Data access risk assessment method and system based on large language model

Abstract

The invention relates to a data access risk assessment method and system based on a large language model, and the method comprises the steps: recognizing the identity information of a user side when an access request instruction sent by any user side is received, and recognizing the access request instruction based on a preset rule, and obtaining an instruction feature; correlating the instruction feature, the identity information and the time information when the access request instruction is received to obtain a correlation data packet, and sending the correlation data packet to an access risk assessment model; the risk assessment model identifies the associated data packet and judges whether a context association judgment rule is started or not; when starting, judging whether the mapping relation among the current instruction feature, the identity information and the time information meets the access requirement or not; and when the access requirement is met, allocating a corresponding access permission to the user side, and tracing the user path information. The data access risk assessment method and device have the effects of improving the accuracy of data access risk assessment and reducing the situation of access risk misinformation.

Description

Technical Field

[0001] The present application relates to the technical field of data security, and in particular to a data access risk assessment method and system based on a large language model. Background Art

[0002] Data access risk assessment is a key technology in the field of information security. It aims to identify, quantify and address security risks that may arise when data is accessed through a systematic approach. Among them, false positives of access risks are a key issue that affects system availability and operational efficiency.

[0003] At present, there is a lack of perfect contextual association judgment in the data access process, and the association between different access elements is relatively simple, which makes it easy for false positives in access risks to occur, resulting in increased costs for subsequent manual review and adjustment and business interruption. Therefore, it is necessary to improve the accuracy of data access risk assessment. Summary of the Invention

[0004] In order to improve the accuracy of data access risk assessment and reduce the occurrence of false positives of access risks, the present application provides a data access risk assessment method and system based on a large language model.

[0005] The above-mentioned invention objective of this application is achieved through the following technical solutions:

[0006] A data access risk assessment method based on a large language model comprises the following steps:

[0007] When receiving an access request instruction from any user terminal, identifying the identity information of the user terminal, and identifying the access request instruction based on preset rules to obtain instruction characteristics;

[0008] Correlating the instruction characteristics, identity information, and time information when the access request instruction is received to obtain a correlation data packet, and sending it to the access risk assessment model;

[0009] The risk assessment model identifies relevant data packets and determines whether to enable context-related judgment rules;

[0010] When enabled, it determines whether the mapping relationship between the current instruction characteristics, identity information, and time information meets the access requirements;

[0011] When the access requirements are met, the corresponding access rights are assigned to the user end and the user path information is traced.

[0012] By adopting the above technical solution, when an access request instruction issued by the user end is received, the identity of the accessed user, the access time and the characteristics of the access instruction are obtained. The instruction characteristics reflect the user's access intention and target. Further, the instruction characteristics, identity information and the time information when the access request instruction is received are sent to the risk assessment model to evaluate whether the current access needs to activate the context association judgment rule, that is, to judge whether the current access has risks. If there are risks, the context association judgment rule needs to be enabled. When the context association judgment rule is enabled, it is necessary to determine whether the identity, time and target of the current visitor can eliminate risks based on the mapping relationship between the instruction characteristics, identity information and time information. If so, access rights are assigned to the user end and the user's path information is traced. Therefore, a single access instruction is judged from multiple dimensions. Compared with the traditional single judgment, the association judgment between different dimensional elements and the comprehensive risk judgment from the visitor's identity, access time and access target can improve the accuracy of data access risk assessment, thereby reducing the risk of false positives of access risks.

[0013] Optionally, the preset rules include instruction type identification and instruction target identification, and the step of identifying the access request instruction based on the preset rules and obtaining the instruction characteristics includes:

[0014] Based on instruction type identification, analyzing the execution intent of the access request instruction, and matching the instruction type associated with the execution intent from a preset database;

[0015] Based on instruction target identification, a target path to be executed by the access request instruction is obtained to obtain the instruction target;

[0016] The instruction type and instruction target in the same access request instruction are packaged and processed to obtain instruction features.

[0017] By adopting the above technical solution, the two features of the access request instruction type and the access target are extracted through preset rules. The execution intention of the user terminal can be judged by the instruction type, and the object that the user terminal currently wants to access is also clarified by the instruction target. The instruction type and instruction target are packaged and processed to obtain the instruction characteristics, which provides more dimensional judgment factors for the subsequent risk assessment model and helps to improve the accuracy of the risk assessment model judgment.

[0018] Optionally, the step of identifying associated data packets by the risk assessment model and determining whether to enable context association judgment rules includes:

[0019] The risk assessment model generates access events based on the combination of instruction features, time information and identity information in the associated data packet;

[0020] It is determined whether the access event is a risky access event or a normal access event; if it is a risky access event, the context association judgment rule is enabled, and if it is a normal access event, the context association judgment rule is not enabled.

[0021] By adopting the above technical solution, by judging whether to enable the context association judgment rule, the judgment step of normal access time can be saved, and the computing power and time consumption can be reduced. If the risk is judged by the instruction characteristics, time information and identity information, a risk access event is generated by combining them, that is, the risky data is first integrated and marked to facilitate the subsequent transmission and judgment of abnormal files.

[0022] Optionally, when enabled, the step of determining whether the mapping relationship between the current instruction characteristics, identity information, and time information meets the access requirements includes:

[0023] When the context association judgment rule is enabled, any one of the three features of instruction feature, identity information and time information is used as a fixed factor to identify whether there is a special permission relationship between the remaining two features and the fixed factor;

[0024] When a special permission relationship exists in the mapping relationship, it is determined that the access requirement is met, and the corresponding access rights are retrieved for the risk access event and allocated to the user end;

[0025] When no special permission relationship exists in the mapping relationship, the access request instruction is rejected and a prompt message is generated and sent to the user end.

[0026] By adopting the above technical solution, when performing context association judgment rules, the three features of instruction features, identity information and time information are combined in pairs to judge the association relationship. The judgment of the association relationship is to judge whether the combination relationship between the current visitor's specific identity, specific access time and specific operation is allowed to access. If so, it means that there is a special permission relationship, such as executives accessing high-security level files during non-working hours, financial personnel exporting reports in batches at the end of the month, developers accessing core systems across permissions, etc., and further assigning corresponding access rights for the current risk access time, that is, the access rights are not fully open, but are open for the current access situation to ensure the security of access. When there is no special permission relationship, it is determined that the access instruction cannot be executed at present, and a prompt message is sent to the user end to prompt the visitor.

[0027] Optionally, the step of identifying whether a special permission relationship exists between the remaining two features and the fixed factor includes:

[0028] When the mapping relationship between any feature and the fixed factor temporarily satisfies the conditions for forming a special permission relationship, determining whether the remaining feature has a preset exclusion relationship with the currently temporarily satisfied special permission relationship;

[0029] When no exclusion relationship is generated, it is determined that a special permission relationship currently exists;

[0030] When an exclusion relationship occurs, it is determined that no special permission relationship currently exists.

[0031] By adopting the above technical solution, that is, the formation of a special permission relationship, it is not only the relationship formed between a single feature and a fixed factor, but also necessary to consider whether the remaining feature produces an absolute exclusion relationship. For example, when an ordinary developer accesses the core system, his access operation behavior exceeds his authority, and it is also determined that there is no special permission relationship, thereby making the risk assessment of data access more accurate.

[0032] Optionally, when a special permission relationship exists in the mapping relationship, determining that the access requirement is met, and retrieving the corresponding access rights for the risk access event to allocate to the user terminal, includes:

[0033] When a special permission relationship exists in the mapping relationship, the constituent features of the current special permission relationship are identified to obtain the special permission type, which includes special identity permission, special behavior permission, and special time permission. The same special permission relationship may include one or more special permission types.

[0034] Retrieves the access rights that match each special permission type in the special permission relationship.

[0035] By adopting the above technical solution, the allocation of access rights needs to be determined according to the type of special permission relationship. The size of permissions corresponding to each special permission type is different. For example, if it is determined to be a special behavior permission, the permission only permits the behavior. If it is a special identity permission, in addition to permitting the current access instruction, other accessible permissions matching the same level as the identity are also permitted. The refined allocation of permissions makes data access more secure.

[0036] Optionally, when the access requirement is met, the step of allocating corresponding access rights to the user terminal and tracing the user path information includes:

[0037] When the access requirements are met, the access rights that match each special permission type in the special permission relationship are allocated to the user end;

[0038] Record the user's IP address information before and after obtaining access rights, and interrupt and reject the access request instruction if the IP address changes after obtaining access rights.

[0039] By adopting the above technical solution, when access needs are met, all access rights that meet the special licensing relationship will be allocated to the user end, realizing targeted allocation of rights, and recording whether the IP address of the user end changes after obtaining access rights. If changes occur, the access request instruction will be interrupted and rejected, so as to reduce illegal operations of the user end after obtaining access rights and improve the security of data access.

[0040] The second object of the present invention is achieved through the following technical solutions:

[0041] A data access risk assessment system based on a large language model, comprising:

[0042] An access identification module is used to identify the identity information of any user terminal when receiving an access request instruction from the user terminal, and identify the access request instruction based on preset rules to obtain instruction characteristics;

[0043] A data association module is used to associate instruction features, identity information, and time information when the access request instruction is received to obtain an associated data packet, and send it to the access risk assessment model;

[0044] The judgment module is used to identify the associated data packets in the risk assessment model and determine whether to enable the context association judgment rule;

[0045] The association analysis module is used to determine whether the mapping relationship between the current instruction characteristics, identity information and time information meets the access requirements when it is enabled;

[0046] The permission allocation module is used to allocate corresponding access permissions to the user end when the access requirements are met, and to trace the user path information.

[0047] By adopting the above technical solution, when an access request instruction issued by the user end is received, the identity of the accessed user, the access time and the characteristics of the access instruction are obtained. The instruction characteristics reflect the user's access intention and target. Further, the instruction characteristics, identity information and the time information when the access request message is received are sent to the risk assessment model to evaluate whether the current access needs to activate the context association judgment rule, that is, to judge whether the current access has risks. If there are risks, the context association judgment rule needs to be enabled. When the context association judgment rule is enabled, it is necessary to determine whether the identity, time and target of the current visitor can eliminate risks based on the mapping relationship between the instruction characteristics, identity information and time information. If so, access rights are allocated to the user end and the user's path information is traced. Therefore, a single access instruction is judged from multiple dimensions. Compared with the traditional single judgment, the association judgment between different dimensional elements and the comprehensive risk judgment from the visitor's identity, access time and access target can improve the accuracy of data access risk assessment, thereby reducing the risk of false positives of access risks.

[0048] The third objective of this application is achieved through the following technical solutions:

[0049] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned data access risk assessment method based on a large language model are implemented.

[0050] The fourth objective of this application is achieved through the following technical solutions:

[0051] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned data access risk assessment method based on a large language model.

[0052] In summary, this application includes at least one of the following beneficial technical effects:

[0053] 1. A single access instruction is judged from multiple dimensions. Compared with traditional single judgment, this method uses correlation judgments between different dimensional elements to make a comprehensive risk assessment based on the visitor's identity, access time, and access target. This can improve the accuracy of data access risk assessment and reduce the risk of false positives.

[0054] 2. Extract two features: the type and target of the access request instruction. The instruction type can be used to determine the user's execution intent, and the instruction target can also clarify the object that the user is currently trying to access. The instruction type and instruction target are packaged together to obtain instruction features, providing more dimensional judgment factors for the subsequent risk assessment model, helping to improve the accuracy of the risk assessment model.

[0055] 3. By determining whether to enable context-related judgment rules, the judgment steps for normal access time can be saved, reducing computing power and time consumption. If risks are judged through instruction characteristics, time information, and identity information, a risk access event is generated by combining them. That is, the risky data is first integrated and marked to facilitate the subsequent transmission and judgment of abnormal files.

[0056] 4. The allocation of access rights needs to be determined according to the type of special permission relationship. Each special permission type corresponds to a different level of permission. For example, if it is determined to be a special behavior permission, the permission only permits that behavior. If it is a special identity permission, in addition to permitting the current access instruction, it also permits other accessible permissions that match the same level as the identity. The detailed allocation of permissions makes data access more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flowchart of an implementation of a data access risk assessment method based on a large language model in the present application;

[0058] Figure 2 This is a flowchart for implementing step S10 in an embodiment of a data access risk assessment method based on a large language model of the present application;

[0059] Figure 3 This is a flowchart for implementing step S40 in an embodiment of a data access risk assessment method based on a large language model of the present application;

[0060] Figure 4 This is a principle block diagram of a computer device of the present application. DETAILED DESCRIPTION

[0061] The following is combined with Figure 1-4 This application is described in further detail.

[0062] In the following embodiments, Figure 1 As shown, this application discloses a data access risk assessment method based on a large language model, which specifically includes the following steps:

[0063] S10: When receiving an access request instruction from any user terminal, identifying the identity information of the user terminal, and identifying the access request instruction based on preset rules to obtain instruction characteristics;

[0064] In this embodiment, the user terminal refers to a PC or mobile terminal for accessing system data. The user terminals with different identity information correspond to different accessible data and data types and can be customized. Identity information refers to the identity information of the staff who logs in to the user terminal. In this embodiment, the user terminal is logged in through an account and password, and the account and password are bound to the identity information of the staff.

[0065] The access request instruction is the instruction information issued by the current user end to the preset system for accessing data, including operations such as link acquisition, data loading, data copying and screenshots.

[0066] The preset rules are used to identify different types of characteristics of access request instructions, including instruction type identification and instruction target identification, to obtain different characteristics that reflect the purpose of the access request instruction, namely instruction characteristics. For details, refer to Figure 2 , including the steps of:

[0067] S11: Based on instruction type identification, analyzing the execution intent of the access request instruction, and matching the instruction type associated with the execution intent from a preset database;

[0068] S12: Based on the instruction target identification, the target path to be executed by the access request instruction is obtained to obtain the instruction target;

[0069] S13: Packing the instruction type and instruction target in the same access request instruction to obtain instruction features.

[0070] In this embodiment, the instruction type includes but is not limited to access loading, copying, screenshots, copying, exporting and downloading, forwarding and editing. Through the preset mapping relationship between the instruction type and the execution intention, the current instruction type with the execution intention can be matched from the database. On the premise of obtaining the instruction type, combined with the identification of the instruction target, the instruction characteristics are obtained to enrich the identification factors of this data access instruction.

[0071] S20: Correlating the instruction characteristics, identity information, and time information when the access request instruction is received to obtain a correlation data packet, and sending it to the access risk assessment model;

[0072] In this embodiment, the associated data packets are sent to the risk assessment model via a special encrypted channel. The risk assessment model is a data time-series mapping model trained using a neural network. It uses the instruction characteristics, identity information, and time information in the associated data packets to determine whether the current data access instruction is risky and whether risk assessment should be enabled.

[0073] S30: The risk assessment model identifies the associated data packets and determines whether to enable the context association judgment rule;

[0074] In this embodiment, the context association judgment rule is to simultaneously identify the mapping relationship between the instruction characteristics, identity information and time information in the associated data packet to determine whether the current data access instruction is risky. Specifically, the steps include:

[0075] S31: The risk assessment model generates an access event based on the instruction characteristics, time information, and identity information in the associated data packet;

[0076] S32: Determine whether the access event is a risky access event or a normal access event; if it is a risky access event, the context association judgment rule is enabled, while if it is a normal access event, the context association judgment rule is not enabled.

[0077] In this embodiment, a risk access event refers to a situation where the mapping relationship between the current data access instruction and the current time or / and the identity of the current user terminal belongs to a preset abnormal mapping relationship, such as executives accessing high-security level files during non-working hours, financial personnel exporting reports in batches at the end of the month, developers accessing core systems across permissions, etc. A normal access event refers to a situation where the mapping relationship between the current access instruction at the current time or / and the current user terminal is determined to belong to a preset normal mapping relationship.

[0078] The purpose of context association judgment rules is to determine whether the current risk access event is credible.

[0079] S40: When enabled, determining whether the mapping relationship between the current instruction characteristics, identity information, and time information meets the access requirements;

[0080] Specifically, refer to Figure 3 , including the steps of:

[0081] S41: When the context association judgment rule is enabled, any one of the three features of instruction feature, identity information, and time information is used as a fixed factor, and whether there is a special permission relationship between the remaining two features and the fixed factor is identified;

[0082] S42: When a special permission relationship exists in the mapping relationship, it is determined that the access requirement is met, and the corresponding access permission is retrieved for the risk access event and allocated to the user terminal;

[0083] S43: When there is no special permission relationship in the mapping relationship, the access request instruction is rejected, and a prompt message is generated and sent to the user end.

[0084] In this embodiment, the instruction feature, identity information, or time information are defined as three features. When determining the mapping relationship between the three features, any one feature is sequentially and non-repeatedly used as a fixed factor, and the remaining two features are identified as to whether a special permission relationship exists between each of the fixed factors, and whether a special permission relationship exists between the remaining two features in combination and the fixed factors. For example, if feature A is a fixed factor, feature B can generate a special permission relationship with feature A alone, and feature B needs to be combined with feature C and feature A to generate a special permission relationship.

[0085] If a special permission relationship exists, indicating that the access requirements are met, the system will allow the corresponding access rights to be assigned to the current risky access event. If no special permission relationship exists, indicating that the current risky access event does not meet the permission requirements, the access request will be rejected, a prompt message will be sent to the user, and the prompt message will be retained in the system background log.

[0086] Specifically, step S41 further includes the following steps:

[0087] S411: When the mapping relationship between any feature and the fixed factor temporarily satisfies the conditions for forming a special permission relationship, determining whether a remaining feature has a preset exclusion relationship with the currently temporarily satisfied special permission relationship;

[0088] S412: When no exclusive relationship is generated, it is determined that a special permission relationship currently exists;

[0089] S413: When an exclusive relationship is generated, it is determined that no special permission relationship currently exists.

[0090] Among them, when the mapping relationship between any feature and a fixed factor temporarily meets the conditions for forming a special permission relationship, if the third feature has an exclusion relationship, it should also be determined that there is no special permission relationship. For example, the user terminal operated by financial personnel accesses the financial statements of the entire enterprise at the end of the month. If the current access instruction is an export instruction, it is determined that there is no exclusion relationship. If it is an edit instruction, an exclusion relationship is generated.

[0091] Further, step S42 includes the steps of:

[0092] S421: When a special permission relationship exists in the mapping relationship, identify the constituent features of the current special permission relationship and obtain the special permission type. The special permission type includes special identity permission, special behavior permission, and special time permission. The same special permission relationship may include one or more special permission types.

[0093] S422: Retrieve the access rights that match each special permission type in the special permission relationship.

[0094] Among them, for matching specific access rights, it is necessary to know the constituent characteristics of the special permission relationship and obtain the special permission type. The access rights corresponding to the identity permission type include providing special access channels for special permission identities, special behavior permissions include allowing the execution of instructions within a preset time, and special time permissions include limiting the access time.

[0095] S50: When the access requirements are met, the corresponding access rights are allocated to the user terminal, and the user path information is traced back.

[0096] In this embodiment, tracing back the user's path information includes instantly obtaining the IP address information of the user terminal during the access process.

[0097] Specifically, the steps include:

[0098] S51: When the access requirement is met, the access rights matching each special permission type in the special permission relationship are allocated to the user terminal;

[0099] S52: Record the IP address information of the user before and after obtaining the access right, and interrupt and reject the access request instruction if the IP address changes after obtaining the access right.

[0100] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0101] In one embodiment, a data access risk assessment system based on a large language model is provided. The data access risk assessment system based on a large language model corresponds to the data access risk assessment method based on a large language model in the above embodiment. The data access risk assessment system based on a large language model includes:

[0102] An access identification module is used to identify the identity information of any user terminal when receiving an access request instruction from the user terminal, and identify the access request instruction based on preset rules to obtain instruction characteristics;

[0103] A data association module is used to associate instruction features, identity information, and time information when the access request instruction is received to obtain an associated data packet, and send it to the access risk assessment model;

[0104] The judgment module is used to identify the associated data packets in the risk assessment model and determine whether to enable the context association judgment rule;

[0105] The association analysis module is used to determine whether the mapping relationship between the current instruction characteristics, identity information and time information meets the access requirements when it is enabled;

[0106] The permission allocation module is used to allocate corresponding access permissions to the user end when the access requirements are met, and to trace the user path information.

[0107] Optionally, the access identification module includes:

[0108] A type identification submodule, configured to analyze the execution intent of the access request instruction based on instruction type identification, and match the instruction type associated with the execution intent from a preset database;

[0109] The target identification submodule is used to obtain the target path to be executed by the access request instruction based on instruction target identification, and obtain the instruction target;

[0110] The data packing submodule is used to pack the instruction type and instruction target in the same access request instruction to obtain instruction characteristics.

[0111] Optionally, the judgment module includes:

[0112] An event generation submodule, configured to generate an access event by combining the risk assessment model with instruction features, time information, and identity information in the associated data packet;

[0113] The event judgment submodule is used to judge whether the access event is a risky access event or a normal access event; the context association judgment rule is enabled for a risky access event, but not for a normal access event.

[0114] Optionally, the association analysis module includes:

[0115] A feature analysis submodule is used to, when the context association judgment rule is enabled, use any one of the three features of instruction feature, identity information, and time information as a fixed factor, and identify whether there is a special permission relationship between the remaining two features and the fixed factor;

[0116] The permission matching submodule is used to determine whether the access requirements are met when a special permission relationship exists in the mapping relationship, and to retrieve the corresponding access rights for the risk access event and allocate them to the user end;

[0117] The rejection submodule is used to reject the access request instruction when there is no special permission relationship in the mapping relationship, generate a prompt message and send it to the user end.

[0118] Optionally, the feature analysis submodule includes:

[0119] an exclusion analysis unit, configured to determine, when a mapping relationship between any feature and a fixed factor temporarily satisfies a condition for forming a special permission relationship, whether a remaining feature has a preset exclusion relationship with the currently temporarily satisfied special permission relationship;

[0120] The exclusion judgment unit is used to determine that a special permission relationship currently exists when no exclusion relationship exists; and to determine that a special permission relationship currently does not exist when an exclusion relationship exists.

[0121] Optional permission matching submodules include:

[0122] A special permission judgment unit is used to identify the constituent features of the current special permission relationship when a special permission relationship exists in the mapping relationship, and obtain the special permission type. The special permission types include special identity permission, special behavior permission, and special time permission. The same special permission relationship may include one or more special permission types.

[0123] The permission allocation unit is used to call the access permission matching each special permission type in the special permission relationship.

[0124] Optionally, the permission allocation module includes:

[0125] The tracing submodule is used to record the IP address information of the user before and after obtaining access rights, and to interrupt and reject the access request instruction if the IP address changes after obtaining access rights.

[0126] Regarding the specific definition of a data access risk assessment system based on a large language model, please refer to the definition of a data access risk assessment method based on a large language model above, which will not be repeated here. The various modules in the above-mentioned data access risk assessment system based on a large language model can be implemented in whole or in part through software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0127] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a data access risk assessment method based on a large language model is implemented.

[0128] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a data access risk assessment method based on a large language model is implemented.

[0129] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, a data access risk assessment method based on a large language model is implemented.

[0130] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0131] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0132] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A data access risk assessment method based on a large language model, characterized by: When receiving an access request instruction from any user terminal, identifying the identity information of the user terminal, and identifying the access request instruction based on preset rules to obtain instruction characteristics; Correlating the instruction characteristics, identity information, and time information when the access request instruction is received to obtain a correlation data packet, and sending it to the access risk assessment model; The risk assessment model identifies relevant data packets and determines whether to enable context-related judgment rules; When enabled, it determines whether the mapping relationship between the current instruction characteristics, identity information, and time information meets the access requirements; When the access requirements are met, the corresponding access rights are assigned to the user end and the user path information is traced.

2. The data access risk assessment method based on a large language model according to claim 1, characterized in that: The preset rules include instruction type identification and instruction target identification. The step of identifying the access request instruction based on the preset rules and obtaining the instruction characteristics includes: Based on instruction type identification, analyzing the execution intent of the access request instruction, and matching the instruction type associated with the execution intent from a preset database; Based on instruction target identification, a target path to be executed by the access request instruction is obtained to obtain the instruction target; The instruction type and instruction target in the same access request instruction are packaged and processed to obtain instruction features.

3. The data access risk assessment method based on a large language model according to claim 1 is characterized in that: The step of the risk assessment model identifying associated data packets and determining whether to enable context association judgment rules includes: The risk assessment model generates access events based on the combination of instruction features, time information and identity information in the associated data packet; It is determined whether the access event is a risky access event or a normal access event; if it is a risky access event, the context association judgment rule is enabled, and if it is a normal access event, the context association judgment rule is not enabled.

4. The data access risk assessment method based on a large language model according to claim 3 is characterized in that: When enabled, the step of determining whether the mapping relationship between the current instruction characteristics, identity information, and time information meets the access requirements includes: When the context association judgment rule is enabled, any one of the three features of instruction feature, identity information and time information is used as a fixed factor to identify whether there is a special permission relationship between the remaining two features and the fixed factor; When a special permission relationship exists in the mapping relationship, it is determined that the access requirement is met, and the corresponding access rights are retrieved for the risk access event and allocated to the user end; When no special permission relationship exists in the mapping relationship, the access request instruction is rejected and a prompt message is generated and sent to the user end.

5. The data access risk assessment method based on a large language model according to claim 4 is characterized in that: The step of identifying whether there is a special permission relationship between the remaining two features and the fixed factor includes: When the mapping relationship between any feature and the fixed factor temporarily satisfies the conditions for forming a special permission relationship, determining whether the remaining feature has a preset exclusion relationship with the currently temporarily satisfied special permission relationship; When no exclusion relationship is generated, it is determined that a special permission relationship currently exists; When an exclusion relationship occurs, it is determined that no special permission relationship currently exists.

6. The data access risk assessment method based on a large language model according to claim 4 is characterized in that: When a special permission relationship exists in the mapping relationship, the step of determining that the access requirement is met and retrieving the corresponding access permission for the risk access event to allocate to the user terminal includes: When a special permission relationship exists in the mapping relationship, the constituent features of the current special permission relationship are identified to obtain the special permission type, which includes special identity permission, special behavior permission, and special time permission. The same special permission relationship may include one or more special permission types. Retrieves the access rights that match each special permission type in the special permission relationship.

7. The data access risk assessment method based on a large language model according to claim 1, characterized in that: When the access requirements are met, the steps of allocating corresponding access rights to the user terminal and tracing the user path information include: When the access requirements are met, the access rights that match each special permission type in the special permission relationship are allocated to the user end; Record the user's IP address information before and after obtaining access rights, and interrupt and reject the access request instruction if the IP address changes after obtaining access rights.

8. A data access risk assessment system based on a large language model, characterized in that: include: An access identification module is used to identify the identity information of any user terminal when receiving an access request instruction from the user terminal, and identify the access request instruction based on preset rules to obtain instruction characteristics; A data association module is used to associate instruction features, identity information, and time information when the access request instruction is received to obtain an associated data packet, and send it to the access risk assessment model; The judgment module is used to identify the associated data packets in the risk assessment model and determine whether to enable the context association judgment rule; The association analysis module is used to determine whether the mapping relationship between the current instruction characteristics, identity information and time information meets the access requirements when it is enabled; The permission allocation module is used to allocate corresponding access permissions to the user end when the access requirements are met, and to trace the user path information.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the data access risk assessment method based on a large language model are implemented as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the data access risk assessment method based on a large language model are implemented.

Images