Access control policy generation method, device, medium, equipment and product for cloud security

Abstract

A method, device, medium, equipment and product for generating an access control policy for cloud security. The method comprises: generating an access control policy for a first current round according to a generalization parameter for the first current round; inputting the access control policy for the first current round and the generalization parameter for the first current round into a large model; when the first current round is not the first round, inputting at least one access control policy generated by the large model in history and the generalization parameter according to which each of the access control policies generated in history is generated into the large model; if the output of the large model includes a second generalization parameter, returning to the step of generating the access control policy for the first current round according to the generalization parameter for the first current round, and taking the second generalization parameter as the generalization parameter for the first current round; and if the output of the large model includes an access control policy meeting a condition, determining the policy as the access control policy for the service. The inference capability of the large model is utilized to automatically complete the evaluation of the access control policy, and the policy meeting the condition is selected.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of security technology, in particular, to a method, device, medium, equipment and product for generating an access control policy for cloud security. BACKGROUND

[0002] Mandatory access control (MAC) is a core mechanism of operating system security, which realizes controlled access of a subject to an object through security attributes and policy rules. At present, static analysis oriented methods, dynamic monitoring oriented methods, and machine learning assisted methods are usually used for MAC policy generation. However, the MAC policies generated by these methods have poor generalization ability, and the threshold for generating the MAC policies is too high, for example, highly dependent on expert knowledge and business context information, more human intervention, and insufficient automation. SUMMARY

[0003] This summary is provided to introduce a selection of concepts that are further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it used to limit the scope of the claimed subject matter's scope.

[0004] In a first aspect, the present disclosure provides a method for generating an access control policy for cloud security, comprising: obtaining behavior data related to a first service; determining a first generalization parameter according to the behavior data; taking the first generalization parameter as a generalization parameter of a first current round; generating an access control policy of the first current round according to the generalization parameter of the first current round; inputting the access control policy of the first current round and the generalization parameter of the first current round into a first large model; and when the first current round is not the first round, inputting at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter on which the first large model generates each of the history generated access control policies into the first large model; wherein the first large model is used to evaluate the input access control policy to find an access control policy meeting a first preset condition; if the first large model does not output an access control policy meeting the first preset condition, and the output of the first large model includes a second generalization parameter, returning to the step of generating an access control policy of the first current round according to the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round; if the output of the first large model includes an access control policy meeting the first preset condition, determining the access control policy meeting the first preset condition as the access control policy of the first service.

[0005] In a second aspect, the present disclosure provides an access control policy generation apparatus for cloud security, comprising: an acquisition module configured to acquire behavior data related to a first service; a first determination module configured to determine a first generalization parameter according to the behavior data; a second determination module configured to take the first generalization parameter as a generalization parameter of a first current round; a first generation module configured to generate an access control policy of the first current round according to the generalization parameter of the first current round; a first evaluation module configured to: input the access control policy of the first current round and the generalization parameter of the first current round into a first large model; and when the first current round is a non-first round, input at least one access control policy generated by the first large model for a history of the behavior data and a generalization parameter on which the first large model generates each of the history-generated access control policies into the first large model; wherein the first large model is configured to evaluate the input access control policies to find an access control policy meeting a first preset condition; a first triggering module configured to, if the first large model does not output an access control policy meeting the first preset condition and the output of the first large model includes a second generalization parameter, trigger the first generation module to generate an access control policy of the first current round according to the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round; and a third determination module configured to, if the output of the first large model includes an access control policy meeting the first preset condition, determine the access control policy meeting the first preset condition as an access control policy of the first service.

[0006] In a third aspect, the present disclosure provides a computer readable medium having stored thereon a computer program, which, when executed by a processing apparatus, implements the steps of the access control policy generation method for cloud security provided in the first aspect of the present disclosure.

[0007] In a fourth aspect, the present disclosure provides an electronic device, comprising: a storage apparatus having stored thereon a computer program; and a processing apparatus configured to execute the computer program in the storage apparatus to implement the steps of the access control policy generation method for cloud security provided in the first aspect of the present disclosure.

[0008] In a fifth aspect, the present disclosure provides a computer program product comprising a computer program, which, when executed by a processor, implements the steps of the access control policy generation method for cloud security provided in the first aspect of the present disclosure.

[0009] In the technical solution, after obtaining the behavior data related to the first service, the first generalization parameter is determined according to the behavior data; then, the first generalization parameter is taken as the generalization parameter of the first current round, and the access control policy of the first current round is generated according to the generalization parameter of the first current round; next, the access control policy of the first current round and the generalization parameter of the first current round are input into the first large model, and at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter on which the first large model generates each historical generated access control policy are input into the first large model when the first current round is a non-first round; wherein, the first large model is used to evaluate the input access control policy to find out the access control policy meeting the first preset condition; if the first large model does not output the access control policy meeting the first preset condition, and the output of the first large model includes the second generalization parameter, the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round, and the step of generating the access control policy of the first current round according to the generalization parameter of the first current round is returned; if the output of the first large model includes the access control policy meeting the first preset condition, the access control policy meeting the first preset condition is determined as the access control policy of the first service. The strategy evaluation method based on the large model and using the reasoning and action process can utilize the reasoning capability of the large model to automatically complete the evaluation of the access control policy, and select the access control policy meeting the first preset condition from the evaluation, without relying on expert knowledge and business context information, and without manual access, so as to generate the access control policy capable of balancing the performance of each aspect.

[0010] Other features and advantages of the present disclosure will be described in detail in the following detailed description section. BRIEF DESCRIPTION OF DRAWINGS

[0011] The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings in which:

[0012] Figure 1 is a flowchart of a method for generating an access control policy for cloud security according to an exemplary embodiment.

[0013] Figure 2 is a schematic diagram of a tree structure corresponding to a plurality of first file access paths according to an exemplary embodiment.

[0014] Figure 3 is a process schematic diagram of generating an access control policy of a first current round according to a generalization parameter of the first current round according to an exemplary embodiment.

[0015] Figure 4 is a flowchart of a method for generating an access control policy for cloud security according to another exemplary embodiment.

[0016] Figure 5 is a schematic diagram of a process for generating an access control policy for cloud security according to an exemplary embodiment.

[0017] Figure 6 is a block diagram of an apparatus for generating an access control policy for cloud security according to an exemplary embodiment.

[0018] Figure 7 is a structural schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0019] Before describing the specific embodiments of the present disclosure, first, the technical terms related to the present disclosure are introduced.

[0020] Mandatory access control: In computer security, mandatory access control is a type of access control by which a security environment (e.g., an operating system or a database) restricts the ability of a subject or initiator to access or modify an object or target. In an operating system, the subject is a process or thread, and the object is a file, a directory, an Internet Protocol address, a Transmission Control Protocol (TCP) / User Datagram Protocol (UDP) port, a shared memory segment, or an input / output device, etc. Both the subject and the object have a set of security attributes. Whenever a subject attempts to access an object, the operating system kernel checks these security attributes, checks the existing authorization rules (also known as policies), and decides whether to grant access. In mandatory access control, the access control policy (hereinafter collectively referred to as Profile) is centrally controlled by a policy administrator and is guaranteed (in principle) to be implemented for all users.

[0021] Container Mandatory Access Control: Container technology is the core and foundation of the cloud-native field. The emergence of Linux containers, container images, and container orchestration technologies has brought higher resource utilization and development efficiency. While people enjoy the performance and convenience brought by Linux containers, they also face security issues such as weak isolation of Linux containers. Therefore, container runtime components and container orchestration systems have added support for Application Armor (AppArmor) and Security-Enhanced Linux (SELinux), allowing users to use them in conjunction with corresponding access control policies to perform mandatory access control on containers, thereby securing Linux containers.

[0022] When users use AppArmor and SELinux to perform mandatory access control on Linux containers, they can choose to use the default policy of the container runtime component or a custom access control policy.

[0023] When implementing mandatory access control policies, the two common modes are default allow and default deny. Among them, default allow (Allow-by-Default): setting the default operation of the mandatory access control policy to "allow" usually means adopting a more open policy approach, i.e., preventing content by defining rules. For example, content filtering rules will take "deny" action for unwanted categories. This is a policy type where everything is allowed except for specific website lists and / or categories. This type of policy is usually easier to manage, but at the same time, it has lower security because any content not explicitly denied will be allowed. To ensure compatibility, the default policy of the container runtime component uses the default allow mode, but it has the security risk of a large attack surface.

[0024] Among them, default deny (Deny-by-Default) is to set the default operation of the mandatory access control policy to "deny", which is similar to a firewall policy, i.e., everything is denied unless explicitly allowed. This type of policy has higher security, but requires more management and is more difficult to develop. Administrators using the default deny policy need to develop fine-grained rules, listing all the required permissions for the target (such as allowing access to which files, executing which programs, using which operating system capabilities), and operations not listed will be denied by default.

[0025] The Reasoning and Action (ReAct) process is the core workflow of the ReAct agent framework, which is an agent process combining reasoning and action. Through dynamic environment perception, multi-step decision-making and feedback adjustment, the automatic solution of complex tasks is realized.

[0026] Embodiments of the present disclosure will be described below in greater detail with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be construed as being limited to the embodiments set forth herein, but rather, these embodiments are provided so that the present disclosure can be more thoroughly and completely understood. It should be understood that the drawings and embodiments of the present disclosure are only for illustrative purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that each of the steps described in the method embodiments of the present disclosure can be performed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "comprising" and variations thereof as used herein are open-ended, and mean "including but not limited to". The term "based on" means "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related definitions are given below.

[0029] It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the adjectives "one", "multiple" mentioned in the present disclosure are illustrative and not limiting, and those skilled in the art should understand that "one or more" should be understood unless the context clearly indicates otherwise.

[0031] The names of the messages or information exchanged between the multiple devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0032] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type of information involved in the present disclosure, the use range, the use scenario, etc. should be informed to the relevant user and the authorization of the relevant user should be obtained through appropriate means according to relevant laws and regulations, wherein the relevant user can include any type of right subject, such as an individual, an enterprise, or a group.

[0033] For example, in response to receiving an active request of a user, a prompt information is sent to the relevant user to explicitly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can voluntarily choose whether to provide the information to the software or hardware such as an electronic device, an application program, a server or a storage medium, etc. performing the operation of the technical solutions of the present disclosure according to the prompt information.

[0034] As an optional but non-limiting implementation manner, in response to receiving an active request of the relevant user, the prompt information can be sent to the relevant user in the form of a pop-up window, and the prompt information can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry selection controls for the user to select "agree" or "disagree" to provide information to the electronic device.

[0035] It can be understood that the above notification and user authorization process is only illustrative and does not limit the implementation of the present disclosure, and other ways that meet the relevant laws and regulations can also be applied to the implementation of the present disclosure.

[0036] It can be understood that the data involved in the present technical solution (including but not limited to the data itself, the obtaining, use, storage or deletion of the data) should comply with the requirements of the relevant laws and regulations and the relevant provisions.

[0037] Figure 1 is a flowchart of a method for generating an access control policy for cloud security according to an example embodiment. As shown in Figure 1 The method for generating an access control policy for cloud security can include the following S101-S107.

[0038] In S101, behavior data related to a first service is obtained.

[0039] In the present disclosure, the behavior data related to the first service can be collected by a behavior monitoring technology, for example, using the behavior modeling function of an open source cloud native container sandbox system, collecting file access, process startup, permission use, network access, etc. behavior data of the containerized microservice (i.e. the first service) during running. Wherein the first service can be a microservice.

[0040] In S102, a first generalization parameter is determined according to the behavior data.

[0041] In S103, the first generalization parameter is taken as the generalization parameter of the first current round.

[0042] In S104, the access control policy of the first current round is generated according to the generalization parameter of the first current round.

[0043] In the present disclosure, the behavior data related to the first service can be generalized according to the generalization parameter of the first current round to generate the access control policy of the first current round.

[0044] In S105, the access control policy of the first current round and the generalization parameter of the first current round are input into the first large model, and when the first current round is a non-first round, at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter according to which the first large model generates each of the history-generated access control policies are also input into the first large model.

[0045] In the present disclosure, when the first current round is a first round, the input of the first large model includes the access control policy of the first current round and the generalization parameter of the first current round. When the first current round is a non-first round, the input of the first large model includes the access control policy of the first current round and the generalization parameter of the first current round, and also includes at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter according to which the first large model generates each of the history-generated access control policies.

[0046] The large model can include any one of a large language model, a visual large model, a speech large model, a multi-modal large model, or a combination of multiple thereof. The present disclosure can use an existing large model for access control policy evaluation or path generalization processing, and the output of the model can be guided by a prompt word.

[0047] In S106, if the first large model does not output an access control policy meeting the first preset condition, and the output of the first large model includes a second generalization parameter, the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round.

[0048] In S107, if the output of the first large model includes an access control policy meeting the first preset condition, the access control policy meeting the first preset condition is determined as the access control policy of the first service.

[0049] When the first large model does not output an access control policy meeting the first preset condition, and the output of the first large model includes a second generalization parameter, it indicates that the first large model does not find an access control policy meeting the first preset condition from the input access control policy. At this time, the second generalization parameter output by the first large model can be used as the generalization parameter of the first current round, and then the above S104 is returned. When the first large model outputs an access control policy meeting the first preset condition, it indicates that the first large model finds an access control policy meeting the first preset condition from the input access control policy. At this time, the access control policy meeting the first preset condition can be determined as the access control policy of the first service.

[0050] The first preset condition can be an access control policy with a total score greater than a preset threshold in the access control policy input to the first large model, wherein the total score is a weighted sum of scores of various aspects of performance.

[0051] In the present disclosure, an evaluator (Evaluator) for evaluating access control policies and a generator (Generator) for generating access control policies are abstracted. The Evaluator is an LM Agent based on a large model (Large Model, LM) and using a ReAct process. The Evaluator takes the Generator as a tool that can be called by the large model, and generates and evaluates whether the generated access control policy meets the first preset condition based on the requirements of the prompt word. Finally, the Evaluator selects an access control policy with high robustness, generalization ability, and balanced security requirements from the generated access control policies, and gives a recommendation reason and optimization suggestion.

[0052] The Evaluator calls the Generator by calling an access control policy generator function (Profile Generator Function) to implement the calling of the Generator, so that the Generator performs generalization processing on the behavior data using the first current generalization parameter to generate an access control policy. The Generator can generate an access control policy with generalization ability based on behavior data and grouping algorithms, and in combination with the semantic recognition ability of the LM.

[0053] In addition, when the output of the first large model includes an access control policy meeting the first preset condition, the output can also include a recommendation reason at the same time, so as to facilitate the user to better understand and accept the recommended access control policy.

[0054] The first large model inputs the current generated access control policy, at least one access control policy generated by the first large model in history, and the generalization parameters relied on when generating the access control policies, into the first large model after generating the access control policy each time, to evaluate the access control policies by the inference ability of the first large model, so as to find an access control policy meeting the first preset condition from the access control policies. If the first large model does not find an access control policy meeting the first preset condition from the input access control policies, a new first current round generalization parameter (i.e., a second generalization parameter) can be determined according to the generalization parameter relied on when generating the first current round access control policy (i.e., a first current round generalization parameter), and the second generalization parameter is output. At this time, the access control policy can be continuously generated according to the new first current round generalization parameter, that is, the second generalization parameter is taken as the first current round generalization parameter, and the above S104 is returned. If the first large model finds an access control policy meeting the first preset condition from the input access control policies, the access control policy meeting the first preset condition is output. Then, the access control policy meeting the first preset condition can be determined as the access control policy of the first service, that is, an access control white list, that is, a default deny access control policy of the first service is obtained.

[0055] In the above technical solution, after obtaining the behavior data related to the first service, the first generalization parameter is determined according to the behavior data. Then, the first generalization parameter is taken as the first current round generalization parameter, and the first current round access control policy is generated according to the first current round generalization parameter. Next, the first current round access control policy and the first current round generalization parameter are input into the first large model, and at least one access control policy generated by the first large model in history and the generalization parameters relied on by the first large model when generating each historical access control policy are input into the first large model when the first current round is not the first round. The first large model is used to evaluate the input access control policy, so as to find an access control policy meeting the first preset condition from the access control policy. If the first large model does not output an access control policy meeting the first preset condition, and the output of the first large model includes a second generalization parameter, the second generalization parameter output by the first large model is taken as the first current round generalization parameter, and the step of generating the first current round access control policy according to the first current round generalization parameter is returned. If the output of the first large model includes an access control policy meeting the first preset condition, the access control policy meeting the first preset condition is determined as the access control policy of the first service. The strategy evaluation method based on a large model and using a reasoning and action process can automatically complete access control policy evaluation by using the inference ability of the large model, and select an access control policy meeting the first preset condition from the access control policy, without relying on expert knowledge, business context information, and manual access, so as to generate an access control policy capable of balancing various performances.

[0056] The specific implementation of determining the first generalization parameter according to the behavior data in S102 is described in detail below.

[0057] In a possible implementation, the first generalization parameter can be determined according to a second quantity of the behavior data. The second quantity is negatively correlated with the first generalization parameter, that is, the greater the second quantity, the smaller the first generalization parameter, and the smaller the second quantity, the greater the first generalization parameter.

[0058] The greater the second quantity, the greater the scale of the behavior data related to the first service, and accordingly, the rules in the generated access control policy are more fine-grained (that is, fine-grained), which affects the generalization capability of the access control policy. Therefore, the first generalization parameter is set smaller to increase the generalization degree, thereby reducing the number of rules in the access control policy generated based on the first generalization parameter and improving the generalization capability of the access control policy. Conversely, the smaller the second quantity, the smaller the scale of the behavior data related to the first service, and accordingly, the rules in the generated access control policy are more coarse-grained (that is, coarse-grained), which leads to overgeneralization of the access control policy. Therefore, the first generalization parameter is set larger to reduce the generalization degree, thereby increasing the number of rules in the access control policy generated based on the first generalization parameter and avoiding overgeneralization of the access control policy. Therefore, the generalization parameter determined based on the scale of the behavior data is used to perform generalization processing on the behavior data, which can improve the generalization capability of the generated access control policy.

[0059] Specifically, the first generalization parameter can be determined according to the second quantity of the behavior data through various implementations. In an implementation, a depth threshold can be used to perform fixed-depth grouping and generalization processing on the behavior data. At this time, the generalization parameter can be the depth threshold. Specifically, the second quantity of the behavior data can be obtained first, and then a first depth threshold corresponding to a quantity interval in which the second quantity is located can be determined according to a first correspondence relationship between the quantity interval and the depth threshold. Then, the first depth threshold is determined as the first generalization parameter.

[0060] In another implementation, a difference entropy threshold can be used to perform dynamic grouping and generalization processing on the behavior data. At this time, the generalization parameter can be the difference entropy threshold. Specifically, the second quantity of the behavior data can be obtained first, and then a first entropy difference threshold corresponding to a quantity interval in which the second quantity is located can be determined according to a second correspondence relationship between the quantity interval and the entropy difference threshold. Then, the first entropy difference threshold is determined as the first generalization parameter.

[0061] The specific implementation of generating the access control policy of the first current round according to the generalization parameter of the first current round in S104 is described in detail below. Specifically, S104 can include the following steps (1) to (5).

[0062] Step (1): Extract the file access paths in the behavior data to obtain a plurality of first file access paths.

[0063] Step (2): Construct a tree structure corresponding to the plurality of first file access paths.

[0064] For example, the plurality of first file access paths include three file access paths, which are / a / b / c / file1, / a / b / d / file2 and / a / x / y / file3, and the tree structure corresponding to the three file access paths is as shown in Figure 2

[0065] Step (3): Group the file access paths in the tree structure according to the generalization parameter of the first current round to obtain at least one first group.

[0066] Wherein, each file access path in the same first group has the same parent directory, and the depth of the parent directory is determined based on the generalization parameter of the first current round. As shown in Figure 3 The grouping mode can include fixed depth grouping and entropy difference dynamic grouping, and the user can freely select the grouping mode. Then, according to the user's selected grouping mode, the corresponding generalization parameter (i.e. depth threshold or entropy difference threshold) can be used for path grouping. When the user selects fixed depth grouping, the paths with a depth greater than or equal to the depth threshold in the tree structure can be found and grouped. When the user selects entropy difference dynamic grouping, the optimal aggregation level can be dynamically calculated to group the paths. Entropy difference dynamic grouping can better adapt to the actual behavior of microservices and improve security.

[0067] Step (4): For each first group in the at least one first group, the first group is processed by the second large model to obtain a first generalization path.

[0068] In the present disclosure, as shown in Figure 3 After effectively merging the file paths using the path grouping algorithm, all first groups generated can be traversed, and the randomness in the file paths of the traversed first groups can be identified and processed in combination with the semantic recognition ability of the LM to generate an access control policy. Wherein, the Generator can perform generalization processing on the grouped paths by calling the second LM.

[0069] ​After grouping the file paths, each group of paths will have a common parent directory. At this time, there can still be some variable elements in the file paths due to different conditions such as software version, runtime, and number of runs, including but not limited to random strings (such as hash, base64 encoded string, universally unique identifier), timestamp, time string, version number, number (such as 1.1, 1-1), etc. To avoid the problem that the generated access control policy lacks generalization ability due to these random contents, the semantic ability of the LM can be used to identify and replace the potential randomness in the file path, thereby significantly improving the generalization ability of the access control policy.

[0070] Specifically, the first group can be generalized by the second large model according to the number of downstream nodes of the parent directory in the first group to obtain a second generalized path. Then, the second large model is used to identify the random content in the second generalized path, and the wildcard is used to replace the random content to obtain the first generalized path.

[0071] In the present disclosure, considering the performance and cost factors, the LM can be used in combination with prompt engineering to process the grouped file paths. First, the first group can be generalized by the second LM according to the number of downstream nodes of the parent directory in the first group to obtain a second generalized path. Specifically, if the number of downstream nodes of the parent directory in the first group is all 1, the second generalized path is the parent directory in the first group / wildcard. If the number of downstream nodes of the parent directory in the first group is not all 1, or the number of downstream nodes of the parent directory in the first group is all greater than 1, i.e., there is a case where the number of downstream nodes of the parent directory in the first group is greater than 1, then the second generalized path is the parent directory in the first group / wildcard+ wildcard. Then, the second LM is used to identify the random part in the second generalized path and replace it with a wildcard.

[0072] In one possible implementation, the wildcard is “*”, where “*” represents matching any file under the current directory, excluding subdirectories and their files, and “**” represents matching any file under the current directory.

[0073] For example, the first group includes / a / b / c / file1 and / a / b / d / file2, the parent directory of the two file access paths in the first group is / a / b, and the number of downstream nodes of the parent directory “ / a / b” in the first group is all 2. Therefore, the second generalized path is “ / a / b / **”.

[0074] For another example, the first group includes / a / b / c / file1, / a / b / c / file2, the parent directory of the two file access paths in the first group is / a / b / c, the number of downstream nodes of the parent directory “ / a / b / c” in the first group is both 1, and the second generalized path is “ / a / b / c / *”.

[0075] For another example, the first group includes / a / b / c / file1, / a / b / c / d, the parent directory of the two file access paths in the first group is / a / b / c, the number of downstream nodes of the parent directory “ / a / b / c” in the first group is both 1, and the second generalized path is “ / a / b / c / *”.

[0076] For another example, the first group includes / a / b / c / file1, / a / b / c / d, the parent directory of the two file access paths in the first group is / a / b / c, the number of downstream nodes of the parent directory “ / a / b / c” in the first group is both 1, and the second generalized path is “ / a / b / c / *”.

[0077] For another example, the first group includes / a / b / c / file1, / a / b / d / , the parent directory of the two file access paths in the first group is / a / b, the number of downstream nodes of the parent directory “ / a / b” in the first group includes 1 and 2, and the second generalized path is “ / a / b / **”.

[0078] Step (5): determining all the first generalized paths and other rules as the access control policy of the first current round, wherein the other rules are the permission data in the behavior data except the plurality of first file access paths.

[0079] The following detailed description is made with respect to the grouping of the file access paths in the tree structure according to the first current round of the generalization parameter in step (3) above. Specifically, the grouping of the file access paths can be implemented in various embodiments. In one embodiment, a fixed-depth grouping method can be used for the grouping of the file access paths, i.e., the first current round of the generalization parameter is a first depth threshold. At this time, a second aggregation layer can be determined from the tree structure according to the first depth threshold, wherein the level of the second aggregation layer is equal to the first depth threshold. Then, the file access paths in the tree structure are grouped based on the second aggregation layer to obtain at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is the first depth threshold.

[0080] In the present disclosure, the fixed-depth grouping is the simplest and most direct grouping mode, which aggregates file paths into different groups according to a specified depth threshold. The higher the depth threshold, the finer the grouping granularity, and the lower the depth threshold, the coarser the grouping granularity. The fixed-depth grouping mode is particularly effective in complex application scenarios. In the present disclosure, the layers of the tree structure are numbered in a top-down order, wherein the layer of the root node of the tree structure is 1, i.e., the layer where the root node of the tree structure is located is the first layer.

[0081] For example, the tree structure corresponding to the plurality of first file access paths is as shown in FIG. 1. Figure 2 As shown in FIG. 1, the first depth threshold is 3, and the layer of the second aggregation layer is 3, i.e., the third layer of the tree structure in FIG. 1, that is, the layer where the node b and the node x are located. Thus, the file access paths in the third layer of the tree structure in FIG. 1 can be grouped to obtain a first group A and a first group B, wherein the first group A is { / a / b / c / file1, / a / b / d / file2}, and the first group B is { / a / x / y / file3}. The two file access paths in the first group A have the same parent directory “ / a / b / ”, and the depth of the parent directory “ / a / b / ” is the first depth threshold “3”. Figure 2 Figure 2 As shown in FIG. 1, the first depth threshold is 3, and the layer of the second aggregation layer is 3, i.e., the third layer of the tree structure in FIG. 1, that is, the layer where the node b and the node x are located. Thus, the file access paths in the third layer of the tree structure in FIG. 1 can be grouped to obtain a first group A and a first group B, wherein the first group A is { / a / b / c / file1, / a / b / d / file2}, and the first group B is { / a / x / y / file3}. The two file access paths in the first group A have the same parent directory “ / a / b / ”, and the depth of the parent directory “ / a / b / ” is the first depth threshold “3”.

[0082] In another embodiment, the file access paths can be grouped by using an entropy difference dynamic grouping mode, i.e., the generalization parameter of the first current round is a first entropy difference threshold. At this time, the file access paths in the tree structure can be grouped by using the following steps (31) to (35) according to the generalization parameter of the first current round to obtain at least one first group.

[0083] Step (31): Calculate the entropy difference between the i-th layer and the (i+1)-th layer of the tree structure.

[0084] In the present disclosure, the entropy difference between the i-th layer and the (i+1)-th layer of the tree structure is the difference between the entropy value of the i-th layer of the tree structure and the entropy value of the (i+1)-th layer of the tree structure. The layers of the tree structure are numbered in a top-down order, and the layer where the root node of the tree structure is located is the first layer. The initial value of i is 2, i.e., the entropy difference between the second layer and the third layer of the tree structure is calculated first.

[0085] Step (32): If the absolute value of the entropy difference between the i-th layer and the (i+1)-th layer of the tree structure is less than the first entropy difference threshold, and i is less than L-1, then i+1, and return to the step of calculating the entropy difference between the i-th layer and the (i+1)-th layer of the tree structure, i.e., return to the above step (31).

[0086] Wherein, L is the number of layers contained in the above tree structure.

[0087] ​Step (33): If the absolute value of the entropy difference between the i-th layer and the i+1-th layer of the tree structure is less than the first entropy difference threshold, and i is equal to L-1, or the absolute value of the entropy difference between the i-th layer and the i+1-th layer of the tree structure is greater than or equal to the first entropy difference threshold, the i+1-th layer of the tree structure is taken as the first aggregation layer.

[0088] Step (34): Based on the first aggregation layer, the file access paths in the tree structure are grouped to obtain at least one first group.

[0089] In the present disclosure, each file access path in the same first group has the same parent directory, and the depth of the parent directory is i+1. The entropy difference grouping is a dynamic path grouping mode based on information entropy. The higher the entropy value of the path level in the tree structure, the greater the diversity of the path segment at this level (the more directory branches), and the lower the entropy value of the path level in the tree structure, the stronger the convergence of the path segment (the more stable the directory structure). Therefore, the structural mutation point of the tree structure is located by the absolute value of the entropy value difference between adjacent levels (i.e., the amount of change in the entropy value), wherein the first entropy difference threshold belongs to the entropy value change sensitive threshold, and is used to determine whether to perform path aggregation.

[0090] When the amount of change in the entropy value is greater than or equal to the first entropy difference threshold, the current level is taken as the aggregation point for grouping. The higher the entropy difference threshold, the finer the grouping granularity, and the lower the entropy difference threshold, the coarser the grouping granularity. By adjusting the entropy difference threshold, the generated access control policy can achieve a balance among security, performance, and generalization ability.

[0091] When the absolute value of the entropy difference between the i-th layer and the i+1-th layer of the tree structure is less than the first entropy difference threshold, and i is equal to L-1, it is indicated that all layers of the tree structure have been traversed, and no adjacent level with an amount of change in the entropy value greater than or equal to the first entropy difference threshold has been found. At this time, the i+1-th layer of the tree structure can be taken as the first aggregation layer, i.e., the L-th layer (i.e., the last layer) of the tree structure is taken as the first aggregation layer. Then, the file access paths in the tree structure are grouped based on the last layer of the tree structure, which is equivalent to that each file access path in the tree structure is taken as a group.

[0092] When the absolute value of the entropy difference between the i-th layer and the i+1-th layer of the tree structure is greater than or equal to the first entropy difference threshold, it is indicated that an adjacent level with an amount of change in the entropy value greater than or equal to the first entropy difference threshold has been found. At this time, the i+1-th layer of the tree structure is taken as the first aggregation layer, and then the file access paths in the tree structure are grouped based on the first aggregation layer to obtain at least one first group.

[0093] When the file paths are grouped, the file permissions, owner (ownership) constraints, etc. in the same group are also aggregated. The owner is used to represent whether the process accessing the file has the same permission to access the file.

[0094] For example, for the tree structure shown in Figure 2 Assuming that the first entropy difference threshold is 0.7, the entropy difference threshold of the second layer and the third layer is 0.918, which is greater than the first entropy difference threshold, therefore, the third layer of the tree structure in Figure 2 may be determined as the first aggregation layer, so that the file access paths in the third layer of the tree structure in Figure 2 may be grouped to obtain a first group A and a first group B, where the first group A is { / a / b / c / file1, / a / b / d / file2}, and the first group B is { / a / x / y / file3}, the two file access paths in the first group A have the same parent directory “ / a / b / ”, and the depth of the parent directory “ / a / b / ” is “3”.

[0095] When calculating the entropy value of the i-th layer of the tree structure, the number of file path segments involved by each element in the i-th layer of the tree structure can be determined first, then the occurrence probability of each element in the i-th layer of the tree structure is calculated according to the number of file path segments involved by each element in the i-th layer of the tree structure, where the occurrence probability of the element in the i-th layer = the number of file path segments involved by the element in the i-th layer / the sum of the number of file path segments involved by each element in the i-th layer; finally, the entropy value of the i-th layer of the tree structure is calculated according to the occurrence probability of each element in the i-th layer.

[0096] For example, the entropy value H of the i-th layer of the tree structure is calculated according to the occurrence probability of each element in the i-th layer by the following equation i :

[0097]

[0098] where N i is the number of elements in the i-th layer of the tree structure; P ij is the occurrence probability of the j-th element in the i-th layer of the tree structure.

[0099] For example, when calculating the entropy value of the second layer of the tree structure shown in Figure 2 , it is determined that the number of file path segments involved by the element “a” in the second layer of the tree structure is 3, and accordingly, the sum of the number of file path segments involved by each element in the second layer of the tree structure is also 3, so that the occurrence probability of the element “a” in the second layer of the tree structure is 3 / 3 = 1.0, i.e. the occurrence probability of the element “a” in the second layer of the tree structure is 1.0, therefore, the entropy value of the second layer of the tree structure is

[0100] For another example, when calculating the entropy value of the second layer of the tree structure shown in Figure 2When the entropy value of the third layer of the tree structure shown in the middle is determined, the number of file path segments involved by the element "b" in the third layer of the tree structure is 2, the number of file path segments involved by the element "x" is 1, and accordingly, the sum of the number of file path segments involved by each element in the third layer of the tree structure is 3, so the occurrence probability of the element "b" in the third layer of the tree structure is 2 / 3, and the occurrence probability of the element "x" in the third layer of the tree structure is 1 / 3, and therefore, the entropy value of the third layer of the tree structure is

[0101] The system configuration file usually needs to limit access, and if it is grouped and then generalized, the access permission of the system configuration file may be out of limit. Therefore, the system configuration file can not be grouped. Specifically, before the above step (2), the above S104 can further include the following step (6).

[0102] Step (6): filtering the first file access path starting with the preset directory from the plurality of first file access paths to obtain a plurality of second file access paths.

[0103] At this time, the above step (3) can include: constructing a tree structure corresponding to the plurality of second file access paths. As shown in the figure, Figure 3 The preset directory can include / etc, / proc, / sys, etc., and the directories starting with / etc, / proc, / sys can be filtered as needed.

[0104] The above S104 further includes the following steps (7) to (9):

[0105] Step (7): grouping the first file access path starting with the preset directory in the plurality of first file access paths according to the difference of the preset directory to obtain at least one second group, wherein the number of preset directories is one or more;

[0106] For example, the preset directory includes / etc, / proc, / sys, and the first file access path starting with / etc in the plurality of first file access paths can be divided into a group, the first file access path starting with / proc in the plurality of first file access paths can be divided into a group, and the first file access path starting with / sys in the plurality of first file access paths can be divided into a group.

[0107] Step (8): for each second group in the at least one second group, the second group is generalized by the second large model to obtain a third generalized path.

[0108] In the present disclosure, the second group can be processed by the second large model in a similar manner as the first group is processed by the second large model in step (4) above, and the present disclosure will not be described again.

[0109] Step (9): Determine all third generalization paths as the access control policy of the first current round.

[0110] In the present disclosure, after obtaining the third generalization paths, all third generalization paths, all first generalization paths, and other rules can be used as the access control policy of the first current round.

[0111] After obtaining a plurality of first file access paths, the data structure of some file access paths is incomplete, for example, lacking access permissions (for example, determining the read-write or execution permissions of a file), at this time, it cannot be used for the generation of the access control policy, therefore, in order to improve the efficiency of the generation of the access control policy, after obtaining a plurality of first file access paths, the legality of the first file access paths can be checked, that is, the data integrity of the first file access paths is checked to filter out file access paths with incomplete data structure. Specifically, before step (2) above, S104 above can further include the following step (10).

[0112] Step (10): Filter out the first file access paths that fail the legality check from the plurality of first file access paths to obtain a plurality of third file access paths.

[0113] At this time, step (3) above can include: constructing a tree structure corresponding to the plurality of third file access paths.

[0114] In addition, after grouping to obtain at least one first group through step (3) above, in order to avoid the generation of the access control policy taking too long time and the communication volume of the interaction between the Generator and the second LM being too large, the generation of the access control policy of the first current round of generalization parameters can be abandoned. Specifically, before step (4) above, S104 above can further include the following step (11):

[0115] Step (11): Determine whether the number of first groups is greater than or equal to a fourth quantity threshold.

[0116] If the number of first groups is greater than or equal to the fourth quantity threshold, the generation of the access control policy of the first current round of generalization parameters can be abandoned, at this time, S105 can be executed; if the number of first groups is less than the fourth quantity threshold, step (4) above is executed.

[0117] The first large model is used to evaluate the input access control policy to find out the access control policy that meets the first preset condition. Specifically, the first large model is used to:

[0118] determining whether to continue generating the access control policy according to the first prompt information, the input access control policy, and the input generalization parameter;

[0119] If it is determined to continue generating the access control policy, a second generalization parameter is determined according to a first number of file access rules in the first current round of access control policies and the first current round of generalization parameters, and the second generalization parameter is outputted.

[0120] If it is determined to stop generating the access control policy and no access control policy meeting the first preset condition is found, an access control policy meeting a second preset condition is selected from the input access control policy as the access control policy meeting the first preset condition, and the access control policy meeting the first preset condition is outputted.

[0121] If it is determined to stop generating the access control policy and an access control policy meeting the first preset condition has been found, the access control policy meeting the first preset condition is outputted.

[0122] In the present disclosure, the first prompt information is used to guide the output of the first large model, which can include principles to be followed when evaluating the access control policy and principles to be followed when calling the Generator to generate the access control policy.

[0123] The principles to be followed when evaluating the access control policy can include:

[0124] The access control policy should strike a balance between generalization ability and security;

[0125] When the number of file access paths is lower than a fifth number threshold (for example, 60), the performance difference is negligible;

[0126] The path depth, randomness, and other factors are comprehensively considered to determine the reasonable evaluation of the generalization ability, and specific files without potential randomness are not required to have generalization ability;

[0127] When it is determined that no subsequent tool calling is to be performed, the optimal solution is selected from the already generated access control policies, and potential optimization suggestions are given.

[0128] The principles to be followed when calling the Generator to generate the access control policy can include:

[0129] Single tool calling is required: only one generalization parameter is selected to call the Generator tool each time.

[0130] Based on the size of the behavior data and the number of rules of the generated access control policy, it is determined which generalization parameter is used to call the Generator tool.

[0131] After the first current round of access control policies and the at least one access control policy generated by the first large model for the behavior data history, and the generalization parameter input into the first large model when generating the access control policies, the first large model can determine whether to continue generating the access control policies according to the first prompt information, the input access control policies, and the input generalization parameters; if it is determined to continue generating the access control policies, second generalization parameters are determined according to the first number of file access rules in the first current round of access control policies and the first generalization parameters, and the second generalization parameters are output; if it is determined to stop generating the access control policies and no access control policy meeting the first preset condition is found, an access control policy meeting a second preset condition is selected from the input access control policies as the access control policy meeting the first preset condition, and the access control policy meeting the first preset condition is output; if it is determined to stop generating the access control policies and the access control policy meeting the first preset condition has been found, the access control policy meeting the first preset condition is directly output.

[0132] The second preset condition can be the optimal one in the access control policies input into the first large model, for example, the one with the maximum total score.

[0133] In a possible implementation, the first large model can be used to determine whether to continue generating the access control policies according to the first prompt information, the input access control policies, and the input generalization parameters by the following manner:

[0134] According to the first prompt information and the input generalization parameters, the input access control policies are evaluated to find the access control policy meeting the first preset condition therefrom;

[0135] If the access control policy meeting the first preset condition is not found, it is determined whether the first number is less than a first number threshold;

[0136] If the first number is less than the first number threshold, it is determined to continue generating the access control policies;

[0137] If the first number is not less than the first number threshold, or the access control policy meeting the first preset condition has been found, it is determined to stop generating the access control policies.

[0138] In the present disclosure, the first large model can evaluate the generalization capability, performance, security, etc. of the input access control policy according to the first prompt information and the input generalization parameter, to find an access control policy meeting the first preset condition therefrom. If an access control policy meeting the first preset condition is found from the input access control policy, it is determined to stop generating the access control policy; if an access control policy meeting the first preset condition is not found from the input access control policy, it is determined whether the first number is less than a first number threshold (for example, 90). If the first number is less than the first number threshold, it is determined to continue generating the access control policy; if the first number is not less than the first number threshold, it is determined to stop generating the access control policy.

[0139] In a possible implementation, the first large model can determine the second generalization parameter according to the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round in the following manner:

[0140] If the first number is less than the second number threshold, the generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and is greater than the generalization parameter of the first current round is determined as the second generalization parameter;

[0141] If the first number is greater than or equal to the second number threshold and less than the third number threshold, the generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round is determined as the second generalization parameter;

[0142] If the first number is greater than or equal to the third number threshold and less than the first number threshold, the generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and is less than the generalization parameter of the first current round is determined as the second generalization parameter;

[0143] The second generalization parameter is deleted from the candidate generalization parameter set.

[0144] In the present disclosure, when the first number of file access rules in the access control policy of the first current round is less than a second number threshold (for example, 30), a new access control policy can be generated based on a generalization parameter slightly larger than the currently adopted generalization parameter. Specifically, the generalization parameter in the candidate generalization parameter set that is larger than the generalization parameter of the first current round and closest to the generalization parameter of the first current round can be determined as the second generalization parameter, and then the second generalization parameter is deleted from the candidate generalization parameter set. When the first number is greater than or equal to the second number threshold and less than a third number threshold (for example, 60), a new access control policy can be generated based on the generalization parameter closest to the currently adopted generalization parameter. Specifically, the generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round can be determined as the second generalization parameter, and then the second generalization parameter is deleted from the candidate generalization parameter set. When the first number is greater than or equal to the third number threshold and less than the first number threshold, a new access control policy can be generated based on a generalization parameter slightly smaller than the currently adopted generalization parameter. Specifically, the generalization parameter in the candidate generalization parameter set that is smaller than the generalization parameter of the first current round and closest to the generalization parameter of the first current round can be determined as the second generalization parameter, and then the second generalization parameter is deleted from the candidate generalization parameter set.

[0145] Some variable elements may appear in the file path due to different conditions such as software version, runtime, and running times. In addition, it may not be possible to cover all behavior data of the microservice due to insufficient test cases and short monitoring time. Furthermore, directly generating an access control policy based on a large amount of original behavior data will result in a large number of rules, thereby causing a large performance impact. Therefore, two path grouping algorithms are introduced to merge file paths, which significantly reduces the number of rules while increasing the generalization capability and balancing security. Specifically, the behavior data related to the file can be grouped by combining the fixed depth grouping and entropy difference grouping algorithms, which effectively reduces the number of rules of the access control policy, improves the generalization capability, and reduces the performance impact. As shown in FIG. 8, the access control policy generation method for cloud security can further include the following S108-S113. Figure 4

[0146] In S108, a third generalization parameter is determined according to the behavior data, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold, and the third generalization parameter is the other of the first depth threshold and the first entropy difference threshold.

[0147] For example, the first generalization parameter is the first depth threshold, and the third generalization parameter is the first entropy difference threshold.

[0148] For another example, the first generalization parameter is the first entropy difference threshold, and the third generalization parameter is the first depth threshold. ​

[0149] As Figure 4 shown, according to the behavior data, the first generalization parameter and the third generalization parameter are determined as initial parameters.

[0150] In S109, the third generalization parameter is taken as the generalization parameter of the second current round.

[0151] In S110, according to the generalization parameter of the second current round, the access control policy of the second current round is generated.

[0152] In the present disclosure, the behavior data related to the first service can be generalized according to the generalization parameter of the second current round to generate the access control policy of the second current round. Among them, the method similar to the method of generating the access control policy of the first current round according to the generalization parameter of the first current round in S104 can be used to generate the access control policy of the second current round according to the generalization parameter of the second current round, and the present disclosure will not be repeated.

[0153] In S111, the access control policy of the second current round and the generalization parameter of the second current round are input into the third large model, and when the second current round is not the first round, at least one access control policy generated by the third large model according to the behavior data history and the generalization parameter on which the third large model generates each historical generated access control policy are input into the third large model.

[0154] In the present disclosure, the third large model is used to evaluate the input access control policy to find the access control policy meeting the first preset condition therefrom. Among them, the third large model can evaluate the input access control policy in a similar way to the evaluation of the input access control policy by the first large model, and the present disclosure will not be repeated.

[0155] In S112, if the third large model does not output the access control policy meeting the first preset condition and the output of the third large model includes the fourth generalization parameter, the fourth generalization parameter output by the third large model is taken as the generalization parameter of the second current round.

[0156] In S113, if the output of the third large model includes the access control policy meeting the first preset condition, at least one access control policy generated by the first large model and at least one access control policy generated by the third large model are input into the first large model or the third large model to determine the access control policy meeting the third preset condition therefrom when the output of the first large model includes the access control policy meeting the first preset condition.

[0157] When the third large model does not output an access control policy meeting the first preset condition, and the output of the third large model includes a fourth generalization parameter, it indicates that the third large model does not find an access control policy meeting the first preset condition from the input access control policies. At this time, the fourth generalization parameter output by the third large model can be used as the generalization parameter of the second current round, and then the above S110 is returned. When the third large model outputs an access control policy meeting the first preset condition, it indicates that the third large model finds an access control policy meeting the first preset condition from the input access control policies. At this time, the at least one access control policy generated by the first large model and the at least one access control policy generated by the third large model can be input into the first large model or the third large model to determine an access control policy meeting the third preset condition therefrom.

[0158] At this time, the above S107 can include determining the access control policy meeting the third preset condition as the access control policy of the first service. The third preset condition can be the same as the first preset condition.

[0159] The third large model inputs the currently generated access control policy and the at least one access control policy generated by the third large model in history, and the generalization parameter used to generate these access control policies into the third LM after generating an access control policy each time, so that the third LM evaluates these access control policies by using the reasoning capability of the third LM to find an access control policy meeting the first preset condition therefrom. If the third LM does not find an access control policy meeting the first preset condition from the input access control policies, a new generalization parameter of the second current round (i.e., a fourth generalization parameter) can be determined according to the generalization parameter used to generate the access control policy of the second current round (i.e., a generalization parameter of the second current round), and the fourth generalization parameter is output. At this time, the access control policy can be continuously generated according to the new generalization parameter of the second current round, i.e., the fourth generalization parameter is used as the generalization parameter of the second current round, and the above S110 is returned. When the third LM finds an access control policy meeting the first preset condition from the input access control policies, and the first LM finds an access control policy meeting the first preset condition from the input access control policies (i.e., the output of the first large model includes an access control policy meeting the first preset condition), the at least one access control policy generated by the first LM and the at least one access control policy generated by the third LM are input into the first large model or the third large model to determine an access control policy meeting the third preset condition therefrom.

[0160] As Figure 5As shown, after the first depth threshold is obtained, the access control policy of the first current round (referred to as the first Profile) can be generated by calling the Profile Generator Function. After the first Profile is generated each time, the currently generated first Profile (hereinafter referred to as the current first Profile), at least one first Profile generated in the history, and the generalization parameters used when generating these first Profiles are input into the first LM, so that the first LM uses its reasoning ability to evaluate the input first Profile, and finds the Profile meeting the first preset condition therefrom. If the first LM does not find the Profile meeting the first preset condition from the input first Profile, the first Profile continues to be generated. At this time, the generalization parameters of the new first current round (i.e., the second generalization parameters) can be determined according to the generalization parameters used when the current first Profile is generated (i.e., the generalization parameters of the first current round), the second generalization parameters are output, and the second generalization parameters are used as calling parameters to call the Profile Generator Function to continue to generate the first Profile. If the first LM finds the Profile meeting the first preset condition from the input first Profile, the first Profile meeting the first preset condition and all the first Profiles generated in the history and the recommendation reason are output.

[0161] As Figure 5As shown, after the first entropy difference threshold is obtained, the access control policy of the second current round (referred to as the third Profile) can be generated by calling the Profile Generator Function. After the third Profile is generated each time, the third Profile generated at present (hereinafter referred to as the current third Profile) and at least one third Profile generated in history, and the generalization parameters relied on when generating the third Profile are input into the third LM, so that the third LM evaluates the input third Profile by using the reasoning ability of the third LM, to find the Profile meeting the first preset condition from the third Profile. If the third LM does not find the Profile meeting the first preset condition from the input third Profile, the third Profile continues to be generated. At this time, the generalization parameters of the new second current round (i.e., the fourth generalization parameters) can be determined according to the generalization parameters relied on when the current third Profile is generated (i.e., the generalization parameters of the second current round), the fourth generalization parameters are output, and the fourth generalization parameters are used as the calling parameters to call the Profile Generator Function to continue to generate the third Profile. If the third LM finds the Profile meeting the first preset condition from the input third Profile, the third Profile meeting the first preset condition and all the third Profiles generated in history and the recommendation reason are output.

[0162] As shown, Figure 5 After the first LM finds the Profile meeting the first preset condition from the input first Profile, and the third LM finds the Profile meeting the first preset condition from the input third Profile, the first LM or the third LM can be used to evaluate at least one first Profile generated by the first LM and at least one third Profile generated by the third LM, to find the Profile meeting the third preset condition from the first Profile and the third Profile, and output the Profile meeting the third preset condition, all the first Profiles generated in history, all the third Profiles generated in history, and the recommendation reason.

[0163] In the present disclosure, in order to improve the generation efficiency of the access control policy, the first LM and the third LM can be different LMs. At this time, the above S102-S106 can be executed in parallel with S108-S112, or in order to save costs, the first LM and the third LM can be the same LM. At this time, the above S102-S106 can be executed first, and then S108-S112 can be executed.

[0164] Figure 6is a block diagram of an access control policy generation apparatus for cloud security according to an exemplary embodiment. As shown in Figure 6 The access control policy generation apparatus 300 for cloud security includes an acquisition module 301 configured to acquire behavior data related to a first service; a first determination module 302 configured to determine a first generalization parameter according to the behavior data; a second determination module 303 configured to use the first generalization parameter as a generalization parameter of a first current round; a first generation module 304 configured to generate an access control policy of the first current round according to the generalization parameter of the first current round; a first evaluation module 305 configured to input the access control policy of the first current round and the generalization parameter of the first current round into a first large model, and input at least one access control policy generated by the first large model for a history of the behavior data and a generalization parameter used by the first large model to generate each of the access control policies generated in the history into the first large model when the first current round is a non-first round; wherein the first large model is configured to evaluate the input access control policies to find an access control policy meeting a first preset condition; a first triggering module 306 configured to trigger the first generation module 304 to generate the access control policy of the first current round according to the generalization parameter of the first current round if the first large model does not output the access control policy meeting the first preset condition and the output of the first large model includes a second generalization parameter, wherein the second generalization parameter output by the first large model is used as the generalization parameter of the first current round; and a third determination module 307 configured to determine the access control policy meeting the first preset condition as the access control policy of the first service if the output of the first large model includes the access control policy meeting the first preset condition.

[0165] In the technical solution, after obtaining the behavior data related to the first service, the first generalization parameter is determined according to the behavior data; then, the first generalization parameter is taken as the generalization parameter of the first current round, and the access control policy of the first current round is generated according to the generalization parameter of the first current round; next, the access control policy of the first current round and the generalization parameter of the first current round are input into the first large model, and at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter on which the first large model generates each historical access control policy are input into the first large model when the first current round is a non-first round; wherein, the first large model is used to evaluate the input access control policy to find the access control policy meeting the first preset condition therefrom; if the first large model does not output the access control policy meeting the first preset condition, and the output of the first large model includes a second generalization parameter, the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round, and the step of generating the access control policy of the first current round according to the generalization parameter of the first current round is returned; if the output of the first large model includes the access control policy meeting the first preset condition, the access control policy meeting the first preset condition is determined as the access control policy of the first service. The strategy evaluation method based on the large model and using the reasoning and action process can utilize the reasoning capability of the large model to automatically complete the evaluation of the access control policy, and select the access control policy meeting the first preset condition therefrom, without relying on expert knowledge, business context information, and manual access, so as to generate the access control policy capable of balancing the performance of each aspect.

[0166] Optionally, the first large model is configured to determine whether to continue to generate the access control policy according to the first prompt information, the input access control policy and the input generalization parameter, wherein the first prompt information is used to guide the output of the first large model; if it is determined to continue to generate the access control policy, the second generalization parameter is determined according to the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round, and the second generalization parameter is output; if it is determined to stop generating the access control policy and the access control policy meeting the first preset condition is not found, the access control policy meeting the second preset condition is selected from the input access control policy as the access control policy meeting the first preset condition, and the access control policy meeting the first preset condition is output; if it is determined to stop generating the access control policy and the access control policy meeting the first preset condition has been found, the access control policy meeting the first preset condition is output.

[0167] Optionally, the first large model is configured to: evaluate the input access control policy according to the first prompt information and the input generalization parameter to find an access control policy meeting the first preset condition therefrom; if no access control policy meeting the first preset condition is found, determine whether the first quantity is less than a first quantity threshold; if the first quantity is less than the first quantity threshold, determine to continue generating access control policies; if the first quantity is not less than the first quantity threshold or an access control policy meeting the first preset condition has been found, determine to stop generating access control policies.

[0168] Optionally, the first large model is configured to: if the first quantity is less than a second quantity threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and greater than the generalization parameter of the first current round as the second generalization parameter; if the first quantity is greater than or equal to the second quantity threshold and less than a third quantity threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round as the second generalization parameter; if the first quantity is greater than or equal to the third quantity threshold and less than a first quantity threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and less than the generalization parameter of the first current round as the second generalization parameter; and delete the second generalization parameter from the candidate generalization parameter set.

[0169] Optionally, the first generation module 304 comprises: an extraction submodule configured to extract file access paths in the behavior data to obtain a plurality of first file access paths; a construction submodule configured to construct a tree structure corresponding to the plurality of first file access paths; a first grouping submodule configured to group file access paths in the tree structure according to the generalization parameter of the first current round to obtain at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is determined based on the generalization parameter of the first current round; a first generalization processing submodule configured to, for each first group in the at least one first group, perform generalization processing on the first group by a second large model to obtain a first generalization path; and a first determination submodule configured to determine all the first generalization paths and other rules as the access control policy of the first current round, wherein the other rules are other permission data in the behavior data other than the plurality of first file access paths.

[0170] Optionally, the first generalization processing submodule comprises: a second generalization processing submodule, configured to perform generalization processing on the first group by the second large model according to the number of downstream nodes of the parent directory in the first group, to obtain a second generalization path; and a third generalization processing submodule, configured to identify random content in the second generalization path by the second large model, and replace the random content with a wildcard to obtain the first generalization path.

[0171] Optionally, the first generation module 304 further comprises: a filtering submodule, configured to filter out a first file access path starting with a preset directory from the plurality of first file access paths, to obtain a plurality of second file access paths, before the construction submodule constructs the tree structure corresponding to the plurality of second file access paths; the construction submodule is configured to construct the tree structure corresponding to the plurality of second file access paths; the first generation module 304 further comprises: a second grouping submodule, configured to group the first file access paths starting with the preset directory in the plurality of first file access paths according to different preset directories, to obtain at least one second group, wherein the number of preset directories is one or more; a fourth generalization processing submodule, configured to perform generalization processing on each second group in the at least one second group by the second large model, to obtain a third generalization path; and a second determination submodule, configured to determine all the third generalization paths as the access control policy of the first current round.

[0172] Optionally, the first current round generalization parameter is a first entropy difference threshold; the first grouping submodule comprises: a calculation submodule, configured to calculate an entropy difference between an i-th layer and an i+1-th layer of the tree structure, wherein the layers of the tree structure are numbered in a top-down order, the layer where a root node of the tree structure is located is the first layer, and an initial value of i is 2; a triggering submodule, configured to, if an absolute value of the entropy difference is less than the first entropy difference threshold and i is less than L-1, set i+1, and trigger the calculation submodule to calculate the entropy difference between the i-th layer and the i+1-th layer of the tree structure, wherein L is the number of levels included in the tree structure; a third determination submodule, configured to, if the absolute value of the entropy difference is less than the first entropy difference threshold and i is equal to L-1, or the absolute value of the entropy difference is greater than or equal to the first entropy difference threshold, take the i+1-th layer of the tree structure as a first aggregation layer; and a third grouping submodule, configured to group the file access paths in the tree structure based on the first aggregation layer, to obtain the at least one first group, wherein each file access path in a same first group has a same parent directory, and the parent directory has a depth of i+1.

[0173] Optionally, the generalization parameter of the first current round is a first depth threshold; the first grouping submodule comprises: a fourth determining submodule, configured to determine a second aggregation layer from the tree structure according to the first depth threshold, wherein the level of the second aggregation layer is equal to the first depth threshold; and a fourth grouping submodule, configured to group the file access paths in the tree structure based on the second aggregation layer to obtain the at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is the first depth threshold.

[0174] Optionally, the first determining module 302 comprises: an obtaining submodule, configured to obtain a second quantity of the behavior data; a fifth determining submodule, configured to determine a first depth threshold corresponding to a quantity interval in which the second quantity is located according to a first correspondence relationship between the quantity interval and the depth threshold; and a sixth determining submodule, configured to determine the first depth threshold as the first generalization parameter.

[0175] Optionally, the first determining module 302 comprises: an obtaining submodule, configured to obtain a second quantity of the behavior data; a seventh determining submodule, configured to determine a first entropy difference threshold corresponding to a quantity interval in which the second quantity is located according to a second correspondence relationship between the quantity interval and the entropy difference threshold; and an eighth determining submodule, configured to determine the first entropy difference threshold as the first generalization parameter.

[0176] Optionally, the access control policy generation apparatus for cloud security 300 further comprises: a fourth determination module configured to determine a third generalization parameter according to the behavior data, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold, and the third generalization parameter is the other of the first depth threshold and the first entropy difference threshold; a fifth determination module configured to take the third generalization parameter as a generalization parameter of a second current round; a second generation module configured to generate an access control policy of the second current round according to the generalization parameter of the second current round; a second evaluation module configured to: input the access control policy of the second current round and the generalization parameter of the second current round into the third large model; and when the second current round is not the first round, input at least one access control policy generated by the third large model for the history of the behavior data and the generalization parameter on which the third large model generates each of the at least one access control policy into the third large model; wherein the third large model is configured to evaluate the input access control policy to find an access control policy meeting the first preset condition therefrom; a second triggering module configured to, if the third large model does not output the access control policy meeting the first preset condition and the output of the third large model includes a fourth generalization parameter, trigger the second generation module to generate the access control policy of the second current round according to the generalization parameter of the second current round, wherein the fourth generalization parameter output by the third large model is taken as the generalization parameter of the second current round; and a third evaluation module configured to, if the output of the third large model includes the access control policy meeting the first preset condition, input at least one access control policy generated by the first large model and at least one access control policy generated by the third large model into the first large model or the third large model when the output of the first large model includes the access control policy meeting the first preset condition, to determine an access control policy meeting a third preset condition therefrom; and the third determination module 307 is configured to determine the access control policy meeting the third preset condition as the access control policy of the first service.

[0177] The present disclosure further provides a computer readable medium having stored thereon a computer program which, when executed by a processing apparatus, implements the steps of the above-mentioned access control policy generation method for cloud security provided by the present disclosure.

[0178] The present disclosure further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the above-mentioned access control policy generation method for cloud security provided by the present disclosure.

[0179] Reference will now be made to the following description Figure 7FIG. 6 shows a block diagram of an electronic device (e.g., a terminal device or a server) 600 suitable for implementing embodiments of the present disclosure. The terminal device in embodiments of the present disclosure can include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet Personal Computer), a PMP (Portable Multimedia Player), a car terminal (e.g., a car navigation terminal), and the like, as well as a stationary terminal such as a digital TV, a desktop computer, and the like. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functions and the range of use of embodiments of the present disclosure.

[0180] As shown in FIG. 6, the electronic device 600 can include a processing device (e.g., a central processor, a graphic processor, etc.) 601 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded into a random access memory (RAM) 603 from a storage device 608. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604. Figure 7

[0181] Generally, the following devices can be connected to the I / O interface 605: input devices 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and the like; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; storage devices 608 including, for example, a magnetic tape, a hard disk, and the like; and communication devices 609. The communication devices 609 can allow the electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 The electronic device 600 is shown as having various devices, but it is understood that all of the shown devices are not required to be implemented or possessed. More or fewer devices can alternatively be implemented or possessed.

[0182] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product including a computer program carried on a non-transitory computer readable medium, the computer program containing program code for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication devices 609, or installed from the storage devices 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-described functions defined in the methods of the present disclosure are performed.

[0183] ​It should be noted that the computer-readable medium described above can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device. In the present disclosure, the computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave in a propagated data signal, in which the computer-readable program code is contained. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium that can send, propagate or transfer the program for use by or in connection with the instruction execution system, apparatus or device. The program code contained in the computer-readable medium can be transmitted by any suitable medium, including but not limited to, wire, cable, RF (radio frequency), etc., or any suitable combination of the above.

[0184] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0185] The computer-readable medium described above can be included in the electronic device described above; or can exist separately from the electronic device, and not be assembled into the electronic device.

[0186] The computer readable medium carries one or more programs, when the one or more programs are executed by the electronic device, cause the electronic device to: acquire behavior data related to a first service; determine a first generalization parameter according to the behavior data; take the first generalization parameter as a generalization parameter of a first current round; generate an access control policy of the first current round according to the generalization parameter of the first current round; input the access control policy of the first current round and the generalization parameter of the first current round into a first large model; and when the first current round is a non-first round, input at least one access control policy generated by the first large model for a history of the behavior data and a generalization parameter relied on by the first large model when generating each of the history generated access control policies into the first large model; wherein the first large model is configured to evaluate the input access control policies to find an access control policy meeting a first preset condition; if the first large model does not output an access control policy meeting the first preset condition and the output of the first large model includes a second generalization parameter, return to the step of generating the access control policy of the first current round according to the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round; and if the output of the first large model includes an access control policy meeting the first preset condition, determine the access control policy meeting the first preset condition as an access control policy of the first service.

[0187] Computer program code for carrying out operations of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0188] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform the operations of the first aspect. The computer program product of the first aspect can include a non-transitory computer-readable medium storing code that, when executed, causes a computer to perform operations for causing one or more processors to perform the operations of the first aspect.

[0189] The modules involved in the embodiments of the present disclosure can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself, for example, the acquisition module can also be described as a "module for acquiring behavior data related to the first service".

[0190] The functions described above in the present document can be performed, at least in part, by one or more hardware logic components. For example, non-limiting examples of exemplary types of hardware logic components that can be used include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SOCs), complex programmable logic devices (CPLDs), etc.

[0191] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable storage media can include, without limitation, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media can include one or more lines of electrical connections, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0192] According to one or more embodiments of the present disclosure, example 1 provides a method for generating an access control policy for cloud security, comprising: obtaining behavior data related to a first service; determining a first generalization parameter according to the behavior data; taking the first generalization parameter as a generalization parameter of a first current round; generating an access control policy of the first current round according to the generalization parameter of the first current round; inputting the access control policy of the first current round and the generalization parameter of the first current round into a first large model; and when the first current round is not the first round, inputting at least one access control policy generated by the first large model for the history of the behavior data and the generalization parameter on which the first large model generates each of the history-generated access control policies into the first large model; wherein the first large model is configured to evaluate the input access control policies to find an access control policy meeting a first preset condition; if the first large model does not output an access control policy meeting the first preset condition and the output of the first large model includes a second generalization parameter, returning to the step of generating the access control policy of the first current round according to the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round; if the output of the first large model includes an access control policy meeting the first preset condition, determining the access control policy meeting the first preset condition as the access control policy of the first service.

[0193] According to one or more embodiments of the present disclosure, example 2 provides the method of example 1, wherein the first large model is configured to: determine whether to continue generating an access control policy according to first prompt information, the input access control policy and the input generalization parameter, wherein the first prompt information is used to guide the output of the first large model; if it is determined to continue generating an access control policy, determine the second generalization parameter according to the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round, and output the second generalization parameter; if it is determined to stop generating an access control policy and no access control policy meeting the first preset condition is found, filter an access control policy meeting a second preset condition from the input access control policy as an access control policy meeting the first preset condition, and output the access control policy meeting the first preset condition; if it is determined to stop generating an access control policy and an access control policy meeting the first preset condition has been found, output the access control policy meeting the first preset condition.

[0194] According to one or more embodiments of the present disclosure, example 3 provides the method of example 2, and the first large model is configured to: evaluate the input access control policy according to the first prompt information and the input generalization parameter to find an access control policy meeting the first preset condition therefrom; if no access control policy meeting the first preset condition is found, determine whether the first number is less than a first number threshold; if the first number is less than the first number threshold, determine to continue generating access control policies; if the first number is not less than the first number threshold, or an access control policy meeting the first preset condition has been found, determine to stop generating access control policies.

[0195] According to one or more embodiments of the present disclosure, example 4 provides the method of example 2, and the first large model is configured to: if the first number is less than a second number threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and greater than the generalization parameter of the first current round as the second generalization parameter; if the first number is greater than or equal to the second number threshold and less than a third number threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round as the second generalization parameter; if the first number is greater than or equal to the third number threshold and less than a first number threshold, determine a generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round and less than the generalization parameter of the first current round as the second generalization parameter; and delete the second generalization parameter from the candidate generalization parameter set.

[0196] According to one or more embodiments of the present disclosure, example 5 provides the method of example 1, and the generating of the access control policy of the first current round according to the generalization parameter of the first current round comprises: extracting file access paths in the behavior data to obtain a plurality of first file access paths; constructing a tree structure corresponding to the plurality of first file access paths; grouping file access paths in the tree structure according to the generalization parameter of the first current round to obtain at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is determined based on the generalization parameter of the first current round; for each first group in the at least one first group, performing generalization processing on the first group by a second large model to obtain a first generalization path; and determining all the first generalization paths and other rules as the access control policy of the first current round, wherein the other rules are other permission data in the behavior data other than the plurality of first file access paths.

[0197] According to one or more embodiments of the present disclosure, example 6 provides the method of example 5, wherein the generalization processing of the first group by the second large model to obtain the first generalization path comprises: generalization processing of the first group by the second large model according to the number of downstream nodes of the parent directory in the first group to obtain a second generalization path; identifying random content in the second generalization path by the second large model and replacing the random content with a wildcard to obtain the first generalization path.

[0198] According to one or more embodiments of the present disclosure, example 7 provides the method of example 5, wherein before the step of constructing a tree structure corresponding to the plurality of first file access paths, the generating of the access control policy of the first current round according to the generalization parameters of the first current round further comprises: filtering out first file access paths starting with a preset directory from the plurality of first file access paths to obtain a plurality of second file access paths; and the constructing of the tree structure corresponding to the plurality of first file access paths comprises: constructing a tree structure corresponding to the plurality of second file access paths; and the generating of the access control policy of the first current round according to the generalization parameters of the first current round further comprises: grouping first file access paths starting with a preset directory in the plurality of first file access paths according to different preset directories to obtain at least one second group, wherein the number of preset directories is one or more; and for each second group in the at least one second group, generalization processing of the second group by the second large model to obtain a third generalization path.

[0199] determining all the third generalization paths as the access control policy of the first current round.

[0200] According to one or more embodiments of the present disclosure, example 8 provides the method of example 5, the generalization parameter of the first current round is a first entropy difference threshold; and the grouping the file access paths in the tree structure according to the generalization parameter of the first current round to obtain at least one first group comprises: calculating an entropy difference between an i-th layer and an i+1-th layer of the tree structure, wherein layers of the tree structure are numbered in a top-down order, a layer where a root node of the tree structure is located is the first layer, and an initial value of i is 2; if an absolute value of the entropy difference is less than the first entropy difference threshold and i is less than L-1, then i+1, and returning to the step of calculating the entropy difference between the i-th layer and the i+1-th layer of the tree structure, wherein L is a number of layers included in the tree structure; if the absolute value of the entropy difference is less than the first entropy difference threshold and i is equal to L-1, or the absolute value of the entropy difference is greater than or equal to the first entropy difference threshold, then taking the i+1-th layer of the tree structure as a first aggregation layer; and grouping the file access paths in the tree structure based on the first aggregation layer to obtain the at least one first group, wherein each file access path in a same first group has a same parent directory, and a depth of the parent directory is i+1.

[0201] According to one or more embodiments of the present disclosure, example 9 provides the method of example 5, the generalization parameter of the first current round is a first depth threshold; and the grouping the file access paths in the tree structure according to the generalization parameter of the first current round to obtain at least one first group comprises: determining a second aggregation layer from the tree structure according to the first depth threshold, wherein a layer level of the second aggregation layer is equal to the first depth threshold; and grouping the file access paths in the tree structure based on the second aggregation layer to obtain the at least one first group, wherein each file access path in a same first group has a same parent directory, and a depth of the parent directory is the first depth threshold.

[0202] According to one or more embodiments of the present disclosure, example 10 provides the method of example 1, and the determining the first generalization parameter according to the behavior data comprises: obtaining a second number of the behavior data; determining a first depth threshold corresponding to a number interval where the second number is located according to a first correspondence relationship between number intervals and depth thresholds; and determining the first depth threshold as the first generalization parameter.

[0203] According to one or more embodiments of the present disclosure, example 11 provides the method of example 1, and the determining the first generalization parameter according to the behavior data comprises: obtaining a second number of the behavior data; determining a first entropy difference threshold corresponding to a number interval where the second number is located according to a second correspondence relationship between number intervals and entropy difference thresholds; and determining the first entropy difference threshold as the first generalization parameter.

[0204] According to one or more embodiments of the present disclosure, example 12 provides the method of any one of examples 1-11, further comprising: determining, according to the behavior data, a third generalization parameter, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold, and the third generalization parameter is the other of the first depth threshold and the first entropy difference threshold; taking the third generalization parameter as a generalization parameter of a second current round; generating, according to the generalization parameter of the second current round, an access control policy of the second current round; inputting the access control policy of the second current round and the generalization parameter of the second current round into a third large model; and when the second current round is a non-first round, inputting, into the third large model, at least one access control policy generated by the third large model for the history of the behavior data, and a generalization parameter according to which the third large model generates each of the at least one access control policy; wherein the third large model is configured to evaluate the input access control policies to find an access control policy meeting the first preset condition therefrom; if the third large model does not output an access control policy meeting the first preset condition, and the output of the third large model includes a fourth generalization parameter, returning to the step of generating, according to the generalization parameter of the second current round, the access control policy of the second current round, wherein the fourth generalization parameter output by the third large model is taken as the generalization parameter of the second current round; if the output of the third large model includes an access control policy meeting the first preset condition, inputting, into the first large model or the third large model, at least one access control policy generated by the first large model and at least one access control policy generated by the third large model, to determine an access control policy meeting a third preset condition therefrom, when the output of the first large model includes an access control policy meeting the first preset condition; and determining the access control policy meeting the first preset condition as the access control policy of the first service.

[0205] According to one or more embodiments of the present disclosure, example 13 provides an access control policy generation apparatus for cloud security, comprising: an acquisition module configured to acquire behavior data related to a first service; a first determination module configured to determine a first generalization parameter according to the behavior data; a second determination module configured to take the first generalization parameter as a generalization parameter of a first current round; a first generation module configured to generate an access control policy of the first current round according to the generalization parameter of the first current round; a first evaluation module configured to: input the access control policy of the first current round and the generalization parameter of the first current round into a first large model; and when the first current round is a non-first round, input at least one access control policy generated by the first large model for a history of the behavior data and a generalization parameter according to which the first large model generates each of the history-generated access control policies into the first large model; wherein the first large model is configured to evaluate the input access control policies to find an access control policy meeting a first preset condition; a first triggering module configured to, if the first large model does not output an access control policy meeting the first preset condition and the output of the first large model includes a second generalization parameter, trigger the first generation module to generate an access control policy of the first current round according to the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is taken as the generalization parameter of the first current round; and a third determination module configured to, if the output of the first large model includes an access control policy meeting the first preset condition, determine the access control policy meeting the first preset condition as an access control policy of the first service.

[0206] According to one or more embodiments of the present disclosure, example 14 provides a computer readable medium having stored thereon a computer program, which, when executed by a processing apparatus, implements the steps of the method of any one of examples 1-12.

[0207] According to one or more embodiments of the present disclosure, example 15 provides an electronic device, comprising: a storage device having stored thereon a computer program; and a processing apparatus configured to execute the computer program in the storage device to implement the steps of the method of any one of examples 1-12. According to one or more embodiments of the present disclosure, example 16 provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of any one of examples 1-12.

[0208] The above description merely illustrates the preferred embodiment of the disclosure and a principle of applied technologies. It should be understood by those skilled in the art that the disclosed range of the disclosure is not limited to the technical solutions formed by the specific combinations of the technical features described above, and should also cover other technical solutions formed by the combinations of the technical features described above or their equivalent features without departing from the disclosed concept. For example, the technical solutions formed by the mutual replacement of the above-described features and the technical features with similar functions disclosed in the disclosure (but not limited to) can be formed.

[0209] Furthermore, although operations are depicted in a particular, sequential order, this should not be understood as requiring or implying that the operations are performed in the order illustrated or sequentially. In certain circumstances, multitasking and parallel processing can be advantageous. Likewise, although specific implementation details are contained in the above discussion, these should not be construed as limiting the scope of the disclosure. Certain features described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0210] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely illustrative of specific forms of implementing the claims. With respect to the devices in the above-described embodiments, the specific manner in which the various modules perform operations has been described in detail in the embodiments related to the method, and will not be described here in detail.

Claims

1. A method for generating access control policies for cloud security, characterized in that, include: Obtain behavioral data related to the first service; Based on the behavioral data, a first generalization parameter is determined, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold; Use the first generalization parameter as the generalization parameter for the first current round; Generate the access control policy for the first current round based on the generalization parameters of the first current round; Input the access control policy of the first current round and the generalization parameters of the first current round into the first large model; And when the first current round is not the first round, at least one access control policy generated by the first large model for the historical behavior data, and the generalization parameters on which the first large model generates each historically generated access control policy, are input into the first large model; wherein, the first large model is used to evaluate the input access control policy to find the access control policy that meets the first preset condition. If the first large model does not output an access control policy that meets the first preset conditions, and the output of the first large model includes a second generalization parameter, then return to the step of generating an access control policy for the first current round based on the generalization parameter of the first current round, wherein the second generalization parameter output by the first large model is used as the generalization parameter of the first current round, and the second generalization parameter is determined based on the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round; If the output of the first large model includes an access control policy that meets the first preset condition, then the access control policy that meets the first preset condition is determined as the access control policy of the first service.

2. The method according to claim 1, characterized in that, The first large model is used for: Based on the first prompt information, the input access control policy, and the input generalization parameters, determine whether to continue generating access control policies, wherein the first prompt information is used to guide the output of the first large model; If it is determined that access control policies will continue to be generated, the second generalization parameter is determined based on the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round, and the second generalization parameter is output. If it is determined that the generation of access control policies will be stopped and no access control policy that meets the first preset condition is found, then the access control policy that meets the second preset condition is selected from the input access control policies and used as the access control policy that meets the first preset condition, and the access control policy that meets the first preset condition is output. If it is determined that the generation of access control policies will be stopped, and an access control policy that meets the first preset condition has been found, then the access control policy that meets the first preset condition will be output.

3. The method according to claim 2, characterized in that, The first large model is used for: Based on the first prompt information and the input generalization parameters, the input access control policy is evaluated to find the access control policy that meets the first preset conditions. If no access control policy that meets the first preset condition is found, then it is determined whether the first quantity is less than the first quantity threshold. If the first quantity is less than the first quantity threshold, then it is determined to continue generating access control policies; If the first quantity is not less than the first quantity threshold, or if an access control policy that meets the first preset condition has been found, then it is determined to stop generating access control policies.

4. The method according to claim 2, characterized in that, The first large model is used for: If the first quantity is less than the second quantity threshold, then the generalization parameter that is greater than the generalization parameter of the first current round and is closest to the generalization parameter of the first current round is determined as the second generalization parameter. If the first quantity is greater than or equal to the second quantity threshold and less than the third quantity threshold, then the generalization parameter in the candidate generalization parameter set that is closest to the generalization parameter of the first current round is determined as the second generalization parameter. If the first quantity is greater than or equal to the third quantity threshold and less than the first quantity threshold, then the generalization parameter in the candidate generalization parameter set that is less than the generalization parameter of the first current round and is closest to the generalization parameter of the first current round is determined as the second generalization parameter. The second generalization parameter is removed from the set of candidate generalization parameters.

5. The method according to claim 1, characterized in that, The step of generating the access control policy for the first current round based on the generalization parameters of the first current round includes: Extract the file access paths from the behavioral data to obtain multiple first file access paths; Construct a tree structure corresponding to the multiple first file access paths; Based on the generalization parameters of the first current round, the file access paths in the tree structure are grouped to obtain at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is determined based on the generalization parameters of the first current round. For each of the at least one first group, the first group is generalized using the second largest model to obtain a first generalization path; All the first generalized paths and other rules are determined as the access control policy for the first current round, wherein the other rules are other permission data in the behavior data other than the multiple first file access paths.

6. The method according to claim 5, characterized in that, The process of generalizing the first group using the second major model to obtain the first generalization path includes: The second generalized path is obtained by generalizing the first group based on the number of downstream nodes of the parent directory in the first group using the second major model. The second generalization path is obtained by identifying random content in the second generalization path using the second major model and replacing the random content with wildcards.

7. The method according to claim 5, characterized in that, Before the step of constructing the tree structure corresponding to the multiple first file access paths, the step of generating the access control policy for the first current round based on the generalization parameters of the first current round further includes: Filter out the first file access paths that start with a preset directory from the multiple first file access paths to obtain multiple second file access paths; The construction of the tree structure corresponding to the multiple first file access paths includes: Construct a tree structure corresponding to the multiple second file access paths; The step of generating the access control policy for the first current round based on the generalization parameters of the first current round further includes: The first file access paths that begin with a preset directory among the multiple first file access paths are grouped according to the different preset directories to obtain at least one second group, wherein the number of preset directories is one or more; For each of the at least one second group, the second group is generalized using the second large model to obtain a third generalization path; All the third generalized paths are determined as the access control policy for the first current round.

8. The method according to claim 5, characterized in that, The generalization parameter of the first current round is the first entropy difference threshold; The step of grouping file access paths in the tree structure according to the generalization parameters of the first current round to obtain at least one first group includes: Calculate the first of the tree structures i Layer and First i +1 layer entropy difference, wherein the layers of the tree structure are numbered in top-down order, and the layer containing the root node of the tree structure is layer 1. i The initial value is 2; If the absolute value of the entropy difference is less than the first entropy difference threshold, and i Less than L -1, then let i +1, return the first value of the calculated tree structure. i Layer and First i The entropy difference step of layer +1, where... L The number of levels contained in the tree structure; If the absolute value of the entropy difference is less than the first entropy difference threshold, and i equal L -1, or the absolute value of the entropy difference is greater than or equal to the first entropy difference threshold, then the first entropy difference threshold of the tree structure is... i +1 layer serves as the first aggregation layer; Based on the first aggregation layer, the file access paths in the tree structure are grouped to obtain at least one first group, wherein each file access path within the same first group has the same parent directory, and the depth of the parent directory is [missing information]. i +1.

9. The method according to claim 5, characterized in that, The generalization parameter of the first current round is the first depth threshold; The step of grouping file access paths in the tree structure according to the generalization parameters of the first current round to obtain at least one first group includes: A second aggregation layer is determined from the tree structure based on the first depth threshold, wherein the level of the second aggregation layer is equal to the first depth threshold; Based on the second aggregation layer, the file access paths in the tree structure are grouped to obtain at least one first group, wherein each file access path in the same first group has the same parent directory, and the depth of the parent directory is the first depth threshold.

10. The method according to claim 1, characterized in that, Determining the first generalization parameter based on the behavioral data includes: Obtain a second quantity of the behavioral data; Based on the first correspondence between the quantity range and the depth threshold, determine the first depth threshold corresponding to the quantity range in which the second quantity is located; The first depth threshold is determined as the first generalization parameter.

11. The method according to claim 1, characterized in that, Determining the first generalization parameter based on the behavioral data includes: Obtain a second quantity of the behavioral data; Based on the second correspondence between the quantity range and the entropy difference threshold, determine the first entropy difference threshold corresponding to the quantity range where the second quantity is located; The first entropy difference threshold is determined as the first generalization parameter.

12. The method according to any one of claims 1-11, characterized in that, The method further includes: Based on the behavioral data, a third generalization parameter is determined, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold, and the third generalization parameter is the other of the first depth threshold and the first entropy difference threshold. Use the third generalization parameter as the generalization parameter for the second current round; Based on the generalization parameters of the second current round, generate the access control policy for the second current round; The access control policy of the second current round and the generalization parameters of the second current round are input into the third major model; and when the second current round is not the first round, at least one access control policy generated by the third major model for the historical behavior data, and the generalization parameters on which the third major model generates each historically generated access control policy, are input into the third major model; wherein, the third major model is used to evaluate the input access control policies in order to find the access control policies that meet the first preset conditions; If the third major model does not output an access control policy that meets the first preset condition, and the output of the third major model includes a fourth generalization parameter, then return to the step of generating an access control policy for the second current round based on the generalization parameter of the second current round, wherein the fourth generalization parameter output by the third major model is used as the generalization parameter of the second current round. If the output of the third major model includes an access control policy that meets the first preset condition, then when the output of the first major model includes an access control policy that meets the first preset condition, at least one access control policy generated by the first major model and at least one access control policy generated by the third major model are input into the first major model or the third major model to determine the access control policy that meets the third preset condition. Determining the access control policy that meets the first preset condition as the access control policy for the first service includes: The access control policy that meets the third preset condition is determined as the access control policy for the first service.

13. An access control policy generation device for cloud security, characterized in that, include: The acquisition module is used to acquire behavioral data related to the first service; The first determining module is used to determine a first generalization parameter based on the behavior data, wherein the first generalization parameter is one of a first depth threshold and a first entropy difference threshold. The second determining module is used to use the first generalization parameter as the generalization parameter of the first current round; The first generation module is used to generate the access control policy for the first current round based on the generalization parameters of the first current round. The first evaluation module is used to input the access control policy of the first current round and the generalization parameters of the first current round into the first large model; And when the first current round is not the first round, at least one access control policy generated by the first large model for the historical behavior data, and the generalization parameters on which the first large model generates each historically generated access control policy, are input into the first large model; wherein, the first large model is used to evaluate the input access control policy to find the access control policy that meets the first preset condition. The first triggering module is configured to trigger the first generation module to generate an access control policy for the first current round based on the generalization parameter of the first current round if the first large model does not output an access control policy that meets the first preset conditions and the output of the first large model includes a second generalization parameter. The second generalization parameter output by the first large model is used as the generalization parameter of the first current round, and the second generalization parameter is determined based on the first number of file access rules in the access control policy of the first current round and the generalization parameter of the first current round. The third determining module is used to determine the access control policy that meets the first preset conditions as the access control policy of the first service if the output of the first large model includes an access control policy that meets the first preset conditions.

14. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method described in any one of claims 1-12.

15. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-12.

Images