Access control method and system based on abnormal behavior detection

Abstract

The invention provides an access control method and system based on abnormal behavior detection, and the method comprises the steps: obtaining an access operation log, and analyzing the log information of the access operation log; encoding each piece of data in the log information to obtain an encoding vector corresponding to each piece of data, combining a plurality of encoding vectors to obtain a first input vector, and inputting the first input vector into a time sequence encoder to obtain a time sequence feature representation vector; constructing a first log set based on the current access operation logs, and constructing a heterogeneous graph based on the access operation logs in the first log set; inputting the heterogeneous graph into a structure encoder to obtain an embedded representation of each node in the heterogeneous graph, and constructing a structure feature vector based on the embedded representations of the access subject, the access operation and the accessed object of the current access operation log; and judging whether the access operation log corresponds to an abnormal behavior or not based on the time sequence feature representation vector and the construction structure feature vector.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, and particularly relates to an access control method and system based on abnormal behavior detection. BACKGROUND

[0002] Attribute-Based Access Control (ABAC) is a flexible and fine-grained access control model that determines whether to grant access permissions by dynamically evaluating the combination of multi-dimensional attributes such as users, resources, and environments. Compared with traditional Role-Based Access Control (RBAC) or Identity-Based Access Control (IBAC), ABAC is more suitable for complex and dynamic distributed system requirements and is widely used in cloud computing, Internet of Things, medical data sharing, and other scenarios.

[0003] Existing access control policy optimization techniques mostly rely on static rule analysis or log feature statistics, which can discover rule conflicts and redundancies, but cannot identify abnormal operations in dynamic access behaviors, nor can they discover structural privilege escalation paths at the attribute combination level. Therefore, existing technologies lack deep modeling and feedback mechanisms for actual user access behaviors, and policy adjustments rely on manual intervention, which cannot form a self-adaptive closed loop. SUMMARY

[0004] In view of this, the embodiments of the present application provide an access control method and system based on abnormal behavior detection to eliminate or improve one or more defects in the prior art.

[0005] One aspect of the present application provides an access control method based on abnormal behavior detection, the method comprising:

[0006] obtaining an access operation log, parsing log information of the access operation log, the log information comprising an attribute set of an access subject, an access operation, and an attribute set of an accessed object;

[0007] encoding each piece of data in the log information to obtain an encoding vector corresponding to each piece of data, combining a plurality of encoding vectors to obtain a first input vector, inputting the first input vector into a temporal encoder to obtain a temporal feature representation vector;

[0008] constructing a first log set based on the current access operation log, and constructing a heterogeneous graph based on the access operation log in the first log set;

[0009] inputting the heterogeneous graph into a structural encoder to obtain an embedding representation of each node in the heterogeneous graph, and constructing a structural feature vector based on the embedding representations of the access subject, the access operation, and the accessed object of the current access operation log;

[0010] Determine whether the access operation log corresponds to abnormal behavior based on the time sequence feature representation vector and the structure feature vector.

[0011] With the above scheme, the application designs an access anomaly detection mechanism combining behavior sequence modeling and structure path modeling, uses a time sequence encoder to extract user behavior context features, models the structural relationship between attributes-operations-resources by combining a graph neural network, and determines whether the access is abnormal by an unsupervised detection model after fusing the features, without manual annotation, to identify complex access anomalies such as structural overreach or behavior mutation, and in the construction process of a heterogeneous graph, both subjects and corresponding operations in the log information are used as nodes, which can more fully express the operation process and more accurately determine abnormal operations.

[0012] In some embodiments of the application, in the steps of obtaining access operation logs and parsing log information of the access operation logs, the log information of each received access operation log is parsed.

[0013] In some embodiments of the application, the method further comprises the steps of:

[0014] If the access operation log is determined to be an abnormal operation, the current operation strategy is traversed to determine the operation strategy corresponding to the access operation log;

[0015] From the historical records of the access operation logs, all access operation logs corresponding to the operation strategy are obtained and constructed into a second log set;

[0016] All attributes in the access operation log corresponding to the abnormal operation are obtained and constructed into an attribute set, the frequency of each attribute in the second log set is determined, and if the frequency is lower than a preset frequency threshold, the attribute is added to the operation strategy corresponding to the access operation log.

[0017] With the above scheme, the present application further proposes a field-level strategy optimization mechanism, which can automatically extract key attribute fields triggering anomalies from identified abnormal access behaviors, and generate strategy constraint suggestions combined with historical normal behavior data, thereby realizing automatic repair and dynamic adjustment of ABAC access control rules, improving the precision, security and sustainable maintenance capability of the strategy.

[0018] In some embodiments of the application, in the step of encoding each data in the log information to obtain an encoding vector corresponding to each data, each data is encoded by a vectorization encoding method, and the vectorization encoding method includes one-hot, embedding and numerical encoding.

[0019] In some embodiments of the present application, in the step of inputting the first input vector into a temporal encoder to obtain a temporal feature representation vector, the temporal encoder adopts a long short-term memory network.

[0020] In some embodiments of the present application, in the step of constructing the first log set based on the current access operation log, the access operation log of a preset time length before the current access operation log is constructed as the first log set.

[0021] In some embodiments of the present application, in the step of constructing a heterogeneous graph based on the access operation log in the first log set, the access subject, the access operation and the accessed object in each access operation log in the first log set are respectively taken as a node, and edges between the corresponding nodes of the access subject and the access operation and between the access operation and the accessed object are constructed to obtain the heterogeneous graph.

[0022] In some embodiments of the present application, in the step of inputting the heterogeneous graph into a structure encoder to obtain the embedding representation of each node in the heterogeneous graph, the structure encoder adopts a graph neural network, and in the processing process of the graph neural network, the embedding representation of each node is updated at each processing layer, and the embedding representation updated at the last layer is taken as the final output of the embedding representation of each node.

[0023] In some embodiments of the present application, in the step of updating the embedding representation of each node at each processing layer in the processing process of the graph neural network, the following formula is adopted for updating:

[0024]

[0025] wherein, is a neighbor set connected to node v through edges of relation r; is a transformation matrix of relation r; σ is a nonlinear activation function; c v,r is a normalization factor; is the embedding representation of node v at the lth layer, is the embedding representation of node v at the (l-1)th layer, is the embedding representation of node u at the (l-1)th layer, represents a self-connection weight matrix, represents a set of relations.

[0026] The second aspect of the present application also provides an access control system based on abnormal behavior detection, which comprises a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, and the processor being configured to execute the computer instructions stored in the memory, and the system implements the steps implemented by the method as described above.

[0027] The third aspect of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the aforementioned access control method based on abnormal behavior detection.

[0028] Additional advantages, objects, and features of the application will be set forth in part by the description that follows, and will become apparent to those skilled in the art upon examination of the following detailed description and drawings in which illustrating the principles of the application. The objects and other advantages of the present application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0029] Those skilled in the art will understand that the objects and advantages of the application realized by the present application are not limited to the above specifically described, and the above and other objects realized by the present application will be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0030] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application.

[0031] Figure 1 A schematic diagram of an embodiment of the access control method based on abnormal behavior detection of the present application;

[0032] Figure 2 A schematic diagram of another embodiment of the access control method based on abnormal behavior detection of the present application. DETAILED DESCRIPTION

[0033] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in combination with embodiments and drawings. Herein, the schematic embodiments of the present application and the descriptions thereof are used to explain the present application, but not as a limitation of the present application.

[0034] It should also be noted that, in order to avoid the present application being obscured by unnecessary details, only the structures and / or processing steps closely related to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0035] Prior art introduction:

[0036] The prior art 1 belongs to the technical field of network boundary protection system, and comprises a data acquisition module, a real-time distributed data processing module, a characteristic processing module, and an alarm module.

[0037] The prior art 2 mainly comprises the following steps: defining rule conflict and redundancy, defining the conflict of XACML rules before rule discovery; multi-attribute splitting of rules, reducing the granularity of rules to the lowest level; rule conflict and redundancy set discovery based on XACML triple hash, splicing the subject, resource and behavior three rule element strings to form a new triple rule information string, then calculating the hash value of the rule information string, if the hash values of different strings conflict, then this is a conflict or redundancy set; rule conflict and redundancy selective deletion based on the maximum matching number of rules, calculating the performance cost of the rule engine after conflict and redundancy elimination, and then selectively deleting rules; and reversing and compressing the original split rules.

[0038] The prior art 3 comprises five parts: a Web console, an access gateway, a business database, an application server, and a mobile terminal. The Web management console realizes terminal information management and policy management. The access gateway provides user management services, terminal device management services, policy management services, and log management services. The business database stores user information, device information, policy information, application information, and log information. The application server is one or more application servers that provide specific services. The mobile terminal initiates access authentication and application access requests. The prior art 3 can handle more concurrent user logins, increase the number of user-configurable policies, and improve user access to application servers.

[0039] The current widely-deployed attribute-based access control (ABAC) model has certain flexibility and scalability, but still has the following key technical problems in actual operation:

[0040] 1. Access control policy lacks adaptive update mechanism: Existing ABAC policies are usually statically configured by administrators, and it is difficult to adjust them according to abnormal access behaviors during system operation, resulting in a long-term "overly wide configuration" or "incomplete coverage" state, which is easy to be bypassed or abused.

[0041] 2. Disconnection between policy and actual behavior data, missing risk feedback path: Current access control systems lack mechanisms to convert runtime behavior (such as access logs) into policy repair basis, and cannot optimize policies based on user operation trajectories, access frequency, or structural paths. Policy maintenance relies heavily on human experience, which is inefficient and costly.

[0042] 3. Unable to identify complex abnormal behaviors such as structural overreach and behavior sequence mutation: In large organizations, the relationship between roles and permissions is complex, and different attribute combinations can form "hidden overreach paths." Traditional policies only check whether single-point attributes meet rules and cannot identify hidden violations under legal attribute combinations. In addition, attackers may also perform privilege escape through continuous and disguised operation behaviors (such as first probing and then abusing), which are difficult to identify and respond in current control models.

[0043] The present solution can dynamically identify access anomalies without relying on labeled data, automatically discover policy risk points, and generate field-level policy repair suggestions, improving the adaptability, security, and maintainability of access control systems.

[0044] Existing access control policy optimization techniques rely on static rule analysis or log feature statistics, which can detect rule conflicts and redundancies, but cannot identify abnormal operations in dynamic access behaviors or discover structural overreach paths at the attribute combination level. Therefore, existing techniques lack deep modeling and feedback mechanisms for actual user access behavior, and policy adjustments rely on human intervention, making it difficult to form an adaptive closed loop.

[0045] To address this, the present solution models and unsupervised detects access behavior to identify abnormal operations and automatically generate policy optimization suggestions, enabling dynamic policy adjustment and risk control, and addressing the shortcomings of existing techniques in behavior perception and policy evolution.

[0046] As shown in Figure 1 The present application proposes an access control method based on abnormal behavior detection, which includes:

[0047] In the specific implementation process, the method is triggered based on the received access operation log, and whenever an access operation log is received, the processing flow of the method is completed.

[0048] Step S100, access operation log is obtained, and the log information of the access operation log is parsed, the log information includes the attribute set of the access subject, the access operation, and the attribute set of the accessed object;

[0049] In the specific implementation process, the log information further includes context information.

[0050] Step S200, encoding each piece of data in the log information to obtain an encoding vector corresponding to each piece of data, combining a plurality of encoding vectors to obtain a first input vector, inputting the first input vector into a time sequence encoder to obtain a time sequence feature representation vector;

[0051] Step S300, constructing a first log set based on the current access operation log, and constructing a heterogeneous graph based on the access operation log in the first log set;

[0052] Step S400, inputting the heterogeneous graph into a structure encoder to obtain an embedding representation of each node in the heterogeneous graph, and constructing a structure feature vector based on the embedding representations of the access subject, access operation and accessed object of the current access operation log;

[0053] Step S500, determining whether the access operation log corresponds to abnormal behavior based on the time sequence feature representation vector and the constructed structure feature vector.

[0054] In the specific implementation process, the time sequence feature representation vector and the constructed structure feature vector are fused to construct a fusion feature representation through a splicing operation: d f = d h + d g The vector contains both the dynamic context information of the user behavior trajectory and the position relationship of the behavior in the system structure, and has strong abnormal expression ability.

[0055] In the specific implementation process, in the step of determining whether the access operation log corresponds to abnormal behavior based on the time sequence feature representation vector and the constructed structure feature vector, a support vector data description (SVDD) model is used for determination, and the splicing result of the time sequence feature representation vector and the constructed structure feature vector is taken as the input of the support vector data description (SVDD) model.

[0056] In order to realize abnormal identification of access behavior in the absence of abnormal behavior annotation, a typical unsupervised anomaly detection algorithm, support vector data description (SVDD), is introduced. The core idea of SVDD is to fit a minimum enclosing sphere in the feature space, and all embedding vectors of "normal behavior" are contained in the sphere as much as possible. If a sample point deviates far from the boundary of the sphere, it can be considered as an abnormal sample. By learning the fusion vector , it is judged whether the access behavior belongs to the abnormal behavior outside the normal distribution.

[0057] Suppose that the training set consists of n access behaviors, and after multi-modal encoding fusion of LSTM and GNN, each behavior is represented as a vector The goal of SVDD is to find a hypersphere in the feature space that can contain most of the training data as tightly as possible.

[0058] Let the smallest bounding sphere be the sphere whose center is... The radius R∈R is represented by the radius.

[0059] Establish the optimization objective function: And constraints: |h i -c| 2 ≤R 2 +ξ i ,ξ i ≥0, i=1,…,n. Where Let ξ be the fusion representation of the i-th access behavior; R is the radius of the bounding sphere; c is the center of the sphere; ξ i For soft-constraint variables, some samples are allowed to deviate from the sphere but are penalized. This represents the tolerance for outlier samples. The optimization objective of this scheme is to reduce the volume R of the sphere under the control of the penalty term. 2 .

[0060] For any new test behavior r t We obtain its fused vector representation after model encoding. Determine whether it has crossed the boundary based on the square of its Euclidean distance from the center of the ball:

[0061]

[0062] Where ∈>0 is a tiny positive value used to control the "tightness" of the boundary. If this condition is met, it means that the access behavior exceeds the boundary of normal behavior → judged as abnormal; otherwise, it is considered to be within the "normal access distribution range" → judged as normal.

[0063] In addition, its "abnormal score" can also be output:

[0064]

[0065] s t >0: The higher the score, the more likely it is to be an anomaly; t <0: Inside the sphere, the closer to the center, the safer it is.

[0066] By adopting the scheme, the application designs an access anomaly detection mechanism combining behavior sequence modeling and structure path modeling, adopts a time sequence encoder to extract user behavior context features, combines a graph neural network to model the structure relationship among attributes-operation-resources, and determines whether the access is abnormal through an unsupervised detection model after fusion, so as to identify complex access anomalies such as structural overreach or behavior mutation without manual annotation, and in the construction process of a heterogeneous graph, two subjects in log information and corresponding operations are all taken as nodes, so that the operation process can be more fully expressed, and the abnormal operation can be more accurately determined.

[0067] In some embodiments of the application, in the step of obtaining the access operation log and parsing the log information of the access operation log, the log information of the access operation log is parsed every time an access operation log is received.

[0068] As shown in Figure 2 In some embodiments of the application, the method further comprises the steps of:

[0069] In step S600, if the access operation log is determined to be an abnormal operation, the operation strategy corresponding to the access operation log is determined by traversing the current operation strategy.

[0070] In step S700, all access operation logs corresponding to the operation strategy are obtained from the history record of the access operation log and constructed as a second log set.

[0071] In step S800, all attributes in the access operation log corresponding to the abnormal operation are obtained and constructed as an attribute set, and the frequency of each attribute in the second log set is determined, if the frequency is lower than a preset frequency threshold, the attribute is added to the operation strategy corresponding to the access operation log.

[0072] Specifically, the access strategy set of the prior art is usually manually written, and it is difficult to completely cover boundary anomalies or misuse access paths. The present scheme also proposes an optimization method for structurally analyzing the access behavior set marked as abnormal by the detection module, and automatically generating optimization suggestions for strategy rules based on the characteristics of abnormal behaviors.

[0073] Let the set of abnormal access behaviors detected in the system be The current ABAC strategy set of the system is The normal behavior log set is

[0074] The access control strategy adjustment optimization mainly includes four steps:

[0075] For each abnormal behavior Traverse all existing strategies The strategy to identify all "hit" cases and allow access to the exception.

[0076] For each abnormal behavior r k Extract its collection of all attribute fields:

[0077] f∈fields(r k ) = A k ∪B k ∪c k

[0078] For each field f, obtain the historical distribution of its corresponding attribute field in normal access (the frequency of f's occurrence in all accesses of p; low frequencies are added to the strategy):

[0079]

[0080] If the field value r in the abnormal behavior k If [f] deviates significantly from this distribution, it is judged as a "high-risk field":

[0081]

[0082] For each exception field Based on its set of normal values Generate new suggested constraints c f ,For example:

[0083] If the field is an enumeration type, such as time∈{day,night}, then it is recommended If the field is a level type, such as sensitivity∈low,medium,high, then it is recommended that:

[0084] Then, all suggested constraints are combined into a policy fix patch set.

[0085] Finally, regarding the strategy that triggered the exception... Construct its repair version p i 'Add field constraints based on the original conditions' Finally, return to the collection of repair suggestions.

[0086] Specifically, the processing logic is as follows:

[0087]

[0088] Based on the above approach, this solution further proposes a field-level policy optimization mechanism that can automatically extract key attribute fields that trigger anomalies from access behaviors identified as abnormal, and generate policy constraint suggestions by combining them with historical normal behavior data. This enables automatic repair and dynamic adjustment of ABAC access control rules, thereby improving the accuracy, security, and sustainable maintenance capabilities of the policy.

[0089] In practical implementation, Attribute-Based Access Control (ABAC) is an access control model that uses attributes as the core decision-making basis. This model makes access decisions based on the access subject attribute, resource object attribute, action type, and context involved in the access request.

[0090] In some embodiments of the present invention, in the step of encoding each piece of data in the log information to obtain the encoding vector of each piece of data, a vectorized encoding method is used to encode each piece of data, including one-hot encoding, embedding, and numerical encoding.

[0091] In some embodiments of the present invention, in the step of inputting the first input vector into a timing encoder to obtain a timing feature representation vector, the timing encoder employs a long short-term memory network.

[0092] In practical implementation, Long Short-Term Memory (LSTM) networks are a type of improved recurrent neural network (RNN) specifically designed for processing and predicting time-sequential data. LSTMs can retain important states over a longer timeframe during information transmission, effectively modeling contextual dependencies in behavioral sequences. In access control scenarios, LSTMs can be used to capture temporal patterns in user access behavior, determine whether a particular access exhibits abnormal changes in its behavioral trajectory, and identify complex behavioral patterns such as "abnormal operation sequence" or "sudden privilege escalation."

[0093] In practice, each access operation log can be formalized as a quadruple: r t =(A t ,a t B t ,c t ), where A t ,a t B t ,c t These represent the attribute set of the accessing subject, the access operation, the attribute set of the accessed object, and the context information, respectively.

[0094] This solution takes a single user or session as a unit and arranges its multiple access logs in ascending order of time to form an access behavior sequence:

[0095]

[0096] To use it as input to the LSTM, each access is embedded into a vector x. t ∈R d :

[0097] x t =Embed(A t )|Embed(a t )|Embed(B t )|Embed(c t )

[0098] Where Embed(·) represents the vectorization encoding method of the corresponding field (such as one-hot, embedding, or numerical encoding), "|" represents vector concatenation, and d is the total feature dimension for each access, which depends on the selected field and encoding method:

[0099] The final input sequence (i.e., the first input vector) is obtained: X = [x1, x2, ..., x T ]∈R T×d This sequence serves as the input to the time-series model LSTM, capturing the contextual information of behavioral trajectories.

[0100] To capture the temporal sequence and contextual information of users or sessions during access, this scheme uses a Long Short-Term Memory (LSTM) network to process the access sequence X = [x1, x2, ..., x...]. T Modeling is performed. The input to the LSTM is the access vector x at each time step. t ∈R d The output is the hidden state vector at each time step. This represents the sequential features of the current action within a temporal context. The model is expressed as follows:

[0101]

[0102] in: It is the output feature representation at step t; c t These are the memory cell states of the LSTM; d h It is the output dimension of LSTM.

[0103] After the sequence is completed, sequence average pooling can be used. As a temporal feature representation of the current behavior or sequence.

[0104] In some embodiments of the present invention, in the step of constructing a first log set based on the current access operation log, the access operation logs of a preset time length before the current access operation log are constructed as the first log set.

[0105] In some embodiments of the present invention, in the step of constructing a heterogeneous graph based on the access operation logs in the first log set, the access subject, access operation and accessed object in each access operation log in the first log set are respectively regarded as a node, and the edges between the access subject and the access operation and between the corresponding nodes of the access operation and the accessed object are constructed to obtain the heterogeneous graph.

[0106] In the specific implementation process, in order to model the attribute-operation-resource relationship in the access behavior, all access operations are constructed as a heterogeneous graph. Used for structural pattern modeling.

[0107] The nodes include two types: attribute value nodes: all subject and object attribute values ​​that appear in the access log, and operation nodes: all operation types.

[0108] Edges also include two types: for each visit r t =(A t ,a t B t Extract all field values ​​from the attribute set and establish the following two types of edges: edges from the main attribute values. To operation node a t : From operation node a t To object attribute value The final structure consists of a three-hop path:

[0109] In some embodiments of the present invention, in the step of inputting the heterogeneous graph into a structural encoder to obtain the embedded representation of each node in the heterogeneous graph, the structural encoder employs a graph neural network. During the processing of the graph neural network, each processing layer updates the embedded representation of each node, and the last layer's updated embedded representation is used as the final output embedded representation of each node.

[0110] In practical implementation, Graph Neural Networks (GNNs) are a type of deep learning model specifically designed for processing graph-structured data. They can learn representations of nodes or subgraphs through information transfer and aggregation between adjacent nodes. In access control, user attributes, resource attributes, and operation types naturally form an "access path" graph structure. GNNs can be used to model these attribute combinations, identify unauthorized access paths (such as illegal attribute-operation-resource triples), and detect and evaluate abnormal access patterns.

[0111] This approach extracts features from access behavior along both temporal and structural dimensions to capture potential multi-class anomalies. To this end, it introduces two deep encoders: LSTM (Long Short-Term Memory) and GNN (Graph Neural Network). These model access behavior from different perspectives, extracting sequence patterns and structural path patterns, thus providing rich feature representations for multimodal fusion.

[0112] By adopting the above scheme, the subject attributes, operation types, object attributes and context information in the access log are structured and modeled. Behavioral features are extracted using time series models and graph models. Unsupervised algorithms are used to identify abnormal access operations. Furthermore, the key attribute fields that trigger anomalies are analyzed to generate constraint optimization suggestions for access strategies, thereby achieving dynamic adjustment of strategies and automatic convergence of access risks.

[0113] In some embodiments of the present invention, during the processing of the graph neural network, in the step where each processing layer updates the embedding representation of each node, the following formula is used for updating:

[0114]

[0115] in, Let r be the set of neighbors connected to node v through the edge of relation r; Let be the transformation matrix of relation r; σ be the nonlinear activation function; c v,r Normalization factor; Let v be the embedding representation of node v at layer l. Let v be the embedding representation of node v at layer l-1. Let u be the embedding representation of node u in the (l-1)th layer. This represents the self-connection weight matrix. A set representing relations.

[0116] After multi-layer propagation, the node embedding contains structural semantics between attribute combinations, operations, and objects.

[0117] For a specific action r t =(A t ,a t B t This scheme extracts node embeddings from the GNN output: The structural representation of the behavior path is obtained by concatenation:

[0118] Ultimately, each access operation r t Both can be represented by two independent representations: Used to represent the contextual semantics of the current behavior within the behavior trajectory; These are used to represent the structural position of the current behavior in the attribute combination graph. They will be combined in the next feature fusion stage for anomaly detection.

[0119] This solution addresses the problem that current ABAC access control systems have static policy rule configurations that cannot be dynamically adjusted based on user behavior. It proposes a method to construct an access behavior model and introduce an anomaly detection mechanism to identify deviations during access, thereby enabling policies to automatically repair and dynamically optimize based on actual access risks, thus improving the adaptive capability of the access control system.

[0120] To address the problem that traditional access control methods cannot identify unauthorized access paths or abnormal behavior sequences, this paper uses LSTM to model the access behavior context sequence and combines it with graph neural networks to model the attribute combination structure. This effectively identifies high-risk behaviors and unauthorized access paths hidden under legitimate attribute combinations, enhancing the system's ability to perceive complex abnormal behaviors.

[0121] To address the current situation where rule updates rely on manual configuration, have high maintenance costs, and are slow to adjust, a field-level attribution analysis is performed after anomaly detection, and automated policy constraint suggestions are generated based on historical data. This achieves the effect of partially or fully automating the policy update process, reducing the reliance on human intervention for policy maintenance and improving policy convergence efficiency.

[0122] In summary, this solution constructs user behavior sequences and access attribute graphs by structurally modeling the access subject attributes, operation types, resource attributes, and contextual information contained in access logs, extracting feature patterns of access behavior from both temporal and structural dimensions. It utilizes a temporal modeling model (LSTM) to identify abnormal evolution of access behavior within its context, and combines this with a graph neural network (GNN) to identify potential structural overreach paths in attribute combinations, achieving efficient detection of abnormal access operations. For access behaviors identified as abnormal, this invention further performs field-level risk analysis to identify the source fields of the anomalies and generates refined policy constraint suggestions based on the distribution of normal behavior data, thereby achieving automatic repair and dynamic optimization of the original access strategy.

[0123] This invention also provides an access control system based on abnormal behavior detection. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0124] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned access control method based on abnormal behavior detection. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0125] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0126] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0127] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0128] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An access control method based on abnormal behavior detection, characterized in that, The method includes: Obtain access operation logs and parse the log information of the access operation logs, wherein the log information includes the attribute set of the access subject, the access operation, and the attribute set of the accessed object; Each piece of data in the log information is encoded to obtain an encoding vector for each piece of data. Multiple encoding vectors are combined to obtain a first input vector. The first input vector is then input into a time encoder to obtain a time-series feature representation vector. Construct a first log set based on the current access operation logs, and construct a heterogeneous graph based on the access operation logs in the first log set; The heterogeneous graph is input into the structural encoder to obtain the embedding representation of each node in the heterogeneous graph. The structural feature vector is constructed based on the embedding representation of the access subject, access operation and accessed object in the current access operation log. Based on the time-series feature representation vector and the constructed structural feature vector, it is determined whether the access operation log corresponds to abnormal behavior.

2. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of obtaining access operation logs and parsing the log information of the access operation logs, the log information of the access operation logs is parsed each time an access operation log is received.

3. The access control method based on abnormal behavior detection according to claim 1 or 2, characterized in that, The method further includes the following steps: If the access operation log is determined to be an abnormal operation, iterate through the current operation policies to determine the operation policy corresponding to the access operation log. From the historical records of the access operation logs, obtain all access operation logs corresponding to this operation strategy and construct a second log set; Obtain all attributes from the access operation log of the corresponding abnormal operation, construct an attribute set, determine the frequency of each attribute in the second log set, and if the frequency is lower than the preset frequency threshold, add the attribute to the operation strategy corresponding to the access operation log.

4. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of encoding each piece of data in the log information to obtain the corresponding encoding vector, a vectorized encoding method is used to encode each piece of data. The vectorized encoding method includes one-hot encoding, embedding, and numerical encoding.

5. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of inputting the first input vector into the time encoder to obtain the time feature representation vector, the time encoder employs a long short-term memory network.

6. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of constructing the first log set based on the current access operation log, the access operation logs of a preset time length before the current access operation log are constructed into the first log set.

7. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of constructing a heterogeneous graph based on the access operation logs in the first log set, the access subject, access operation and accessed object in each access operation log in the first log set are respectively regarded as a node, and the edges between the access subject and the access operation and between the corresponding nodes of the access operation and the accessed object are constructed to obtain the heterogeneous graph.

8. The access control method based on abnormal behavior detection according to claim 1, characterized in that, In the step of inputting the heterogeneous graph into the structural encoder to obtain the embedding representation of each node in the heterogeneous graph, the structural encoder adopts a graph neural network. During the processing of the graph neural network, each processing layer updates the embedding representation of each node, and the embedding representation updated by the last layer is used as the final output embedding representation of each node.

9. The access control method based on abnormal behavior detection according to claim 8, characterized in that, In the processing of the graph neural network, the step of updating the embedding representation of each node in each processing layer is performed using the following formula: in, Let r be the set of neighbors connected to node v through the edge of relation r; Let be the transformation matrix of relation r; σ be the nonlinear activation function; c v,r Normalization factor; Let v be the embedding representation of node v at layer l. Let v be the embedding representation of node v at layer l-1. Let u be the embedding representation of node u in the (l-1)th layer. This represents the self-connection weight matrix. A set representing relations.

10. An access control system based on abnormal behavior detection, characterized in that, The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method as described in any one of claims 1 to 9.

Images