An out-of-authority detection method and system fusing state space sequence modeling and authority policy

Abstract

The application discloses a kind of fusion state space sequence modeling and over-authorization detection method and system of policy, belong to information security technical field, this method includes following steps: step 1, access log data of user is collected and preprocessed, constructs user operation sequence;Operation vector sequence is generated;Step 2, the vector sequence after coding is trained, the time sequence characteristics and normal operation mode of self-supervised learning user behavior;Step 3, constructs over-authorization detector, realizes over-authorization judgment to real-time operation;Step 4, the over-authorization of determination is adapted to authority and dynamically authorized suggestion;Step 5, the Mamba sequence modeler of training completion and over-authorization detector is deployed in edge node or cloud end.The application realizes real-time accurate detection and authority adjustment to over-authorization, to improve the intelligentization and automation level of system security protection.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to an unauthorized access detection method and system that integrates state-space sequence modeling and permission policies. Background Technology

[0002] With the widespread application of information systems, the complexity and diversity of user access behaviors are increasing. How to effectively monitor and prevent unauthorized access has become an important issue in ensuring system security. Traditional access control methods based on static permission configuration, such as role-based access control (RBAC) and attribute-based access control (ABAC), can regulate the scope of user permissions to a certain extent, but they are difficult to adapt to dynamic and changing operating environments and lack the ability to identify and respond to abnormal behaviors in a timely manner.

[0003] In recent years, with the development of machine learning, especially sequence modeling techniques, abnormal behavior detection using user operation history sequences has gradually become a research hotspot. Modeling the temporal features of user behavior using deep neural networks can uncover normal user operation patterns, thereby promptly detecting potential unauthorized operations. However, existing methods have the following shortcomings: First, their modeling capabilities are limited. Some methods employ traditional recurrent neural networks or their variants, making it difficult to efficiently capture complex long-term dependencies and state evolutions, resulting in insufficient accuracy in unauthorized operation detection. Second, the integration of access control policies is insufficient. Most studies neglect to combine access control policies with behavior detection, failing to fully utilize user role and permission information, thus limiting the interpretability and fine-grained management capabilities of the detection. Third, their real-time response capabilities are weak. Existing models suffer from high computational complexity and large response latency in practical system deployments, which is detrimental to real-time security protection. Summary of the Invention

[0004] In view of the above-mentioned problems in the prior art, the technical problem to be solved by the present invention is to provide an unauthorized detection method and system that integrates state space sequence modeling and permission policy, so as to realize real-time and accurate detection and permission adjustment of unauthorized behavior, thereby improving the intelligence and automation level of system security protection.

[0005] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0006] An unauthorized access detection method integrating state-space sequence modeling and permission policies includes the following steps:

[0007] Step 1: Collect and preprocess user access log data. Extract user identifier, operation type, resource identifier, access time, and context information from the system access records to construct a user operation sequence. Perform multi-dimensional vector encoding on each operation in the user operation sequence. Combine operation type embedding, resource identifier embedding, and time difference encoding to generate an operation vector sequence.

[0008] Step 2: Use the Mamba sequence modeler based on the state space model to train the encoded operation vector sequence, and learn the temporal features of user behavior and normal operation mode in a self-supervised manner.

[0009] Step 3: Based on the hidden state output by the trained Mamba sequence modeler, construct an unauthorized behavior detector to realize unauthorized judgment of real-time operations;

[0010] Step 4: Combining role-based access control policies with user role permissions and context information, provide permission adaptation and dynamic authorization suggestions for the identified unauthorized behavior.

[0011] Step 5: Deploy the trained Mamba sequence modeler and privilege escalation detector on edge nodes or in the cloud to achieve real-time privilege escalation detection and dynamic permission adjustment for user operations.

[0012] Preferably, step 1, generating the operation vector sequence, specifically includes the following steps:

[0013] Step 1.1: Determine the operation type Using embedded functions Mapped to dense vectors ,in, A dense vector representing the operation type at the current time step. The vector dimension is The real number space;

[0014] Step 1.2: Identify the resource. Using embedded functions Vectorization ,in, This represents a dense vector of resources accessed at the current time step. The vector dimension is The real number space;

[0015] Step 1.3: Calculate the time difference between the current operation and the previous operation. ,in, Indicates the current operation timestamp. This represents the timestamp of the previous operation, and logarithmic positional encoding is used to positionally encode the time difference, as follows:

[0016]

[0017] Obtain the time difference vector , ,in, The frequency scaling factor is denoted by log(·), which represents the natural logarithm function.

[0018] Step 1.4: Summing the above three vectors yields the final operation vector, represented as follows:

[0019]

[0020] in, This represents the final operation vector sequence.

[0021] Preferably, the Mamba sequence modeler in step 2 consists of multiple layers of residually connected MambaBlocks, with each layer updating the hidden state based on the state space:

[0022]

[0023] in, Indicates the index of the network layer. This represents the number of layers in the network, with the initial input being... ;

[0024] The training method includes the following steps:

[0025] Step 2.1: Each MambaBlock dynamically models the input sequence based on the state space parameters (A, B, C, D):

[0026]

[0027] Where A is the state matrix, representing the transition relationship between the hidden state in the previous time step and the current state; B is the input matrix, representing the influence of the input on the state; C is the output matrix, defining how the state maps to the actual output; and D is the pass-through matrix, representing the direct mapping relationship between the input and the output. Represents the state vector. This represents the state vector at the previous moment. For the input vector, For output;

[0028] Step 2.2: Employ a self-supervised learning strategy to train the Mamba sequence modeler by predicting the task of the next operation, with the optimization objective being the cross-entropy loss function.

[0029]

[0030] in, This represents the loss function during the pre-training phase. Indicates that in a given hidden state Predict the next operation The logarithmic probability, This represents the hidden state at time t. This represents the actual next operation in the sequence, where T represents the total length of the sequence and t represents the time step index.

[0031] Step 2.3: Using real operation sequences from the training samples, gradually minimize the loss function. Use the Adam optimizer to optimize the parameters of the Mamba sequence modeler to accurately capture the user's normal operation pattern. Introduce a learning rate decay strategy during training and continue iterating until the model converges.

[0032] Preferably, the unauthorized behavior detector constructed in step 3 is a binary classifier based on hidden states, and the specific construction steps are as follows:

[0033] Step 3.1: Extract the hidden states of each time step from the output of the Mamba sequence modeler. The input is fed into a binary classification neural network detector, and the output is the overweight probability. :

[0034]

[0035] in, For the Sigmoid function, For temperature coefficient, These are learnable parameters;

[0036] Step 3.2: Train using labeled data on unauthorized behavior, labeling unauthorized samples. The loss function of the unauthorized behavior detector is the binary cross-entropy:

[0037]

[0038] in, The loss function represents the classification task;

[0039] Step 3.3: During training, supervised training is performed using a manually labeled dataset of unauthorized behaviors to minimize [the impact of unauthorized behavior]. .

[0040] Preferably, step 4, which involves providing permission adaptation and dynamic authorization suggestions for the determined unauthorized behavior, specifically includes:

[0041] Step 4.1, for the current user The character set is obtained through the character mapping function. :

[0042] ;

[0043] Step 4.2, based on the character set With the currently accessed resource permission set Perform matching while considering contextual validity. Determine operation permissions and calculate:

[0044]

[0045] in, This is a permission matching function. For contextual validity checks, determine whether the role permissions match and whether the current environment is secure.

[0046] Step 4.3: When the unauthorized behavior detector determines that the operation is unauthorized and the permission adaptation result is denied, a dynamic authorization suggestion is triggered to further evaluate whether temporary authorization should be allowed.

[0047]

[0048] in, This is the threshold for the probability of exceeding the weight limit. This is a context matching function used to determine whether dynamic authorization conditions are met. It suggests a temporary authorization. This indicates a refusal of the provisional authorization.

[0049] Preferably, the deployment method in step 5 includes:

[0050] The trained Mamba sequence modeler and the unauthorized behavior detector are jointly deployed to the cloud or edge node. The operation log data is received in real time and processed in streaming according to the process of steps 1 to 4, and the unauthorized risk probability, permission judgment and dynamic authorization suggestions are returned.

[0051] This invention also provides an unauthorized access detection system that integrates state-space sequence modeling and permission policies, for implementing the above-mentioned unauthorized access detection method that integrates state-space sequence modeling and permission policies, including a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized behavior detector, an RBAC policy module, and a dynamic authorization evaluation module;

[0052] The data acquisition and preprocessing module is used to collect and preprocess user access log data to generate operation vector sequences.

[0053] The Mamba sequence modeler is used to train the sequence of operation vectors generated by the data acquisition and preprocessing module. After training, the Mamba sequence modeler maps the user behavior sequence to hidden states at the time step level.

[0054] An overstepping behavior detector is used to take the hidden state output by the Mamba sequence modeler at each time step as input and output the probability value of whether the current operation is normal or overstepping.

[0055] The RBAC policy module is responsible for querying the current user's role set and matching it with the role permission set bound to the target resource when the unauthorized behavior detector determines that an unauthorized operation has been performed. It also combines context information to determine whether the access conditions are met.

[0056] The dynamic authorization evaluation module is used when the unauthorized behavior detector determines that an operation is unauthorized and the permission adaptation result of the RBAC policy module is denied. It then enters the dynamic authorization evaluation stage, and generates a suggestion on whether to allow temporary authorization based on the context credibility and the degree of behavior abnormality, for the administrator to make a decision or for the automated policy engine to adopt.

[0057] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0058] 1. A state-space model-based Mamba sequence model is combined with a role-based access control policy for joint modeling, thereby achieving a deep integration of dynamic learning of user behavior and permission constraints.

[0059] 2. By learning the temporal dependency features in user behavior sequences through self-supervised learning and introducing RBAC permission structure information to assist in discrimination, the system achieves an organic combination of behavior detection and permission judgment, breaking through the limitations of traditional methods that rely solely on static permission configuration or fixed rule recognition, and significantly improving the accuracy, interpretability, and adaptability of unauthorized access detection.

[0060] 3. This method fundamentally solves the key problems of existing unauthorized access detection methods, such as insufficient ability to identify complex temporal behaviors, insufficient depth of permission integration, and lack of real-time response capabilities. It establishes an unauthorized access protection mechanism that can be deployed online, continuously learns, and dynamically makes authorization decisions. This method is not only applicable to behavioral security control in general information systems, but also has practical application value in high-security scenarios such as finance, industrial internet, and government platforms. It has good scalability and broad prospects for promotion. Attached Figure Description

[0061] Figure 1 This is a flowchart of the method according to an embodiment of the present invention;

[0062] Figure 2 This is a system structure diagram of the present invention. Detailed Implementation

[0063] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0064] like Figure 1 As shown, an unauthorized access detection method integrating state-space sequence modeling and permission policies includes the following steps:

[0065] Step 1: Collect and preprocess user access log data. Extract user identifier, operation type, resource identifier, access time and context information from the system access records. User identifier includes user ID, operation type is login, download and modify, resource identifier is the access target resource identifier, and context information includes IP address and device type. Group the log data by user and arrange them in chronological order to construct a user operation sequence.

[0066] Each operation in the user operation sequence is encoded using multidimensional vector encoding. This is combined with operation type embedding, resource identifier embedding, and temporal difference encoding to generate an operation vector sequence. The specific steps for multidimensional vector encoding of user operations include the following:

[0067] Step 1.1: Determine the operation type Using embedded functions Mapped to dense vectors ,in, A dense vector representing the operation type at the current time step. The vector dimension is The dense vector, obtained by looking up the operation type embedding table, captures the semantic similarity between operation types in the real number space.

[0068] Step 1.2: Identify the resource. Using embedded functions Vectorization ,in, This represents a dense vector of resources accessed at the current time step. The vector dimension is The vector is a real number space, which is obtained through resource encoder mapping and is used to capture semantic features and access patterns between different resources.

[0069] Step 1.3: Calculate the time difference between the current operation and the previous operation. ,in, Indicates the current operation timestamp. This represents the timestamp of the previous operation, and logarithmic positional encoding is used to positionally encode the time difference, as follows:

[0070]

[0071] Obtain the time difference vector , ;in, is the frequency scaling factor, and log(·) represents the natural logarithm function, which is used to map the time difference to a logarithmic scale, thereby reducing the numerical differences between different time spans and improving the robustness of the model to long time intervals.

[0072] Step 1.4: Summing the above three vectors yields the final operation vector, represented as follows:

[0073]

[0074] in, This represents the final operation vector sequence.

[0075] Step 2: Use the Mamba sequence modeler based on the state space model to train the final operation vector sequence of Step 1, and learn the temporal features of user behavior and normal operation mode in a self-supervised manner.

[0076] The Mamba sequence modeler consists of multiple layers of residually connected MambaBlocks. Each MambaBlock can be viewed as a submodule based on the state-space modeling concept, capable of capturing long-term behavioral dependencies and state evolution. Each layer updates the hidden state based on the state space.

[0077]

[0078] in, Indicates the index of the network layer. This represents the number of layers in the network, with the initial input being... ;

[0079] The training method includes the following steps:

[0080] Step 2.1: Each MambaBlock dynamically models the input sequence based on the state space parameters (A, B, C, D):

[0081]

[0082] Where A is the state matrix, representing the transition relationship between the hidden state in the previous time step and the current state; B is the input matrix, representing the influence of the input on the state; C is the output matrix, defining how the state maps to the actual output; and D is the pass-through matrix, representing the direct mapping relationship between the input and the output. Represents the state vector. This represents the state vector at the previous moment. For the input vector, This is the output.

[0083] Step 2.2: Employ a self-supervised learning strategy to train the Mamba sequence modeler by predicting the task of the next operation, with the optimization objective being the cross-entropy loss function.

[0084]

[0085] in, This represents the loss function during the pre-training phase. Indicates that in a given hidden state Predict the next operation The logarithmic probability, This represents the hidden state at time t. This represents the actual next operation in the sequence, where T represents the total length of the sequence and t represents the time step index.

[0086] Step 2.3: Using real operation sequences from the training samples, the loss function is gradually minimized. The Adam optimizer is used to optimize the parameters of the Mamba sequence modeler to accurately capture the user's normal operation mode. A learning rate decay strategy is introduced during training, and the model is continuously iterated until it converges, thereby ensuring that the model has strong generalization ability while maintaining stability.

[0087] Step 3: Based on the hidden states output by the trained sequence model, construct an overstepping behavior detector to detect overstepping of authority in real-time operations. The constructed overstepping behavior detector is a binary classifier based on the hidden states. The specific construction steps are as follows:

[0088] Step 3.1: Extract the hidden states of each time step from the output of the Mamba sequence modeler. The input is fed into a binary classification neural network detector, and the output is the overweight probability. :

[0089]

[0090] in, For the Sigmoid function, For temperature coefficient, These are learnable parameters.

[0091] Step 3.2: Train using labeled data on unauthorized behavior, labeling unauthorized samples. The loss function of the unauthorized behavior detector is the binary cross-entropy:

[0092]

[0093] in, This represents the loss function for the classification task.

[0094] Step 3.3: During training, supervised training is performed using a manually labeled dataset of unauthorized behaviors to minimize [the impact of unauthorized behavior]. During the inference phase, the detector outputs the over-weighting probability based on the hidden state input in real time.

[0095] This allows for the assessment of unauthorized actions in real-time operations.

[0096] Step 4: Combining Role-Based Access Control (RBAC) policies with user role permissions and context information, provide permission adaptation and dynamic authorization suggestions for identified unauthorized behaviors, specifically including:

[0097] Step 4.1, for the current user The character set is obtained through the character mapping function. :

[0098]

[0099] This step queries the current user's set of roles based on the RBAC strategy.

[0100] Step 4.2, based on the character set Permission set of the target resource currently being accessed Perform matching while considering contextual validity. Determine operation permissions and calculate:

[0101]

[0102] in, This is a permission matching function. For contextual validity checks, the system determines whether role permissions match and whether the current environment is secure; this step matches the set of role permissions bound to the target resource. It also considers contextual information to determine if the access conditions are met.

[0103] Step 4.3: When the unauthorized behavior detector determines that the operation is unauthorized and the permission adaptation result is denied, a dynamic authorization suggestion is triggered to further evaluate whether temporary authorization should be allowed.

[0104]

[0105] in, This is the threshold for the probability of exceeding the weight limit. This is a context matching function used to determine whether dynamic authorization conditions are met. It suggests a temporary authorization. This indicates a refusal of temporary authorization. This step generates a recommendation on whether to allow temporary authorization based on contextual credibility and the degree of behavioral abnormality, for administrator decision-making or adoption by the automated policy engine.

[0106] Step 5: Deploy the trained Mamba sequence modeler and privilege escalation detector on edge nodes or in the cloud to achieve real-time privilege escalation detection and dynamic permission adjustment for user operations. Model deployment methods include:

[0107] The trained Mamba sequence modeler and the unauthorized behavior detector are jointly deployed to the cloud or edge node. In actual operation, operation log data is received in real time and processed in streaming according to the process of steps 1-4. The system returns the probability of unauthorized behavior risk, permission judgment and dynamic authorization suggestions, so as to realize a low-latency and high-precision online unauthorized behavior detection and response system.

[0108] This implementation method can be flexibly applied to scenarios such as enterprise information systems, industrial control systems, and public data platforms. It can achieve efficient modeling of complex user behaviors and accurate identification of abnormal behaviors, and has good versatility and engineering feasibility.

[0109] like Figure 2 As shown, this embodiment also provides an unauthorized access detection system that integrates state-space sequence modeling and permission policies. The system includes a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized access detector, an RBAC policy module, and a dynamic authorization evaluation module.

[0110] The data acquisition and preprocessing module is used to collect and preprocess user access log data, group the log data by user, arrange them according to time order to construct a user operation sequence, perform multi-dimensional vector encoding on each operation in the user operation sequence, and combine operation type embedding, resource identifier embedding and time difference encoding to generate the final operation vector sequence.

[0111] The Mamba sequence modeler, composed of multiple layers of residual connections in MambaBlock, has the ability to capture long-term behavioral dependencies and state evolution. It is used to train the final operation vector sequence generated by the data acquisition and preprocessing module. After training, the Mamba sequence modeler maps the user behavior sequence to hidden states at the time step level, providing a high-dimensional dynamic representation for subsequent over-weighting judgment.

[0112] The unauthorized behavior detector is a binary classification detector composed of multiple layers of feedforward neural networks. It takes the hidden state output by the Mamba sequence modeler at each time step as input and outputs the probability value of whether the current operation is normal or unauthorized. In actual deployment, when the unauthorized probability exceeds a set threshold, it is judged as a potential unauthorized operation.

[0113] The RBAC (Role-Based Access Control) policy module is responsible for querying the current user's role set and matching it with the role permission set bound to the target resource when the unauthorized behavior detector determines that an unauthorized operation has been performed. It also combines context information to determine whether the access conditions are met.

[0114] The dynamic authorization evaluation module is used when the unauthorized behavior detector determines that an operation is unauthorized and the permission adaptation result of the RBAC policy module is denied. The module will then enter the dynamic authorization evaluation stage, and generate a suggestion on whether to allow temporary authorization based on the context credibility and the degree of behavior abnormality, for the administrator to make a decision or for the automated policy engine to adopt.

[0115] This implementation method can be flexibly applied to scenarios such as enterprise information systems, industrial control systems, and public data platforms. It can achieve efficient modeling of complex user behaviors and accurate identification of abnormal behaviors, and has good versatility and engineering feasibility.

[0116] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting unauthorized access by integrating state-space sequence modeling and permission policies, characterized in that, Includes the following steps: Step 1: Collect and preprocess user access log data. Extract user identifier, operation type, resource identifier, access time, and context information from the system access records to construct a user operation sequence. Perform multi-dimensional vector encoding on each operation in the user operation sequence. Combine operation type embedding, resource identifier embedding, and time difference encoding to generate an operation vector sequence. Step 2: Use the Mamba sequence modeler based on the state space model to train the encoded operation vector sequence, and learn the temporal features of user behavior and normal operation mode in a self-supervised manner. Step 3: Based on the hidden state output by the trained Mamba sequence modeler, construct an unauthorized behavior detector to realize unauthorized judgment of real-time operations; Step 4: Combining role-based access control policies with user role permissions and context information, provide permission adaptation and dynamic authorization suggestions for identified unauthorized behaviors, specifically including: Step 4.1, for the current user The character set is obtained through the character mapping function. : ； Step 4.2, based on the character set With the currently accessed resource permission set Perform matching while considering contextual validity. Determine operation permissions and calculate: ； in, This is a permission matching function. For contextual validity checks, determine whether the role permissions match and whether the current environment is secure. Step 4.3: When the unauthorized behavior detector determines that the operation is unauthorized and the permission adaptation result is denied, a dynamic authorization suggestion is triggered to further evaluate whether temporary authorization should be allowed. ； in, For the probability of exceeding the weight limit, This is the threshold for the probability of exceeding the weight limit. This is a context matching function used to determine whether dynamic authorization conditions are met. It suggests a temporary authorization. This indicates a refusal of the provisional authorization; Step 5: Deploy the trained Mamba sequence modeler and privilege escalation detector on edge nodes or in the cloud to achieve real-time privilege escalation detection and dynamic permission adjustment for user operations.

2. The unauthorized access detection method integrating state-space sequence modeling and permission policy as described in claim 1, characterized in that, Step 1, generating the operation vector sequence, specifically includes the following steps: Step 1.1: Determine the operation type Using embedded functions Mapped to dense vectors ,in, A dense vector representing the operation type at the current time step. The vector dimension is The real number space; Step 1.2: Identify the resource Using embedded functions Vectorization ,in, This represents a dense vector of resources accessed at the current time step. The vector dimension is The real number space; Step 1.3: Calculate the time difference between the current operation and the previous operation. ,in, Indicates the current operation timestamp. This represents the timestamp of the previous operation, and logarithmic positional encoding is used to positionally encode the time difference, as follows: ； Obtain the time difference vector , ,in, The frequency scaling factor is denoted by log(·), which represents the natural logarithm function. Step 1.4: Summing the above three vectors yields the final operation vector, represented as follows: ； in, This represents the final operation vector sequence.

3. The unauthorized access detection method based on the fusion of state-space sequence modeling and permission policy as described in claim 2, characterized in that, The Mamba sequence modeler in step 2 consists of multiple layers of residual connections in the MambaBlock, with each layer updating the hidden state based on the state space: ； in, Indicates the index of the network layer. This represents the number of layers in the network, with the initial input being... ; The training method includes the following steps: Step 2.1: Each MambaBlock dynamically models the input sequence based on the state space parameters (A, B, C, D): ； Where A is the state matrix, representing the transition relationship between the hidden state in the previous time step and the current state; B is the input matrix, representing the influence of the input on the state; C is the output matrix, defining how the state maps to the actual output; and D is the pass-through matrix, representing the direct mapping relationship between the input and the output. Represents the state vector. This represents the state vector at the previous moment. For the input vector, For output; Step 2.2: Employ a self-supervised learning strategy to train the Mamba sequence modeler by predicting the task of the next operation, with the optimization objective being the cross-entropy loss function. ； in, This represents the loss function during the pre-training phase. Indicates that in a given hidden state Predict the next operation The logarithmic probability, This represents the hidden state at time t. This represents the actual next operation in the sequence, where T represents the total length of the sequence and t represents the time step index. Step 2.3: Using real operation sequences from the training samples, gradually minimize the loss function. Use the Adam optimizer to optimize the parameters of the Mamba sequence modeler to accurately capture the user's normal operation pattern. Introduce a learning rate decay strategy during training and continue iterating until the model converges.

4. The unauthorized access detection method based on the fusion of state-space sequence modeling and permission policy as described in claim 2, characterized in that, The overstepping behavior detector constructed in step 3 is a binary classifier based on hidden states. The specific construction steps are as follows: Step 3.1: Extract the hidden states of each time step from the output of the Mamba sequence modeler. The input is fed into a binary classification neural network detector, and the output is the overweight probability. : ； in, For the Sigmoid function, For temperature coefficient, These are learnable parameters; Step 3.2: Train using labeled data on unauthorized behavior, labeling unauthorized samples. The loss function of the unauthorized behavior detector is the binary cross-entropy: ； in, The loss function represents the classification task; Step 3.3: During training, supervised training is performed using a manually labeled dataset of unauthorized behaviors to minimize [the impact of unauthorized behavior]. .

5. The unauthorized access detection method integrating state-space sequence modeling and permission policy as described in claim 1, characterized in that, The deployment methods in step 5 include: The trained Mamba sequence modeler and the unauthorized behavior detector are jointly deployed to the cloud or edge node. The operation log data is received in real time and processed in streaming according to the process of steps 1 to 4, and the unauthorized risk probability, permission judgment and dynamic authorization suggestions are returned.

6. An unauthorized access detection system integrating state-space sequence modeling and permission policies, used to implement the unauthorized access detection method integrating state-space sequence modeling and permission policies as described in any one of claims 1 to 5, characterized in that, It includes a data acquisition and preprocessing module, a Mamba sequence modeler, an unauthorized behavior detector, an RBAC policy module, and a dynamic authorization evaluation module; The data acquisition and preprocessing module is used to collect and preprocess user access log data to generate operation vector sequences. The Mamba sequence modeler is used to train the sequence of operation vectors generated by the data acquisition and preprocessing module. After training, the Mamba sequence modeler maps the user behavior sequence to hidden states at the time step level. An overstepping behavior detector is used to take the hidden state output by the Mamba sequence modeler at each time step as input and output the probability value of whether the current operation is normal or overstepping. The RBAC policy module is responsible for querying the current user's role set and matching it with the role permission set bound to the target resource when the unauthorized behavior detector determines that an unauthorized operation has been performed. It also combines context information to determine whether the access conditions are met. The dynamic authorization evaluation module is used when the unauthorized behavior detector determines an operation is unauthorized and the RBAC policy module's permission adaptation result is "deny". It then initiates a dynamic authorization evaluation, generating a recommendation on whether to allow temporary authorization based on contextual credibility and the degree of behavioral abnormality. This recommendation is provided for administrator decision-making or adoption by the automated policy engine. The dynamic authorization evaluation specifically includes: For the current user The character set is obtained through the character mapping function. : ； Based on the character set With the currently accessed resource permission set Perform matching while considering contextual validity. Determine operation permissions and calculate: ； in, This is a permission matching function. For contextual validity checks, determine whether the role permissions match and whether the current environment is secure. When the unauthorized behavior detector determines that an operation is unauthorized and the permission adaptation result is denied, a dynamic authorization suggestion is triggered to further evaluate whether temporary authorization should be allowed: ； in, For the probability of exceeding the weight limit, This is the threshold for the probability of exceeding the weight limit. This is a context matching function used to determine whether dynamic authorization conditions are met. It suggests a temporary authorization. This indicates a refusal of the provisional authorization.

Images