the sample log information using the trained log encoder to obtain a second sample log feature matrix for each of the sample log information; each of the second sample log feature matrices includes a sample embedding matrix of the sample sub-logs of different categories; Inputting each of the second sample log feature matrices into the base large model, so as to output a second sample trust evaluation result of each of the sample log information based on each of the second sample log feature matrices through the base large model; and Inputting the sample embedding matrices of the sample sub-logs of different categories in each of the second sample log feature matrices into the log analysis expert network, so as to output sample analysis results of each of the sample log information based on the sample embedding matrices of the sample sub-logs of different categories in each of the second sample log feature matrices through the log analysis expert network; Using the sample analysis results of each of the sample log information, adjusting the second sample trust evaluation results of each of the sample log information to obtain a comprehensive sample trust evaluation result of each of the sample log information; Calculating a second cross entropy loss between the comprehensive sample trust evaluation result and the annotation information belonging to the same sample log information; The second cross entropy loss is used to update the parameters of the log analysis expert network through reverse gradient propagation until the second cross entropy loss is less than or equal to the second loss threshold, thereby obtaining a trained log analysis expert network.

[0012] A second aspect of the present application provides a zero-trust continuous trust assessment device, the device comprising: A first acquisition module is configured to acquire target log information of a user and a preset prompt word upon receiving an access request from the user; A first evaluation module is configured to input the target log information and the prompt word into a large model, so as to perform a trust evaluation on the user based on the target log information through the large model, and output a structured target trust evaluation result of the user through the large model under the guidance of the prompt word; A response module is used to respond to the access request according to the target trust evaluation result.

[0013] A third aspect of the present application provides an electronic device, including: processor; and The memory stores executable codes thereon, and when the executable codes are executed by the processor, the processor is caused to execute the method described above.

[0014] A fourth aspect of the present application provides a computer-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor is caused to execute the method described above.

[0015] The technical solution provided by this application may include the following beneficial results: The solution provided by this application obtains the user's target log information and a pre-set prompt word when receiving a user's access request; inputs the target log information and prompt word into the large model, so as to conduct a trust assessment on the user based on the target log information through the large model, and outputs the user's target trust assessment result in a structured manner under the guidance of the prompt word through the large model; and responds to the access request based on the target trust assessment result. This application utilizes the powerful language understanding ability of the large model to achieve efficient and accurate analysis of zero-trust user-related logs, significantly improving the efficiency, accuracy and generalization ability of continuous trust assessment, and through the flexible use of prompt words, it can enable the large model to quickly respond to new threats, thereby effectively solving the problem of massive data processing, the problem of balancing accuracy and efficiency, and the problem of insufficient adaptability to new threats.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present application will become more apparent by describing in more detail exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0018] Figure 1 This is a flow chart of a zero-trust continuous trust assessment method according to an embodiment of the present application; Figure 2This is another flowchart of the zero-trust continuous trust assessment method shown in an embodiment of the present application; Figure 3 Schematic diagram of the structure of the log encoder shown in the embodiment of the present application; Figure 4 This is a training flow chart of a log encoder according to an embodiment of the present application; Figure 5 This is a training flow chart of the log analysis expert network shown in an embodiment of the present application; Figure 6 Schematic diagram of the structure of a zero-trust continuous trust evaluation device shown in an embodiment of the present application; Figure 7 It is a structural diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following describes embodiments of the present application in more detail with reference to the accompanying drawings. Although the accompanying drawings illustrate embodiments of the present application, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0020] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0021] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0022] In related technologies, log analysis often relies on manual screening and rule writing. However, this approach faces many problems, as follows: (1) The problem of massive data processing: With the surge in data volume, manual screening and rule writing methods are unable to cope with massive log data, making it difficult to respond and process in a timely manner.

[0023] (2) The difficulty of balancing accuracy and efficiency: Manual screening and rule-writing methods have limitations in accuracy, especially when facing complex and changing security threats. It is difficult to ensure high accuracy while maintaining efficient processing speed.

[0024] (3) Lack of adaptability to new threats: With the continuous evolution of attack methods, manual screening and rule writing methods are unable to detect new attacks and unknown threats and are unable to adapt to the rapidly changing security environment.

[0025] In response to the above problems, the embodiments of the present application provide a zero-trust continuous trust assessment method. By utilizing the powerful language understanding capabilities of the large model, it can achieve efficient and accurate analysis of zero-trust user-related logs, significantly improving the efficiency, accuracy and generalization capabilities of continuous trust assessment. Moreover, by flexibly utilizing prompt words, the large model can quickly respond to new threats, thereby effectively solving the problems of massive data processing, the balance between accuracy and efficiency, and the lack of adaptability to new threats.

[0026] The technical solutions of the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0027] Figure 1 This is a flow chart of the zero-trust continuous trust assessment method shown in an embodiment of the present application.

[0028] See also Figure 1 The zero-trust continuous trust assessment method of this application includes: S110 , when receiving a user's access request, obtaining the user's target log information and a preset prompt word.

[0029] In an embodiment of the present application, it can be applied to a zero-trust system, which includes a log center. When a user's access request is received, the zero-trust system can obtain the user's target log information from the log center. Since the zero-trust system follows the principle of "never trust, always verify", the target log information can be log information related to the currently received access request.

[0030] In order to respond to new threats promptly and effectively, the embodiments of the present application can pre-set prompt words (prompt), so that in actual application, the zero trust system can directly call the prompt words. For example, the prompt words can be set as follows: You are a Zero Trust Continuous Trust Assessment Specialist, responsible for conducting user trust assessments by evaluating user-related logs. Please fully understand the following new threats: Analysis of new threats: [Add analysis of emerging threats here, such as ransomware, phishing attacks, and APT (Advanced Persistent Threat) attacks.] [Describe the characteristics, scope of impact, potential risks, and countermeasures of the new threat] You will follow a fixed format output, in Chinese, and the output is a JSON string. The JSON contains two keys: security reputation level (high risk, suspicious, normal, good) and security reputation evaluation (user reputation evaluation conclusion, including analysis dimensions, anomalies, suspicious points, user reputation prediction, etc.).

[0031] S120, input the target log information and prompt words into the big model, so as to perform a trust evaluation on the user based on the target log information through the big model, and output the target trust evaluation result of the user in a structured manner under the guidance of the prompt words through the big model.

[0032] The zero-trust system deploys a large model, which is trained using a large amount of natural language data and possesses powerful language comprehension capabilities. The zero-trust system can input target log information and prompt words into the large model, allowing the large model to leverage its powerful language comprehension capabilities and efficiently and accurately evaluate the input target log information. The target log information contains a wealth of information, such as the user's accessed IP address (Internet Protocol), port number, URL (Uniform Resource Locator) path, access status, and detailed information within the request field. This rich information is crucial for user trust assessments. Therefore, based on the evaluation of the target log information, the large model can determine the user's target trust assessment results.

[0033] Prompt words can guide the large model to perform structured output. Structured output means that the output of the large model is presented in a regularized and predefined form. Therefore, after obtaining the user's target trust assessment result, the large model can output the target trust assessment result in a structured manner under the guidance of the prompt words.

[0034] S130: respond to the access request according to the target trust evaluation result.

[0035] After obtaining the target trust assessment result output by the large model structure, the zero-trust system can respond to the user's access request based on the target trust assessment result. Specifically, if the target trust assessment result indicates that the user has an abnormality, the zero-trust system can reject the access request currently received from the user, thereby ensuring the security of the zero-trust system; if the target trust assessment result indicates that the user has no abnormality, the zero-trust system can allow the access request currently received from the user. Since the zero-trust system follows the principle of least privilege, that is, only granting users the minimum privileges necessary to complete their work, the zero-trust system can assign corresponding access rights to the user.

[0036] After responding to the currently received access request, the zero-trust system can return to step S110 to continuously monitor the user's access behavior, conduct continuous trust evaluation of the user based on the monitored access behavior, and dynamically adjust the user's permissions based on the evaluation results, thereby ensuring the security of the zero-trust system.

[0037] As can be seen from this example, the solution provided by this application obtains the user's target log information and a pre-set prompt word when receiving a user's access request; inputs the target log information and prompt word into the large model, so as to conduct a trust assessment on the user based on the target log information through the large model, and outputs the user's target trust assessment result in a structured manner under the guidance of the prompt word through the large model; and responds to the access request based on the target trust assessment result. This application utilizes the powerful language understanding ability of the large model to achieve efficient and accurate analysis of zero-trust user-related logs, significantly improving the efficiency, accuracy and generalization ability of continuous trust assessment, and through the flexible use of prompt words, the large model can quickly respond to new threats, thereby effectively solving the problem of massive data processing, the problem of balancing accuracy and efficiency, and the problem of insufficient adaptability to new threats.

[0038] Figure 2 This is another flow chart of the zero-trust continuous trust assessment method shown in this application.

[0039] See also Figure 2 The zero-trust continuous trust assessment method of this application includes: S210 , when receiving a user's access request, obtaining the user's target log information and a preset prompt word.

[0040] This step can be referred to the description in S110 and will not be repeated here.

[0041] S220, input the target log information and the prompt word into a pre-trained log encoder to encode the target log information through the log encoder to obtain a target log feature matrix, and encode the prompt word through the log encoder to obtain a target prompt word feature matrix; wherein the target log information includes target sub-logs of different categories, and the target log feature matrix includes target embedding matrices of target sub-logs of different categories.

[0042] The zero-trust system is deployed with a large model. Since the large model is basically trained using natural language corpus, it is difficult for the large model to understand the abstract information of the log. For this reason, the embodiment of the present application can pre-train the log encoder so that the log can be encoded by the log encoder, which can greatly improve the large model's ability to parse and judge the log.

[0043] Specifically, embodiments of the present application can deploy a trained log encoder into a zero-trust system so that, in actual applications, the zero-trust system can directly call the log encoder. The user's target log information is then input into the log encoder, which then encodes the target log information, thereby obtaining a target log feature matrix. For example, the target log feature matrix can be: [sequence_length, 3584], where sequence_length is the length of the target log information's token and 3584 is the embedding_dim (the number of embedded channels) of the target log information.

[0044] In addition, the zero-trust system can input the prompt word into the log encoder so that the log encoder can encode the prompt word to obtain a target prompt word feature matrix. For example, the target prompt word feature matrix can be: [prompt_length, 3584], where prompt_length is the number of tokens in the prompt word and 3584 is the embedding_dim of the prompt word.

[0045] It should be noted that the target log information belongs to the parent log, which includes target sub-logs of different categories. Therefore, the target log feature matrix may include the target embedding matrices of the target sub-logs of different categories.

[0046] S230 , concatenating the target log feature matrix and the target prompt word feature matrix to obtain a target concatenated feature matrix.

[0047] After obtaining the target log feature matrix and the target prompt word feature matrix output by the log encoder, the zero-trust system can concatenate the target log feature matrix and the target prompt word feature matrix to obtain a target concatenated feature matrix. For example, the target concatenated feature matrix can be: [sequence_length + prompt_length, 3584].

[0048] S240: Input the target splicing feature matrix into the base large model, so as to perform a trust evaluation on the user based on the target log feature matrix in the target splicing feature matrix through the base large model to obtain an initial trust evaluation result of the user.

[0049] The large model may include a base large model. The embodiment of the present application may select qwen2.5 7B as the base large model, wherein qwen2.5 7B is specially designed to understand and execute instructions and is suitable for applications requiring specific functions. Therefore, it can accurately interpret user commands and perform tasks with higher accuracy and consistency.

[0050] The zero-trust system can input the target splicing feature matrix (such as [sequence_length + prompt_length, 3584]) into the base large model, so that the base large model can perform a trust evaluation on the user based on the target log feature matrix (such as [sequence_length, 3584]) in the target splicing feature matrix, thereby obtaining the user's initial trust evaluation result.

[0051] S250, input the target embedding matrix of the target sub-logs of different categories into the log analysis expert network, so as to analyze the network security situation of the target sub-logs of different categories based on the target embedding matrix of the target sub-logs of different categories through the log analysis expert network to obtain the target analysis results.

[0052] Since the target log information covers target sub-logs of different categories, in order to enable the large model to analyze and integrate log information from different sources, the embodiment of the present application can pre-construct a log analysis expert network of the large model and train the log analysis expert network so that in actual applications, the zero-trust system can input the target embedding matrix of target sub-logs of different categories into the trained log analysis expert network. Through the log analysis expert network based on the target embedding matrix of target sub-logs of different categories, the network security situation of target sub-logs of different categories can be analyzed, and then by integrating the analysis results of target sub-logs of different categories, the target analysis results of the target log information can be obtained.

[0053] The target analysis results can effectively reflect the possible network security threats in the target log information. Therefore, through the log analysis expert network, we can achieve in-depth observation and accurate analysis of the network security situation of the target log information, greatly enhancing the prediction and response speed of network security threats.

[0054] In one embodiment, different categories of target sub-logs include user basic information, terminal environment information, security alarm information and user behavior information, and the log analysis expert network includes user basic information analysis experts, terminal environment information analysis experts, security alarm information analysis experts and user behavior information analysis experts.

[0055] Target log information can include four categories of target sub-logs: basic user information, terminal environment information, security alert information, and user behavior information. User basic information can include at least one of account information, organizational relationship attributes, and permission information; terminal environment information can include at least one of the mobile terminal information used for user access, terminal security check information, network security detection information, terminal IP address, and geographic location information; security alert information can include at least one of terminal environment detection, security rule detection, ALC (Automatic Level Control) blocking, abnormal access, sensitive data access, and data leakage; and user behavior information can include at least one of user authentication information, application access information, user accessed IP address, port, domain name, URL, access interaction data information, sensitive data access information, and user behavior statistics.

[0056] The log analysis expert network can include user basic information analysis experts, terminal environment information analysis experts, security alert information analysis experts, and user behavior information analysis experts. Among them, user basic information analysis experts can be responsible for processing user basic information; terminal environment information analysis experts can be responsible for processing terminal environment information; security alert information analysis experts can be responsible for processing security alert information; and user behavior information analysis experts can be responsible for processing user behavior information.

[0057] In one embodiment, the target embedding matrices of target sub-logs of different categories are input into the log analysis expert network, so that the log analysis expert network analyzes the network security situation of the target sub-logs of different categories based on the target embedding matrices of the target sub-logs of different categories, and obtains target analysis results, which may include: The target embedding matrix of the user basic information is input into the user basic information analysis expert, so that the user basic information analysis expert analyzes the network security situation of the user basic information based on the target embedding matrix of the user basic information to obtain a first analysis result; and the target embedding matrix of the terminal environment information is input into the terminal environment information analysis expert, so that the terminal environment information analysis expert analyzes the network security situation of the terminal environment information based on the target embedding matrix of the terminal environment information to obtain a second analysis result; and the target embedding matrix of the security alarm information is input into the security alarm information analysis expert, so that the security alarm information analysis expert analyzes the network security situation of the security alarm information based on the target embedding matrix of the security alarm information to obtain a third analysis result; and the target embedding matrix of the user behavior information is input into the user behavior information analysis expert, so that the user behavior information analysis expert analyzes the network security situation of the user behavior information based on the target embedding matrix of the user behavior information to obtain a fourth analysis result; the first analysis result, the second analysis result, the third analysis result and the fourth analysis result are spliced to obtain a target analysis result.

[0058] The zero-trust system can input the target embedding matrix of different categories of target sub-logs into the user basic information analysis expert, terminal environment information analysis expert, security alarm information analysis expert and user behavior information analysis expert for processing.

[0059] In one implementation, the zero-trust system can input the target embedding matrix of the user's basic information into the user's basic information analysis expert, so that the user's basic information analysis expert can analyze the network security situation of the user's basic information based on the target embedding matrix of the user's basic information, thereby obtaining a first analysis result. The first analysis result can effectively reflect the possible network security threats of the user's basic information. Therefore, the user's basic information analysis expert can achieve in-depth observation and accurate analysis of the network security situation of the user's basic information, greatly enhancing the prediction and response speed of network security threats.

[0060] In another implementation, the zero-trust system can input the target embedding matrix of the terminal environment information into the terminal environment information analysis expert, so that the terminal environment information analysis expert can analyze the network security situation of the terminal environment information based on the target embedding matrix of the terminal environment information, thereby obtaining a second analysis result. The second analysis result can effectively reflect the possible network security threats of the terminal environment information. Therefore, the terminal environment information analysis expert can achieve in-depth observation and accurate analysis of the network security situation of the terminal environment information, greatly enhancing the prediction and response speed of network security threats.

[0061] In another implementation, the zero-trust system can input the target embedding matrix of the security alarm information into the security alarm information analysis expert, so that the security alarm information analysis expert can analyze the network security situation of the security alarm information based on the target embedding matrix of the security alarm information, thereby obtaining a third analysis result. The third analysis result can effectively reflect the possible network security threats of the security alarm information. Therefore, the security alarm information analysis expert can achieve in-depth observation and accurate analysis of the network security situation of the security alarm information, greatly enhancing the prediction and response speed of network security threats.

[0062] In another implementation, the zero-trust system can input the target embedding matrix of user behavior information into the user behavior information analysis expert, so that the user behavior information analysis expert can analyze the network security situation of the user behavior information based on the target embedding matrix of the user behavior information, thereby obtaining a fourth analysis result. The fourth analysis result can effectively reflect the possible network security threats of the user behavior information. Therefore, the user behavior information analysis expert can achieve in-depth observation and accurate analysis of the network security situation of the user behavior information, greatly enhancing the prediction and response speed of network security threats.

[0063] The large model can also include a feature splicing module. After obtaining the first analysis result for the user's basic information, the second analysis result for the terminal environment information, the third analysis result for the security warning information, and the fourth analysis result for the user's behavior information, the first analysis result, the second analysis result, the third analysis result, and the fourth analysis result can be spliced together through the feature splicing module to obtain the target analysis result for the target log information.

[0064] S260, using the target analysis result through the large model, adjusting the initial trust evaluation result, and outputting the user's target trust evaluation result in a structured manner under the guidance of the target prompt word feature matrix in the target splicing feature matrix through the large model.

[0065] The base large model has already mastered extensive language knowledge and semantic representation, but in order to make the large model perform better on specific tasks, the embodiments of the present application can be fine-tuned on the dataset of the specific task.

[0066] Specifically, the large model can also include a feature addition module. After obtaining the initial trust assessment result output by the base large model and the target analysis result output by the log analysis expert network, the target analysis result can be used by the feature addition module to adjust the initial trust assessment result. The specific operation can be that the feature addition module adds the target analysis result to the initial trust assessment result to obtain the user's target trust assessment result.

[0067] The target prompt word feature matrix in the target splicing feature matrix (such as [prompt_length, 3584]) can guide the large model to perform structured output. Therefore, after obtaining the user's target trust evaluation result, the large model can output the target trust evaluation result in a structured manner under the guidance of the target prompt word feature matrix.

[0068] S270: Respond to the access request based on the target trust evaluation result.

[0069] This step can be referred to the description in S130 and will not be repeated here.

[0070] In one embodiment, the target trust evaluation result includes a security reputation level and a security reputation evaluation; responding to the access request based on the target trust evaluation result may include: If the security reputation level indicates normal or good, the user's access request is allowed, and the user is assigned corresponding access rights based on the security reputation evaluation; otherwise, if the security reputation level indicates high risk or suspicious, the user's access request is denied.

[0071] Because the target trust assessment results are structured outputs by the large model under the guidance of prompt words, they can be composed of two parts: a security reputation level and a security reputation evaluation. The security reputation level can include at least one of high-risk, suspicious, normal, and good; the security reputation evaluation can be the user reputation evaluation conclusion, which includes at least one of the following: analysis dimensions, anomalies, suspicious points, and user reputation prediction. The zero-trust system can respond to user access requests based on the security reputation level and security reputation evaluation.

[0072] In one example, if the security reputation level is normal or good, indicating that there is no abnormality in the user, the zero-trust system can allow the access request currently received from the user. Since the zero-trust system follows the principle of least privilege, that is, only granting users the minimum privileges necessary to complete their work, the zero-trust system can assign corresponding access rights to the user based on the security reputation evaluation.

[0073] In another example, if the security reputation level is high risk or suspicious, indicating that the user has an abnormal situation, the zero trust system can reject the access request currently received from the user, thereby ensuring the security of the zero trust system.

[0074] In one embodiment, the log encoder includes an embedding module and a transformer encoder, wherein the transformer encoder includes a plurality of cascaded transformer modules. The log encoder can be trained as follows: Acquire multiple sample log information; wherein each sample log information includes annotation information; input each sample log information into an embedding module so as to encode each sample log information through the embedding module and obtain an embedding tensor of each sample log information; input each embedding tensor into multiple transformer modules so as to extract high-order information of each sample log information based on each embedding tensor through the multiple transformer modules and obtain a first sample log feature matrix of each sample log information; input each first sample log feature matrix and a prompt word into a base large model so as to output a first sample trust evaluation result of each sample log information in a structured manner based on each first sample log feature matrix and the prompt word through the base large model; calculate a first cross entropy loss of the first sample trust evaluation result and the annotation information belonging to the same sample log information; use the first cross entropy loss to update the parameters of the log encoder through back gradient propagation until the first cross entropy loss is less than or equal to a first loss threshold, thereby obtaining a trained log encoder.

[0075] In order to improve the large model's ability to parse and judge logs, the embodiment of the present application can pre-train the log encoder. In a specific implementation, first, the embodiment of the present application can collect a large number of zero-trust user-related logs and annotate these user-related logs to obtain a training data set. Among them, the training data set can contain multiple sample log information, and each sample log information can contain annotation information. The annotation information is the analysis and judgment of the user-related logs. The judgment output is a structured output, including two parts: security reputation level (high risk, suspicious, normal, good) and security reputation evaluation (user reputation evaluation conclusion, which can include analysis dimensions, anomalies, suspicious points and user reputation predictions, etc.). Then, the embodiment of the present application can construct a log encoder. The specific structure of the log encoder can be found in Figure 3 ,like Figure 3 As shown, the log encoder may include an embedding module and a transformer encoder, wherein the embedding module may include a position embedding module and a log text embedding module, and the transformer encoder may include a plurality of cascaded transformer modules (such as 12 transformer blocks), a normalization module and a fully connected network module, and each transformer block is composed of a normalization module, a multi-head attention module, a residual module 1, a forward network module and a residual module 2 in series.

[0076] After the log encoder is built, the embodiment of the present application can traverse each sample log information in the log encoder. The traversal process of a single sample log information is described below as an example: like Figure 3 As shown, the currently traversed sample log information (i.e. Figure 3 The input shown: user-related log) is input into the embedding module so that the sample log information is encoded by the embedding module to obtain the embedding tensor of the sample log information. Specifically, an embodiment of the present application can initialize an embedding tensor of shape [sequence_length, embedding_dim] in the position embedding module, where sequence_length is the length of the token of the currently traversed sample log information, and embedding_dim is the number of embedded channels of the currently traversed sample log information, where the embedding_dim of each sample log information is initialized to 1024, and the embedding tensor is updated by reverse gradient propagation during the training process; at the same time, an embodiment of the present application can input the currently traversed sample log information into the log text embedding module so that the sample log information can be segmented by the log text embedding module, and each segmented word is assigned a specific index number in the vocabulary, where the vocabulary is a set containing all unique segmented words, and the embedding tensor [sequence_length, embedding_dim] of the segmented word is found from the embedding matrix through the segmentation index number, and its size is the same as the embedding tensor output by the position embedding module, and the weights in the embedding matrix are updated by reverse gradient propagation during the training process.

[0077] After obtaining the embedding vector output by the position embedding module and the embedding tensor output by the log text embedding module, the embodiment of the present application can add the embedding vector output by the position embedding module and the embedding tensor output by the log text embedding module to obtain the embedding vector [sequence_length, 1024] of the currently traversed sample log information, and then input the embedding vector into multiple transformer modules so that the high-order information of the currently traversed sample log information can be extracted based on the embedding vector through multiple transformer modules, and then processed by the normalization module and the fully connected network module to obtain the first sample log feature matrix [sequence_length, 3584] of the sample log information. Specifically, Figure 3As shown, the log encoder includes 12 transformer blocks, each of which is composed of a normalization module, a multi-head attention module, a residual module 1, a forward network module, and a residual module 2 connected in series. Therefore, in the embodiment of the present application, the embedding vector [sequence_length, 1024] of the currently traversed sample log information can be input into the normalization module of the first transformer module, so that the input embedding vector [sequence_length, 1024] is normalized by the normalization module to obtain a normalized feature matrix [sequence_length, 1024]. Specifically, layer normalization is adopted, as shown below:

[0078] in, is the input matrix of the normalization module (i.e. the embedding vector [sequence_length, 1024] of the currently traversed sample log information), is the output matrix of the normalization module (i.e., the normalized feature matrix [sequence_length, 1024]), and They are The mean and variance of and are all learnable parameters. is a small constant used to prevent the denominator from being zero.

[0079] Then, the embodiment of the present application can input the output matrix of the normalization module (i.e., the normalized feature matrix [sequence_length, 1024]) into the multi-head attention module of the first transformer module, wherein the multi-head attention module may include multiple attention heads (such as 16 attention heads), and the multi-head attention module divides the input normalized feature matrix [sequence_length, 1024] into multiple heads. For example, if there are 16 attention heads, it will be divided into 16 heads, and each head performs attention calculation independently. The multi-head attention module splices the output matrices of all heads together and fuses them through a linear layer to obtain the final multi-head attention feature matrix [sequence_length, 1024].

[0080] Then, the embodiment of the present application can input the output matrix of the multi-head attention module (i.e., the multi-head attention feature matrix [sequence_length, 1024]) into the residual module 1 of the first transformer module, and the input matrix of the normalization module (i.e., the embedding vector [sequence_length, 1024] of the currently traversed sample log information) can also be input into the residual module 1 of the first transformer module, so that the input matrix of the normalization module (i.e., the embedding vector [sequence_length, 1024] of the currently traversed sample log information) is added to the output matrix of the multi-head attention module (i.e., the multi-head attention feature matrix [sequence_length, 1024]) through the residual module 1 to obtain the first residual feature matrix [sequence_length, 1024].

[0081] Then, the embodiment of the present application can input the output matrix of the residual module 1 (i.e., the first residual feature matrix [sequence_length, 1024]) into the forward network module of the first transformer module, wherein the forward network module can be composed of a fully connected layer with an input feature number of 1024 and an output feature number of 2048 and a fully connected layer with an input feature number of 2048 and an output feature number of 1024 connected in series. Therefore, the forward network module uses the two fully connected layers in series to perform a transformation operation on the input first residual feature matrix [sequence_length, 1024] to obtain a transformed feature matrix [sequence_length, 1024].

[0082] Then, in an embodiment of the present application, the output matrix of the forward network module (i.e., the transformation feature matrix [sequence_length, 1024]) can be input into the residual module 2 of the first transformer module, and the output matrix of the residual module 1 (i.e., the first residual feature matrix [sequence_length, 1024]) can also be input into the residual module 2 of the first transformer module, so that the output matrix of the forward network module (i.e., the transformation feature matrix [sequence_length, 1024]) and the output matrix of the residual module 1 (i.e., the first residual feature matrix [sequence_length, 1024]) can be added through the residual module 2 to obtain the second residual feature matrix [sequence_length, 1024].

[0083] At this point, the processing flow of the first transformer block ends, and the high-order information extracted by the first transformer block for the currently traversed sample log information (i.e., the second residual feature matrix [sequence_length, 1024]) is obtained. Then, the processing flow of the second transformer block begins, that is, the output matrix of the first transformer block (i.e., the second residual feature matrix [sequence_length, 1024]) is input into the normalization module of the second transformer block. It should be noted that the processing flow of the second transformer block to the last transformer block is the same as that of the first transformer block. For details, please refer to the processing flow of the first transformer block and will not be repeated here.

[0084] After obtaining the output matrix of the last transformer block (i.e., the second residual feature matrix [sequence_length, 1024]), the embodiment of the present application can input the output matrix of the last transformer block (i.e., the second residual feature matrix [sequence_length, 1024]) into the normalization module (i.e., the normalization module outside the transformer block) to obtain the output matrix [sequence_length, 1024] of the normalization module. It should be noted that the normalization method used by the normalization module outside the transformer block is the same as the normalization method used by the normalization module inside the transformer block. For details, please refer to the processing flow of the normalization module inside the transformer block (such as the normalization module of the first transformer block), which will not be repeated here.

[0085] In the embodiment of the present application, the output matrix [sequence_length, 1024] of the normalization module outside the transformer block can be input into the fully connected network module, wherein the fully connected network module can be composed of a fully connected layer with an input feature number of 1024 and an output feature number of 2048 and a fully connected layer with an input feature number of 2048 and an output feature number of 3584 connected in series. Therefore, the fully connected network module uses the two fully connected layers in series to transform the output matrix [sequence_length, 1024] of the normalization module outside the transformer block to obtain the first sample log feature matrix [sequence_length, 3584] of the currently traversed sample log information (i.e. Figure 3 Output shown: log-feature matrix).

[0086] like Figure 4 As shown, the embodiment of the present application can train the log encoder under the guidance of the base large model (such as qwen2.5 7B), wherein, when training the log encoder, the parameters of the base large model are fixed, that is, the parameters of the base large model do not participate in the reverse gradient propagation. Specifically, as Figure 4 As shown, the sample log information currently traversed (i.e. Figure 4 The zero-trust user-related log shown in the figure is encoded by the log encoder to obtain the first sample log feature matrix [sequence_length, 3584] of the sample log information. In addition, the prompt word can also be encoded by the log encoder to obtain the sample prompt word feature matrix [prompt_length, 3584] of the prompt word.

[0087] In an embodiment of the present application, the first sample log feature matrix [sequence_length, 3584] of the currently traversed sample log information may be spliced with the sample prompt word feature matrix [prompt_length, 3584] to obtain a sample splicing feature matrix [sequence_length + prompt_length, 3584].

[0088] In an embodiment of the present application, the sample splicing feature matrix [sequence_length + prompt_length, 3584] can be input into the base large model, so that the base large model can perform a trust evaluation on the currently traversed sample log information based on the first sample log feature matrix [sequence_length, 3584] in the sample splicing feature matrix to obtain the first sample trust evaluation result of the sample log information.

[0089] The sample prompt word feature matrix [prompt_length, 3584] in the sample splicing feature matrix can guide the base large model to perform structured output. Specifically, "You are a zero-trust continuous trust judgment expert, and will follow a fixed format output in Chinese. The output is a JSON string, and the JSON contains two keys: security reputation level (high risk, suspicious, normal, good) and security reputation evaluation (user reputation evaluation conclusion, including analysis dimensions, anomalies, suspicious points, user reputation prediction, etc.)". Therefore, after obtaining the first sample trust evaluation result of the currently traversed sample log information, the base large model can, under the guidance of the sample prompt word feature matrix [prompt_length, 3584], structuredly output the first sample trust evaluation result.

[0090] like Figure 4 As shown, after obtaining the first sample trust evaluation result of the structured output of the base large model for the currently traversed sample log information, the embodiment of the present application can calculate the first sample trust evaluation result of the sample log information and the first cross entropy loss of the annotation information, so as to use the currently calculated first cross entropy loss to update the parameters of the log encoder through reverse gradient propagation.

[0091] Then, the next sample log information is traversed until the first cross entropy loss is less than or equal to the first loss threshold, thereby obtaining a trained log encoder. It should be noted that the traversal process of each sample log information in the log encoder is specifically referred to the above traversal process (i.e. Figure 3 and Figure 4 The processing flow of , will not be described here.

[0092] In one embodiment, each sample log information includes sample sub-logs of different categories; the log analysis expert network can be trained in the following manner: Each sample log information is encoded by a trained log encoder to obtain a second sample log feature matrix of each sample log information; each second sample log feature matrix includes a sample embedding matrix of sample sub-logs of different categories; each second sample log feature matrix is input into the base large model to output the second sample trust evaluation result of each sample log information through the base large model based on each second sample log feature matrix; and, the sample embedding matrix of the sample sub-logs of different categories in each second sample log feature matrix is input into the log analysis expert network to output the sample analysis result of each sample log information through the log analysis expert network based on the sample embedding matrix of the sample sub-logs of different categories in each second sample log feature matrix; the sample analysis result of each sample log information is used to adjust the second sample trust evaluation result of each sample log information to obtain a comprehensive sample trust evaluation result of each sample log information; the second cross entropy loss of the comprehensive sample trust evaluation result and the annotation information belonging to the same sample log information is calculated; the second cross entropy loss is used to update the parameters of the log analysis expert network through back gradient propagation until the second cross entropy loss is less than or equal to the second loss threshold, thereby obtaining a trained log analysis expert network.

[0093] In order to enable the large model to analyze and integrate log information from different sources, the embodiment of the present application can pre-construct a log analysis expert network of the large model. As mentioned above, the log analysis expert network includes user basic information analysis experts, terminal environment information analysis experts, security alarm information analysis experts and user behavior information analysis experts. Therefore, the embodiment of the present application can construct user basic information analysis experts, terminal environment information analysis experts, security alarm information analysis experts and user behavior information analysis experts, and then use the above-mentioned training data set to train the log analysis expert network.

[0094] It should be noted that each sample log information in the above-mentioned training data set can include four categories of sample sub-logs: basic user information, terminal environment information, security alert information, and user behavior information. Among them, basic user information can include at least one of account information, organizational relationship attributes, and permission information; terminal environment information can include at least one of the mobile terminal information used for user access, terminal security check information, network security detection information, terminal IP, and geographic location information; security alert information can include at least one of terminal environment detection, security rule detection, ALC blocking, abnormal access, sensitive data access, and data leakage; user behavior information can include at least one of user authentication information, application access information, user access IP, port, domain name, URL, access interaction data information, sensitive data access information, and user behavior statistics.

[0095] like Figure 5As shown, when training the log analysis expert network, the parameters of the base large model and log encoder are fixed, that is, the parameters of the base large model and log encoder do not participate in reverse gradient propagation. Specifically, after the log analysis expert network (including user basic information analysis experts, terminal environment information analysis experts, security alert information analysis experts, and user behavior information analysis experts) is constructed, the embodiment of the present application can traverse each sample log information in the log analysis expert network. The traversal process of a single sample log information is illustrated below: After obtaining the trained log encoder, the embodiment of the present application can input the currently traversed sample log information into the trained log encoder, so that the trained log encoder can encode the currently traversed sample log information, thereby obtaining the second sample log feature matrix of the currently traversed sample log information. For the specific encoding process, please refer to the above traversal process (i.e. Figure 3 and Figure 4 The processing flow of , will not be described here.

[0096] It should be noted that the first sample log feature matrix and the second sample log feature matrix are both obtained after the same sample log information is encoded by the log encoder. The difference is that the first sample log feature matrix is obtained by the encoding processing of the log encoder during the training process, and the second sample log feature matrix is obtained by the encoding processing of the log encoder after training.

[0097] Since the currently traversed sample log information includes sample sub-logs of different categories, the second sample log feature matrix of the sample log information may include sample embedding matrices of the sample sub-logs of different categories.

[0098] exist Figure 5 In the example, X is the second sample log feature matrix of the currently traversed sample log information, X1~X4 are the sample embedding matrices of the sample sub-logs of different categories in the second sample log feature matrix X. Specifically, X1 is the sample embedding matrix of user basic information in the second sample log feature matrix X, X2 is the sample embedding matrix of terminal environment information in the second sample log feature matrix X, X3 is the sample embedding matrix of security warning information in the second sample log feature matrix X, and X4 is the sample embedding matrix of user behavior information in the second sample log feature matrix X.

[0099] In this embodiment of the present application, the second sample log feature matrix X can be input into the base large model (qwen2.5 7B), so that the base large model can output the second sample trust evaluation result of the currently traversed sample log information based on the second sample log feature matrix X: W0X, where , d is 3584, and W0 is the weight matrix of the base large model (qwen2.5 7B).

[0100] It should be noted that the first sample trust evaluation result and the second sample trust evaluation result are both trust evaluation results output by the base large model for the same sample log information. The difference is that the first sample trust evaluation result is obtained by evaluating the encoding result (i.e., the first sample log feature matrix) output by the base large model based on the log encoder during the training process for the sample log information, and the second sample trust evaluation result is obtained by evaluating the encoding result (i.e., the second sample log feature matrix) output by the base large model based on the trained log encoder for the sample log information. In addition, the first sample trust evaluation result requires prompt words to guide the base large model for structured output, while the second sample trust evaluation result does not require prompt words to guide the base large model for structured output.

[0101] While inputting the second sample log feature matrix X into the base large model (qwen2.5 7B), the embodiment of the present application can input the sample embedding matrices X1~X4 of the sample sub-logs of different categories in the second sample log feature matrix X into the log analysis expert network, so that the log analysis expert network can output the sample analysis results of the currently traversed sample log information based on the sample embedding matrices X1~X4 of the sample sub-logs of different categories in the second sample log feature matrix X. Specifically, Figure 5 As shown, the user basic information analysis expert, terminal environment information analysis expert, security warning information analysis expert and user behavior information analysis expert all adopt lora (low-rank adaptation) design. In the embodiment of the present application, the sample embedding matrix X1 of the user basic information can be input into the user basic information analysis expert, so that the user basic information analysis expert can output the first analysis result of the user basic information based on the sample embedding matrix X1 of the user basic information: B1A1X1, where B1A1 is the low-rank adaptation weight parameter matrix of the user basic information analysis expert. , , r is 512. At the same time, the embodiment of the present application can input the sample embedding matrix X2 of the terminal environment information to the terminal environment information analysis expert, so that the terminal environment information analysis expert can output the second analysis result of the terminal environment information based on the sample embedding matrix X2 of the terminal environment information: B2A2X2, wherein B2A2 is the low-rank adaptive weight parameter matrix of the terminal environment information analysis expert, B2 has the same structure as B1, and A2 has the same structure as A1. At the same time, the embodiment of the present application can input the sample embedding matrix X3 of the security alarm information to the security alarm information analysis expert, so that the security alarm information analysis expert can output the third analysis result of the security alarm information based on the sample embedding matrix X3 of the security alarm information: B3A3X3, wherein B3A3 is the low-rank adaptive weight parameter matrix of the security alarm information analysis expert, B3 has the same structure as B1, and A3 has the same structure as A1. At the same time, the embodiment of the present application can input the sample embedding matrix X4 of the user behavior information into the user behavior information analysis expert, so that the user behavior information analysis expert can output the fourth analysis result of the user behavior information based on the sample embedding matrix X4 of the user behavior information: B4A4X4, where B4A4 is the low-rank adaptive weight parameter matrix of the user behavior information analysis expert, B4 has the same structure as B1, and A4 has the same structure as A1. After obtaining the first analysis result, the second analysis result, the third analysis result, and the fourth analysis result respectively, the first analysis result, the second analysis result, the third analysis result, and the fourth analysis result can be spliced together through the feature splicing module to obtain the sample analysis result of the currently traversed sample log information: [B1A1X1, B2A2X2, B3A3X3, B4A4X4].

[0102] After obtaining the second sample trust evaluation result (W0X) and the sample analysis result ([B1A1X1, B2A2X2, B3A3X3, B4A4X4]) of the currently traversed sample log information, the embodiment of the present application can use the sample analysis result ([B1A1X1, B2A2X2, B3A3X3, B4A4X4]) to adjust the second sample trust evaluation result (W0X), thereby obtaining the comprehensive sample trust evaluation result h of the currently traversed sample log information. Specifically, Figure 5 As shown, in the embodiment of the present application, the sample analysis result ([B1A1X1, B2A2X2, B3A3X3, B4A4X4]) can be added to the second sample trust evaluation result (W0X) through the feature addition module to obtain the comprehensive sample trust evaluation result h of the currently traversed sample log information, which is specifically as follows:

[0103] As mentioned above, , d is 3584, W0 is the weight matrix of the base large model (qwen2.5 7B), B1A1, B2A2, B3A3, and B4A4 are the low-rank adaptive weight parameter matrices of the user basic information analysis expert, terminal environment information analysis expert, security alarm information analysis expert, and user behavior information analysis expert, respectively. , , r is 512, B2, B3, and B4 have the same structure as B1, A2, A3, and A4 have the same structure as A1, and Concat is an operation to concatenate the first analysis result output by the user basic information analysis expert, the second analysis result output by the terminal environment information analysis expert, the third analysis result output by the security alarm information analysis expert, and the fourth analysis result output by the user behavior information analysis expert.

[0104] After obtaining the comprehensive sample trust evaluation result h of the currently traversed sample log information, the embodiment of the present application can calculate the second cross-entropy loss of the comprehensive sample trust evaluation result h of the currently traversed sample log information and the labeled information, so as to use the currently calculated second cross-entropy loss to update the parameters of the log analysis expert network (including user basic information analysis experts, terminal environment information analysis experts, security alarm information analysis experts and user behavior information analysis experts) through reverse gradient propagation.

[0105] Then, the next sample log information is traversed until the second cross entropy loss is less than or equal to the second loss threshold, thereby obtaining a trained log analysis expert network. It should be noted that the traversal process of each sample log information in the log analysis expert network is specifically referred to the above traversal process (i.e. Figure 5 The processing flow of , will not be described here.

[0106] As can be seen from this example, the solution provided by this application, by utilizing the powerful language understanding ability of the large model, can achieve efficient and accurate analysis of zero-trust user-related logs, significantly improving the efficiency, accuracy and generalization ability of continuous trust assessment, and by flexibly using prompt words, the large model can quickly respond to new threats, thereby effectively solving the problems of massive data processing, the balance between accuracy and efficiency, and the lack of adaptability to new threats.

[0107] Furthermore, the solution provided by this application, by constructing multiple cascaded transformer blocks in the log encoder, enables the trained log encoder to better extract high-order information of the target log information. In this way, the encoding processing of the target log information by the trained log encoder can greatly improve the large model's ability to parse and judge the target log information.

[0108] Furthermore, in the solution provided by the present application, the target log information covers rich information such as user basic information, terminal environment information, security alert information and user behavior information. The log analysis expert network includes user basic information analysis experts, terminal environment information analysis experts, security alert information analysis experts and user behavior information analysis experts. Through the user basic information analysis experts, the network security situation of user basic information can be deeply observed and accurately analyzed, and through the terminal environment information analysis experts, the network security situation of terminal environment information can be deeply observed and accurately analyzed, and through the security alert information analysis experts, the network security situation of security alert information can be deeply observed and accurately analyzed, and through the user behavior information analysis experts, the network security situation of user behavior information can be deeply observed and accurately analyzed. Therefore, the log analysis expert network can greatly enhance the prediction and response speed of network security threats.

[0109] Corresponding to the aforementioned application function implementation method embodiment, the present application also provides a zero-trust continuous trust assessment device, an electronic device and corresponding embodiments.

[0110] Figure 6 Schematic diagram of the structure of the zero-trust continuous trust evaluation device shown in an embodiment of the present application.

[0111] See also Figure 6 , the present application provides a zero-trust continuous trust evaluation device, which may include: The first acquisition module 610 is used to acquire the user's target log information and a preset prompt word when receiving a user's access request; The first evaluation module 620 is used to input the target log information and prompt words into the large model, so as to use the large model to perform a trust evaluation on the user based on the target log information, and to output the target trust evaluation result of the user in a structured manner under the guidance of the prompt words through the large model; The response module 630 is configured to respond to the access request according to the target trust evaluation result.

[0112] In one embodiment, before inputting the target log information and prompt words into the large model, the device may include: The first encoding module is used to input the target log information and the prompt word into a pre-trained log encoder to encode the target log information through the log encoder to obtain a target log feature matrix, and to encode the prompt word through the log encoder to obtain a target prompt word feature matrix; The first splicing module is used to splice the target log feature matrix and the target prompt word feature matrix to obtain a target splicing feature matrix.

[0113] In one embodiment, the large model includes a base large model and a pre-trained log analysis expert network, the target log information includes target sub-logs of different categories, and the target log feature matrix includes target embedding matrices of target sub-logs of different categories; the first evaluation module 620 may include: An evaluation submodule, configured to input the target splicing feature matrix into the base large model, so as to perform a trust evaluation on the user based on the target log feature matrix in the target splicing feature matrix through the base large model, and obtain an initial trust evaluation result of the user; and The first analysis submodule is configured to input the target embedding matrices of target sub-logs of different categories into the log analysis expert network, so as to analyze the network security situation of the target sub-logs of different categories based on the target embedding matrices of the target sub-logs of different categories through the log analysis expert network to obtain target analysis results; The first adjustment submodule is used to adjust the initial trust evaluation result by using the target analysis result through the large model, and to output the user's target trust evaluation result in a structured manner under the guidance of the target prompt word feature matrix in the target splicing feature matrix through the large model.

[0114] In one embodiment, different categories of target sub-logs include basic user information, terminal environment information, security warning information, and user behavior information. The log analysis expert network includes experts in user basic information analysis, terminal environment information analysis, security warning information analysis, and user behavior information analysis. The first analysis sub-module may include: A first analysis unit is configured to input the target embedding matrix of the user basic information into a user basic information analysis expert, so that the user basic information analysis expert analyzes the network security situation of the user basic information based on the target embedding matrix of the user basic information to obtain a first analysis result; and a second analysis unit, configured to input the target embedding matrix of the terminal environment information into a terminal environment information analysis expert, so that the terminal environment information analysis expert analyzes the network security situation of the terminal environment information based on the target embedding matrix of the terminal environment information to obtain a second analysis result; and a third analysis unit, configured to input the target embedding matrix of the security alert information into the security alert information analysis expert, so that the security alert information analysis expert analyzes the network security situation of the security alert information based on the target embedding matrix of the security alert information to obtain a third analysis result; and a fourth analysis unit, configured to input the target embedding matrix of the user behavior information into the user behavior information analysis expert, so that the user behavior information analysis expert analyzes the network security situation of the user behavior information based on the target embedding matrix of the user behavior information to obtain a fourth analysis result; The splicing unit is used to splice the first analysis result, the second analysis result, the third analysis result and the fourth analysis result to obtain a target analysis result.

[0115] In one embodiment, the target trust assessment result includes a security reputation level and a security reputation evaluation; the response module 630 may include: The first response submodule is configured to allow the user's access request if the security reputation level is normal or good, and assign corresponding access rights to the user based on the security reputation evaluation; or The second response submodule is used to reject the user's access request if the security reputation level indicates high risk or suspiciousness.

[0116] In one embodiment, the log encoder includes an embedding module and a transformer encoder, wherein the transformer encoder includes multiple transformer modules in cascade. The log encoder can be trained by the following modules: The sample data acquisition module is used to obtain multiple sample log information; wherein each sample log information includes annotation information; A second encoding module is used to input each sample log information into the embedding module, so as to encode each sample log information through the embedding module to obtain an embedding tensor of each sample log information; An extraction module, configured to input each embedding tensor into a plurality of transformer modules, so as to extract high-order information of each sample log information based on each embedding tensor through the plurality of transformer modules to obtain a first sample log feature matrix of each sample log information; A second evaluation module is configured to input each first sample log feature matrix and prompt word into the base large model, so as to output a structured first sample trust evaluation result of each sample log information based on each first sample log feature matrix and prompt word through the base large model; A first calculation module is used to calculate a first cross entropy loss between a first sample trust evaluation result and the annotation information belonging to the same sample log information; The first updating module is configured to update the parameters of the log encoder by using a first cross entropy loss through reverse gradient propagation until the first cross entropy loss is less than or equal to a first loss threshold, thereby obtaining a trained log encoder.

[0117] In one embodiment, each sample log information includes sample sub-logs of different categories; the log analysis expert network can be trained through the following modules: A third encoding module is configured to encode each sample log information using a trained log encoder to obtain a second sample log feature matrix for each sample log information; each second sample log feature matrix includes a sample embedding matrix for a sample sub-log of a different category; a third evaluation module, configured to input each second sample log feature matrix into the base large model, so as to output a second sample trust evaluation result of each sample log information based on each second sample log feature matrix through the base large model; and a second analysis module, configured to input the sample embedding matrices of the sample sub-logs of different categories in each second sample log feature matrix into the log analysis expert network, so as to output a sample analysis result of each sample log information based on the sample embedding matrices of the sample sub-logs of different categories in each second sample log feature matrix through the log analysis expert network; A second adjustment module is configured to adjust the second sample trust evaluation result of each sample log information using the sample analysis result of each sample log information to obtain a comprehensive sample trust evaluation result of each sample log information; A second calculation module is used to calculate a second cross entropy loss of a comprehensive second sample trust evaluation result and the annotation information belonging to the same sample log information; The second update module is used to update the parameters of the log analysis expert network by using the second cross entropy loss through reverse gradient propagation until the second cross entropy loss is less than or equal to the second loss threshold, thereby obtaining a trained log analysis expert network.

[0118] As can be seen from this example, the solution provided by this application obtains the user's target log information and a pre-set prompt word when receiving a user's access request; inputs the target log information and prompt word into the large model, so as to conduct a trust assessment on the user based on the target log information through the large model, and outputs the user's target trust assessment result in a structured manner under the guidance of the prompt word through the large model; and responds to the access request based on the target trust assessment result. This application utilizes the powerful language understanding ability of the large model to achieve efficient and accurate analysis of zero-trust user-related logs, significantly improving the efficiency, accuracy and generalization ability of continuous trust assessment, and through the flexible use of prompt words, the large model can quickly respond to new threats, thereby effectively solving the problem of massive data processing, the problem of balancing accuracy and efficiency, and the problem of insufficient adaptability to new threats.

[0119] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated again here.

[0120] Figure 7It is a structural diagram of an electronic device shown in an embodiment of the present application.

[0121] See also Figure 7 , the electronic device 700 includes a memory 710 and a processor 720.

[0122] The processor 720 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. Memory 710 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage. ROM may store static data or instructions required by processor 720 or other computer modules. Permanent storage may be a readable and writable storage device. Permanent storage may be a non-volatile storage device that maintains stored instructions and data even when the computer is powered off. In some embodiments, the permanent storage device utilizes a mass storage device (e.g., a magnetic or optical disk, flash memory). In other embodiments, the permanent storage device may be a removable storage device (e.g., a floppy disk, optical drive). System memory may be a readable and writable storage device or a volatile readable and writable storage device, such as dynamic random access memory (DRAM). System memory may store some or all instructions and data required by the processor during operation. Furthermore, memory 710 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (e.g., DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), as well as magnetic disks and / or optical disks. In some embodiments, the memory 710 may include a readable and / or writable removable storage device, such as a compact disc (CD), a read-only digital versatile disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, an ultra-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not include carrier waves and transient electronic signals transmitted wirelessly or wired.

[0123] The memory 710 stores executable codes. When the executable codes are processed by the processor 720 , the processor 720 may execute part or all of the above-mentioned methods.

[0124] In addition, the method according to the present application may also be implemented as a computer program or a computer program product, which includes computer program code instructions for executing some or all of the steps in the above method of the present application.

[0125] Alternatively, the present application can also be implemented as a computer-readable storage medium (or non-transitory machine-readable storage medium or machine-readable storage medium), which stores executable code (or computer program or computer instruction code) and, when executed by a processor of an electronic device (or server, etc.), enables the processor to perform part or all of the steps of the above-mentioned method according to the present application.

[0126] The present application also provides a computer program product, which includes computer instructions, and when the computer instructions are executed by a processor, the method described above is implemented.

[0127] The embodiments of the present application have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A zero-trust continuous trust assessment method, characterized in that: The method comprises: When receiving a user's access request, obtaining the user's target log information and a preset prompt word; Inputting the target log information and the prompt word into a large model, so as to perform a trust evaluation on the user based on the target log information through the large model, and outputting a target trust evaluation result of the user in a structured manner through the large model under the guidance of the prompt word; The access request is responded to according to the target trust evaluation result.

2. The method according to claim 1, characterized in that Before inputting the target log information and the prompt word into the large model, the method further includes: Inputting the target log information and the prompt word into a pre-trained log encoder to encode the target log information through the log encoder to obtain a target log feature matrix, and encoding the prompt word through the log encoder to obtain a target prompt word feature matrix; The target log feature matrix and the target prompt word feature matrix are spliced together to obtain a target spliced feature matrix.

3. The method according to claim 2, characterized in that The large model includes a base large model and a pre-trained log analysis expert network. The target log information includes target sub-logs of different categories. The target log feature matrix includes target embedding matrices of the target sub-logs of different categories. The target log information and the prompt word are input into the large model to perform a trust assessment on the user based on the target log information by the large model. The large model outputs a structured target trust assessment result of the user under the guidance of the prompt word, including: Inputting the target splicing feature matrix into the base large model, so as to perform a trust evaluation on the user based on the target log feature matrix in the target splicing feature matrix by the base large model, and obtain an initial trust evaluation result of the user; and Inputting the target embedding matrices of the target sub-logs of different categories into the log analysis expert network, so as to analyze the network security situation of the target sub-logs of different categories based on the target embedding matrices of the target sub-logs of different categories by the log analysis expert network to obtain target analysis results; The target analysis result is adopted by the large model to adjust the initial trust evaluation result, and the target trust evaluation result of the user is structuredly output by the large model under the guidance of the target prompt word feature matrix in the target splicing feature matrix.

4. The method according to claim 3, characterized in that The target sub-logs of different categories include user basic information, terminal environment information, security warning information and user behavior information. The log analysis expert network includes user basic information analysis experts, terminal environment information analysis experts, security warning information analysis experts and user behavior information analysis experts. The target embedding matrices of the target sub-logs of different categories are input into the log analysis expert network, so that the network security situation of the target sub-logs of different categories is analyzed by the log analysis expert network based on the target embedding matrices of the target sub-logs of different categories, and target analysis results are obtained, including: Inputting the target embedding matrix of the user basic information into the user basic information analysis expert, so that the user basic information analysis expert analyzes the network security situation of the user basic information based on the target embedding matrix of the user basic information to obtain a first analysis result; and inputting the target embedding matrix of the terminal environment information into the terminal environment information analysis expert, so that the terminal environment information analysis expert analyzes the network security situation of the terminal environment information based on the target embedding matrix of the terminal environment information to obtain a second analysis result; and inputting the target embedding matrix of the security alert information into the security alert information analysis expert, so that the security alert information analysis expert analyzes the network security situation of the security alert information based on the target embedding matrix of the security alert information to obtain a third analysis result; and inputting the target embedding matrix of the user behavior information into the user behavior information analysis expert, so that the user behavior information analysis expert analyzes the network security situation of the user behavior information based on the target embedding matrix of the user behavior information to obtain a fourth analysis result; The first analysis result, the second analysis result, the third analysis result and the fourth analysis result are spliced together to obtain a target analysis result.

5. The method according to claim 1, wherein The target trust evaluation result includes a security reputation level and a security reputation evaluation; and responding to the access request according to the target trust evaluation result includes: If the security reputation level indicates normal or good, then the user's access request is allowed, and corresponding access rights are allocated to the user based on the security reputation evaluation; or If the security reputation level indicates high risk or suspicion, the user's access request is rejected.

6. The method according to claim 2, characterized in that The log encoder includes an embedding module and a transformer encoder, wherein the transformer encoder includes a plurality of cascaded transformer modules; the log encoder is trained in the following manner: Acquire multiple sample log information; wherein each of the sample log information includes annotation information; Inputting each of the sample log information into the embedding module, so as to encode each of the sample log information through the embedding module to obtain an embedding tensor of each of the sample log information; Inputting each of the embedding tensors into the multiple transformer modules, so as to extract high-order information of each of the sample log information based on each of the embedding tensors through the multiple transformer modules to obtain a first sample log feature matrix of each of the sample log information; Inputting each of the first sample log feature matrices and the prompt words into a base large model, so as to output a first sample trust evaluation result of each of the sample log information in a structured manner based on each of the first sample log feature matrices and the prompt words through the base large model; Calculating a first cross entropy loss between the first sample trust evaluation result and the labeled information belonging to the same sample log information; The first cross entropy loss is used to update the parameters of the log encoder through reverse gradient propagation until the first cross entropy loss is less than or equal to a first loss threshold, thereby obtaining a trained log encoder.

7. The method according to claims 3 and 6, characterized in that Each of the sample log information includes sample sub-logs of different categories; the log analysis expert network is trained in the following way: Encoding each of the sample log information using the trained log encoder to obtain a second sample log feature matrix for each of the sample log information; each of the second sample log feature matrices includes a sample embedding matrix of the sample sub-logs of different categories; Inputting each of the second sample log feature matrices into the base large model, so as to output a second sample trust evaluation result of each of the sample log information based on each of the second sample log feature matrices through the base large model; as well as, Inputting the sample embedding matrices of the sample sub-logs of different categories in each of the second sample log feature matrices into the log analysis expert network, so as to output sample analysis results of each of the sample log information based on the sample embedding matrices of the sample sub-logs of different categories in each of the second sample log feature matrices through the log analysis expert network; Using the sample analysis results of each of the sample log information, adjusting the second sample trust evaluation results of each of the sample log information to obtain a comprehensive sample trust evaluation result of each of the sample log information; Calculating a second cross entropy loss between the comprehensive sample trust evaluation result and the annotation information belonging to the same sample log information; The second cross entropy loss is used to update the parameters of the log analysis expert network through reverse gradient propagation until the second cross entropy loss is less than or equal to the second loss threshold, thereby obtaining a trained log analysis expert network.

8. A zero-trust continuous trust assessment device, characterized in that: The device comprises: A first acquisition module is configured to acquire target log information of a user and a preset prompt word upon receiving an access request from the user; A first evaluation module is configured to input the target log information and the prompt word into a large model, so as to perform a trust evaluation on the user based on the target log information through the large model, and output a structured target trust evaluation result of the user through the large model under the guidance of the prompt word; A response module is used to respond to the access request according to the target trust evaluation result.

9. An electronic device, characterized in that: include: processor; as well as A memory having executable codes stored thereon, which, when executed by the processor, causes the processor to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable codes stored thereon, wherein when the executable codes are executed by a processor of an electronic device, the processor is caused to execute the method according to any one of claims 1 to 7.

Images