A data access security verification method

Abstract

The application provides a data access security verification method, comprising: obtaining multi-dimensional feature data of an access request, performing cleaning and formatting processing on the feature data to obtain a standardized feature data set; if an abnormal pattern is detected, marking as a suspected fake request record; for the suspected fake request record, collecting state information of each node in the propagation path to obtain a state information set; according to the state information set, analyzing the state consistency of the suspected fake request record at each node to determine whether there is a suspicion of a fake behavior; if it is determined that there is a suspicion of a fake behavior, generating a corresponding abnormal report; according to the abnormal report, determining the specific node position where the abnormality occurs, obtaining the propagation trajectory data of the related node, and generating a trajectory log file; and according to the final detection report, updating a feature database and optimizing the classification model.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a data access security verification method. Background Technology

[0002] Data access security verification is directly related to the core protection capabilities of information systems and is a key cornerstone for ensuring data privacy and business continuity. With the continuous evolution of cyberattack methods, ensuring the legitimacy and security of access behavior has become a crucial issue that cannot be ignored across industries. However, current data access security verification methods have significant limitations in dealing with complex attack scenarios. Many solutions tend to focus only on single-point defense at the access point, neglecting the dynamic changes and multi-node interactions of data during propagation. This approach struggles to comprehensively capture the possibility of attackers disguising or tampering at different stages, especially when facing meticulously designed forged access. The lack of comprehensive analytical capabilities regarding behavioral characteristics and propagation status makes it difficult to identify and intercept potential threats in a timely manner.

[0003] The technical challenges in data access security verification are multifaceted. First, the source information and behavioral patterns of access requests are highly complex and covert. Attackers can circumvent traditional detection methods by forging timestamps or simulating normal access patterns, rendering identification methods relying solely on static features ineffective. As this problem intensifies, another key challenge emerges: the consistency of the states of various nodes in the data propagation path is difficult to verify in real time. Attackers may exploit information asymmetry between nodes to create confusion, causing the system to be unable to accurately determine the legitimacy of requests. These two factors intertwine, severely testing the accuracy and real-time performance of security verification. Therefore, establishing a security verification method that can accurately identify forgery behavior and track the propagation state in real time through multi-dimensional feature analysis and node state consistency verification in the data propagation path becomes the key issue in solving the aforementioned technical challenges. Summary of the Invention

[0004] This invention provides a data access security verification method, which mainly includes:

[0005] The system acquires multi-dimensional feature data of access requests, cleans and formats the feature data to obtain a standardized feature dataset. Based on the standardized feature dataset, a pre-established classification model is used to analyze the access requests to determine if any abnormal patterns exist. If an abnormal pattern is detected, the request is marked as a suspected forgery record. For each suspected forgery record, its state information at each node along the propagation path is collected to obtain a state information set. Based on the state information set, the consistency of the state of the suspected forgery record at each node is analyzed to determine if forgery behavior is suspected. If forgery behavior is suspected, a corresponding anomaly report is generated. Based on the anomaly report, the specific node location where the anomaly occurred is determined, and the propagation trajectory data of the relevant nodes is acquired to generate a trajectory log file. Through the trajectory log file, the propagation trajectory characteristics of the suspected forgery behavior are analyzed to determine whether they conform to preset anomaly propagation rules. If they conform, it is determined to be definite forgery behavior, and a final detection report is generated. Based on the final detection report, the feature database is updated and the classification model is optimized.

[0006] Furthermore, the acquisition of multi-dimensional feature data of the access request includes: collecting the source information, timestamp, and access pattern data of the access request through identification components deployed at key nodes in the propagation path; performing preliminary verification on the source information, timestamp, and access pattern data to exclude invalid or incomplete data records; and converting the verified data to a unified data structure and encoding method to generate the standardized feature dataset.

[0007] Furthermore, the step of analyzing the access request using a pre-established classification model based on the standardized feature dataset includes: inputting the standardized feature dataset into the classification model to extract multi-dimensional feature vectors of the access request; calculating weights on the feature vectors using the classification model to generate a corresponding risk score; comparing the risk score with a preset threshold to determine whether the access request has an abnormal pattern; if the risk score exceeds the preset threshold, marking the access request as potentially abnormal; for the access request marked as potentially abnormal, recording its feature vector and score result to form a preliminary analysis log; performing secondary verification on the preliminary analysis log to eliminate the possibility of misjudgment; and updating the marking status of the potentially abnormal request based on the secondary verification result.

[0008] Furthermore, the step of collecting status information of the suspected forged request record at each node of the propagation path includes: obtaining the processing progress data of the suspected forged request record at each node of the propagation path in real time by querying the response component; collecting the security status information of each node and recording whether there are abnormal alarms or error logs; generating a detailed status description of each node based on the processing progress data and the security status information; integrating the detailed status descriptions into the status information set and arranging them according to the node order; performing timestamp verification on the status information set to ensure the consistency of data collection time; performing redundancy checks on the status information set to exclude duplicate or irrelevant data items; and generating an integrity report of the status information set based on the verification and check results.

[0009] Furthermore, the step of analyzing the consistency of the suspected forged request record across nodes based on the state information set includes: extracting the processing progress and security status data of each node in the state information set; determining whether there is a state inconsistency by comparing the data of each node; if the state inconsistency is detected, recording the specific node and data difference; calculating the severity score of the state inconsistency based on the data difference; comparing the severity score with a preset suspicion threshold, and if it exceeds the suspicion threshold, determining it as a suspected forged behavior; and generating an anomaly report containing the node location and difference details for the records determined to be suspected forged behavior.

[0010] Furthermore, determining the specific node location of the anomaly based on the anomaly report includes: parsing the state inconsistency information recorded in the anomaly report and extracting the node identifiers involved; determining the node location where the anomaly first appears by comparing the state change time series of each node in the state inconsistency information; marking the node location where the anomaly first appears as a key anomaly node; obtaining the state change data of the nodes before and after the key anomaly node; verifying the accuracy of the anomaly location by analyzing the time series differences between the key anomaly node and its nodes before and after; generating a location record containing the specific node location based on the verification result; and associating and storing the location record with the anomaly report to form a complete anomaly analysis archive.

[0011] Furthermore, the step of acquiring the propagation trajectory data of relevant nodes and generating a trajectory log file includes: extracting detailed propagation path information of the key abnormal node and its preceding and following nodes based on the specific node location; collecting state change records of access requests in the propagation path information, including timestamps and state descriptions; generating a propagation trajectory sequence by sorting the state change records in chronological order; analyzing the state transition patterns of the access requests between nodes based on the propagation trajectory sequence; and integrating the state transition patterns with the propagation path information to generate the trajectory log file.

[0012] Furthermore, the step of analyzing the propagation trajectory characteristics of the suspected forgery behavior through the trajectory log file includes: parsing the trajectory log file and extracting the state change sequence of the access request in the propagation path; determining whether there is an abnormal state transition by performing pattern matching on the state change sequence; extracting the corresponding propagation trajectory feature data based on the abnormal state transition; comparing the propagation trajectory feature data with the preset abnormal diffusion rules; if the propagation trajectory feature data matches the preset abnormal diffusion rules, then determining that the access request is the exact forgery behavior; for the access request determined to be the exact forgery behavior, recording its propagation trajectory features and rule matching results; and generating the final detection report containing details of the exact forgery behavior based on the matching results.

[0013] Furthermore, updating the feature database and optimizing the classification model based on the final detection report includes: parsing the final detection report and extracting the propagation trajectory features and abnormal pattern data of the exact forgery behavior; updating the database content by inputting the propagation trajectory features and abnormal pattern data into the feature database; adjusting the training dataset of the classification model according to the updated content of the feature database; and optimizing the classification parameters of the classification model by retraining the training dataset.

[0014] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0015] This invention discloses a data access security verification method. It establishes a standardized feature dataset through multi-dimensional feature data collection and cleaning, uses a classification model to identify abnormal patterns, and performs state consistency analysis on suspected forged request records to determine suspected forgery behavior. Further, it collects state information of each node along the propagation path, analyzes state consistency, generates anomaly reports, and locates specific abnormal nodes. It acquires propagation trajectory data to generate trajectory log files, analyzes propagation trajectory features to determine whether they conform to abnormal propagation rules, and finally confirms it as definite forgery behavior, generating a detection report. This invention also continuously improves the detection accuracy of forgery behavior by updating the feature database and optimizing the classification model. This method can effectively identify and track forged access requests in the network, improving network security protection capabilities. Attached Figure Description

[0016] Figure 1 This is a flowchart of a data access security verification method according to the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and thoroughly described below with reference to the accompanying drawings. The described embodiments are merely some embodiments of the present invention.

[0018] like Figure 1 This embodiment of a data access security verification method may specifically include:

[0019] Step S101, obtaining the multi-dimensional feature data of the access request, includes: collecting the source information, timestamp, and access pattern data of the access request through identification components deployed at key nodes of the propagation path; performing preliminary verification on the source information, timestamp, and access pattern data to exclude invalid or incomplete data records; and converting the verified data to a unified data structure and encoding method to generate the standardized feature dataset.

[0020] By deploying identification components at key nodes in the propagation path, the source information, timestamps, and access pattern data of access requests are collected.

[0021] In one embodiment, a traffic capture component is deployed on the core router node of the network traffic monitoring system to record the IP address of each access request, the request initiation time (e.g., 2024-10-15 14:30:00), and the access frequency pattern (e.g., requests per minute). This multi-dimensional data collection helps to comprehensively understand the background of the requests, laying the foundation for subsequent analysis.

[0022] Preliminary verification is performed on the source information, timestamp, and access pattern data to exclude invalid or incomplete records.

[0023] During the verification process, if a request is found to have an empty IP address or an incorrect timestamp format (such as missing seconds), it is marked as invalid data and discarded. This ensures the quality of data for subsequent analysis and avoids misjudgments due to data errors.

[0024] The validated data is formatted, the data structure and encoding method are standardized, and a standardized feature dataset is generated.

[0025] Timestamps from different sources are uniformly converted to UTC format. For example, the local time 2024-10-15 14:30:00 is converted to the standard format 2023-10-15T14:30:00Z to ensure data consistency and facilitate cross-system analysis.

[0026] Step S102, analyzing the access request using a pre-established classification model based on the standardized feature dataset, includes: inputting the standardized feature dataset into the classification model to extract multi-dimensional feature vectors of the access request; calculating weights on the multi-dimensional feature vectors using the classification model to generate a corresponding risk score; comparing the risk score with a preset threshold to determine if the access request has an abnormal pattern; if the risk score exceeds the preset threshold, marking the access request as potentially abnormal; recording the feature vectors and score results for the access requests marked as potentially abnormal to form a preliminary analysis log; performing secondary verification on the preliminary analysis log to eliminate the possibility of misjudgment; and updating the marking status of the potentially abnormal based on the secondary verification results.

[0027] The standardized feature dataset is input into the classification model to extract multi-dimensional feature vectors of the access requests.

[0028] In one embodiment, the access request contains feature data such as the source IP address, request time, and access frequency, which are standardized to form a feature dataset. The classification model then transforms this data into a multi-dimensional feature vector, for example, mapping IP addresses to geolocation codes and quantifying access frequency into a numerical range, ultimately forming a vector containing 10 features. The purpose of this process is to transform complex raw data into structured information that the model can recognize for subsequent analysis. This extraction method can effectively capture potential patterns in access requests, providing a foundation for subsequent risk assessment.

[0029] The risk score is generated by calculating the weights of the feature vectors using a classification model.

[0030] Using the default parameters of scikit-learn's RandomForestClassifier, a classification model is trained on historical data. The model then calculates weights for the feature vectors, assigning a weight to each feature dimension. For example, a high access frequency might be assigned a higher weight of 0.4, while whether the request time falls within an abnormal period might have a weight of 0.3. The model then calculates a weighted average of all dimensions to arrive at a risk score, such as 0.75. A higher score reflects a higher degree of abnormality in the access request; a higher score may indicate a problem. The purpose of the weight calculation is to highlight the impact of key features, ensuring that the score more closely reflects actual risk.

[0031] The risk score is compared with a preset threshold to determine whether the access request has an abnormal pattern.

[0032] Assuming a preset threshold of 0.6, a request scoring 0.75 is considered to exhibit an abnormal pattern. The purpose of setting this threshold is to differentiate between normal and abnormal requests; the threshold can be dynamically adjusted based on historical data and business needs. This step helps to quickly identify potentially problematic requests, reducing the workload of subsequent analysis.

[0033] If the risk score exceeds a preset threshold, the access request is marked as potentially abnormal.

[0034] For requests with a score of 0.75, the system automatically marks them as potentially abnormal and records relevant information. This marking mechanism facilitates subsequent tracking and processing, ensures that abnormal requests are not missed, and provides a basis for further verification.

[0035] For access requests marked as potentially abnormal, their feature vectors and scoring results are recorded to form a preliminary analysis log.

[0036] The system will record the request's feature vectors, such as access frequency and time, along with a score of 0.75, in a log. This log serves to provide detailed evidence for subsequent verification, ensuring the analysis process is traceable.

[0037] By performing a second verification on the initial analysis logs, the possibility of misjudgment was ruled out.

[0038] Secondary verification may combine manual review or more complex rule engines to check for high scores due to special scenarios, such as peak access times during holidays. If a false positive is found, the label status is adjusted. This process effectively improves detection accuracy and reduces false positives.

[0039] Based on the results of the secondary verification, update the flag status of suspected anomalies.

[0040] If the request is confirmed to be normal after verification, the suspected anomaly flag is removed; if it is confirmed to be an anomaly, the flag is retained. This update mechanism ensures the accuracy of the final result and provides a reliable basis for subsequent processing.

[0041] Step S103, the step of collecting status information of the suspected forged request record at each node of the propagation path, includes: obtaining the processing progress data of the suspected forged request record at each node of the propagation path in real time by querying the response component; collecting the security status information of each node and recording whether there are abnormal alarms or error logs; generating a detailed status description of each node based on the processing progress data and the security status information; integrating the detailed status descriptions into the status information set and arranging them according to the node order; performing timestamp verification on the status information set to ensure the consistency of data collection time; performing redundancy checks on the status information set to exclude duplicate or irrelevant data items; and generating an integrity report of the status information set based on the verification and check results.

[0042] For suspected forged request records, collect their status information at each node along the propagation path.

[0043] In one embodiment, processing progress data is obtained in real time by querying the response component.

[0044] Understandably, the query response component is a system module specifically designed to monitor and record request processing progress. It can capture the processing time and status changes of a request at each node with millisecond precision. Assuming a request passes through three nodes, the query response component might record a processing time of 50 milliseconds at node 1, 80 milliseconds at node 2, and 120 milliseconds at node 3. These data reflect the differences in processing efficiency across nodes, providing a basis for subsequent analysis. The purpose of this is to promptly detect processing delays or abnormal pauses, ensuring that the data accurately reflects the request flow status.

[0045] Collect security status information of each node and record whether there are any abnormal alarms or error logs.

[0046] Specifically, security status information includes whether a node has triggered firewall rules and whether there are any unauthorized access records. For example, if node 2 generates an error log displaying "Insufficient access permissions" while processing a request, this could indicate that the request has been tampered with or forged. Collecting this information serves to assess the credibility of the request from a security perspective, providing direct evidence to determine forgery.

[0047] A detailed status description for each node is generated based on processing progress data and security status information.

[0048] The status description for node 1 might be "processing time 50 milliseconds, no abnormal alarms," ​​while for node 2 it might be "processing time 80 milliseconds, permission error log exists." This description integrates scattered data into intuitive information, facilitating subsequent analysis.

[0049] The detailed state descriptions are integrated into a set of state information and arranged in node order.

[0050] Specifically, the state information set is a structured list that ensures data from node 1 to node 3 is presented in order, avoiding confusion. This helps to clearly show the complete state changes of a request along its propagation path.

[0051] The status information set is timestamped to ensure consistency of data collection time.

[0052] Check if the timestamps of the data from each node are within the same time window. For example, if node 1's timestamp is 10:00:01, node 2's is 10:00:02, and node 3's is 10:01:00, there may be a risk of data delay or forgery. The purpose of timestamp verification is to ensure data synchronization and avoid analysis distortion due to time discrepancies.

[0053] Redundancy checks eliminate duplicate or irrelevant data items.

[0054] If the status data of node 2 is recorded twice, the redundant entries are deleted to ensure data accuracy. This step reduces data redundancy and improves analysis efficiency.

[0055] An integrity report is generated based on the verification and check results, representing the set of status information.

[0056] Specifically, the integrity report records whether data is missing or tampered with, such as "Data for nodes 1 to 3 is complete, with no missing items." This helps confirm data reliability and lays the foundation for subsequent analysis.

[0057] Step S104, analyzing the consistency of the suspected forged request record across nodes based on the status information set, includes: extracting the processing progress and security status data of each node in the status information set; determining whether there is a status inconsistency by comparing the data of each node; if a status inconsistency is detected, recording the specific node and data difference; calculating the severity score of the status inconsistency based on the data difference; comparing the severity score with a preset suspicion threshold, and if it exceeds the suspicion threshold, determining it as a suspected forged behavior; and generating an anomaly report containing node identifiers and difference details for records determined to be suspected forged behavior.

[0058] Extract the processing progress and security status data of each node from the status information set.

[0059] In one embodiment, the network request propagation path assumes three nodes, A, B, and C, which record the request processing time and security verification result, respectively. Node A shows a processing time of 10:00 and a security status of "passed"; Node B shows a processing time of 10:02 and a security status of "passed"; Node C shows a processing time of 10:05 and a security status of "failed". By extracting this data, a complete set of status information can be formed, laying the foundation for subsequent analysis. The purpose of this is to ensure the comprehensiveness and accuracy of the data so that no key information is missed during subsequent comparisons.

[0060] By comparing the data of each node, it can be determined whether there are any inconsistencies in the state.

[0061] Nodes A and B both have a successful security status, while node C has failed, indicating a potential inconsistency in their states. Further comparison of processing times reveals that node C's processing time is significantly delayed, suggesting possible request tampering or delayed processing. This comparative analysis helps quickly identify anomalies and provides a basis for subsequent judgments.

[0062] If an inconsistency is detected, the specific node and data difference of the inconsistency are recorded.

[0063] For node C, its security status is recorded as failed, inconsistent with other nodes, with a time difference of 3 minutes. These specific data differences will be recorded in detail, forming initial clues to the anomaly. The purpose of recording this information is to provide traceable evidence for subsequent analysis and ensure the accuracy of anomaly localization.

[0064] Based on the data discrepancies, a severity score for the inconsistency in status is calculated.

[0065] By combining time difference and security failure scenarios, a score of 1 point is assigned for each minute of time difference, and 5 points for each security failure, resulting in a score of 8 points for node C. This scoring mechanism quantifies the severity of anomalies and provides a reference for subsequent decision-making.

[0066] The severity score is compared with a preset suspicion threshold. If the score exceeds the suspicion threshold, it is determined to be a suspected forgery.

[0067] Assuming a suspicion threshold of 6 points, node C's score of 8 points exceeds the threshold and is therefore identified as a suspected forgery. The purpose of setting a threshold is to filter out minor anomalies, focus on high-risk situations, and improve analysis efficiency.

[0068] For records identified as suspected of being forged, generate an anomaly report that includes node identifiers and details of the discrepancies.

[0069] The report details the name of node C, the 3-minute time difference, and the failure of its security status. The purpose of generating this report is to provide a clear reference for subsequent analysis and ensure that no abnormal information is lost.

[0070] Step S105, determining the specific node location of the anomaly based on the anomaly report, includes: parsing the state inconsistency information recorded in the anomaly report and extracting the node identifiers involved; determining the node location where the anomaly first appears by comparing the state change time series of each node in the state inconsistency information; marking the node location where the anomaly first appears as a key anomaly node; obtaining the state change data of the nodes before and after the key anomaly node; verifying the accuracy of the anomaly location by analyzing the time series differences between the key anomaly node and its nodes before and after; generating a location record containing the specific node location based on the verification result; and storing the location record in association with the anomaly report to form a complete anomaly analysis archive.

[0071] Analyze the inconsistent status information recorded in the anomaly report and extract the identifiers of the involved nodes.

[0072] In one embodiment, an anomaly report in a network transmission system might record inconsistencies in the status of data packets across multiple nodes. Specifically, some nodes might indicate that data has been received, while subsequent nodes might show that it has not. During parsing, the system first extracts all node identifiers mentioned in the report, such as nodes A, B, and C, and records the status information of each node, such as a timestamp and status description. The purpose of this is to clarify the scope of the anomaly and provide basic data support for subsequent troubleshooting. In this way, potential problem areas can be quickly identified.

[0073] By comparing the time series of state changes of each node in the inconsistent state information, the location of the node where the anomaly first appeared can be determined.

[0074] In the system described above, node A's timestamp shows a data reception time of 10:00, while node B shows no data received with a timestamp of 10:01. This comparison reveals that node B is the first point of inconsistency in status, thus initially indicating that the anomaly first appeared at node B. Such comparative analysis helps to accurately pinpoint the origin of the problem, avoids blind troubleshooting, and improves efficiency.

[0075] Based on the location of the node where the anomaly first appears, mark it as a critical anomaly node.

[0076] Taking the above example, node B is marked as a key anomaly node, meaning that subsequent analysis will revolve around this node. The key role of marking is to focus resources, concentrate analytical efforts, and ensure that the investigation does not deviate from its intended direction.

[0077] For critical abnormal nodes, obtain the state change data of their preceding and following adjacent nodes.

[0078] For node B, obtain the status data of the preceding node A and the following node C to check whether A sent data normally and whether C received data normally, with timestamps of 9:59 and 10:02 respectively. By obtaining data from adjacent nodes, complete contextual information can be formed, providing a basis for verifying abnormal locations.

[0079] The accuracy of the anomaly location was verified by analyzing the time series differences between key anomaly nodes and their preceding and following nodes.

[0080] Analysis revealed that node A transmitted normally, while node C did not receive, and the timestamp of node B showed a processing delay, verifying that the anomaly did indeed occur at node B. This verification process ensures the reliability of the location results and avoids misjudgments.

[0081] Based on the verification results, a location record containing the specific node location is generated.

[0082] The generated record shows the anomaly location as node B, the time as 10:01, and the status as "not received." The purpose of this location record is to provide a clear target for subsequent repairs and to facilitate archiving and management.

[0083] Location records are linked and stored with anomaly reports to form a complete anomaly analysis archive.

[0084] In the above embodiment, the location record of node B is bound to the original report and stored in the database to form a traceable archive. This facilitates historical data analysis and problem reproduction, and improves system maintenance capabilities.

[0085] Step S106, obtaining the propagation trajectory data of relevant nodes and generating a trajectory log file, includes: extracting detailed propagation path information of the key abnormal node and its preceding and following nodes according to the specific node location; collecting the state change records of access requests in the propagation path information, including timestamps and state descriptions; generating a propagation trajectory sequence by sorting the state change records in chronological order; analyzing the state transition patterns of the access requests between nodes according to the propagation trajectory sequence; and integrating the state transition patterns with the propagation path information to generate the trajectory log file.

[0086] Extract detailed propagation path information of key abnormal nodes and their preceding and following nodes based on specific node locations.

[0087] In one embodiment, assuming node A is marked as an abnormal node, the system first locates node A's position in the entire request chain, and then extracts relevant information from node A's preceding node B and following node C, including the time when the request enters and leaves each node, the request identifier, and other data. This extraction method helps to fully reconstruct the context in which the anomaly occurred, providing a comprehensive basis for subsequent analysis.

[0088] Collect and record the status change records of access requests in the propagation path information, including timestamps and status descriptions.

[0089] In the analysis of node A above, the system recorded the request's timestamp at node B as 2023-10-01 10:00:00, with a status of "Processing"; and at node A as 2023-10-01 10:00:05, with a status of "Abnormal Interruption". These records provide a clear understanding of the request's status changes at each node, offering clues for locating the cause of the anomaly.

[0090] By sorting the state change records, a propagation trajectory sequence is generated in chronological order.

[0091] The records are sorted by timestamp from smallest to largest, forming a trajectory sequence from B to A and then to C. This chronological arrangement visually demonstrates the request flow and facilitates subsequent analysis of the logic of state transitions.

[0092] The state transition patterns of access requests between nodes are analyzed based on the propagation trajectory sequence.

[0093] Analysis revealed that the change in the request status from "processing" on node B to "abnormal interruption" on node A was likely due to packet loss. This pattern analysis helps identify potential patterns in anomalies, providing a basis for subsequent judgments.

[0094] The state transition mode and propagation path information are integrated to generate a trajectory log file.

[0095] The aforementioned state transition patterns and path information are integrated into a structured log file, containing fields such as node identifier, timestamp, and state description. This integration method facilitates systematic storage and retrieval.

[0096] Step S107, analyzing the propagation trajectory features of the suspected forgery behavior through the trajectory log file, includes: parsing the trajectory log file and extracting the state change sequence of the access request in the propagation path; determining whether there is an abnormal state transition by performing pattern matching on the state change sequence; extracting the corresponding propagation trajectory feature data based on the abnormal state transition; comparing the propagation trajectory feature data with the preset abnormal diffusion rules; if the propagation trajectory feature data matches the preset abnormal diffusion rules, then determining that the access request is the exact forgery behavior; for the access request determined to be the exact forgery behavior, recording its propagation trajectory features and rule matching results; and generating the final detection report containing details of the exact forgery behavior based on the matching results.

[0097] Parse the trajectory log file to extract the state change sequence of the access request in the propagation path.

[0098] In one embodiment, the log file records the state changes of the access request propagating from node A to node E as "initiated-forwarded-received-abnormal interruption-retry". These state changes are extracted chronologically using a parsing tool, forming a state change sequence. This extraction process can help in subsequent analysis to identify any unusual state transitions, thus providing foundational data for judging forgery behavior.

[0099] It should be noted that the completeness and accuracy of the state change sequence directly affect the subsequent analysis results; therefore, the integrity of the log file must be ensured during parsing. Pattern matching of the state change sequence is performed to determine whether any abnormal state transitions exist.

[0100] In a propagation path, the normal state transition should be "initiate-forward-receive," but the extracted sequence shows "initiate-forward-abnormal interruption-retry." Pattern matching reveals that the "abnormal interruption" does not conform to the normal pattern. This indicates that forgery may be interfering with normal propagation. The pattern matching process can be based on a preset normal state transition template for comparison; the appearance of abnormal states often signifies potential risks.

[0101] Based on the abnormal state transition, extract the corresponding propagation trajectory feature data.

[0102] When an "abnormal interruption" state is detected, the system extracts the timestamp of the occurrence as 2023-10-01 14:30:00, the node where the occurrence occurred as C, and the access frequency data of the nodes before and after it. This feature data can reflect specific anomalies in the propagation trajectory, providing a basis for subsequent rule comparison. The purpose of extracting feature data is to more accurately characterize the manifestation of abnormal behavior.

[0103] The propagation trajectory feature data is compared with the preset abnormal diffusion rules.

[0104] In one embodiment, a preset rule stipulates that if a node experiences multiple "abnormal interruptions" within a short period of time, and the access frequency exceeds 50 times per minute, it is considered an abnormal spread. Assuming node C's data conforms to this rule, the comparison results show that its characteristic data highly matches the rule. The purpose of this step is to quantify abnormal behavior through rules, ensuring the objectivity of the judgment.

[0105] If the propagation trajectory feature data matches the preset abnormal diffusion rules, then the access request is determined to be a genuine forgery.

[0106] Node C's feature data meets the rule conditions, and the system marks it as forgery. This judgment process can effectively filter out real threats, reduce the possibility of false positives, and provide a clear target for subsequent processing.

[0107] For access requests identified as definite forgeries, their propagation trajectory characteristics and rule matching results are recorded.

[0108] The relevant data for node C, including timestamps, access frequency, and matching rule numbers, is stored in the database. This recording process facilitates subsequent traceability and analysis, ensuring the verifiability of the detection results.

[0109] Based on the matching results, a final detection report containing details of the exact forgery behavior is generated.

[0110] In one embodiment, the report details the time of the forgery as 14:30:00 on October 1, 2023, the location as node C, the anomaly type as "abnormal interruption," and includes the basis for rule matching. The generated report visually presents the detection results, facilitating quick understanding of the situation by relevant personnel. The final detection report is then transmitted to relevant modules for subsequent processing and feedback.

[0111] Step S108, updating the feature database and optimizing the classification model based on the final detection report, includes: parsing the final detection report and extracting the propagation trajectory features and abnormal pattern data of the exact forgery behavior; updating the database content by inputting the propagation trajectory features and abnormal pattern data into the feature database; adjusting the training dataset of the classification model according to the updated content of the feature database; and optimizing the classification parameters of the classification model by retraining the training dataset.

[0112] The final detection report is analyzed to extract the exact propagation trajectory characteristics and abnormal pattern data of the forgery behavior. In one embodiment, the detection report may include the propagation path of the forgery behavior in the network, such as time-series data from node A to node B and then to node C, as well as the specific manifestations of abnormal patterns, such as abnormal traffic surges. By analyzing this data, it is possible to clarify how the forgery behavior spreads in the system, such as an abnormal 50% increase in traffic within a certain period, thus providing a basis for subsequent updates. The purpose of this is to accurately locate the characteristics of the forgery behavior and ensure that subsequent model optimization is targeted and effective.

[0113] The propagation trajectory characteristics and abnormal pattern data are entered into the feature database, and the database content is updated.

[0114] The extracted propagation paths and abnormal traffic data can be entered into the database to form new feature entries, such as "multi-node traffic surge in a short period of time" as an abnormal pattern. This enriches the database's feature types, improves the model's ability to identify new forgery behaviors, and ensures that the database always reflects the latest threat patterns.

[0115] Adjust the training dataset for the classification model based on the updated content of the feature database.

[0116] After updating the database, the newly added feature data can be combined with historical data to form a new training set. For example, adding 1,000 abnormal pattern data can increase the training set coverage by 20%. This is done to allow the model to learn the latest forgery behavior features and improve classification accuracy.

[0117] Retrain the training dataset to optimize the classification parameters of the classification model.

[0118] By iteratively training the model and adjusting its weights on anomalous patterns, its recognition rate for new features is improved. This enhances the model's adaptability to new threats, ensuring greater accuracy in real-world applications.

[0119] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the concept of the present invention. In one embodiment, a technical solution is formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the present invention.

Claims

1. A data access security verification method, characterized in that, include: Obtain multi-dimensional feature data of access requests, clean and format the feature data to obtain a standardized feature dataset; Based on the standardized feature dataset, the access request is analyzed using a pre-established classification model to determine whether there are any abnormal patterns. If the abnormal pattern is detected, it is marked as a suspected forged request record; For the suspected forged request record, collect its status information at each node of the propagation path to obtain a set of status information; Based on the set of state information, analyze the consistency of the state of the suspected forged request record on each node to determine whether there is any suspicion of forgery. If the forgery is suspected, a corresponding anomaly report will be generated. Based on the anomaly report, determine the specific node location where the anomaly occurred, obtain the propagation trajectory data of the relevant nodes, and generate a trajectory log file; The propagation trajectory characteristics of the suspected forgery behavior are analyzed through the trajectory log file to determine whether they meet the preset abnormal diffusion rules. If they do, it is determined to be a definite forgery behavior, and a final detection report is generated. According to the final test report... Update the feature database and optimize the classification model.

2. The data access security verification method as described in claim 1, characterized in that, The acquisition of multi-dimensional feature data of the access request includes: By deploying identification components at key nodes in the propagation path, the source information, timestamps, and access pattern data of the access requests are collected; A preliminary verification is performed on the source information, timestamp, and access pattern data to exclude invalid or incomplete data records; The verified data is format-converted to unify the data structure and encoding method, generating the standardized feature dataset.

3. The data access security verification method as described in claim 1, characterized in that, The step of analyzing the access request using a pre-established classification model based on the standardized feature dataset includes: The standardized feature dataset is input into the classification model to extract the multi-dimensional feature vector of the access request; The classification model is used to calculate the weights of the multi-dimensional feature vectors to generate a corresponding risk score. The risk score is compared with a preset threshold to determine whether the access request has an abnormal pattern. If the risk score exceeds the preset threshold, the access request is marked as potentially abnormal. For access requests marked as potentially abnormal, their feature vectors and scoring results are recorded to form a preliminary analysis log; By performing a second verification on the preliminary analysis logs, the possibility of misjudgment was eliminated; Based on the secondary verification results, update the flag status of the suspected anomaly.

4. The data access security verification method as described in claim 1, characterized in that, The process of collecting status information of the suspected forged request record at each node along the propagation path includes: By querying the response component, the processing progress data of the suspected forged request record at each node of the propagation path can be obtained in real time; Collect the security status information of each node and record whether there are any abnormal alarms or error logs. Based on the processing progress data and the security status information, a detailed status description for each node is generated; The detailed state descriptions are integrated into the state information set and arranged according to the node order; The status information set is timestamped to ensure the consistency of data collection time. By performing a redundancy check on the set of state information, duplicate or irrelevant data items are eliminated; Based on the verification and check results, an integrity report of the status information set is generated.

5. The data access security verification method as described in claim 1, characterized in that, The step of analyzing the consistency of the state of the suspected forged request record across nodes based on the set of state information includes: Extract the processing progress and security status data of each node from the status information set; By comparing the data of each node, it can be determined whether there are any inconsistencies in the state. If an inconsistency is detected, the specific nodes and data differences of the inconsistency are recorded. Based on the data discrepancies, a severity score for the inconsistency in status is calculated; The severity score is compared with a preset suspicion threshold. If the score exceeds the suspicion threshold, the act is determined to be suspected of being fraudulent. For records identified as suspected of being forgeries, an anomaly report containing node identifiers and difference details is generated.

6. The data access security verification method as described in claim 1, characterized in that, The step of determining the specific node location where the anomaly occurred based on the anomaly report includes: Parse the inconsistent status information recorded in the anomaly report and extract the node identifiers involved; By comparing the time series of state changes of each node in the state inconsistency information, the location of the node where the anomaly first occurs can be determined. Based on the node location where the anomaly first appears, mark it as a critical anomaly node; For the critical abnormal node, obtain the state change data of its preceding and following adjacent nodes; The accuracy of the anomaly location was verified by analyzing the time series differences between the key anomaly nodes and their preceding and following nodes. Based on the verification results, a location record containing the specific node location is generated; The location records are associated with the anomaly reports and stored together to form a complete anomaly analysis file.

7. The data access security verification method as described in claim 1, characterized in that, The step of obtaining the propagation trajectory data of relevant nodes and generating trajectory log files includes: Based on the specific node location, extract detailed propagation path information of the key abnormal node and its preceding and following nodes; Collect the status change records of access requests in the propagation path information, including timestamps and status descriptions; By sorting the state change records, a propagation trajectory sequence is generated in chronological order; Based on the propagation trajectory sequence, analyze the state transition pattern of the access request between each node; The state transition mode is integrated with the propagation path information to generate the trajectory log file.

8. The data access security verification method as described in claim 1, characterized in that, The step of analyzing the propagation trajectory characteristics of the suspected forgery behavior through the trajectory log file includes: Parse the trajectory log file and extract the state change sequence of the access request in the propagation path; By performing pattern matching on the state change sequence, it can be determined whether there are any abnormal state transitions; Based on the abnormal state transition, extract the corresponding propagation trajectory feature data; The propagation trajectory feature data is compared with the preset abnormal diffusion rules; If the propagation trajectory feature data matches the preset abnormal diffusion rule, then the access request is determined to be the exact forgery behavior; For access requests identified as the exact forgery behavior, record their propagation trajectory characteristics and rule matching results; Based on the matching results, a final detection report containing details of the exact forgery behavior is generated.

9. The data access security verification method as described in claim 1, characterized in that, The step of updating the feature database and optimizing the classification model based on the final detection report includes: Analyze the final detection report to extract the propagation trajectory characteristics and abnormal pattern data of the exact forgery behavior; The propagation trajectory features and abnormal pattern data are entered into the feature database, and the database content is updated. The training dataset of the classification model is adjusted based on the updated content of the feature database. The classification parameters of the classification model are optimized by retraining the training dataset.

Images