Zero-trust network dynamic access control method based on AI behavior portrait

Abstract

The application discloses a zero-trust network dynamic access control method based on AI behavior portrait, which comprises the following steps: step 1: when an access request is made, collect multi-source real-time behavior data; step 2: based on historical data, build an AI behavior portrait engine, input the integrated multi-source behavior data, calculate the behavior deviation degree through the AI behavior portrait engine, and output a risk score; step 3: dynamic strategy decision, the decision engine executes hierarchical control according to the risk score; step 4: continuous session monitoring and real-time adjustment; step 5: when a risk escalation is detected in the session, the session permission is downgraded, high-risk operations are limited, and the session is terminated, and evidence data is retained; step 6: audit event generation and portrait updating; step 7: strategy optimization closed loop. The application calculates a risk score in real time based on an AI behavior portrait, realizes the transition from'static authorization' to 'dynamic permission adjustment', and effectively blocks internal threats such as credential theft.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a zero-trust network dynamic access control method based on AI behavioral profiling. Background Technology

[0002] As cyberattacks become increasingly sophisticated, traditional perimeter-based static access control models struggle to cope with insider threats and advanced persistent attacks (APTs). Zero Trust architecture enhances security through the principle of "never trust, continuous verification," but existing implementations still have shortcomings; for example, most solutions rely on predefined policies and cannot dynamically respond to abnormal behavior. For instance, after legitimate credentials are stolen, attackers can move laterally without changing their privileges.

[0003] In addition, existing behavioral analysis focuses on single-dimensional data such as identity or environment, such as IP reputation, and lacks integrated analysis of user operation sequences and resource interaction patterns, resulting in a high false alarm rate and difficulty in detecting latent threats. Summary of the Invention

[0004] To address this issue, the present invention provides a zero-trust network dynamic access control method based on AI behavioral profiling to solve the problems in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A zero-trust network dynamic access control method based on AI behavioral profiling includes the following steps:

[0007] Step 1: When a user or device initiates an access request, the zero-trust gateway collects multi-source behavioral data in real time and integrates the multi-source behavioral data;

[0008] Step 2: Build an AI behavior profile engine based on historical data. Input the integrated multi-source behavior data, calculate the behavior deviation through the AI ​​behavior profile engine, and output a risk score.

[0009] Step 3: Dynamic policy decision-making. The decision engine executes hierarchical control based on risk scores. For low-risk cases, access is granted and the system enters the default session channel. For medium-risk cases, multi-factor authentication is triggered, and restricted permissions are granted upon successful verification. For high-risk cases, access is immediately blocked, and an alarm is triggered to the SOC, recording attack tracing data.

[0010] Step 4: Monitor the entire lifecycle of established sessions and analyze the operation sequence and session activity in real time;

[0011] Step 5: When an escalation of risk is detected in the session, the session permissions are downgraded, high-risk operations are restricted, the session is terminated, the connection is forcibly interrupted, the account is frozen, and evidence data is preserved.

[0012] Step 6: Generate standardized audit events from all decision logs and write them to the blockchain or an immutable database; and feed back the behavioral data from the session to the AI ​​behavioral profiling engine;

[0013] Step 7: Regularly analyze the effectiveness of audit events and risk management, adjust the strategic decision-making threshold through reinforcement learning, and update the sensitive resource tag library.

[0014] Furthermore, multi-source behavioral data includes identity information, behavioral data, and environmental data; identity information mainly includes user roles, device fingerprints, and authentication strength; behavioral data includes API call sequences, operation frequency, access time, and data traffic patterns; and environmental data includes IP geographic location, network environment security score, and device security status.

[0015] Furthermore, by capturing device-level behavior through terminal agents, analyzing communication patterns through network traffic probes, and linking identity credibility and security information provided by the identity management system with global threat intelligence from the event management system, multi-dimensional behavioral data cross-validation can be achieved.

[0016] Furthermore, the specific steps for building the AI ​​behavior profiling engine are as follows:

[0017] (1) Collection of historical raw behavioral data; collect raw behavioral data of users and the system in all aspects through various sensors, agent programs and log systems deployed in the network environment;

[0018] (2) Spatiotemporal feature extraction; using time series analysis technology, extracting time dimension features from raw data; based on geographic information system technology, analyzing the spatial features of user access and constructing a spatial distribution model of user behavior;

[0019] (3) Graph neural network processing; the extracted spatiotemporal features are mapped to graph structure data to construct a user-resource interaction graph; in which users, devices, and application entities are graph nodes, and the access relationships between entities are edges; a graph neural network model is used to perform deep learning on the graph structure data to mine the implicit patterns of user behavior in complex network relationships;

[0020] (4) Node embedding generation; through the training of the graph neural network, the high-dimensional sparse graph node features are mapped into low-dimensional dense node embedding vectors; each node embedding vector contains comprehensive feature information of user behavior;

[0021] (5) Temporal modeling; Temporal modeling of node embedding vectors to capture the temporal evolution of user behavior; Using recurrent neural network (RNN), long short-term memory network (LSTM) or temporal convolutional network (TCN) models to learn the temporal dependencies of user behavior and predict future behavior trends.

[0022] (6) Generate behavioral profile vectors; integrate the results of spatiotemporal feature extraction, graph neural network processing and time series modeling to generate user behavioral profile vectors;

[0023] (7) Risk scoring engine; a risk assessment model is constructed based on behavioral profile vectors; machine learning algorithms are used to score user behavior for risk; the risk scoring results are used to dynamically adjust the user's network access permissions.

[0024] Furthermore, the risk score is generated based on the comprehensive behavioral deviation, environmental risk weight, and sensitive resource labels, and the behavior is divided into three levels: low risk, medium risk, and high risk according to the risk score.

[0025] Furthermore, the specific implementation steps of the dynamic strategy decision are as follows:

[0026] (1) User access request; When a user attempts to access a protected network resource, an access request must be sent to the gateway;

[0027] (2) Profile query and strategy generation; After receiving the user's access request, the gateway will send a request to the decision engine to query the user profile; The decision engine generates dynamic strategies based on the user's historical behavior data and identity information, combined with AI algorithms.

[0028] (3) Access control execution; The gateway makes real-time judgments and decisions on user access requests based on the dynamic policies returned by the decision engine; If the policy allows access, the gateway will allow the request and allow the user to access the target resource; If the policy detects potential risks, the gateway will restrict access and require the user to perform multi-factor authentication or take other security measures.

[0029] (4) Session monitoring and policy adjustment; During a user session, the gateway continuously collects real-time behavioral data of the user and sends this real-time behavioral data to the AI ​​behavior profiling engine; The AI ​​behavior profiling engine uses AI algorithms to analyze the user's behavioral data and detect whether there are any abnormalities or risk fluctuations; When the AI ​​behavior profiling engine detects risk fluctuations, it sends a warning message to the decision engine; The decision engine reassesses the user's risk level based on the warning message and generates a policy adjustment instruction; After receiving the policy adjustment instruction, the gateway will adjust the access control policy for the user session in real time to ensure the security of network resources.

[0030] Furthermore: In step 4, if abnormal behavior is detected, the dynamic policy is adjusted; the risk level is upgraded in real time, and the user or device's session permissions are downgraded or the session is terminated.

[0031] This invention has the following advantages: it calculates risk scores in real time based on AI behavior profiles, realizing a leap from "static authorization" to "dynamic permission adjustment", effectively blocking internal threats such as credential theft; it combines full-cycle session monitoring with a real-time permission downgrade mechanism to minimize the attack window; and it improves system adaptability by iterating policy thresholds and resource tag libraries through reinforcement learning.

[0032] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. Attached Figure Description

[0033] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are able to easily make conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0034] Figure 1 The following is an execution flowchart of a zero-trust network dynamic access control method based on AI behavioral profiling, provided as an embodiment of this application.

[0035] Figure 2 This is a flowchart of the behavior profile modeling process in the zero-trust network dynamic access control method based on AI behavior profiles of the present invention.

[0036] Figure 3 This is a sequence diagram of policy decision-making in the zero-trust network dynamic access control method based on AI behavior profiling of the present invention. Detailed Implementation

[0037] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these embodiments are merely for further explanation of the present invention and should not be construed as limiting the scope of protection of the present invention. Technical engineers in the field can make some non-essential improvements and adjustments to the present invention based on the above-described content. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Please see Figures 1-3 A zero-trust network dynamic access control method based on AI behavioral profiling includes the following steps:

[0039] Step 1: When an access request is made, collect real-time behavioral data from multiple sources;

[0040] When a user / device initiates an access request, the zero-trust gateway collects multi-source behavioral data in real time; the multi-source behavioral data includes identity information, behavioral data, and environmental data.

[0041] Identity information mainly includes user roles, device fingerprints, authentication strength, etc.; behavioral data includes API call sequences, operation frequency, access time, data traffic patterns, etc.; environmental data includes IP geolocation, network environment security score, and device security status (such as patch version).

[0042] To avoid the risk of misjudgment from a single data source, such as abnormal operation frequency caused by network fluctuations being misjudged as attack behavior, multi-dimensional data is integrated and cross-validated through deep linkage of terminal agents, network traffic probes, identity management system (IAM), and security information and event management (SIEM) systems.

[0043] Among them, the terminal agent can capture device-level behavior, such as process operations, file access, and peripheral device usage; the network traffic probe can analyze communication patterns, such as abnormal port scanning and data outflow traffic; the IAM system can provide identity trustworthiness, such as permission change history and authentication failure count; and the SIEM system can correlate global threat intelligence, such as known attack fingerprints and historical violation events.

[0044] For example, when the IAM system confirms that a user only has data read permissions, if the terminal agent detects an abnormal write operation, the system will automatically trigger permission downgrade and generate an alarm. In the face of advanced persistent threats (APTs), the abnormal process behavior captured by the terminal agent, the C2 communication characteristics identified by the network probe, and the threat intelligence fingerprint matched by SIEM will form a complete chain of evidence to accurately identify complex attacks that bypass single-layer defenses.

[0045] Step 2: Build an AI behavior profiling engine, and calculate the behavior deviation based on multi-dimensional integrated multi-source behavior data, and output a risk score.

[0046] See Figure 2 The specific steps for building an AI behavior profiling engine are as follows:

[0047] (1) Collection of historical raw behavior data; through various sensors, agent programs and log systems deployed in the network environment, raw behavior data of users and systems are collected in all aspects; the data sources cover network traffic logs, system operation logs, application usage records, device status information and other dimensions to form a multi-dimensional raw data pool.

[0048] (2) Spatiotemporal feature extraction; using time series analysis technology, extract time dimension features from the original data, including time series patterns such as operation frequency, session duration, and access time distribution; based on geographic information system (GIS) technology, analyze the spatial features such as the geographical location information and network topology of user access, and construct a spatial distribution model of user behavior.

[0049] (3) Graph neural network processing; the extracted spatiotemporal features are mapped to graph structure data to construct a user-resource interaction graph; in which, entities such as users, devices, and applications are used as graph nodes, and the access relationships between entities are used as edges; a graph neural network model (graph convolutional network GCN is used in this embodiment) is used to perform deep learning on the graph structure data to mine the implicit patterns of user behavior in complex network relationships.

[0050] (4) Node embedding generation: Through the training of the graph neural network, the high-dimensional sparse graph node features are mapped into low-dimensional dense node embedding vectors; each node embedding vector contains comprehensive feature information of user behavior, such as behavioral preferences, operating habits, risk propensity, etc.

[0051] (5) Temporal modeling; Temporal modeling of node embedding vectors to capture the temporal evolution of user behavior; Using models such as recurrent neural network (RNN), long short-term memory network (LSTM), or temporal convolutional network (TCN), to learn the temporal dependencies of user behavior and predict future behavior trends.

[0052] (6) Generate behavioral profile vector; integrate the results of spatiotemporal feature extraction, graph neural network processing and time series modeling to generate user behavioral profile vector; the vector comprehensively reflects the user's behavioral characteristics, risk level and behavioral trend, providing a basis for subsequent risk assessment.

[0053] (7) Risk scoring engine; Based on behavioral profile vectors, a risk assessment model is constructed; Machine learning algorithms are used to score user behavior for risk; The risk scoring results are used to dynamically adjust the user's network access permissions to achieve fine-grained access control under zero-trust network.

[0054] Based on comprehensive behavioral deviation, environmental risk weight, and sensitive resource tags, a real-time risk score of 0-100 is generated; for example: low risk (0-30), medium risk (31-70), and high risk (71-100).

[0055] Step 3: Dynamic strategy decision-making; the decision engine executes tiered control based on risk scores;

[0056] For low-risk attacks, access is granted and the user enters the default session channel; for medium-risk attacks, multi-factor authentication (MFA) is triggered, and restricted permissions (such as read-only operation) are granted upon successful verification; for high-risk attacks, access is immediately blocked, and an alarm is triggered to the SOC (Security Operations Center) to record attack tracing data.

[0057] See Figure 3 The specific implementation steps of dynamic strategy decision-making are as follows:

[0058] 1) User access request: When a user attempts to access a protected network resource, they need to send an access request to the gateway.

[0059] 2) Profile Query and Policy Generation: After receiving a user's access request, the gateway will send a request to the decision engine to query the user's profile. The decision engine generates a dynamic policy based on the user's historical behavior data, identity information, etc., combined with AI algorithms. This dynamic policy includes a temporary token, which is used for subsequent access control and session monitoring.

[0060] 3) Access control enforcement: The gateway makes real-time judgments and decisions on user access requests based on the dynamic policies returned by the decision engine. If the policy allows access, the gateway will allow the request and allow the user to access the target resource. If the policy detects potential risks, the gateway will restrict access and may require the user to perform multi-factor authentication (MFA) or take other security measures.

[0061] 4) Session monitoring and policy adjustment; During a user session, the gateway continuously collects real-time user behavior data, such as login time, operation frequency, and accessed resources; The gateway sends this real-time behavior data to the AI ​​behavior profiling engine for further analysis.

[0062] The AI ​​behavior profiling engine uses AI algorithms to analyze user behavior data and detect any anomalies or risk fluctuations. When the AI ​​behavior profiling engine detects risk fluctuations, it sends an early warning to the decision engine. The decision engine reassesses the user's risk level based on the early warning and generates a policy adjustment instruction. After receiving the policy adjustment instruction, the gateway adjusts the access control policy for user sessions in real time to ensure the security of network resources.

[0063] Step 4: Continuous session monitoring and real-time adjustments;

[0064] Monitor the entire lifecycle of established sessions and analyze operation sequences (such as database query patterns and file download volume) and session activity in real time.

[0065] If abnormal behavior is detected (such as attempts to escalate privileges or a surge in data transmission traffic), dynamic policy adjustments are triggered; the risk level is upgraded in real time (e.g., from low to medium risk), and privilege downgrades or session termination is performed.

[0066] Step 5: Dynamically downgrade / terminate permissions

[0067] When an escalation of risk is detected in a session: session permissions are downgraded, high-risk operations are restricted (e.g., file uploads are prohibited, access to sensitive APIs is disabled); the session is terminated, the connection is forcibly interrupted, and the account is frozen, while forensic data is preserved, including operation recordings and network packet logs.

[0068] Step 6: Audit Event Generation and Profile Update; Generate standardized audit events from all decision logs (risk scoring basis, strategy execution actions) and write them to the blockchain or an immutable database; Feed back the behavioral data in the session to the AI ​​behavioral profile engine to update the user / device behavior baseline model (e.g., optimize LSTM weights through online learning).

[0069] Step 7: Optimize the closed loop of strategy; regularly analyze the effectiveness of audit events and risk handling, and adjust the strategy decision threshold through reinforcement learning (RL) (e.g., reduce the MFA trigger threshold from 30 points to 25 points); update the sensitive resource tag library (e.g., add core databases as high-risk resources).

[0070] The zero-trust network dynamic access control method based on AI behavior profiling in this embodiment can dynamically adjust access policies according to users' real-time behavior, achieve fine-grained access control, and effectively improve network security.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An AI behavior portrait-based zero-trust network dynamic access control method, characterized in that, Comprise the following steps: Step 1: When the user or device initiates an access request, the zero trust gateway collects multi-source behavior data in real time, and integrates the multi-source behavior data; Step 2: Based on historical data, an AI behavior portrait engine is constructed, the integrated multi-source behavior data is input, the behavior deviation degree is calculated through the AI behavior portrait engine, and the risk score is output; The specific steps of constructing the AI behavior portrait engine are as follows: (1) Collecting historical raw behavior data; through various sensors, agent programs and log systems deployed in the network environment, the original behavior data of users and systems is collected comprehensively; (2) Spatio-temporal feature extraction; time series analysis technology is used to extract time dimension features from the original data; Based on geographic information system technology, the spatial characteristics of user access are analyzed, and a spatial distribution model of user behavior is constructed; (3) Graph neural network processing; the extracted spatio-temporal features are mapped to graph structure data, and a user-resource interaction graph is constructed; wherein, the user, device and application entity are graph nodes, and the access relationship between entities is an edge; a graph neural network model is used to perform deep learning on the graph structure data, and the implicit patterns of user behavior in complex network relationships are mined; (4) Node embedding generation; through the training of the graph neural network, the high-dimensional sparse graph node features are mapped to low-dimensional dense node embedding vectors; each node embedding vector contains comprehensive feature information of user behavior; (5) Time series modeling; time series modeling is performed on the node embedding vector to capture the time evolution law of user behavior; the time series dependence relationship of user behavior is learned to predict future behavior trends; (6) Behavior portrait vector generation; the results of spatio-temporal feature extraction, graph neural network processing and time series modeling are fused to generate a user behavior portrait vector; (7) Risk score engine; based on the behavior portrait vector, a risk assessment model is constructed; a machine learning algorithm is used to score the user behavior; the risk score result is used to dynamically adjust the network access permission of the user; Step 3: Dynamic strategy decision, the decision engine executes hierarchical control according to the risk score; for low-risk, grant access permission, enter the default session channel; for medium-risk, trigger multi-factor authentication, grant restricted permission after verification; for high-risk, immediately block access and trigger alarm to SOC, record attack trace data; Step 4: Monitor the behavior flow of the established session throughout the cycle, and analyze the operation sequence and session activity in real time; Step 5: When the risk level of the session is detected, the session permission is downgraded, high-risk operations are limited, the session is terminated, the connection is forcibly interrupted and the account is frozen, and the evidence data is retained; Step 6: Generate standardized audit events for all decision logs, write them into a blockchain or tamper-proof database; and feed the behavior data in the session back to the AI behavior portrait engine; Step 7: Regularly analyze audit events and risk disposal effects, adjust strategy decision thresholds through reinforcement learning; update the sensitive resource tag library. 2.The AI behavior profile-based zero trust network dynamic access control method of claim 1, wherein, The multi-source behavior data includes identity information, behavior data and environment data; the identity information mainly includes user role, device fingerprint, authentication strength; the behavior data includes API call sequence, operation frequency, access time, data flow pattern; the environment data includes IP geographical location, network environment security score, device security state. 3.The AI-behavior-profile-based zero-trust network dynamic access control method of claim 1, wherein, Through terminal agent to capture device level behavior, network flow probe to analyze communication mode, identity management system to provide identity credibility and security information and event management system to associate global threat intelligence to deeply link, thereby cross-verification of multi-dimensional behavior data. 4.The AI behavior profile-based zero trust network dynamic access control method of claim 1, wherein, The risk score is generated based on comprehensive behavior deviation, environment risk weight and sensitive resource label, and the behavior is divided into three levels of low risk, medium risk and high risk according to the risk score. 5.The AI behavior profile-based zero trust network dynamic access control method of claim 1, wherein, The specific implementation steps of the dynamic strategy decision are as follows: (1) User access request; when the user tries to access the protected network resource, the access request needs to be sent to the gateway; (2) Portrait query and strategy generation; after the gateway receives the user's access request, it will initiate a request to query the user's portrait to the decision engine; the decision engine generates a dynamic strategy according to the user's historical behavior data, identity information and AI algorithm; (3) Access control execution; the gateway makes real-time judgment and decision on the user's access request according to the dynamic strategy returned by the decision engine; If the strategy allows access, the gateway will release the request and allow the user to access the target resource; if the strategy detects potential risks, the gateway will restrict access and require the user to perform multi-factor authentication or take other security measures; (4) Session monitoring and strategy adjustment; during the user session, the gateway will continuously collect the user's real-time behavior data, and the gateway will send these real-time behavior data to the AI behavior portrait engine; the AI behavior portrait engine analyzes the user's behavior data using AI algorithm to detect whether there is abnormality or risk fluctuation; when the AI behavior portrait engine detects risk fluctuation, it will send warning information to the decision engine; the decision engine re-evaluates the user's risk level according to the warning information and generates strategy adjustment instruction; after the gateway receives the strategy adjustment instruction, it will adjust the access control strategy of the user session in real time to ensure the security of the network resource. 6.The AI behavior profile-based zero trust network dynamic access control method of claim 1, wherein, In step 4, if abnormal behavior is detected, the adjustment of dynamic strategy is triggered; Real-time upgrade risk level, and execute permission downgrade or session termination for user or device session.

Images