Over-authority detection method and system fusing state space sequence modeling and authority strategy

Abstract

The invention discloses an unauthorized detection method and system fusing state space sequence modeling and an authority strategy, and belongs to the technical field of information security, the method comprises the following steps: step 1, collecting and preprocessing user access log data, and constructing a user operation sequence; generating an operation vector sequence; step 2, training the encoded vector sequence, and self-supervising and learning time sequence characteristics and normal operation modes of user behaviors; step 3, constructing an unauthorized behavior detector to realize unauthorized judgment of real-time operation; 4, performing permission adaptation and dynamic authorization suggestion on the judged unauthorized behavior; and step 5, deploying the trained Mama sequence modeler and the unauthorized behavior detector at an edge node or a cloud. According to the invention, real-time accurate detection and authority adjustment of an unauthorized behavior are realized, so that the intelligence and automation level of system security protection is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to an over-privilege detection method and system fusing state space sequence modeling and permission policy. BACKGROUND

[0002] With the wide application of information systems, the complexity and diversity of user access behaviors are increasing, and how to effectively monitor and prevent over-privilege access has become an important issue to ensure system security. Traditional access control methods based on static permission configuration, such as role-based access control (RBAC) and attribute-based access control (ABAC), can regulate the user permission range to a certain extent, but they are difficult to adapt to dynamic and changing operating environments and lack the ability to identify and respond to abnormal behaviors in a timely manner.

[0003] In recent years, with the development of machine learning, especially sequence modeling technology, abnormal behavior detection using user operation history sequences has gradually become a research hotspot. By modeling the time sequence features of user behavior through deep neural networks, the normal operation patterns of users can be mined to timely detect potential over-privilege operations. However, existing methods have the following shortcomings: first, the modeling capability is limited, and some methods use traditional recurrent neural networks or their variants, which are difficult to efficiently capture complex long-term dependencies and state evolution, resulting in insufficient over-privilege detection accuracy. Second, the integration of permission policies is insufficient, and most studies ignore the combination of access control policies and behavior detection, failing to fully utilize user roles and permission information, which limits the interpretability and fine-grained management capability of detection. Third, the real-time response capability is weak, and existing models have high computational complexity and large response delay in actual system deployment, which is not conducive to real-time security protection. SUMMARY

[0004] To solve the above problems in the prior art, the technical problem to be solved by the present application is to provide an over-privilege detection method and system fusing state space sequence modeling and permission policy, which realizes real-time and accurate detection of over-privilege behaviors and permission adjustment, thereby improving the intelligentization and automation level of system security protection.

[0005] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present application is as follows:

[0006] An over-privilege detection method fusing state space sequence modeling and permission policy, comprising the following steps:

[0007] Step 1, collect and preprocess user access log data, extract user identification, operation type, resource identification, access time and context information from system access records, and construct user operation sequences; perform multi-dimensional vector encoding on each operation in the user operation sequence, combine operation type embedding, resource identification embedding and time difference coding, and generate operation vector sequences;

[0008] Step 2, train the encoded operation vector sequence using the Mamba sequence modeler based on the state space model, and self-supervised learn the timing features and normal operation mode of user behavior;

[0009] Step 3, based on the hidden state output by the trained Mamba sequence modeler, build an unauthorized behavior detector to realize real-time operation of unauthorized judgment;

[0010] Step 4, combined with the role-based access control strategy, integrate user role permissions and context information to adapt the permissions and dynamically authorize the determined unauthorized behavior;

[0011] Step 5, deploy the trained Mamba sequence modeler and unauthorized behavior detector on the edge node or cloud to realize real-time unauthorized detection and dynamic permission adjustment of user operation.

[0012] Preferably, the operation vector sequence generated in step 1 specifically includes the following steps:

[0013] Step 1.1, operation type Use embedding function Map to dense vector , wherein represents the dense vector of the operation type at the current time step, represents the real number space with a vector dimension of ;

[0014] Step 1.2, resource identification Use embedding function for vector representation , wherein represents the dense vector of the accessed resource at the current time step, represents the real number space with a vector dimension of ;

[0015] Step 1.3, calculate the time difference between the current operation and the previous operation , wherein represents the current operation timestamp, represents the previous operation timestamp, and the time difference is position encoded using logarithmic position encoding, which is encoded as follows:

[0016]

[0017] Get time difference vector , , wherein is the frequency scaling factor, and log(·) represents the natural logarithm function;

[0018] Step 1.4. Sum the above three vectors to get the final operation vector representation as:

[0019]

[0020] where, denotes the final operation vector sequence.

[0021] Preferably, the Mamba sequence modeler in step 2 is composed of multiple layers of residual connected MambaBlocks, each layer updating the hidden state based on a state space:

[0022]

[0023] where, denotes the index of the network layer, denotes the number of network layers, the initial input is ;

[0024] The training method includes the following steps:

[0025] Step 2.1. Each MambaBlock implements dynamic modeling of the input sequence according to the state space parameters (A, B, C, D):

[0026]

[0027] where A is the state matrix, representing the transition relationship of the previous time hidden state to the current state, B is the input matrix, representing the influence of the input on the state, C is the output matrix, defining how the state is mapped to the actual output, D is the straight-through matrix, representing the direct mapping relationship of the input to the output, denotes the state vector, denotes the state vector at the previous time, is the input vector, is the output.

[0028] Step 2.2. Adopt a self-supervised learning strategy to train the Mamba sequence modeler by predicting the task of the next operation, and the optimization goal is the cross-entropy loss function:

[0029]

[0030] where, denotes the loss function in the pre-training phase, denotes the log probability of predicting the next operation under the given hidden state at time t, denotes the hidden state representation at time t, denotes the real next operation in the sequence, T denotes the total length of the sequence, and t denotes the time step index.

[0031] Step 2.3, using the real operation sequence in the training sample, step by step minimize the loss function, using Adam optimizer to optimize the parameters of Mamba sequence modeler, to accurately capture the normal operation mode of users, learning rate decay strategy is introduced in the training process, and continuous iteration until the model converges.

[0032] Preferably, the overreach behavior detector constructed in step 3 is a hidden state-based binary classifier, and the specific construction steps are:

[0033] Step 3.1, the hidden state of each time step output by the Mamba sequence modeler Input into a binary classification neural network detector, output overreach probability :

[0034]

[0035] Where, is the Sigmoid function, is the temperature coefficient, is a learnable parameter;

[0036] Step 3.2, training through labeled overreach behavior data, overreach sample label The loss function of overreach behavior detector is binary cross entropy:

[0037]

[0038] Where, represents the loss function of classification task;

[0039] Step 3.3, supervised training with artificially annotated overreach behavior dataset during training to minimize .

[0040] Preferably, the step 4 of the determined overreach behavior includes:

[0041] Step 4.1, for the current user , get its role set through role mapping function :

[0042] ;

[0043] Step 4.2, according to the role set And the current access resource permission set Match while considering the context legality , judge the operation permission, calculate:

[0044]

[0045] wherein, is a permission matching function, is a context legality check, respectively judging whether the role permission matches and the current environment is safe;

[0046] Step 4.3, when the unauthorized behavior detector judges that the operation is unauthorized and the permission adaptation result is rejection, triggering dynamic authorization suggestion, further evaluating whether to allow temporary authorization:

[0047]

[0048] wherein, is an unauthorized probability threshold, is a context matching judgment function, used to judge whether the dynamic authorization condition is met, represents suggesting temporary authorization, represents rejecting temporary authorization.

[0049] Preferably, the deployment mode in step 5 includes:

[0050] The trained Mamba sequence modeler and the unauthorized behavior detector are jointly deployed to the cloud or edge node, real-time receiving operation log data and performing stream processing according to the process of steps 1-4, returning the unauthorized risk probability, permission judgment and dynamic authorization suggestion.

[0051] The application also provides an unauthorized detection system fusing state space sequence modeling and permission policy, for realizing the above-mentioned unauthorized detection method fusing state space sequence modeling and permission policy, including a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized behavior detector, an RBAC policy module and a dynamic authorization evaluation module.

[0052] The data acquisition and preprocessing module is used for acquiring and preprocessing user access log data, and generating operation vector sequences.

[0053] The Mamba sequence modeler is used for training the operation vector sequences generated by the data acquisition and preprocessing module, and after training, the Mamba sequence modeler maps the user behavior sequence into a hidden state at a time step level.

[0054] The unauthorized behavior detector is used for taking the hidden state output by the Mamba sequence modeler at each time step as input, and outputting a probability value of the current operation being normal or unauthorized.

[0055] RBAC policy module, which is used to query the role set of the current user when the unauthorized behavior detector determines that the operation is unauthorized, and match the role permission set bound to the target resource, and judge whether the access condition is met in combination with the context information;

[0056] Dynamic authorization evaluation module, which is used to enter dynamic authorization evaluation when the unauthorized behavior detector judges that the operation is unauthorized and the permission adaptation result of the RBAC policy module is rejection, generate a suggestion of whether to allow temporary authorization according to the context credibility and the behavior abnormality degree, and provide the administrator with a decision or an automatic policy engine with an adoption.

[0057] Advantages: Compared with the prior art, the present application has the following advantages:

[0058] 1. Mamba sequence model based on state space modeling, combined with role-based access control policy for joint modeling, thereby realizing dynamic learning of user operation behavior and deep fusion of permission constraints;

[0059] 2. The time sequence dependence features in the user behavior sequence are learned in a self-supervised manner, and the RBAC permission structure information is introduced to assist in judgment, realizing the organic combination of behavior detection and permission judgment, breaking through the limitations of traditional methods which only rely on static permission configuration or fixed rule recognition, and significantly improving the precision, interpretability and adaptability of unauthorized detection;

[0060] 3. The key problems of insufficient recognition ability of complex time sequence behavior, insufficient depth of permission fusion and lack of real-time response capability in existing unauthorized detection methods are fundamentally solved, and an unauthorized access protection mechanism which can be deployed online, continuously self-learned and dynamically authorized is established; the method is not only suitable for behavior security control in general information systems, but also has practical application value in financial, industrial internet, government platform and other high security requirement scenes, and has good scalability and broad application prospect. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 is a flow chart of the method of the embodiment of the present application;

[0062] Figure 2 is a system structure diagram of the present application. DETAILED DESCRIPTION

[0063] The present application will be further illustrated below in combination with specific embodiments, which are implemented on the premise of the technical scheme of the present application, and should be understood that these embodiments are only used to illustrate the present application and not to limit the scope of the present application.

[0064] As shown in Figure 1 A kind of unauthorized detection method fusing state space sequence modeling and permission policy, including the following steps:

[0065] Step 1, collect and pre-process user access log data, extract user identification, operation type, resource identification, access time and context information from system access records, user identification includes user ID, operation type login, download and modification, resource identification is access target resource identification, context information includes IP address and device type, group log data by user, arrange in time sequence to construct user operation sequence;

[0066] Each operation in the user operation sequence is encoded as a multi-dimensional vector, combined with operation type embedding, resource identification embedding and time difference coding to generate an operation vector sequence. The multi-dimensional vector encoding of user operation includes the following steps:

[0067] Step 1.1, operation type using embedding function mapping to dense vector wherein, represents the dense vector of the operation type at the current time step, represents a real number space with a vector dimension of The dense vector is obtained by looking up the operation type embedding table, which can capture the semantic similarity between operation types.

[0068] Step 1.2, resource identification using embedding function vector representation wherein, represents the dense vector of the accessed resource at the current time step, represents a real number space with a vector dimension of The vector is obtained by mapping the resource encoder, which is used to capture the semantic features and access patterns of different resources.

[0069] Step 1.3, calculate the time difference between the current operation and the previous operation wherein, represents the current operation timestamp, represents the previous operation timestamp, and the time difference is position coded using logarithmic position coding, which is coded as follows:

[0070]

[0071] get time difference vector , ; wherein, is a frequency scaling factor, log(·) represents a natural logarithm function, which is used to map the time difference to a logarithmic scale, thereby reducing the numerical difference between different time spans and improving the robustness of the model to long time intervals.

[0072] Step 1.4, the final operation vector is obtained by summing the above three vectors:

[0073]

[0074] wherein, represents the final operation vector sequence.

[0075] Step 2, the final operation vector sequence of step 1 is trained by using a Mamba sequence modeler based on a state space model, to self-supervised learn the time sequence features and normal operation mode of user behavior;

[0076] The Mamba sequence modeler is composed of multiple layers of residual connection MambaBlock, each MambaBlock can be regarded as a kind of sub-module based on state space modeling idea, which has the ability to capture long-term behavior dependence and state evolution, and each layer updates the hidden state based on state space:

[0077]

[0078] wherein, represents the index of the network layer, represents the number of network layers, and the initial input is ;

[0079] The training method includes the following steps:

[0080] Step 2.1, each MambaBlock realizes dynamic modeling of the input sequence according to the state space parameters (A, B, C, D):

[0081]

[0082] wherein, A is a state matrix, representing the transition relationship of the previous time hidden state to the current state, B is an input matrix, representing the influence of the input on the state, C is an output matrix, defining how the state is mapped to the actual output, and D is a straight-through matrix, representing the direct mapping relationship of the input to the output, represents the state vector, represents the state vector of the previous time, is an input vector, is an output.

[0083] Step 2.2, a self-supervised learning strategy is adopted to train the Mamba sequence modeler by predicting the task of the next operation, and the optimization target is the cross-entropy loss function:

[0084]

[0085] wherein, represents the loss function in the pre-training stage, represents the log probability of the next operation given the hidden state next operation , represents the hidden state at time t, represents the true next operation in the sequence, T represents the total length of the sequence, and t represents the time step index.

[0086] Step 2.3, using the real operation sequence in the training sample, step by step minimize the loss function, using Adam optimizer to optimize the parameters of Mamba sequence modeler to optimize, to accurately capture the normal operation mode of the user, learning rate decay strategy is introduced in the training process, and continuous iteration until the model converges, so as to ensure that the model has strong generalization ability while maintaining stability.

[0087] Step 3, based on the hidden state output by the trained sequence model, build an abuse of authority detector to realize the abuse of authority judgment of real-time operation, the built abuse of authority detector is a binary classifier based on hidden state, the specific construction steps are:

[0088] Step 3.1, input the hidden state of each time step output by the Mamba sequence modeler to a binary classification neural network detector, output the probability of abuse of authority :

[0089]

[0090] where, is the Sigmoid function, is the temperature coefficient, is a learnable parameter.

[0091] Step 3.2, train through labeled abuse of authority data, the label of abuse of authority sample , the loss function of abuse of authority detector is binary cross entropy:

[0092]

[0093] where, represents the loss function of classification task.

[0094] Step 3.3, supervised training is carried out by using the abuse of authority data set marked by artificial in the training process, so as to minimize . In the inference stage, the detector outputs the probability of abuse of authority

[0095] according to the real-time input hidden state, and realizes the abuse of authority judgment of real-time operation accordingly.

[0096] Step 4, combined with the role-based access control (RBAC) policy, the user role permission and the context information are integrated to adapt the permission and dynamically authorize the unauthorized behavior, including:

[0097] Step 4.1, for the current user , get its role set through the role mapping function :

[0098]

[0099] This step queries the role set of the current user based on the RBAC policy.

[0100] Step 4.2, according to the role set and the target resource permission set accessed at present, match while considering the context legality , judge the operation permission, calculate:

[0101]

[0102] Among them, is the permission matching function, is the context legality check, which respectively judges whether the role permission matches and whether the current environment is safe; this step matches the role permission set bound to the target resource. At the same time, combined with the context information, it judges whether the access condition is met.

[0103] Step 4.3, when the unauthorized behavior detector judges that the operation is unauthorized and the permission adaptation result is refused, trigger the dynamic authorization suggestion, further assess whether to allow temporary authorization:

[0104]

[0105] Among them, is the unauthorized probability threshold, is the context matching judgment function, which is used to judge whether the dynamic authorization condition is met, represents suggesting temporary authorization, represents refusing temporary authorization. This step generates a suggestion of whether to allow temporary authorization according to the context credibility and the degree of behavior anomaly, for the administrator to make a decision or for the automatic policy engine to adopt.

[0106] Step 5, deploy the trained Mamba sequence modeler and unauthorized behavior detector on the edge node or cloud to realize real-time unauthorized detection and dynamic permission adjustment of user operation, including:

[0107] The trained Mamba sequence modeler is combined with the unauthorized behavior detector and deployed to the cloud or edge node. In actual operation, operation log data is received in real time and processed according to the steps 1-4, and the unauthorized risk probability, permission determination and dynamic authorization suggestion are returned, so as to realize a low-delay and high-precision online unauthorized detection and response system.

[0108] The embodiment can be flexibly applied to enterprise information systems, industrial control systems, public data platforms and the like, and can realize efficient modeling of complex user behaviors and accurate identification of abnormal behaviors, and has good universality and engineering feasibility.

[0109] As shown in Figure 2 The embodiment also provides an unauthorized detection system combining state space sequence modeling and permission policy, which comprises a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized behavior detector, an RBAC policy module and a dynamic authorization evaluation module.

[0110] The data acquisition and preprocessing module is used for acquiring and preprocessing user access log data, grouping the log data according to users, arranging and constructing user operation sequences according to time sequence, performing multi-dimensional vector coding on each operation in the user operation sequence, combining operation type embedding, resource identification embedding and time difference coding, and generating a final operation vector sequence.

[0111] The Mamba sequence modeler is composed of a plurality of MambaBlocks connected in multiple layers and has the ability to capture long-term behavior dependence and state evolution, and is used for training the final operation vector sequence generated by the data acquisition and preprocessing module. After training, the Mamba sequence modeler maps the user behavior sequence into a hidden state at a time step level, and provides a high-dimensional dynamic representation for subsequent unauthorized discrimination.

[0112] The unauthorized behavior detector is a binary classification detector composed of a plurality of multilayer feedforward neural networks, which is used for taking the hidden state output by the Mamba sequence modeler at each time step as input and outputting a probability value of the current operation being normal or unauthorized. In actual deployment, when the unauthorized probability exceeds a set threshold, the operation is determined as a potential unauthorized operation.

[0113] The RBAC (role-based access control) policy module is used for querying the role set of the current user after the unauthorized behavior detector determines an unauthorized operation, and matching the role permission set bound to the target resource, and judging whether the access condition is met in combination with context information.

[0114] The dynamic authorization evaluation module is used for entering the dynamic authorization evaluation when the operation is judged as an unauthorized operation by the unauthorized operation detector and the permission adaptation result of the RBAC policy module is rejection, and generating a suggestion of whether to allow temporary authorization according to the context credibility and the behavior abnormality degree, for the administrator decision or the automatic policy engine adoption.

[0115] The embodiment can be flexibly applied to enterprise information systems, industrial control systems, public data platforms and the like, and can realize efficient modeling of complex user behaviors and accurate identification of abnormal behaviors, and has good universality and engineering feasibility.

[0116] The above only describes the preferred embodiments of the present application, and it should be pointed out that for ordinary skilled persons in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for detecting unauthorized access by integrating state-space sequence modeling and permission policies, characterized in that, Includes the following steps: Step 1: Collect and preprocess user access log data. Extract user identifier, operation type, resource identifier, access time, and context information from the system access records to construct a user operation sequence. Perform multi-dimensional vector encoding on each operation in the user operation sequence. Combine operation type embedding, resource identifier embedding, and time difference encoding to generate an operation vector sequence. Step 2: Use the Mamba sequence modeler based on the state space model to train the encoded operation vector sequence, and learn the temporal features of user behavior and normal operation mode in a self-supervised manner. Step 3: Based on the hidden state output by the trained Mamba sequence modeler, construct an unauthorized behavior detector to realize unauthorized judgment of real-time operations; Step 4: Combining role-based access control policies with user role permissions and context information, provide permission adaptation and dynamic authorization suggestions for the identified unauthorized behavior. Step 5: Deploy the trained Mamba sequence modeler and privilege escalation detector on edge nodes or in the cloud to achieve real-time privilege escalation detection and dynamic permission adjustment for user operations.

2. The unauthorized access detection method based on the fusion of state-space sequence modeling and permission policy as described in claim 1, characterized in that, Step 1, generating the operation vector sequence, specifically includes the following steps: Step 1.1: Determine the operation type Using embedded functions Mapped to dense vectors ,in, A dense vector representing the operation type at the current time step. The vector dimension is The real number space; Step 1.2: Identify the resource. Using embedded functions Vectorization ,in, This represents a dense vector of resources accessed at the current time step. The vector dimension is The real number space; Step 1.3: Calculate the time difference between the current operation and the previous operation. ,in, Indicates the current operation timestamp. This represents the timestamp of the previous operation, and logarithmic positional encoding is used to positionally encode the time difference, as follows: ； Obtain the time difference vector , ,in, The frequency scaling factor is denoted by log(·), which represents the natural logarithm function. Step 1.4: Summing the above three vectors yields the final operation vector, represented as follows: ； in, This represents the final operation vector sequence.

3. The unauthorized access detection method based on the fusion of state-space sequence modeling and permission policy as described in claim 2, characterized in that, The Mamba sequence modeler in step 2 consists of multiple layers of residual connections in the MambaBlock, with each layer updating the hidden state based on the state space: ； in, Indicates the index of the network layer. This represents the number of layers in the network, with the initial input being... ; The training method includes the following steps: Step 2.1: Each MambaBlock dynamically models the input sequence based on the state space parameters (A, B, C, D): ； Where A is the state matrix, representing the transition relationship between the hidden state in the previous time step and the current state; B is the input matrix, representing the influence of the input on the state; C is the output matrix, defining how the state maps to the actual output; and D is the pass-through matrix, representing the direct mapping relationship between the input and the output. Represents the state vector. This represents the state vector at the previous moment. For the input vector, For output; Step 2.2: Employ a self-supervised learning strategy to train the Mamba sequence modeler by predicting the task of the next operation, with the optimization objective being the cross-entropy loss function. ； in, This represents the loss function during the pre-training phase. Indicates that in a given hidden state Predict the next operation The logarithmic probability, This represents the hidden state at time t. This represents the actual next operation in the sequence, where T represents the total length of the sequence and t represents the time step index. Step 2.3: Using real operation sequences from the training samples, gradually minimize the loss function. Use the Adam optimizer to optimize the parameters of the Mamba sequence modeler to accurately capture the user's normal operation pattern. Introduce a learning rate decay strategy during training and continue iterating until the model converges.

4. The unauthorized access detection method based on the fusion of state-space sequence modeling and permission policy as described in claim 2, characterized in that, The overstepping behavior detector constructed in step 3 is a binary classifier based on hidden states. The specific construction steps are as follows: Step 3.1: Extract the hidden states of each time step from the output of the Mamba sequence modeler. The input is fed into a binary classification neural network detector, and the output is the overweight probability. : ； in, For the Sigmoid function, For temperature coefficient, These are learnable parameters; Step 3.2: Train using labeled data on unauthorized behavior, labeling unauthorized samples. The loss function of the unauthorized behavior detector is the binary cross-entropy: ； in, The loss function represents the classification task; Step 3.3: During training, supervised training is performed using a manually labeled dataset of unauthorized behaviors to minimize [the impact of unauthorized behavior]. .

5. The unauthorized access detection method integrating state-space sequence modeling and permission policy as described in claim 1, characterized in that, Step 4, which involves providing permission adaptation and dynamic authorization suggestions for the determined unauthorized behavior, specifically includes: Step 4.1, for the current user The set of characters is obtained through the character mapping function. : ； Step 4.2, based on the character set With the currently accessed resource permission set Perform matching while considering contextual validity. Determine operation permissions and calculate: ； in, This is a permission matching function. For contextual validity checks, it is necessary to determine whether the role permissions match and whether the current environment is secure. Step 4.3: When the unauthorized behavior detector determines that the operation is unauthorized and the permission adaptation result is denied, a dynamic authorization suggestion is triggered to further evaluate whether temporary authorization should be allowed. ； in, This is the threshold for the probability of exceeding the weight limit. This is a context matching function used to determine whether dynamic authorization conditions are met. It suggests a temporary authorization. This indicates a refusal of the provisional authorization.

6. The unauthorized access detection method integrating state-space sequence modeling and permission policy as described in claim 1, characterized in that, The deployment methods in step 5 include: The trained Mamba sequence modeler and the unauthorized behavior detector are jointly deployed to the cloud or edge node. The operation log data is received in real time and processed in streaming according to the process of steps 1 to 4, and the unauthorized risk probability, permission judgment and dynamic authorization suggestions are returned.

7. An unauthorized access detection system integrating state-space sequence modeling and permission policies, used to implement the unauthorized access detection method integrating state-space sequence modeling and permission policies as described in any one of claims 1 to 6, characterized in that, It includes a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized behavior detector, an RBAC policy module, and a dynamic authorization evaluation module; The data acquisition and preprocessing module is used to collect and preprocess user access log data to generate operation vector sequences. The Mamba sequence modeler is used to train the operation vector sequence generated by the data acquisition and preprocessing module. After training, the Mamba sequence modeler maps the user behavior sequence to hidden states at the time step level. An overstepping behavior detector is used to take the hidden state output by the Mamba sequence modeler at each time step as input and output the probability value of whether the current operation is normal or overstepping. The RBAC policy module is responsible for querying the current user's role set and matching it with the role permission set bound to the target resource when the unauthorized behavior detector determines that an unauthorized operation has been performed. It also combines context information to determine whether the access conditions are met. The dynamic authorization evaluation module is used when the unauthorized behavior detector determines that an operation is unauthorized and the permission adaptation result of the RBAC policy module is denied. It then enters the dynamic authorization evaluation stage, and generates a suggestion on whether to allow temporary authorization based on the context credibility and the degree of behavior abnormality, for the administrator to make a decision or for the automated policy engine to adopt.

Images