Equipment network access permission updating method based on big data analysis model

Abstract

The invention relates to the technical field of computer networks, and particularly discloses an equipment network access permission updating method based on a big data analysis model, which comprises the following steps: analyzing recent access behaviors of equipment through the big data analysis model, and identifying a current access strategy and identification confidence of the current access strategy; modeling a historical access strategy of the equipment by using a long-short-term memory network, and capturing a long-term access behavior trend and a periodic rule; a fault tree analysis and probability risk assessment method is adopted, and a current access strategy, identification confidence, a long-term access behavior trend and a periodic rule are integrated to obtain a current access risk level of the equipment; according to the current access risk level of the equipment, the network access authority of the equipment is updated in combination with a dynamic self-adaptive authority adjustment strategy, so that the dynamic management of the network access authority of the equipment is realized, and the network security is guaranteed; according to the method, the equipment access risk can be effectively assessed in real time, the access authority is dynamically adjusted, and the network security and the normal access of the equipment are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a method for updating device network access rights based on a big data analysis model. Background Art

[0002] In today's digital age, a wide range of devices are widely connected to the network, enabling efficient data exchange and resource sharing. However, with the increasing complexity of network environments and the rapid growth in the number of devices, the management of device network access rights has become a critical component in ensuring network security and data protection. Traditional device network access rights management typically uses relatively fixed and static permission settings, which are difficult to adapt to the dynamic changes in device access behavior. Device access behavior analysis often relies on simple rule matching or limited historical data, failing to fully and deeply understand device access patterns and potential needs. The development of big data technology has brought new opportunities for device network access rights management. By collecting and analyzing large amounts of device access data, more valuable information can be discovered.

[0003] However, existing methods still have shortcomings in the application of big data analysis models. They struggle to accurately identify complex device access policies, and their analysis of access behavior is not sophisticated enough. Furthermore, their ability to capture long-term device access behavior trends and periodic access patterns is limited, making it impossible to effectively predict a device's future access needs. The lack of comprehensive, scientific analysis methods for assessing device access risk levels results in untimely and inaccurate permission updates, making it impossible to effectively balance network security with the normal access needs of devices.

[0004] A device network access permission updating method based on big data analysis model is proposed. Summary of the Invention

[0005] The present invention provides a method for updating device network access rights based on a big data analysis model. Step S1 uses a big data analysis model to identify the current access policy and confidence level of the device, and can accurately grasp the current access situation of the device. Step S2 uses a long-short-term memory network to model the device's historical access policy, capture long-term behavioral trends and periodic laws, and provide more comprehensive information for risk assessment. Step S3 uses a comprehensive analysis of fault tree analysis and probabilistic risk assessment methods to derive the current access risk level, making the assessment results more scientific and reliable. Step S4 updates access rights based on the current access risk level and dynamic adaptive permission adjustment strategy, achieving flexible and precise adjustment of permissions and improving the security of network access. This method can effectively assess device access risks in real time and dynamically adjust access rights, ensuring network security and normal device access.

[0006] The present invention provides a method for updating device network access rights based on a big data analysis model, comprising:

[0007] S1: Based on the big data analysis model, access policy identification is performed on the device's access behavior in the recent period, and the device's current access policy and identification confidence level are identified;

[0008] S2: Model the device's historical access strategy based on the long short-term memory network and capture the device's long-term access behavior trends and periodic access patterns;

[0009] S3: Analyze the device's current access strategy and identification confidence, as well as its long-term access behavior trends and periodic access patterns, based on fault tree analysis and probabilistic risk assessment methods to obtain the device's current access risk level.

[0010] S4: Update the device's network access permissions based on the device's current access risk level and the dynamically adaptive permission adjustment policy.

[0011] Preferably, a method for updating device network access rights based on a big data analysis model, S1: performing access policy identification on the access behavior of the device in the most recent period based on the big data analysis model, identifying the current access policy of the device and the identification confidence, including:

[0012] S101: Collecting the device access data in the recent period from various device logs, server logs, and security device alarm information in the network based on the distributed data collection framework;

[0013] S102: Analyze high-frequency access patterns in access data based on a data mining algorithm and use this as the current access strategy for the device;

[0014] S103: Perform cluster analysis on all sub-access data belonging to the high-frequency access pattern in the access data to determine the recognition confidence of the current access policy of the device.

[0015] Preferably, the method for updating device network access rights based on a big data analysis model, S102: analyzing high-frequency access patterns in access data based on a data mining algorithm as the current access policy for the device, includes:

[0016] Define all transactions in the access data based on the association rule mining algorithm, and mine high-frequency item sets from all transactions in the access data in combination with the preset minimum support threshold;

[0017] Sequence pattern mining is performed on all time series data in the high-frequency item set to identify the high-frequency access pattern of the device as the current access strategy of the device.

[0018] Preferably, the method for updating device network access rights based on a big data analysis model, S103: performing cluster analysis on all sub-access data belonging to high-frequency access patterns in the access data to determine the recognition confidence of the current access policy of the device, includes:

[0019] Construct a feature vector for each sub-access data based on the feature information of each sub-access data, and aggregate the feature vectors of all sub-access data belonging to the high-frequency access pattern in the access data as an original vector set;

[0020] Randomly select k eigenvectors from the original vector set as cluster centers, and calculate the Euclidean distance from each eigenvector to each cluster center;

[0021] Assign each eigenvector in the original vector set to the cluster corresponding to the nearest cluster center to obtain k vector clusters, and average all eigenvectors in each vector cluster to obtain a new cluster center for each vector cluster. Based on all the new cluster centers, re-cluster all eigenvectors in the original vector set until the average value of the Euclidean distance between all eigenvectors in each newly obtained vector cluster and the latest cluster center of the corresponding vector cluster is less than a preset threshold, then all qualified vector clusters are obtained;

[0022] The identification confidence of the device's current access policy is calculated based on all qualified vector clusters.

[0023] Preferably, the device network access permission updating method based on the big data analysis model calculates the recognition confidence of the device's current access policy based on all qualified vector clusters, including:

[0024]

[0025] Where C is the recognition confidence of the current access policy of the device, α is the cluster weight coefficient, k is the total number of all qualified vector clusters, and n j is the total number of eigenvectors contained in the jth qualified vector cluster, n is the total number of eigenvectors contained in the original vector set, β is the intra-cluster density weight coefficient, x ij is the i-th eigenvector in the j-th qualified vector cluster, c j is the cluster center of the jth qualified vector cluster, ‖x ij -c j ‖ 2 is the sum of the squares of the differences between the i-th eigenvector in the j-th qualified vector cluster and the cluster center of the j-th qualified vector cluster in each dimension, γ is the inter-cluster alienation weight coefficient, m is the total dimension of the eigenvector, c jl is the value of the lth dimension of the cluster center of the jth qualified vector cluster, c klThe value of the lth dimension of the cluster center of the kth qualified vector cluster.

[0026] Preferably, the device network access permission updating method based on the big data analysis model, S2: modeling the historical access strategy of the device based on the long short-term memory network and capturing the long-term access behavior trend and periodic access rule of the device, including:

[0027] S201: organizing the historical access strategy of the device into time series data to obtain a historical access strategy sequence;

[0028] S202: inputting the historical access strategy sequence into the long short-term memory network model, setting the number of hidden nodes and the learning rate for model training, and obtaining the long-term access behavior trend and periodic access rule of the device.

[0029] Preferably, the device network access permission updating method based on the big data analysis model, S3: analyzing the current access strategy and recognition confidence of the device and the long-term access behavior trend and periodic access rule of the device based on the fault tree analysis method and the probability risk assessment method to obtain the current access risk level of the device, including:

[0030] S301: taking the occurrence of the device access risk as the top event, and decomposing the top event into multiple intermediate events and basic events to obtain a device fault tree;

[0031] S302: assigning an occurrence probability to each basic event in the device fault tree based on the probability risk assessment method and the current access strategy of the device to obtain the occurrence probability of each basic event in the device fault tree;

[0032] S303: scoring the security degree of the current access strategy of the device based on the long-term access behavior trend and periodic access rule of the device to obtain the security degree score of the current access strategy of the device;

[0033] S304: obtaining the current access risk level of the device based on the occurrence probability of each basic event in the device fault tree and the security degree score and recognition confidence of the current access strategy of the device.

[0034] Preferably, the device network access permission updating method based on the big data analysis model, obtaining the current access risk level of the device based on the occurrence probability of each basic event in the device fault tree and the security degree score and recognition confidence of the current access strategy of the device, including:

[0035] weighting the occurrence probability of all basic events in the device fault tree based on the weight coefficient of each basic event in the device fault tree to obtain the first access risk level of the device;

[0036] Determine a second access risk level for the device based on the security score of the current access policy of the device and the recognition confidence;

[0037] The higher of the first access risk level and the second access risk level of the device is regarded as the current access risk level of the device.

[0038] Preferably, the method for updating device network access rights based on a big data analysis model, S4: updating the device's network access rights based on the device's current access risk level and a dynamically adaptive permission adjustment strategy, includes:

[0039] S401: pre-define the permission adjustment policy corresponding to each access risk level and obtain a permission policy database;

[0040] S402: Retrieve the permission policy database based on the current access risk level of the device to obtain the current network access permission of the device;

[0041] S403: Update the network access permission of the device to the current network access permission of the device based on the network access control device and server configuration.

[0042] Preferably, the method for updating device network access rights based on the big data analysis model further includes:

[0043] S5: All update operations are recorded in real time and stored in the update log database.

[0044] The beneficial effects of the present invention compared to the prior art are as follows: Step S1 uses a big data analysis model to identify the current access strategy and confidence level of the device, and can accurately grasp the current access situation of the device. Step S2 uses a long-short-term memory network to model the historical access strategy of the device, capture long-term behavioral trends and periodic laws, and provide more comprehensive information for risk assessment. Step S3 uses a comprehensive analysis of fault tree analysis and probabilistic risk assessment methods to derive the current access risk level, making the assessment results more scientific and reliable. Step S4 updates access permissions based on the current access risk level and dynamic adaptive permission adjustment strategy, achieving flexible and precise adjustment of permissions and improving the security of network access. This method can effectively assess device access risks in real time and dynamically adjust access permissions, ensuring network security and normal device access.

[0045] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in this application document.

[0046] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0048] Figure 1 This is a logic diagram for executing a method for updating device network access rights based on a big data analysis model in an embodiment of the present invention;

[0049] Figure 2 is a specific execution flow chart of step S1 in an embodiment of the present invention;

[0050] Figure 3 4 is a specific execution flow chart of step S2 in an embodiment of the present invention;

[0051] Figure 4 4 is a specific execution flow chart of step S3 in an embodiment of the present invention;

[0052] Figure 5 4 is a specific execution flow chart of step S4 in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0054] Example 1:

[0055] The present invention provides a method for updating device network access rights based on a big data analysis model. Figure 1 ,include:

[0056] S1: Based on the big data analysis model, access policy identification is performed on the device's access behavior in the recent period, and the device's current access policy and identification confidence level are identified;

[0057] S2: Model the device's historical access strategy based on the long short-term memory network and capture the device's long-term access behavior trends and periodic access patterns;

[0058] S3: Analyze the device's current access strategy and identification confidence, as well as its long-term access behavior trends and periodic access patterns based on fault tree analysis and probabilistic risk assessment methods to obtain the device's current access risk level.

[0059] S4: Update the device's network access permissions based on the device's current access risk level and the dynamically adaptive permission adjustment policy.

[0060] In this embodiment, a big data analysis model refers to a set of methods and systems that process and mine large amounts of data by combining multiple data analysis techniques and algorithms to obtain valuable information and insights. For example, a model constructed using techniques such as cluster analysis and association rule mining can be used to analyze the purchasing behavior of e-commerce users.

[0061] In this embodiment, a device refers to a hardware or software entity that can access a network and perform data transmission and interaction, such as a smartphone, a computer, an IoT sensor, etc.

[0062] In this embodiment, the recent period refers to a specific and relatively recent period of time, for example, the past week, the past month, etc.

[0063] In this embodiment, access behavior refers to the actions and methods of a device in performing operations such as resource acquisition and data interaction on a network, for example, accessing a specific website, downloading a file, etc.

[0064] In this embodiment, access policy identification refers to the process of determining the rules and methods that a device follows in network access, for example, determining whether a device is allowed to access a specific type of resource at a specific time.

[0065] In this embodiment, the current access policy of a device refers to the rules and methods of network access currently adopted by the device. For example, a device can currently only access an authorized internal database.

[0066] In this embodiment, the recognition confidence refers to a measure of the reliability and accuracy of the identified device access policy. For example, if the access policy of a device is identified as high risk with a confidence of 85%, it means that the judgment has a high reliability.

[0067] In this embodiment, the long short-term memory network refers to a neural network model that can process long-term series data, for example, to predict long-term patterns and trends in access behavior.

[0068] In this embodiment, the historical access policy of a device refers to a record and summary of the rules and methods followed by the device in its past network access, for example, reviewing the access permission settings of a device for different websites in the past year.

[0069] In this embodiment, the long-term access behavior trend and periodic access pattern of a device refer to the overall direction and recurring pattern of the device's access behavior over a long period of time. For example, a device may have a long-term increasing demand for access to a certain type of resource, with concentrated access on a specific day each month.

[0070] In this embodiment, the fault tree analysis method refers to a method for analyzing the causes and effects of system failures by constructing a logical relationship diagram of the failures. For example, when analyzing power system failures, the power outage is used as the top event, and the possible factors leading to the power outage are gradually identified.

[0071] In this embodiment, the probabilistic risk assessment method refers to a method for assessing the likelihood of an event and the degree of risk based on probability statistics, for example, assessing the probability of a device malfunctioning.

[0072] In this embodiment, the current access risk level of the device refers to the classification level of the risk degree of the device's current network access behavior, for example, divided into three levels: low risk, medium risk, and high risk.

[0073] In this embodiment, the dynamic adaptive permission adjustment policy refers to a policy that can automatically adjust the network access rights of a device according to its real-time situation and changes. For example, when the device access traffic increases abnormally, the permission to automatically reduce its download speed.

[0074] In this embodiment, the network access permission of a device refers to the scope of operations and access that the device is allowed to perform on the network. For example, a device is allowed to read files in a specific folder, but is prohibited from writing to files.

[0075] The beneficial effects of the above technology are as follows: Step S1 uses the big data analysis model to identify the current access strategy and confidence of the device, and can accurately grasp the current access situation of the device. Step S2 uses the long-short-term memory network to model the historical access strategy of the device, capture long-term behavioral trends and periodic laws, and provide more comprehensive information for risk assessment. Step S3 uses fault tree analysis and probabilistic risk assessment methods for comprehensive analysis to derive the current access risk level, making the assessment results more scientific and reliable. Step S4 updates access permissions based on the current access risk level and dynamic adaptive permission adjustment strategy, realizing flexible and precise adjustment of permissions and improving the security of network access. This method can effectively assess device access risks in real time and dynamically adjust access permissions, ensuring network security and normal device access.

[0076] Example 2:

[0077] Based on Example 1, a method for updating device network access rights based on a big data analysis model includes: S1: identifying the access policy of the device in the most recent period based on the big data analysis model, and identifying the device's current access policy and identification confidence, including:

[0078] S101: Collecting the device access data in the recent period from various device logs, server logs, and security device alarm information in the network based on the distributed data collection framework;

[0079] S102: Analyze high-frequency access patterns in access data based on a data mining algorithm and use this as the current access strategy for the device;

[0080] S103: Perform cluster analysis on all sub-access data belonging to the high-frequency access pattern in the access data to determine the recognition confidence of the current access policy of the device.

[0081] In this embodiment, the distributed data collection framework refers to an architecture for collecting data from multiple data sources, which can efficiently and concurrently acquire data. For example, the Flume framework in the Hadoop ecosystem is used to collect log data from devices on different network nodes.

[0082] In this embodiment, various network device logs, server logs, and security device alarm information refer to logs generated by various network devices (such as routers, switches, etc.) that record their operating conditions, logs generated by server operations, and alarm information issued by security devices (such as firewalls, intrusion detection systems, etc.). For example, a router's connection log, a server's system error log, and a firewall's alarm information regarding abnormal access.

[0083] In this embodiment, the high-frequency access pattern in the access data refers to an access method or behavior pattern that appears frequently in the access data of the device. For example, a device frequently accesses a specific database server every morning.

[0084] In this embodiment, all sub-access data belonging to the high-frequency access pattern refers to the data records of each specific access that constitutes the high-frequency access pattern, for example, the specific time and access duration of each access of the above device to a specific database server every morning.

[0085] The beneficial effects of the above technical solution include: Step S101 comprehensively collects access data through a distributed data collection framework, ensuring the breadth and integrity of data sources. Step S102 utilizes a data mining algorithm to identify high-frequency access patterns as the current access policy, improving the accuracy and specificity of policy identification. Step S103 performs cluster analysis on the sub-access data of high-frequency access patterns to determine identification confidence, making the confidence assessment more scientific and reasonable. The ability to accurately and reliably identify the device's current access policy and corresponding identification confidence provides a strong foundation for subsequent risk assessment and permission updates.

[0086] Example 3:

[0087] Based on Example 2, the method for updating device network access rights based on a big data analysis model, S102: analyzing high-frequency access patterns in access data based on a data mining algorithm as the current access policy for the device, includes:

[0088] Define all transactions in the access data based on the association rule mining algorithm, and mine high-frequency item sets from all transactions in the access data in combination with the preset minimum support threshold;

[0089] Sequence pattern mining is performed on all time series data in the high-frequency item set to identify the high-frequency access pattern of the device as the current access strategy of the device.

[0090] In this embodiment, the association rule mining algorithm refers to an algorithm used to discover the association relationships between different items in a data set. For example, the algorithm can discover that customers who buy bread often also buy milk.

[0091] In this embodiment, defining all transactions in the access data based on the association rule mining algorithm means treating each meaningful operation or a group of related operations in the access data as a transaction, for example, a complete website access process or a group of related file download operations.

[0092] In this embodiment, the preset minimum support threshold refers to a pre-set minimum frequency standard for determining whether an item set appears frequently. For example, setting the minimum support threshold to 30% means that only item sets with a frequency exceeding 30% are considered meaningful.

[0093] In this embodiment, all transactions in the access data are defined using an association rule mining algorithm. High-frequency itemsets are then mined from all transactions in the access data using a preset minimum support threshold. This involves first identifying transactions in the access data and then finding itemsets with sufficiently high frequency based on the preset minimum support threshold. For example, in website access data, if the frequency of the combination "visiting page A and visiting page B" exceeds a preset threshold, this is a high-frequency itemset.

[0094] In this embodiment, all time series data in a high-frequency item set refers to data related to time sequence in the high-frequency item set. For example, the access times corresponding to a high-frequency item set are "9:00 AM, 10:00 AM, and 2:00 PM" in sequence.

[0095] In this embodiment, sequential pattern mining refers to discovering frequently occurring ordered patterns from time series data. For example, discovering a regular pattern such as "every Monday morning at 9:00 am, every Wednesday afternoon" from a user's login time series.

[0096] In this embodiment, sequence pattern mining is performed on all time series data in the high-frequency item set. Identifying the high-frequency access patterns of devices involves analyzing the time-arranged data in the high-frequency item set to find the device's frequently occurring access patterns. For example, discovering that a device always accesses a specific server at 10:00 AM at the beginning of each month.

[0097] The beneficial effects of the above technical solution include: defining transactions through an association rule mining algorithm and mining high-frequency itemsets using a minimum support threshold effectively screens for representative and important access patterns. Sequential pattern mining of time series data within high-frequency itemsets identifies high-frequency access patterns, further improving the accuracy and reliability of current access policies. This allows for more precise capture of high-frequency access patterns on devices, providing valuable policy support for subsequent access risk assessments and permission updates.

[0098] Example 4:

[0099] Based on Example 2, the device network access permission updating method based on the big data analysis model, S103: performing cluster analysis on all sub-access data belonging to high-frequency access patterns in the access data to determine the recognition confidence of the current access policy of the device, including:

[0100] Construct a feature vector for each sub-access data based on the feature information of each sub-access data, and aggregate the feature vectors of all sub-access data belonging to the high-frequency access pattern in the access data as an original vector set;

[0101] Randomly select k eigenvectors from the original vector set as cluster centers, and calculate the Euclidean distance from each eigenvector to each cluster center;

[0102] Assign each eigenvector in the original vector set to the cluster corresponding to the nearest cluster center to obtain k vector clusters, and average all eigenvectors in each vector cluster to obtain a new cluster center for each vector cluster. Based on all the new cluster centers, re-cluster all eigenvectors in the original vector set until the average value of the Euclidean distance between all eigenvectors in each newly obtained vector cluster and the latest cluster center of the corresponding vector cluster is less than a preset threshold, then all qualified vector clusters are obtained;

[0103] The identification confidence of the device's current access policy is calculated based on all qualified vector clusters.

[0104] In this embodiment, the characteristic information of the sub-access data refers to relevant information that can describe the characteristics and attributes of the sub-access data, such as the access time of the sub-access data, the type of resources accessed, the frequency of access, etc.

[0105] In this embodiment, constructing a feature vector for each sub-access data item based on its feature information means converting the feature information of each sub-access data item into a mathematical vector for subsequent calculation and analysis. For example, features such as the access time and resource type of each sub-access data item can be represented numerically and combined into a vector.

[0106] In this embodiment, calculating the Euclidean distance from each feature vector to each cluster center means calculating the distance between the feature vector and the cluster center using the Euclidean distance formula.

[0107] In this embodiment, averaging all feature vectors in each vector cluster means adding the values of the corresponding dimensions of all feature vectors in the vector cluster, and then dividing by the number of vectors to obtain a new average value as a new cluster center.

[0108] The beneficial effects of the above technical solutions include: by constructing feature vectors and aggregating them into an original vector set, a clear data structure is provided for clustering analysis. Randomly selecting cluster centers and calculating Euclidean distances achieves initial clustering division. Continuously iterating and updating cluster centers and re-clustering until a threshold condition is met to obtain qualified vector clusters, improving the accuracy and stability of clustering. Based on the qualified vector clusters, the recognition confidence is calculated, making the determination of the recognition confidence more scientific and objective. The recognition confidence of the current access strategy of the device can be accurately determined, providing a reliable quantitative basis for evaluating access risks and updating permissions.

[0109] Embodiment 5:

[0110] Based on embodiment 4, the device network access permission updating method based on a big data analysis model calculates the recognition confidence of the current access strategy of the device based on all qualified vector clusters, including:

[0111]

[0112] In the formula, C is the recognition confidence of the current access strategy of the device, a is the cluster proportion weight coefficient, k is the total number of all qualified vector clusters, n j is the total number of feature vectors in the jth qualified vector cluster, n is the total number of feature vectors in the original vector set, β is the intra-cluster tightness weight coefficient, x ij is the ith feature vector in the jth qualified vector cluster, c j is the cluster center of the jth qualified vector cluster, ‖x ij -c j ‖ 2 is the sum of the squares of the differences between the ith feature vector in the jth qualified vector cluster and the cluster center of the jth qualified vector cluster in each dimension, γ is the inter-cluster distance weight coefficient, m is the total dimension of the feature vector, c jl is the value of the lth dimension of the cluster center of the jth qualified vector cluster, c kl is the value of the lth dimension of the cluster center of the kth qualified vector cluster, and a+β+γ=1.

[0113] In this embodiment, the cluster proportion weight coefficient refers to a coefficient for measuring the proportion of each qualified vector cluster in the whole.

[0114] In this embodiment, the intra-cluster tightness weight coefficient refers to a weight coefficient for reflecting the tightness between feature vectors within each vector cluster.

[0115] In this embodiment, the inter-cluster separation weight coefficient refers to a coefficient for reflecting the importance of the degree of separation between different vector clusters.

[0116] The beneficial effects of the above technical solutions include: the identification confidence is calculated by comprehensively considering multiple factors such as cluster proportion, intra-cluster tightness, and inter-cluster separation through a specific formula. The cluster proportion weight coefficient reflects the distribution of qualified vector clusters in the whole, making the confidence calculation more representative. The intra-cluster tightness weight coefficient measures the concentration degree of feature vectors within each qualified vector cluster, reflecting the consistency of the access strategy. The inter-cluster separation weight coefficient considers the differences between different qualified vector clusters, highlighting the uniqueness of the access strategy. The formula can comprehensively and accurately calculate the identification confidence of the current access strategy of the device, providing a scientific and reliable basis for subsequent risk assessment and permission update.

[0117] Embodiment 6:

[0118] On the basis of embodiment 1, the device network access permission updating method based on a big data analysis model, S2: modeling the historical access strategy of the device based on a long short-term memory network and capturing the long-term access behavior trend and periodic access rule of the device, referring to Figure 3 , includes:

[0119] S201: organizing the historical access strategy of the device into time series data to obtain a historical access strategy sequence;

[0120] S202: inputting the historical access strategy sequence into a long short-term memory network model, setting the number of hidden nodes and the learning rate for model training, and obtaining the long-term access behavior trend and periodic access rule of the device.

[0121] In this embodiment, organizing the historical access strategy of the device into time series data to obtain a historical access strategy sequence refers to arranging the access strategy related information of the device in the past in chronological order to form a data sequence with a chronological order. For example, the access permission settings and access frequency information of the device at different time points are sorted in chronological order to obtain the historical access strategy sequence, just like recording the daily temperature changes.

[0122] In this embodiment, setting the number of hidden nodes and the learning rate refers to determining the number of nodes in the hidden layer and the parameter value for controlling the learning speed of the model in the long short-term memory network model. For example, the number of hidden nodes is set to 128, and the learning rate is set to 0.01.

[0123] In this embodiment, the historical access policy sequence is input into a long-short-term memory network model, and the number of hidden nodes and learning rate are set for model training to obtain the device's long-term access behavior trends and periodic access patterns. This means that the compiled historical access policy sequence data is input into the long-short-term memory network model, and the two key parameters, the number of hidden nodes and the learning rate, are set. The model is then trained and optimized to discover how the device's access behavior changes over a long period of time and whether there are any periodic patterns. For example, if the model is trained to discover that a device's frequency of accessing a specific website increases significantly in certain months of each year, this is a long-term access behavior trend and periodic access pattern.

[0124] The beneficial effects of the above technical solution include: Step S201 organizes historical access policies into time series data, providing a standardized and organized data format for subsequent modeling. Step S202 effectively captures long-term device access behavior trends and periodic access patterns by inputting time series data into a long-short-term memory network model and training it with a reasonable number of hidden nodes and learning rate. Accurately modeling a device's historical access policies provides an important basis for comprehensively evaluating device access and updating permissions.

[0125] Example 7:

[0126] Based on Example 1, a device network access permission update method based on a big data analysis model, S3: Based on the fault tree analysis method and the probabilistic risk assessment method, the current access policy and identification confidence of the device, as well as the long-term access behavior trend and periodic access rules of the device are analyzed to obtain the current access risk level of the device, reference Figure 4 ,include:

[0127] S301: Taking a device access risk as a top event, the top event is decomposed into multiple intermediate events and basic events to obtain a device fault tree;

[0128] S302: Based on the probabilistic risk assessment method and the current access policy of the device, assign an occurrence probability to each basic event in the device fault tree to obtain the occurrence probability of each basic event in the device fault tree;

[0129] S303: Score the security of the device's current access policy based on the device's long-term access behavior trend and periodic access pattern to obtain a security score for the device's current access policy.

[0130] S304: Based on the occurrence probability of each basic event in the device fault tree and the security score and identification confidence of the current access policy of the device, the current access risk level of the device is obtained.

[0131] In this embodiment, a device access risk is taken as the top event and decomposed into multiple intermediate events and basic events. This means obtaining a device fault tree. This involves taking the potential device access risk as the top, most serious event, and then gradually analyzing its causes. These causes are divided into intermediate events and the bottom-level basic events, and the logical relationships between them are displayed in a tree structure. For example, a device access risk is the top event, while intermediate events might include network connection anomalies or user authentication failures. Basic events might include network line damage or incorrect password input.

[0132] In this embodiment, a probability of occurrence is assigned to each basic event in the device fault tree based on a probabilistic risk assessment method and the device's current access policy. Obtaining the probability of occurrence for each basic event in the device fault tree means applying the probabilistic risk assessment method, combined with the device's current actual access policy, to estimate the likelihood of occurrence for each bottom-level basic event in the fault tree. For example, in the above example, the probability of network line damage is assessed at 5%, and the probability of an incorrect password entry is assessed at 10%.

[0133] In this embodiment, the probability of occurrence of each basic event in the equipment fault tree refers to the specific probability value of each basic event that may occur obtained through the above evaluation process.

[0134] In this embodiment, the security score of the device's current access policy is assessed based on the device's long-term access behavior trends and periodic access patterns. The security score of the device's current access policy is obtained by evaluating the security of the current access policy based on the device's long-term access behavior trends and periodic patterns, and then assigning a quantitative score. For example, if the device's access behavior has been stable and compliant over a long period of time, and its periodic patterns are normal, the security score of the current access policy may be high, such as 80 points.

[0135] In this embodiment, the security score of the current access policy of the device is the specific score value obtained by the above evaluation, which is used to reflect the security level of the current access policy.

[0136] The beneficial effects of the above technical solution include: Step S301 constructs a device fault tree, breaking down complex risk situations for systematic analysis and assessment. Step S302 assigns occurrence probabilities to basic events, making risk assessment more quantitative and accurate. Step S303 assigns a security score to the current access policy, assessing the security of the access policy from another perspective. Step S304 comprehensively considers the probabilities of basic events, the security score, and the recognition confidence level to determine the access risk level, resulting in a more comprehensive and reliable assessment result. This system can scientifically and accurately assess the current access risk level of a device, providing strong support for the appropriate update of network access rights.

[0137] Example 8:

[0138] Based on Example 7, the device network access permission updating method based on the big data analysis model obtains the current access risk level of the device based on the probability of occurrence of each basic event in the device fault tree and the security score and identification confidence of the device's current access policy, including:

[0139] Performing weighted processing on the occurrence probabilities of all basic events in the equipment fault tree based on the weight coefficient of each basic event in the equipment fault tree to obtain a first access risk level of the equipment;

[0140] Determine a second access risk level for the device based on the security score of the current access policy of the device and the recognition confidence;

[0141] The higher of the first access risk level and the second access risk level of the device is regarded as the current access risk level of the device.

[0142] In this embodiment, the weight coefficient of each basic event in the device fault tree refers to a numerical value assigned to each basic event to indicate its relative importance. For example, in a device fault tree, the weight coefficient of the basic event "hardware failure" may be 0.7, and the weight coefficient of "software error" may be 0.3.

[0143] In this embodiment, the probability of occurrence of all basic events in the device fault tree is weighted based on the weight coefficient of each basic event in the device fault tree. Obtaining the device's first access risk level involves adjusting the probability of occurrence of each basic event based on its weight, thereby deriving a preliminary access risk level. For example, if the probability of "hardware failure" is 0.2 and the weight coefficient is 0.7, and the probability of "software error" is 0.1 and the weight coefficient is 0.3, the weighted calculation results in a value of 0.17. Based on 0.17, the preset weighted result - access risk level list - is retrieved to obtain the device's first access risk level.

[0144] In this embodiment, the first access risk level of the device is a level representing the risk degree of the device obtained by performing the weighting process and searching a preset list.

[0145] In this embodiment, determining the second access risk level for a device based on the security score and recognition confidence of the device's current access policy involves comprehensively considering the security score of the current access policy and the confidence level of the policy recognition, and then retrieving the product of the two from a preset list of security calculation results - access risk levels to determine another access risk level. For example, if the security score is 80 and the recognition confidence level is 0.9, the product of the two is calculated to be 72, and the access risk level corresponding to 72 is retrieved from the preset list of security calculation results - access risk levels as the device's second access risk level.

[0146] In this embodiment, the second access risk level of the device is another level obtained by the above calculation to measure the degree of device access risk.

[0147] The above technical solution has the following beneficial effects: A first access risk level is derived by weighting the probability of occurrence of basic events, highlighting the varying importance of different basic events. A second access risk level is calculated by combining the security score and recognition confidence, assessing risk from a different perspective. The higher of the first and second access risk levels is used as the current access risk level, ensuring a more conservative and secure assessment result. This allows for a more comprehensive and prudent assessment of a device's current access risk level, effectively ensuring network access security and mitigating potential risks.

[0148] Example 9:

[0149] On the basis of Example 1, a device network access permission updating method based on a big data analysis model, S4: updating the device's network access permission based on the device's current access risk level and a dynamically adaptive permission adjustment strategy, refer to Figure 5 ,include:

[0150] S401: pre-define the permission adjustment policy corresponding to each access risk level and obtain a permission policy database;

[0151] S402: Retrieve the permission policy database based on the current access risk level of the device to obtain the current network access permission of the device;

[0152] S403: Update the network access permission of the device to the current network access permission of the device based on the network access control device and server configuration.

[0153] In this embodiment, pre-defining the permission adjustment policy corresponding to each access risk level means determining the permission change method to be adopted for different access risk levels before the actual operation is carried out. For example, the permission adjustment policy corresponding to the high risk level may be to completely prohibit certain sensitive operations, while the permission adjustment policy corresponding to the medium risk level may be to restrict access to specific resources.

[0154] In this embodiment, the permission policy database is a database that stores information related to various permission adjustment policies. It contains detailed records of different risk levels and corresponding permission adjustment policies. For example, the database records information such as permission adjustment policy A corresponding to low risk, permission adjustment policy B corresponding to medium risk, and permission adjustment policy C corresponding to high risk.

[0155] In this embodiment, updating a device's network access permissions to the device's current network access permissions based on the configuration of the network access control device and server means that, based on the relevant settings of the network access control device (such as a firewall, router, etc.) and the server (such as an identity authentication server), the device's original network access permissions are modified and adjusted according to the current permissions determined by the assessment. For example, if a device originally had access to the external network, but the risk level increases after assessment, its external network access permissions can be revoked through the configuration of the network access control device and server.

[0156] The beneficial effects of the above technical solution include: Step S401 predefines the permission adjustment policy to form a permission policy database, which provides a clear basis and guidance for subsequent permission updates. Step S402 retrieves the database based on the current access risk level to obtain the current network access rights, achieving fast and accurate permission matching. Step S403 updates the rights through the network access control device and server configuration, ensuring the effective implementation of permission adjustment. The ability to dynamically and adaptively update network access rights based on the current access risk level of the device ensures network security and the rationality of device access.

[0157] Example 10:

[0158] Based on Example 1, the method for updating device network access rights based on the big data analysis model further includes:

[0159] S5: All update operations are recorded in real time and stored in the update log database.

[0160] In this embodiment, the update operation refers to an action of modifying, adjusting or resetting the network access rights of the device, for example, canceling the permissions of certain websites that the device originally had access to, or adding new access restrictions.

[0161] In this embodiment, the update log database is used to store all records related to device network access permission update operations. It records in detail the time, content, and operator of each update operation. For example, it records that at a certain moment, the external network access permission of device A was disabled, and the operator was administrator Zhang San.

[0162] The beneficial effects of the above technical solution include: Real-time recording of all update operations creates a complete operation record, facilitating subsequent traceability and auditing. Storing records in an update log database ensures data security and queryability. This helps promptly identify potential issues or errors, providing a basis for subsequent optimization and improvement. It enhances the transparency and controllability of the entire permission update process, ensuring the stable and secure operation of the system. It also improves the management mechanism for updating device network access permissions, enhancing system reliability and maintainability.

[0163] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for updating device network access rights based on a big data analysis model, characterized in that: include: S1: Based on the big data analysis model, access policy identification is performed on the device's access behavior in the recent period, and the device's current access policy and identification confidence level are identified; S2: Model the device's historical access strategy based on the long short-term memory network and capture the device's long-term access behavior trends and periodic access patterns; S3: Analyze the device's current access strategy and identification confidence, as well as its long-term access behavior trends and periodic access patterns, based on fault tree analysis and probabilistic risk assessment methods to obtain the device's current access risk level. S4: Update the device's network access permissions based on the device's current access risk level and the dynamically adaptive permission adjustment policy.

2. The device network access permission updating method based on the big data analysis model according to claim 1 is characterized in that: S1: Based on the big data analysis model, the device's access behavior in the recent period is analyzed for access policy identification. The device's current access policy and identification confidence level are identified, including: S101: Collecting device access data in the most recent period from various device logs, server logs, and security device alarm information in the network based on a distributed data collection framework; S102: Analyze high-frequency access patterns in access data based on a data mining algorithm and use this as the current access strategy for the device; S103: Perform cluster analysis on all sub-access data belonging to the high-frequency access pattern in the access data to determine the recognition confidence of the current access policy of the device.

3. The device network access permission updating method based on the big data analysis model according to claim 2 is characterized in that: S102: Analyze high-frequency access patterns in the access data based on a data mining algorithm and use them as the current access strategy for the device, including: Define all transactions in the access data based on the association rule mining algorithm, and mine high-frequency item sets from all transactions in the access data in combination with the preset minimum support threshold; Sequence pattern mining is performed on all time series data in the high-frequency item set to identify the high-frequency access pattern of the device as the current access strategy of the device.

4. The device network access permission updating method based on the big data analysis model according to claim 2 is characterized in that: S103: Perform cluster analysis on all sub-access data belonging to high-frequency access patterns in the access data to determine the recognition confidence of the current access policy of the device, including: Construct a feature vector for each sub-access data based on the feature information of each sub-access data, and aggregate the feature vectors of all sub-access data belonging to the high-frequency access pattern in the access data as an original vector set; Randomly select k eigenvectors from the original vector set as cluster centers, and calculate the Euclidean distance from each eigenvector to each cluster center; Assign each eigenvector in the original vector set to the cluster corresponding to the nearest cluster center to obtain k vector clusters, and average all eigenvectors in each vector cluster to obtain a new cluster center for each vector cluster. Based on all the new cluster centers, re-cluster all eigenvectors in the original vector set until the average value of the Euclidean distance between all eigenvectors in each newly obtained vector cluster and the latest cluster center of the corresponding vector cluster is less than a preset threshold, then all qualified vector clusters are obtained; The identification confidence of the device's current access policy is calculated based on all qualified vector clusters.

5. The device network access permission updating method based on the big data analysis model according to claim 4 is characterized in that: Calculate the identification confidence of the device's current access policy based on all qualified vector clusters, including: Where C is the recognition confidence of the current access policy of the device, α is the cluster weight coefficient, k is the total number of all qualified vector clusters, and n j is the total number of eigenvectors contained in the jth qualified vector cluster, n is the total number of eigenvectors contained in the original vector set, β is the intra-cluster density weight coefficient, x ij is the i-th eigenvector in the j-th qualified vector cluster, c j is the cluster center of the jth qualified vector cluster, ‖x ij -c j ‖ 2 is the sum of the squares of the differences between the i-th eigenvector in the j-th qualified vector cluster and the cluster center of the j-th qualified vector cluster in each dimension, γ is the inter-cluster alienation weight coefficient, m is the total dimension of the eigenvector, c jl is the value of the lth dimension of the cluster center of the jth qualified vector cluster, c kl is the value of the lth dimension of the cluster center of the kth qualified vector cluster.

6. The device network access permission updating method based on the big data analysis model according to claim 1 is characterized in that: S2: Models the device's historical access strategy based on a long short-term memory network and captures the device's long-term access behavior trends and periodic access patterns, including: S201: Arrange the historical access policies of the device into time series data to obtain a historical access policy sequence; S202: Input the historical access strategy sequence into the long short-term memory network model, and set the number of hidden nodes and learning rate to perform model training to obtain the long-term access behavior trend and periodic access pattern of the device.

7. The method for updating device network access rights based on a big data analysis model according to claim 1, characterized in that: S3: Analyze the device's current access strategy and identification confidence level, as well as the device's long-term access behavior trends and periodic access patterns based on fault tree analysis and probabilistic risk assessment methods to obtain the device's current access risk level, including: S301: Taking a device access risk as a top event, the top event is decomposed into multiple intermediate events and basic events to obtain a device fault tree; S302: Based on the probabilistic risk assessment method and the current access policy of the device, assign an occurrence probability to each basic event in the device fault tree to obtain the occurrence probability of each basic event in the device fault tree; S303: Score the security of the device's current access policy based on the device's long-term access behavior trend and periodic access pattern to obtain a security score for the device's current access policy. S304: Based on the occurrence probability of each basic event in the device fault tree and the security score and identification confidence of the current access policy of the device, the current access risk level of the device is obtained.

8. The method for updating device network access rights based on a big data analysis model according to claim 7, characterized in that: Based on the probability of occurrence of each basic event in the device fault tree, the security score of the device's current access policy, and the identification confidence, the current access risk level of the device is obtained, including: Performing weighted processing on the occurrence probabilities of all basic events in the equipment fault tree based on the weight coefficient of each basic event in the equipment fault tree to obtain a first access risk level of the equipment; Determine a second access risk level for the device based on the security score of the current access policy of the device and the recognition confidence; The higher of the first access risk level and the second access risk level of the device is regarded as the current access risk level of the device.

9. The device network access permission updating method based on the big data analysis model according to claim 1 is characterized in that: S4: Updates the device's network access permissions based on the device's current access risk level and dynamically adaptive permission adjustment policies, including: S401: pre-define the permission adjustment policy corresponding to each access risk level and obtain a permission policy database; S402: Retrieve the permission policy database based on the current access risk level of the device to obtain the current network access permission of the device; S403: Update the network access permission of the device to the current network access permission of the device based on the network access control device and server configuration.

10. The device network access permission updating method based on the big data analysis model according to claim 1 is characterized in that: Also includes: S5: All update operations are recorded in real time and stored in the update log database.

Images