Host network access control security protection system based on flexible gray measurement

Abstract

The invention discloses a host network access control security protection system based on flexible gray calculation, which relates to the technical field of network access security and comprises a user access resource matching degree analysis module, a user security degree analysis module, a comprehensive risk assessment and decision module and a verification-free judgment module. According to the host network access control security protection system based on flexible gray scale measurement and calculation, a verification-free judgment module is arranged, so that when a user needs to be verified, the user access request data can be verified according to the behavior baseline conformity of all user access request data corresponding to the user in the current access process; and analyzing and generating a verification-free reputation score according to the user identity verification success effective frequency and the user identity verification success effective frequency of which the similarity with the current user access request data is greater than a set similarity threshold value in the user historical data, and executing a verification-free operation at a random probability when the verification-free reputation score is greater than a verification-free threshold value. The verification frequency of the user is greatly reduced while the security is ensured, and the access experience of the user is improved.

Description

Technical Field

[0001] This invention relates to the field of network access security technology, specifically to a host network access control security protection system based on flexible grayscale calculation. Background Technology

[0002] Flexible gray-scale assessment refers to a dynamic, adaptive security decision-making model based on multi-dimensional risk quantitative assessment. By introducing flexible gray-scale assessment, it avoids the control policies in traditional host network access security that rely on blacklists and whitelists to determine access permissions. For example, prior art with publication number CN118656870A discloses a method and system for managing secure access to sensitive enterprise data. The method includes: multi-dimensional analysis and dynamic assessment of enterprise data to obtain categorized data with sensitivity indices; correlation analysis to obtain an adaptive access control matrix; comprehensive recording and pattern analysis to obtain data access audit logs; security domain partitioning and collaboration policy configuration to obtain virtual collaboration spaces and data sharing rules; differentiated encryption processing and key generation to obtain encrypted data and decryption permission policies; integrated analysis to obtain dynamic defense strategies and real-time response schemes; and updating the adaptive access control matrix according to the dynamic defense strategies to obtain the target access control matrix. This prior art achieves self-optimization of security policies, enabling continuous adaptation to changing security environments and business needs.

[0003] However, in actual operation, some security systems that use this flexible grayscale calculation will perform secondary or enhanced verification on users whose risk level is not high enough to restrict or block access, but whose risk level is higher than that of the normal unrestricted situation. Only after the verification is passed will the user's access request be granted. Although this improves security, the verification windows that pop up from time to time also greatly reduce the user experience. Summary of the Invention

[0004] The purpose of this invention is to provide a host network access control security protection system based on flexible grayscale calculation, so as to solve the above-mentioned shortcomings in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a host network access control security protection system based on flexible grayscale calculation, comprising the following modules:

[0006] The user access resource matching degree analysis module is used to perform similarity analysis between user type data and user access request data based on user type data, user access request data, and resource user vector coordinate data set, and generate user access resource matching degree data; the user access request data contains the host resource information that the user wants to access;

[0007] The user security analysis module is used to calculate the security level of a user's current access based on user access context data, user access request data, user behavior baseline, and user security assessment parameter set, and to generate user security data.

[0008] The comprehensive risk assessment and decision-making module is used to perform weighted calculation processing based on the user access resource matching degree data and user security degree data to generate comprehensive security data, and to perform threshold judgment based on the comprehensive security data and the set decision scheme to obtain decision data. The decision scheme includes allowing access, verifying user identity, restricting access, and blocking access.

[0009] The verification-free judgment module is used to generate a verification-free reputation score when the decision data is to verify the user's identity. It is based on the behavioral baseline conformity of all user access request data corresponding to the user in the current access process (one access process is defined as the user's access process from the start of the user's connection to the host network to the end of the user's disconnection from the host network) and the number of valid user identity verifications passed in the user's historical data that have a similarity greater than a set similarity threshold. The module then determines whether the verification-free reputation score is greater than the verification-free threshold. If so, the verification-free operation is performed with a random probability.

[0010] Furthermore, the system also includes the following modules:

[0011] The user basic information module is used to store user basic data and corresponding user type data, and to obtain user access request information and generate user access request data. The host resource information refers to the identification code or ID information corresponding to the host resource, rather than the host resource file itself.

[0012] The user login environment information acquisition module is used to acquire the context environment information when a user applies to access the host network and generate user access context environment data. The context environment data may include integrated terminal agents, network devices, authentication systems, etc., and collect signals such as network environment (enterprise intranet / public network), time, IP geographical reputation, terminal security status (patches, antivirus software), and authentication strength (MFA / password) in real time.

[0013] The host resource relationship module is used to store resource level type resource information data containing resource importance level and resource type, and resource user vector coordinate data set containing the corresponding vector position relationship between resource level type resource data and user type data; specifically, by obtaining host resource information, it can be divided into multiple resource levels according to the set resource importance level, and the host resource information of each resource level can be divided into multiple resource types according to the set resource type to obtain resource level type resource data.

[0014] Furthermore, the user access resource matching degree analysis module generates user access resource matching degree data, including the following steps:

[0015] Based on character matching search, the vector coordinates of the user type data and the user access request data are searched in the resource user vector coordinate data set respectively, and user type vector coordinate data and user access request vector coordinate data are generated.

[0016] Calculate the cosine similarity between the user type vector coordinate data and the user access request vector coordinate data to generate access resource matching data.

[0017] Furthermore, the user security analysis module generates user security data, including the following steps:

[0018] The initial security assessment parameter set is obtained by searching the user security assessment parameter set to find user security assessment parameters that match the user access context environment data. Weighted calculation and normalization are then performed based on the initial security assessment parameter set to generate initial user security data. This can be achieved using a two-pointer search method, ensuring that each dimension of the user access context environment data corresponds to a matching user security assessment parameter. The initial security assessment parameter set includes a base risk value and weight corresponding to different scenarios for each dimension in the context environment data. For example, access time in the early morning: base risk value +20, weight 0.2; access from an overseas IP address: base risk value +50, weight 0.4, etc. Then, the product of the base risk value and weight for each dimension is summed to obtain the initial risk value. After normalization, the initial risk value is subtracted by 1 to obtain the initial user security data, i.e., initial user security data = 1 - normalized risk value.

[0019] Furthermore, this invention employs Min-Max normalization or Z-Score standardization when performing normalization.

[0020] Based on the user access context environment data, user access request data, and user behavior baseline, the deviation of each access behavior in the current user access process from the corresponding user behavior baseline is first calculated, then summed, and finally normalized to generate user behavior anomaly values.

[0021] The initial user security data is adjusted using the value obtained by subtracting the abnormal user behavior value from 1 as a coefficient to generate user security data. Specifically, user security data = (1 - abnormal user behavior value) * initial user security data.

[0022] Furthermore, the comprehensive risk assessment and decision-making module generates comprehensive security data and obtains decision data, including the following steps:

[0023] Set access matching weight and user security weight, where access matching weight + user security weight = 1;

[0024] Based on the access matching degree weight and the user security degree weight, the user access resource matching degree data and the user security degree data are weighted respectively, and then the weighted results are summed to generate comprehensive security data, that is, comprehensive security data = access matching degree weight * user access resource matching data + user security degree weight * user security data;

[0025] Multiple decision schemes are set, and a corresponding security value range is set for each decision scheme. The decision schemes include allowing access, verifying user identity, restricting access, and blocking access. Furthermore, decision schemes can be added or reduced according to actual needs, and the corresponding security value ranges can be adjusted.

[0026] Determine the decision scheme corresponding to the security value range where the comprehensive security data is located, and generate decision data.

[0027] Furthermore, the verification-free judgment module generates a verification-free reputation score, including the following steps:

[0028] Obtain all user access request data and user access context data in the current user access process, and calculate the proportion of user access behavior that conforms to the user behavior baseline based on the user behavior baseline to obtain the behavior baseline conformity.

[0029] Search and count historical records and corresponding times that are identical or have a similarity greater than the set context similarity threshold to the current user access request data, and generate verification passed historical records and time data;

[0030] Based on the verification history and time data, the time elapsed between the verification history and time data and the current time is calculated. The number of verification history and time data is counted to obtain the number of valid user authentication passes. A mechanism is introduced to reduce the number of valid user authentication passes as the time elapses to correct the number of valid user authentication passes. For example, the number of valid user authentication passes C can be calculated using the following formula:

[0031]

[0032] in This represents the historical record and time data of the i-th successful verification, where n is the number of historical records and time data of successful verification. Initially equal to 1, depending on the corresponding The duration increases and then decreases, further... The decrease over time can be step-like, linear, curvilinear, or similar.

[0033] Set the behavioral baseline compliance weight and the pass count weight, respectively, and then weight the logarithm of the behavioral baseline compliance and the valid number of behavioral verification passes. Then sum the weighted results to obtain the verification-free reputation score.

[0034] Furthermore, the verification-free judgment module performs the verification-free operation with a random probability, including the following steps:

[0035] If the verification-free reputation score is greater than the set verification-free threshold, the Sigmoid function is used to smooth the verification reputation score and generate the verification-free probability.

[0036] Generate a uniformly distributed random number R between 0 and 1;

[0037] Determine if the probability of exemption from verification is greater than R;

[0038] If yes, then perform the verification-free operation; otherwise, verify the user's identity according to the decision data.

[0039] Furthermore, this verification-free operation should be recorded to facilitate subsequent auditing.

[0040] Furthermore, the context similarity threshold is dynamically adjusted in the reverse direction as the behavioral baseline conformity increases or decreases.

[0041] One embodiment includes the following steps:

[0042] Set the initial context similarity threshold;

[0043] The context similarity threshold T is dynamically adjusted based on the dynamic adjustment formula for the context similarity threshold:

[0044]

[0045] in, , These represent the maximum and minimum context similarity thresholds, respectively, where k is the decay coefficient and Y is the behavioral baseline conformity.

[0046] 1. Compared with existing technologies, the present invention provides a host network access control security protection system based on flexible gray-scale calculation. By setting up a user access resource matching degree analysis module, a user security degree analysis module, and a comprehensive risk assessment and decision-making module, the system evaluates the static security degree of the matching degree of user access to host resources, the dynamic security degree of whether user behavior conforms to the baseline, and the risk of user network environment, respectively. The comprehensive security degree is then calculated by weighting. This achieves the effect of directly searching for the corresponding feature vector from the resource user vector coordinate data set during static security degree analysis, eliminating the process of data preprocessing, mapping, and feature extraction, reducing the amount of calculation during analysis, and improving the efficiency of analysis.

[0047] 2. Compared with existing technologies, the host network access control security protection system based on flexible grayscale calculation provided by this invention, by setting up an authentication-free judgment module, can generate an authentication-free reputation score when user authentication is required. This is based on the behavioral baseline conformity of all user access request data corresponding to the current user in the current access process, and the number of valid authentication passes for users whose historical data has a similarity to the current user's access request data is greater than a set similarity threshold. When the authentication-free reputation score is greater than the authentication-free threshold, an authentication-free operation is performed with a random probability. This greatly reduces the number of authentications required for users while ensuring security, thus improving the user's access experience. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0049] Figure 1 A system structure block diagram provided for embodiments of the present invention;

[0050] Figure 2 A diagram illustrating the system implementation steps provided in this embodiment of the invention;

[0051] Figure 3 The diagram illustrates the verification-free steps provided in this embodiment of the invention. Detailed Implementation

[0052] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0053] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified. Furthermore, the terms "installed," "connected," and "linked" should be interpreted broadly; for example, they may refer to a fixed connection, a detachable connection, or an integral connection; they may refer to a mechanical connection or an electrical connection; they may refer to a direct connection or an indirect connection through an intermediate medium; and they may refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0054] Exemplary embodiments will be described more fully below with reference to the accompanying drawings; however, these exemplary embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will enable those skilled in the art to fully understand the scope of this disclosure.

[0055] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0056] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0057] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded.

[0058] The embodiments described herein can be described with reference to plan views and / or cross-sectional views using the ideal schematic diagrams of this disclosure. Therefore, the example illustrations can be modified according to manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to those shown in the drawings, but include modifications to configurations formed based on manufacturing processes. Therefore, the areas illustrated in the drawings are schematic in nature, and the shapes of the areas shown in the figures illustrate specific shapes of areas of an element, but are not intended to be limiting.

[0059] Please see Figures 1-3A host network access control security protection system based on flexible grayscale calculation includes the following modules: user basic information module, user login environment information module, host resource relationship module, user access resource matching degree analysis module, user security degree analysis module, comprehensive risk assessment and decision-making module, and verification-free judgment module.

[0060] The user basic information module is used to store basic user data and corresponding user type data, and to obtain user access request information and generate user access request data. Among them, host resource information refers to the identification code or ID information corresponding to the host resource, rather than the host resource file itself; user basic data is basic information that is clearly used for classification, such as department, position, job title, project team, etc.

[0061] The user login environment information acquisition module is used to obtain the context environment information when a user applies to access the host network and generate user access context environment data. The context environment data can include integrated terminal agents, network devices, authentication systems, etc., and collect signals such as network environment (enterprise intranet / public network), time, IP geographical reputation, terminal security status (patches, antivirus software), and authentication strength (MFA / password) in real time.

[0062] The host resource relationship module stores resource level type information data containing resource importance levels and resource types, and a set of resource user vector coordinate data containing the corresponding vector position relationships between resource level type data and user type data. Specifically, by obtaining host resource information, it can be divided into multiple resource levels according to the set resource importance level, such as: public, internal, secret, and top secret, and the host resource information of each resource level can be divided into multiple resource types according to the set resource type, such as: financial database, code repository, personnel file, and ordinary document, to obtain resource level type resource data.

[0063] The resource user vector coordinate data set includes user type vectors and resource level type resource information vectors. The parameters of the mapping function from user type data to user type vector and from resource level type resource information data to resource level type resource information vector can be solved and optimized through machine learning. This makes "similar" users and resources closer in the vector space and "dissimilar" users farther away. This technology is common knowledge under existing technology and is applied directly without modification. Therefore, it will not be described in detail in this technical solution, and it will not cause any problems for the people in this field.

[0064] The user access resource matching analysis module is used to perform similarity analysis between user type data and user access request data based on user type data, user access request data, and resource user vector coordinate data sets, and generate user access resource matching data; the user access request data contains the host resource information that the user wants to access.

[0065] The user security analysis module is used to calculate the security level of a user's current access based on user access context data, user access request data, user behavior baseline, and a set of user security assessment parameters, generating user security data. This includes the following steps:

[0066] a. Based on character matching search, search for the vector coordinates of user type data and user access request data in the resource user vector coordinate data set, and generate user type vector coordinate data and user access request vector coordinate data respectively.

[0067] b. Calculate the cosine similarity between the user type vector coordinate data and the user access request vector coordinate data to generate access resource matching data.

[0068] The comprehensive risk assessment and decision-making module is used to perform weighted calculations based on user access resource matching data and user security data to generate comprehensive security data. Based on this comprehensive security data and established decision-making schemes, threshold judgments are made to obtain decision data. Decision-making schemes include allowing access, verifying user identity, restricting access, and blocking access, including the following steps:

[0069] a. Search the user security assessment parameter set to find user security assessment parameters that match the user's access context data to obtain the initial security assessment parameter set. Perform weighted calculations and normalization based on the initial security assessment parameter set to generate initial user security data. This can be achieved using a two-pointer search method, ensuring that each dimension of the user's access context data corresponds to a matching user security assessment parameter. The initial security assessment parameter set includes the base risk value and weight corresponding to different scenarios in each dimension of the context data. For example, access time in the early morning: base risk value +20, weight 0.2; access from an overseas IP address: base risk value +50, weight 0.4, etc. Then, sum the products of the base risk value and weight for each dimension to obtain the initial risk value. After normalizing the initial risk value, subtract 1 to obtain the initial user security data, i.e., initial user security data = 1 - normalized risk value.

[0070] Furthermore, this invention employs Min-Max normalization or Z-Score standardization when performing normalization.

[0071] b. Based on user access context data, user access request data, and user behavior baseline, the deviation of each access behavior in the current user access process from the corresponding user behavior baseline is first calculated, then summed, and finally normalized to generate user behavior anomaly values; wherein, the user behavior baseline can be constructed by the user's historical user access context data and corresponding historical user access request data.

[0072] c. Use the value obtained by subtracting the abnormal user behavior value from 1 as a coefficient to adjust the initial user security data and generate user security data. Specifically, user security data = (1 - abnormal user behavior value) * initial user security data.

[0073] d. Set the access matching score weight and user security score weight, where access matching score weight + user security score weight = 1;

[0074] e. Based on the access matching degree weight and the user security degree weight, the user access resource matching degree data and the user security degree data are weighted respectively, and then the weighted results are summed to generate comprehensive security data, that is, comprehensive security data = access matching degree weight * user access resource matching data + user security degree weight * user security data.

[0075] f. Set multiple decision schemes and set corresponding security value ranges for each decision scheme. Decision schemes include allowing access, verifying user identity, restricting access, and blocking access. Further, decision schemes can be added or reduced according to actual needs, and the corresponding security value ranges can be adjusted.

[0076] g. Determine the decision scheme corresponding to the safety value range where the comprehensive safety data is located, and generate decision data.

[0077] The verification-free judgment module is used to generate a verification-free reputation score when the decision data is for verifying user identity. This is based on the behavioral baseline conformity of all user access request data corresponding to the user in the current access process (one access process is defined as the user connecting to the host network and disconnecting from the host network). The calculation is weighted by the number of valid user identity verification passes in the user's historical data that have a similarity greater than a set similarity threshold to the current user's access request data. The module then determines whether the verification-free reputation score is greater than the verification-free threshold. If so, a verification-free operation is performed with a random probability, including the following steps:

[0078] a. Obtain all user access request data and user access context data in the user's current access process, and calculate the proportion of user access behavior that conforms to the user behavior baseline based on the user behavior baseline to obtain the behavior baseline conformity.

[0079] b. Search and count historical records and corresponding times that are the same as or have a similarity greater than the set context similarity threshold to the current user access request data, and generate verification passed historical records and time data;

[0080] c. Based on historical verification records and time data, calculate the time elapsed between the current time and the historical verification records. Count the number of historical verification records and time data to obtain the number of valid user authentication passes. Introduce a mechanism to reduce the number of valid user authentication passes as the time elapses to correct for this error. For example, the number of valid user authentication passes C can be calculated using the following formula:

[0081]

[0082] in This represents the historical record and time data of the i-th successful verification, where n is the number of historical records and time data of successful verification. Initially equal to 1, depending on the corresponding The duration increases and then decreases, further... The decrease over time can be step-like, linear, curvilinear, or similar.

[0083] d. Set the behavioral baseline compliance weight and the pass count weight. Weight the behavioral baseline compliance and the logarithm of the valid number of behavioral verification passes respectively. Then sum the weighted results to obtain the verification-free reputation score.

[0084] e. Use the Sigmoid function to smooth the verification reputation score and generate a verification-free probability;

[0085] f. Generate a uniformly distributed random number R between 0 and 1;

[0086] g. Determine if the probability of exemption from verification is greater than R;

[0087] h. If yes, then perform the verification-free operation; otherwise, verify the user's identity according to the decision data.

[0088] Furthermore, this verification-free operation should be recorded to facilitate subsequent auditing.

[0089] In one embodiment, setting a context similarity threshold that is dynamically adjusted inversely as the behavioral baseline conformity increases or decreases includes the following steps:

[0090] a. Set the initial context similarity threshold;

[0091] b. Dynamically adjust the context similarity threshold T based on the context similarity threshold dynamic adjustment formula:

[0092]

[0093] in, , These represent the maximum and minimum context similarity thresholds, respectively, where k is the decay coefficient and Y is the behavioral baseline conformity.

[0094] In one embodiment, the host network access control security protection system based on flexible grayscale calculation provided by the present invention is implemented through the following steps:

[0095] Based on user access context data, user access request data, user behavior baseline, and user security assessment parameter set, the security level of the user's current access is calculated, and user security data is generated.

[0096] Based on user access resource matching data and user security data, a weighted calculation is performed to generate comprehensive security data. Then, based on the comprehensive security data and the set decision scheme, a threshold judgment is made to obtain decision data.

[0097] When the decision data is used to verify the user's identity, a weighted calculation is performed based on the behavioral baseline conformity of all user access request data corresponding to the user in the current access process, and the number of valid user identity verifications in the user's historical data that are more similar to the current user's access request data than the set similarity threshold, to generate a verification-free reputation score.

[0098] Determine whether the verification-free reputation score is greater than the verification-free threshold.

[0099] If yes, then perform the verification-free operation with a random probability; otherwise, verify the user's identity according to the decision data.

[0100] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A host network access control security protection system based on flexible grayscale calculation, characterized in that, Includes the following modules: The user access resource matching degree analysis module is used to perform similarity analysis between user type data and user access request data based on user type data, user access request data, and resource user vector coordinate data sets, and generate user access resource matching degree data. The user access request data contains information about the host resources that the user wants to access. The user security analysis module is used to calculate the security level of a user's current access based on user access context data, user access request data, user behavior baseline, and user security assessment parameter set, and to generate user security data. The comprehensive risk assessment and decision-making module is used to perform weighted calculation processing based on the user access resource matching degree data and user security degree data to generate comprehensive security data, and to perform threshold judgment based on the comprehensive security data and the set decision scheme to obtain decision data. The decision scheme includes allowing access, verifying user identity, restricting access, and blocking access. The verification-free judgment module is used to generate a verification-free reputation score when the decision data is to verify the user's identity. It is based on the behavioral baseline conformity of all user access request data corresponding to the user in the current access process and the number of valid user identity verifications in the user's historical data that are more similar to the current user's access request data than a set similarity threshold. The module then determines whether the verification-free reputation score is greater than the verification-free threshold. If so, the verification-free operation is performed with a random probability.

2. The host network access control security protection system based on flexible grayscale calculation according to claim 1, characterized in that, The system also includes the following modules: The user basic information module is used to store basic user data and corresponding user type data, and to obtain user access request information and generate user access request data. The user login environment information acquisition module is used to obtain the context environment information when a user requests access to the host network and generate user access context environment data. The host resource relationship module is used to store resource level type information data containing resource importance level and resource type, and resource user vector coordinate data set containing the corresponding vector position relationship between resource level type resource data and user type data.

3. The host network access control security protection system based on flexible grayscale calculation according to claim 1, characterized in that, The user access resource matching degree analysis module generates user access resource matching degree data, including the following steps: Based on character matching search, the vector coordinates of the user type data and the user access request data are searched in the resource user vector coordinate data set respectively, and user type vector coordinate data and user access request vector coordinate data are generated. Calculate the cosine similarity between the user type vector coordinate data and the user access request vector coordinate data to generate access resource matching data.

4. The host network access control security protection system based on flexible grayscale calculation according to claim 1, characterized in that, The user security analysis module generates user security data, including the following steps: Searching for user security assessment parameters that match the user access context environment data in the user security assessment parameter set yields an initial security assessment parameter set. Based on the initial security assessment parameter set, weighted calculations and normalization are performed to generate initial user security data. Based on the user access context environment data, user access request data, and user behavior baseline, the deviation of each access behavior in the current user access process from the corresponding user behavior baseline is first calculated, then summed, and finally normalized to generate user behavior anomaly values. The initial user security score data is adjusted by subtracting the abnormal user behavior value from 1 as a coefficient to generate the user security score data.

5. A host network access control security protection system based on flexible grayscale calculation according to claim 1, characterized in that, The comprehensive risk assessment and decision-making module generates comprehensive security data and obtains decision data, including the following steps: Set access matching weight and user security weight, where access matching weight + user security weight = 1; Based on the access matching degree weight and the user security degree weight, the user access resource matching degree data and the user security degree data are weighted respectively, and then the weighted results are summed to generate comprehensive security data; Multiple decision schemes are set, and a corresponding security value range is set for each decision scheme. The decision schemes include allowing access, verifying user identity, restricting access, and blocking access. Determine the decision scheme corresponding to the security value range where the comprehensive security data is located, and generate decision data.

6. The host network access control security protection system based on flexible grayscale calculation according to claim 1, characterized in that, The verification-free judgment module generates a verification-free reputation score, including the following steps: Obtain all user access request data and user access context data in the current user access process, and calculate the proportion of user access behavior that conforms to the user behavior baseline based on the user behavior baseline to obtain the behavior baseline conformity. Search and count historical records and corresponding times that are identical or have a similarity greater than the set context similarity threshold to the current user access request data, and generate verification passed historical records and time data; Based on the verification history and time data, the time elapsed between the verification history and time data and the current time is calculated. The number of verification history and time data is counted to obtain the number of valid user authentication passes. A mechanism is introduced to reduce the number of valid user authentication passes as the time elapses to correct the number of valid user authentication passes. Set the behavioral baseline compliance weight and the pass count weight, respectively, and then weight the logarithm of the behavioral baseline compliance and the valid number of behavioral verification passes. Then sum the weighted results to obtain the verification-free reputation score.

7. A host network access control security protection system based on flexible grayscale calculation according to claim 6, characterized in that, The verification-free judgment module performs the verification-free operation with a random probability, including the following steps: If the verification-free reputation score is greater than the set verification-free threshold, the verification reputation score is smoothed using the Sigmoid function to generate the verification-free probability; Generate a uniformly distributed random number R between 0 and 1; Determine if the probability of exemption from verification is greater than R; If so, then perform the verification-free operation.

8. A host network access control security protection system based on flexible grayscale calculation according to claim 6, characterized in that, The context similarity threshold is dynamically adjusted in reverse as the behavioral baseline conformity increases or decreases.

Images