Network access behavior dynamic evaluation method and system for zero-trust architecture

Abstract

The invention discloses a zero-trust architecture-oriented network access behavior dynamic evaluation method and system, and the method comprises the steps: obtaining a network access request which comprises user identity information, access target information and access context information; constructing a user behavior model based on the access behavior historical record; implementing access behavior tracking based on space-time correlation analysis, recording a historical access path of a user and constructing an access path topological graph; dynamic trust degree calculation is executed based on the access path topological graph, and a dynamic trust score is generated in combination with the real-time evaluation vector and historical access path data; matching access context information in the network access request with the user behavior model to obtain a preliminary evaluation result; and determining whether to allow the network access request to continue according to the preliminary evaluation result. According to the method, the user behavior history, the real-time context information and the access path topology are comprehensively analyzed, and fine-grained dynamic access control is successfully realized.

Description

Technical Field

[0001] The present invention relates to the field of network access security, and in particular to a method and system for dynamically evaluating network access behavior for a zero-trust architecture. Background Art

[0002] The core concept of Zero Trust Architecture (ZTA) is "not trusting internal or external networks by default." Rather than relying on traditional perimeter protection, each access request undergoes rigorous authentication, real-time evaluation, and dynamic authorization. Leveraging big data analysis and machine learning, the system can learn user behavior patterns from past access records. By analyzing user information such as frequently accessed resources, regular access times, device types, and frequently used networks, a personalized behavior model is constructed, providing historical reference for real-time risk assessment. This technology has been widely used in behavioral anomaly detection and intrusion detection systems.

[0003] Existing network access behavior monitoring technologies have the following major challenges: First, traditional access control methods typically rely on static rules or a single authentication method, making them difficult to dynamically adapt to complex network environments and changing user behavior. This solution addresses this issue by introducing a dynamic trust scoring mechanism, addressing the inability of static methods to address dynamic threats. Second, traditional access control methods struggle to implement fine-grained access control based on user behavior and contextual information. This solution successfully implements fine-grained dynamic access control by comprehensively analyzing user behavior history, real-time contextual information, and access path topology. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for dynamic evaluation of network access behavior for a zero-trust architecture, which solves the above-mentioned technical problems pointed out in the prior art.

[0005] The present invention provides a method for dynamically evaluating network access behavior for a zero-trust architecture, comprising the following steps:

[0006] Obtaining a network access request, wherein the network access request includes user identity information, access target information, and access context information;

[0007] Extracting access behavior history records related to the user from a user behavior database based on the user identity information;

[0008] Building a user behavior model based on the access behavior history;

[0009] Implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and build access path topology maps;

[0010] Perform dynamic trust calculation based on the access path topology graph, and generate dynamic trust scores by combining real-time evaluation vectors and historical access path data;

[0011] Matching the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result;

[0012] Determine whether to allow the network access request to proceed based on the preliminary evaluation result.

[0013] Preferably, the step of extracting the access behavior history records related to the user includes:

[0014] Retrieving a user identifier that matches the user identity information from a user behavior database;

[0015] Extracting the resource type, access time, access frequency, and access duration of the user during the user's historical access process based on the user identifier;

[0016] The extracted resource type, access time, access frequency and access duration are used as access behavior history records.

[0017] Preferably, the step of constructing the user behavior model includes:

[0018] Classifying the resource types in the access behavior history records to obtain a resource type distribution;

[0019] Calculate the access time distribution and access frequency distribution of each resource type in the access behavior history records;

[0020] A user behavior model is constructed based on the resource type distribution, access time distribution, and access frequency distribution.

[0021] Preferably, the step of implementing access behavior tracking based on spatiotemporal correlation analysis includes:

[0022] Recording the access time, access location information, and user identity information in the network access request;

[0023] Performing spatiotemporal correlation matching with historical access records based on the access time, access location information, and user identity information;

[0024] Determine the user's access path at different times and locations, and build an access path topology map.

[0025] Preferably, the step of performing dynamic trust calculation based on the access path topology graph includes:

[0026] Determine the importance weight coefficient of each access path node in the access path topology graph;

[0027] Obtaining a real-time evaluation vector of each access behavior feature in the network access request;

[0028] A dynamic trust score is generated by combining the real-time evaluation vector, historical access path data, and importance weight coefficients of each access path node.

[0029] Preferably, the step of matching the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result includes:

[0030] Extracting the resource type and access time from the access target information in the network access request;

[0031] Comparing the resource type and access time with the resource type distribution and access time distribution in the user behavior model;

[0032] According to the comparison result, the matching degree between the network access request and the user behavior model is determined.

[0033] Preferably, the calculation formula of the dynamic trust score T is:

[0034] T=∑i=1n(wi×(α×Ri+β×Hi));

[0035] Where wi is the importance weight coefficient of the i-th access path node; Ri is the real-time evaluation vector value of the i-th access behavior feature; Hi is the relevance value of the historical access path data corresponding to the i-th access path node; α and β are the weight coefficients of the real-time evaluation vector and the historical access path data, respectively, and α + β = 1.

[0036] The present invention provides a network access behavior dynamic evaluation system for a zero-trust architecture, comprising:

[0037] A request acquisition module, configured to acquire a network access request, wherein the network access request includes user identity information, access target information, and access context information;

[0038] A history record extraction module is used to extract the access behavior history records related to the user from the user behavior database according to the user identity information;

[0039] A behavior model building module, used to build a user behavior model based on the access behavior history;

[0040] Access behavior tracking module, used to implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and build access path topology maps;

[0041] Dynamic trust calculation module, used to perform dynamic trust calculation based on the access path topology graph, and generate dynamic trust scores by combining real-time evaluation vectors and historical access path data;

[0042] a matching evaluation module, configured to match the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result;

[0043] The access decision module is used to determine whether to allow the network access request to proceed according to the preliminary evaluation result.

[0044] Correspondingly, the present application also relates to a storage medium, in which a computer program is stored. When the computer program is executed by a processor, a method for dynamically evaluating network access behavior for a zero-trust architecture is implemented.

[0045] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0046] An analysis of the above-mentioned method for dynamic network access behavior assessment for a zero-trust architecture provided by the present invention shows that, in specific applications, a network access request is first obtained, the network access request including user identity information, access target information, and access context information; based on the user identity information, access behavior history records related to the user are extracted from a user behavior database; based on the access behavior history records, a user behavior model is constructed; access behavior tracking based on spatiotemporal correlation analysis is implemented, the user's historical access path is recorded, and an access path topology map is constructed;

[0047] Dynamic trust calculation is performed based on the access path topology graph, and a dynamic trust score is generated by combining the real-time evaluation vector and historical access path data; the access context information in the network access request is matched with the user behavior model to obtain a preliminary evaluation result; and based on the preliminary evaluation result, it is determined whether to allow the network access request to continue.

[0048] The technical solution employed in this embodiment of the present invention introduces a dynamic trust calculation mechanism. Based on user behavior history, real-time contextual information, and access path topology, it dynamically and accurately assesses the trustworthiness of network access requests, enabling real-time, fine-grained control of network access behavior. Integrating the concept of a zero-trust architecture, this solution effectively detects anomalous behavior and potential threats through spatiotemporal correlation analysis and dynamic trust scoring, mitigating potential security risks associated with traditional static rule-based evaluation methods and improving the overall security of the network system.

[0049] At the same time, by constructing access path topology maps and dynamic trust scores, manual intervention is reduced, automated evaluation and management of complex network access behaviors are achieved, and the intelligence level of the system is improved.

[0050] Research has found that traditional access control methods typically rely on static rules or a single authentication method, making it difficult to dynamically adapt to complex network environments and changing user behavior. However, the technical solution of the embodiments of the present invention addresses the problem that static methods are difficult to deal with dynamic threats by introducing a dynamic trust scoring mechanism. Research has found that traditional access control methods have difficulty implementing fine-grained access control based on user behavior and contextual information. However, the technical solution of the embodiments of the present invention successfully implements fine-grained dynamic access control by comprehensively analyzing user behavior history, real-time contextual information, and access path topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 This is an overall flow chart of a method for dynamically evaluating network access behavior in a zero-trust architecture, provided in Example 1 of the present invention;

[0053] Figure 2 A flowchart of a recognition system for processing skit content based on computer vision recognition provided in the second embodiment of the present invention;

[0054] Figure 3 A storage medium provided in embodiment 3 of the present invention;

[0055] Tags: request acquisition module 10; history extraction module 20; behavior model construction module 30; access behavior tracking module 40; dynamic trust calculation module 50; matching evaluation module 60; access decision module 70; processor 1110; communication interface 1120; memory 1130; computer storage medium 1140. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] The present invention will be further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0058] Example 1

[0059] like Figure 1 As shown, the present invention proposes a method for dynamic evaluation of network access behavior for zero-trust architecture, including the following steps:

[0060] S101: Obtain a network access request, where the network access request includes user identity information, access target information, and access context information;

[0061] S102: extracting access behavior history records related to the user from a user behavior database based on the user identity information;

[0062] S103: Building a user behavior model based on the access behavior history records;

[0063] S104: Implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and construct an access path topology map;

[0064] S105: Perform dynamic trust calculation based on the access path topology graph, and generate a dynamic trust score by combining the real-time evaluation vector and historical access path data;

[0065] S106: Matching the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result;

[0066] S107: Determine whether to allow the network access request to proceed based on the preliminary evaluation result.

[0067] Analysis of the above technical solution shows that, in its specific application, it first obtains a network access request, which includes user identity information, access target information, and access context information; based on the user identity information, extracts the user's access behavior history records from the user behavior database; constructs a user behavior model based on the access behavior history records; implements access behavior tracking based on spatiotemporal correlation analysis, records the user's historical access path, and constructs an access path topology map;

[0068] Dynamic trust calculation is performed based on the access path topology graph, and a dynamic trust score is generated by combining the real-time evaluation vector and historical access path data; the access context information in the network access request is matched with the user behavior model to obtain a preliminary evaluation result; and based on the preliminary evaluation result, it is determined whether to allow the network access request to continue.

[0069] The technical solution employed in this embodiment of the present invention introduces a dynamic trust calculation mechanism. Based on user behavior history, real-time contextual information, and access path topology, it dynamically and accurately assesses the trustworthiness of network access requests, enabling real-time, fine-grained control of network access behavior. Integrating the concept of a zero-trust architecture, this solution effectively detects anomalous behavior and potential threats through spatiotemporal correlation analysis and dynamic trust scoring, mitigating potential security risks associated with traditional static rule-based evaluation methods and improving the overall security of the network system.

[0070] At the same time, by constructing access path topology maps and dynamic trust scores, manual intervention is reduced, automated evaluation and management of complex network access behaviors are achieved, and the intelligence level of the system is improved.

[0071] Research has found that traditional access control methods typically rely on static rules or a single authentication method, making it difficult to dynamically adapt to complex network environments and changing user behavior. However, the technical solution of the embodiments of the present invention addresses the problem that static methods are difficult to deal with dynamic threats by introducing a dynamic trust scoring mechanism. Research has found that traditional access control methods have difficulty implementing fine-grained access control based on user behavior and contextual information. However, the technical solution of the embodiments of the present invention successfully implements fine-grained dynamic access control by comprehensively analyzing user behavior history, real-time contextual information, and access path topology.

[0072] Preferably, in step S102, the step of extracting access behavior history records includes:

[0073] S201: Retrieving a user identifier that matches the user identity information from a user behavior database;

[0074] S202: Extracting the resource type, access time, access frequency, and access duration of the user during historical access according to the user identifier;

[0075] S203: The extracted resource type, access time, access frequency, and access duration are recorded as access behavior history.

[0076] Executing steps S201-S203 extracts historical behavior data, including multi-dimensional information such as resource type, access time, access frequency, and duration, ensuring the comprehensiveness and accuracy of historical records. This provides a high-quality data foundation for subsequent steps (such as user behavior model construction and dynamic trust calculation), improving the reliability and accuracy of evaluation results.

[0077] Preferably, in step S103, the step of constructing the user behavior model includes:

[0078] S301: Classify the resource types in the access behavior history records to obtain resource type distribution;

[0079] S302: Calculate the access time distribution and access frequency distribution of each resource type in the access behavior history records;

[0080] S303: Constructing a user behavior model based on the resource type distribution, access time distribution, and access frequency distribution.

[0081] The above steps S301-S303 construct a comprehensive model of user behavior characteristics by quantitatively analyzing the distribution of resource types, access times, and access frequencies. This model can capture users' usage habits and behavioral patterns when accessing different resources, providing an accurate behavioral benchmark for dynamic evaluation.

[0082] Preferably, in step S104, the step of implementing access behavior tracking based on spatiotemporal correlation analysis includes:

[0083] S401: Recording the access time, access location information, and user identity information in the network access request;

[0084] S402: performing spatiotemporal correlation matching with historical access records based on the access time, access location information, and user identity information;

[0085] S403: Determine the access paths of users at different times and locations, and construct an access path topology map.

[0086] The above steps introduce spatiotemporal correlation analysis, enabling comprehensive tracking of user access behavior across both time and space. Furthermore, by constructing an access path topology map, it clearly reflects user access paths across time and space, enhancing the ability to detect anomalous access paths and improving the efficiency of capturing potential threats.

[0087] Preferably, in step S105, the step of performing dynamic trust calculation based on the access path topology graph includes:

[0088] S501: Determine the importance weight coefficient of each access path node in the access path topology graph;

[0089] S502: Obtaining a real-time evaluation vector of each access behavior feature in the network access request;

[0090] S503: Generate a dynamic trust score by combining the real-time evaluation vector, historical access path data, and importance weight coefficients of each access path node.

[0091] This technical solution quantifies the importance of access path nodes using weight coefficients, ensuring a more accurate and reasonable dynamic trust score. By integrating real-time evaluation vectors with historical access path data, the dynamic trust score is generated. This technology aims to dynamically combine current behavior with historical patterns to achieve dynamic trust assessment based on multi-dimensional features, improving the accuracy of trust calculations.

[0092] Preferably, in step S106, the step of matching the access context information in the network access request with the user behavior model includes:

[0093] S601: Extracting the resource type and access time from the access target information in the network access request;

[0094] S602: Compare the resource type and access time with the resource type distribution and access time distribution in the user behavior model;

[0095] S603: Determine the matching degree between the network access request and the user behavior model according to the comparison result.

[0096] The above-mentioned execution steps S601-S603 achieve context-aware dynamic matching by comparing access target information (such as resource type and access time) with the user behavior model, which can quickly evaluate the legitimacy and matching degree of the current network access request, significantly improving the accuracy of access control decisions.

[0097] Preferably, in step S105, the calculation formula of the dynamic trust score T is:

[0098] T=∑i=1n(wi×(α×Ri+β×Hi));

[0099] Where wi is the importance weight coefficient of the i-th access path node; Ri is the real-time evaluation vector value of the i-th access behavior feature; Hi is the relevance value of the historical access path data corresponding to the i-th access path node; α and β are the weight coefficients of the real-time evaluation vector and the historical access path data, respectively, and α + β = 1.

[0100] This technical solution proposes a dynamic trust scoring model that comprehensively considers node weights, real-time evaluation vectors, and historical path data to ensure the rationality of the scoring results. By dynamically adjusting the weight parameters (α and β), it can flexibly balance the importance of real-time and historical behavior in different scenarios.

[0101] The above technical solutions support the rapid assessment of complex network access and improve the efficiency and security of dynamic access control in the zero-trust architecture.

[0102] Example 2

[0103] like Figure 2 As shown, accordingly, the present invention also proposes a network access behavior dynamic evaluation system for zero-trust architecture, including:

[0104] A request acquisition module 10 is configured to acquire a network access request, wherein the network access request includes user identity information, access target information, and access context information;

[0105] A history record extraction module 20 is used to extract the access behavior history records related to the user from the user behavior database according to the user identity information;

[0106] A behavior model building module 30 is used to build a user behavior model based on the access behavior history;

[0107] The access behavior tracking module 40 is used to implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and construct an access path topology map;

[0108] A dynamic trust calculation module 50 is used to perform dynamic trust calculation based on the access path topology graph and generate a dynamic trust score by combining the real-time evaluation vector and historical access path data;

[0109] a matching evaluation module 60, configured to match the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result;

[0110] The access decision module 70 is configured to determine whether to allow the network access request to proceed based on the preliminary evaluation result.

[0111] Example 3

[0112] like Figure 3 As shown, on the other hand, this third embodiment is based on the method for dynamic network access behavior assessment for a zero-trust architecture provided in the first embodiment of the invention, and further provides a computer storage medium 1140 (hereinafter referred to as the storage medium). This is a schematic diagram of the computer storage medium structure framework provided in the third embodiment of the invention, which includes:

[0113] Memory 1130, for storing computer programs;

[0114] The communication interface 1120 is used to connect the memory 1130 to the processor 1110;

[0115] Processor 1110 is used to execute a computer program to implement a dynamic evaluation method for network access behavior oriented to a zero-trust architecture involved in Example 1 disclosed in combination with any of the above-mentioned implementation methods.

[0116] It is understood that the embodiments described herein may be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits, digital signal processors, digital signal processing devices, programmable logic devices, field programmable gate arrays, general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or a combination thereof.

[0117] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0118] To sum up, the example of the present invention proposes a dynamic network access behavior evaluation method and system for a zero-trust architecture. Through multi-dimensional data extraction, user behavior modeling, spatiotemporal correlation analysis, dynamic trust scoring and other steps, a dynamic network access evaluation method for a zero-trust architecture is constructed, which enhances the detection capability of abnormal behavior and potential threats and provides a good balance between security and user experience.

[0119] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for dynamic evaluation of network access behavior for zero-trust architecture, characterized in that: The following steps are included: Obtaining a network access request, wherein the network access request includes user identity information, access target information, and access context information; Extracting access behavior history records related to the user from a user behavior database based on the user identity information; Building a user behavior model based on the access behavior history; Implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and build access path topology maps; Perform dynamic trust calculation based on the access path topology graph, and generate dynamic trust scores by combining real-time evaluation vectors and historical access path data; Matching the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result; Determine whether to allow the network access request to proceed based on the preliminary evaluation result.

2. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 1 is characterized in that: The step of extracting the access behavior history records related to the user includes: Retrieving a user identifier that matches the user identity information from a user behavior database; Extracting the resource type, access time, access frequency, and access duration of the user during the user's historical access process based on the user identifier; The extracted resource type, access time, access frequency and access duration are used as access behavior history records.

3. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 2 is characterized in that: The steps of constructing the user behavior model include: Classifying the resource types in the access behavior history records to obtain a resource type distribution; Calculate the access time distribution and access frequency distribution of each resource type in the access behavior history records; A user behavior model is constructed based on the resource type distribution, access time distribution, and access frequency distribution.

4. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 3 is characterized in that: The steps of implementing access behavior tracking based on spatiotemporal correlation analysis include: Recording the access time, access location information, and user identity information in the network access request; Performing spatiotemporal correlation matching with historical access records based on the access time, access location information, and user identity information; Determine the user's access path at different times and locations, and build an access path topology map.

5. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 4 is characterized in that: The step of performing dynamic trust calculation based on the access path topology graph includes: Determine the importance weight coefficient of each access path node in the access path topology graph; Obtaining a real-time evaluation vector of each access behavior feature in the network access request; A dynamic trust score is generated by combining the real-time evaluation vector, historical access path data, and importance weight coefficients of each access path node.

6. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 5, characterized in that: The step of matching the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result includes: Extracting the resource type and access time from the access target information in the network access request; Comparing the resource type and access time with the resource type distribution and access time distribution in the user behavior model; According to the comparison result, the matching degree between the network access request and the user behavior model is determined.

7. The method for dynamic network access behavior evaluation based on zero-trust architecture according to claim 6 is characterized in that: The calculation formula of the dynamic trust score T is: T=∑i=1n(wi×(α×Ri+β×Hi)); Where wi is the importance weight coefficient of the i-th access path node; Ri is the real-time evaluation vector value of the i-th access behavior feature; Hi is the relevance value of the historical access path data corresponding to the i-th access path node; α and β are the weight coefficients of the real-time evaluation vector and the historical access path data, respectively, and α + β = 1.

8. A network access behavior dynamic evaluation system for zero-trust architecture, characterized by: include: A request acquisition module, configured to acquire a network access request, wherein the network access request includes user identity information, access target information, and access context information; A history record extraction module is used to extract the access behavior history records related to the user from the user behavior database according to the user identity information; A behavior model building module, used to build a user behavior model based on the access behavior history; Access behavior tracking module, used to implement access behavior tracking based on spatiotemporal correlation analysis, record user historical access paths and build access path topology maps; Dynamic trust calculation module, used to perform dynamic trust calculation based on the access path topology graph, and generate dynamic trust scores by combining real-time evaluation vectors and historical access path data; a matching evaluation module, configured to match the access context information in the network access request with the user behavior model to obtain a preliminary evaluation result; The access decision module is used to determine whether to allow the network access request to proceed according to the preliminary evaluation result.

9. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for dynamically evaluating network access behavior for a zero-trust architecture as described in any one of claims 1 to 7.

Images