Computer network security access control management method based on big data

Abstract

This invention relates to the field of computer network security technology and discloses a big data-based computer network security access control management method. The method includes constructing a network security situation knowledge graph; collecting real-time access behavior sequences through probes and synchronizing them to the knowledge graph; simulating network entity interaction states in the knowledge graph to predict threat propagation paths and potential intrusion behaviors; setting dynamic access control policies; constructing a multi-dimensional feature matrix by combining the correlation influence of real-time access behavior sequences and policy execution priority constraints; calculating policy conflict risk scores using a deep learning model; comparing the scores with preset thresholds to determine if conflicts exist; and reconstructing the policies if conflicts exist. Based on the reconstructed policies, the method automatically executes access blocking, session termination, and data encryption operations, records execution logs and security feedback data, and updates the knowledge graph in real time. This method improves the dynamism and security of access control and can effectively address security threats in complex network environments.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a computer network security access control management method based on big data. Background Technology

[0002] With the rapid development of information technology, computer networks have become a core infrastructure for social operation and economic development, and various organizations and individuals are increasingly reliant on networks. However, the openness and complexity of the network environment have led to increasingly diverse security threats, with frequent security incidents such as illegal intrusions, data breaches, and malicious attacks, posing serious challenges to the confidentiality, integrity, and availability of network information.

[0003] Traditional network security access control methods are mostly based on static rules, such as Access Control Lists (ACLs) and Role-Based Access Control (RBAC). These methods are difficult to cope with dynamically changing network environments and complex attack methods. For example, when new attack patterns or abnormal behaviors emerge in the network, static rules cannot be adjusted in time, which can easily lead to security vulnerabilities. At the same time, as the network scales up and the number of users increases, the management of static rules becomes increasingly difficult, and conflicts between rules are hard to avoid, further reducing the effectiveness of access control.

[0004] Existing methods have significant shortcomings in threat prediction and response. They often focus on passive defense against events that have already occurred, lacking the ability to proactively identify and predict potential threats, and failing to block possible intrusion paths in advance. When processing access behavior, they also struggle to fully consider the correlations between different behaviors, resulting in low accuracy in identifying complex attack behaviors. Furthermore, when faced with a large number of concurrent access requests, the processing efficiency of existing methods is insufficient to meet practical needs, easily leading to response delays and impacting normal network operation.

[0005] With the development of big data technology, how to utilize massive amounts of network access data to achieve more intelligent and dynamic access control has become a research hotspot. However, current access control methods based on big data still have many problems in knowledge representation, threat prediction model construction, and dynamic policy adjustment. For example, it is difficult to effectively integrate multi-source heterogeneous network data, it is impossible to accurately simulate the interaction relationships between network entities, and the conflict detection and reconstruction mechanism of dynamic policies is not perfect. These problems limit the security and adaptability of access control methods. Summary of the Invention

[0006] The purpose of this invention is to provide a computer network security access control management method based on big data to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides a computer network security access control management method based on big data, the method comprising:

[0008] A network security situation knowledge graph is constructed by collecting real-time access behavior sequences through probes deployed at network boundaries and internal nodes, and synchronizing the real-time access behavior sequences to the network security situation knowledge graph.

[0009] Simulate network entity interaction states in the network security situation knowledge graph to predict threat propagation paths and potential intrusion behaviors;

[0010] A dynamic access control policy is set up. This policy combines the correlation between real-time access behavior sequences and policy execution priority constraints to determine whether there are policy conflicts in the rule engine. If so, the dynamic access control policy is restructured, specifically as follows:

[0011] The dynamic access control policy constructs a multi-dimensional feature matrix based on the correlation mapping between the predicted value of the identity anomaly index and the estimated value of the data flow sensitivity. Combined with the preset policy execution priority, the policy conflict risk score is generated by the rule engine through a deep learning model. The risk score is then compared with the preset conflict threshold to determine whether a policy conflict exists.

[0012] The system automatically executes access blocking, session termination, and data encryption operations based on the reconstructed dynamic access control policy, and continuously records policy execution logs and security feedback data. The network security situation knowledge graph is updated in real time based on the security feedback data.

[0013] Preferably, the probe is used to collect real-time access behavior sequences including user authentication records, protocol type distribution, data packet payload characteristics, session duration and access frequency distribution, which are used to construct a multi-level, regional knowledge graph input feature set.

[0014] Preferably, a spatiotemporal graph convolutional network is used to predict threat propagation paths and potential intrusion behaviors, specifically including:

[0015] The entire network topology is divided into multiple security domains, each corresponding to a super node in the graph structure; the connection relationship between super nodes is established based on network traffic paths, permission inheritance relationships, or vulnerability dependency chains; each super node is associated with real-time access behavior sequences collected by multiple probes, forming the spatiotemporal feature tensor of the node; an initial network security graph structure is constructed, which includes a set of nodes, a set of edges, and a node feature cube;

[0016] The network state of each collection cycle is represented as a dynamic graph sequence, and continuous time windows form a spatiotemporal graph evolution sequence; combining the changes in node features in each graph with the network topology invariance, a spatiotemporal graph neural network input is constructed; the labeled data are threat level labels or intrusion behavior markers for each supernode within a preset time period in the future;

[0017] Temporal graph convolutional networks are used to extract the spatiotemporal correlation features of super nodes; the spatiotemporal graph convolutional network performs convolution operations on the dynamic graph at each time slice and outputs the threat embedding vector of the node;

[0018] The threat embedding vector is input into the multi-step prediction module; the future time window traffic anomaly index or permission change frequency of each supernode is predicted; the prediction results are analyzed for anomalies in conjunction with the historical security event database; if the predicted value of a supernode deviates from the baseline behavior model, it is marked as a potential intrusion behavior.

[0019] Preferably, the method for obtaining the predicted value of the identity anomaly index is as follows: construct a causal reasoning graph for identity authentication, determine the variable nodes related to the identity anomaly index, including authentication failure frequency, session geographical offset, permission change frequency and access time anomaly degree, establish causal dependency chains between variables, form a directed acyclic reasoning graph, and set the predicted value of the identity anomaly index as the target variable node.

[0020] Collect real-time monitoring data from historical cybersecurity incidents and train a Bayesian inference network.

[0021] During access control, real-time observations of authentication failure frequency, session geographic offset, permission change frequency, and access time anomaly are acquired; these observations are input into the Bayesian inference network as known nodes; the probability distribution of network nodes is updated through the evidence propagation algorithm; and the probability distribution result of the predicted identity anomaly index is output as the current predicted identity anomaly index value.

[0022] The preferred method for obtaining data flow sensitivity estimation is as follows:

[0023] A deep packet inspection engine is deployed at the core switching node of the network to collect data stream features in fixed time windows; each data stream feature sequence represents the trajectory of changes in data transmission sensitivity within a specific time window, forming a sensitivity time series sample;

[0024] A temporal variational autoencoder is used to extract features from the sensitivity time series: the encoder network automatically learns the feature vector of the sensitivity change pattern in each time series; the decoder network attempts to reconstruct the original sensitivity curve; after training, the encoder compresses the newly acquired data stream sensitivity sequence into a low-dimensional feature representation.

[0025] Density clustering algorithm is used to classify feature vectors into patterns; each cluster represents a typical data sensitivity evolution pattern; after clustering, a preset sensitivity level label is assigned to each pattern.

[0026] During access control operation, the system continuously collects the current data stream sensitivity time series; extracts the current feature vector using a trained temporal variational autoencoder; performs similarity matching between the feature vector and cluster centers to determine the sensitivity pattern category to which the current sequence belongs; and outputs the current data stream sensitivity estimate based on the matching results.

[0027] Preferably, the predicted value of the identity anomaly index and the estimated value of data flow sensitivity are fused into a multi-dimensional feature matrix. The multi-dimensional feature matrix is ​​used as the input of a deep learning model. Combined with the currently configured policy execution priority, the deep learning model uses the predicted policy conflict risk value of each set of feature matrices as the training objective and the minimization of the prediction error of all policy conflict risk values ​​as the optimization objective. The deep learning model is continuously trained until the error converges. The policy conflict risk value of the rule engine is determined based on the model output value. The deep learning model adopts a spatiotemporal convolutional neural network architecture.

[0028] Preferably, the obtained rule engine policy conflict risk value is compared with a preset conflict threshold. If the rule engine policy conflict risk value reaches or exceeds the conflict threshold, it is determined that there is a policy conflict in the rule engine. At this time, a policy reconstruction instruction is triggered and the dynamic access control policy is optimized. If the rule engine policy conflict risk value is lower than the conflict threshold, it is determined that there is no policy conflict in the rule engine. At this time, the current policy execution state is maintained.

[0029] Preferably, the network security situation knowledge graph is updated in real time based on security feedback data, specifically including: constructing the basic structure of the network security situation knowledge graph during the initialization phase, synchronously establishing a feedback data repository, and associating the correspondence between each policy execution record, system response result, and knowledge graph output; constructing an incremental learning task set using historical security feedback data, with each task corresponding to a specific network attack scenario, including a training sample set and a validation sample set; fine-tuning the parameters of the network security situation knowledge graph in each task; iteratively optimizing the embedding representation of the knowledge graph through multi-tasks, in actual operation, the real-time feedback data collected after each policy execution is used to construct new tasks; inputting the new tasks into the meta-learning optimizer for incremental training, updating the local parameters of the current knowledge graph, and retaining the updated sub-graph model; the system periodically verifies the prediction accuracy of the sub-graph model; if the error decreases to a preset threshold, the fine-tuned parameters are synchronized to the main knowledge graph, and the global graph parameters are updated or stored in the scenario model library.

[0030] Preferably, the reconstructing process of the dynamic access control policy further includes: when a policy conflict is detected, extracting the key dimensions from the current multidimensional feature matrix and generating a policy adjustment suggestion vector; co-optimizing the access blocking rules, session termination conditions, and data encryption strength based on the policy adjustment suggestion vector; and synchronizing the optimized policy parameters to all execution nodes through a security policy distribution channel.

[0031] Preferably, the prediction of the future time window traffic anomaly index or permission change frequency for each supernode includes:

[0032] If the similarity between the threat embedding vector of the current supernode and the known threat patterns in the historical security event database reaches a preset matching threshold, the fast response analysis channel is activated, and an access blocking instruction is directly generated based on the threat feature matching results.

[0033] If the similarity is lower than the preset matching threshold, the traffic protocol distribution features and permission change trajectory features in the spatiotemporal feature tensor are extracted, and the unidentified threat behaviors are analyzed through a multi-level anomaly detection model to generate incremental threat feature vectors and update the historical security event database.

[0034] Compared with the prior art, the beneficial effects of the present invention are:

[0035] By constructing a network security posture knowledge graph, it is possible to effectively integrate real-time access behavior sequences of network boundaries and internal nodes, achieving a comprehensive and dynamic characterization of network security status. As a powerful form of knowledge representation, knowledge graphs can clearly present the relationships between network entities, providing a solid foundation for subsequent threat prediction and access control strategy formulation.

[0036] Simulating network entity interactions within a cybersecurity posture knowledge graph helps to gain a deeper understanding of the inherent patterns in network behavior, thereby enabling more accurate predictions of threat propagation paths and potential intrusion behaviors. This proactive predictive capability changes the traditional passive defense approach, allowing for preemptive action to reduce the likelihood of security incidents. Early identification of potential threats buys more time for cybersecurity protection, minimizing losses caused by attacks.

[0037] The dynamic access control policy settings fully consider the correlation between real-time access behavior sequences and policy execution priority constraints, making access control more flexible and adaptable. A multi-dimensional feature matrix is ​​constructed based on the correlation mapping between the predicted identity anomaly index and the estimated data flow sensitivity. Combined with a deep learning model, a risk score for policy conflicts is calculated by the rule engine, enabling more accurate determination of policy conflicts. When conflicts exist, the dynamic access control policy is reconstructed, avoiding security vulnerabilities caused by policy conflicts and ensuring the consistency and effectiveness of the access control policy. This conflict detection and reconstruction mechanism improves the policy's adaptability and can cope with complex and ever-changing network environments.

[0038] The restructured dynamic access control policy automatically executes access blocking, session termination, and data encryption operations, enabling rapid response to security incidents. Simultaneously, it continuously records policy execution logs and security feedback data, and updates the network security posture knowledge graph in real time based on this data, forming a closed-loop adaptive system. The accumulation of logs and feedback data continuously optimizes the accuracy and completeness of the knowledge graph, thereby improving the accuracy of threat prediction and the adaptability of dynamic policies. This continuous iterative update mechanism allows the access control method to evolve with changes in the network environment, maintaining good security protection performance in the long term. Attached Figure Description

[0039] Figure 1 This is a schematic diagram illustrating the working principle of the big data-based computer network security access control management method described in this invention.

[0040] Figure 2 This is a flowchart for predicting threat propagation paths and potential intrusion behaviors based on spatiotemporal graph convolutional networks;

[0041] Figure 3 A flowchart illustrating the method for obtaining the predicted value of the identity anomaly index;

[0042] Figure 4 A flowchart for updating the cybersecurity posture knowledge graph based on security feedback data;

[0043] Figure 5 This is a flowchart of the process for refactoring dynamic access control policies. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Please see Figure 1 This invention provides a computer network security access control management method based on big data, the method comprising:

[0046] A dynamically evolving cybersecurity posture knowledge graph is constructed, forming a closed-loop control system through real-time behavior acquisition, threat prediction, and policy self-optimization. The cybersecurity posture knowledge graph is stored in a distributed graph database, containing network entity nodes, access relationship edges, and dynamic attribute sets. The probe module is deployed as an SDN controller plugin, capturing OSI seven-layer protocol data at a preset sampling frequency. Real-time access behavior sequences are converted into spatiotemporal attributes of the knowledge graph after feature extraction, and attack propagation paths are simulated using graph traversal algorithms. Dynamic access control policies adopt a reinforcement learning-based policy tree structure, with policy nodes containing conditional predicates and operation sets. Policy conflict detection is achieved by calculating the cosine similarity of the policy graph embedding vectors using a graph neural network. The policy reconstruction process uses a genetic algorithm to generate candidate policy sets, which are then verified in a sandbox environment before being distributed to execution nodes.

[0047] Example 1: See Figure 2 The project involves the construction of a cybersecurity situational awareness knowledge graph, the collection and analysis of real-time access behavior sequences, and a threat prediction method based on spatiotemporal graph convolutional networks. The entire implementation process adopts a modular design, with each component working collaboratively to form a dynamic monitoring and prediction system.

[0048] The probe acquisition module adopts a lightweight architecture and is deployed on the network boundary firewall and core switching nodes. Each probe instance contains three functional units: a packet sniffer that captures raw traffic based on the libpcap library and sets a BPF filter to exclude known legitimate traffic; a protocol parser that supports deep parsing of the SNI field in the TLS / SSL handshake protocol, HTTP / 2 frame header features, and DNS query records; and a feature extractor that uses a sliding window mechanism to generate a set of feature vectors containing 28-dimensional statistics every 5 minutes. User authentication records are obtained by listening to the Radius and TACACS+ protocol ports, and the record fields include authentication method, credential hash value, and response latency. Protocol type distribution statistics use an adaptive window algorithm to dynamically adjust the statistical period to balance real-time performance and computational overhead.

[0049] Packet payload characteristic analysis employs a layered processing strategy: the link layer focuses on MAC address flipping anomalies, the network layer detects IP fragmentation attack characteristics, the transport layer analyzes SYN flood behavior patterns, and the application layer constructs a regular expression rule base to match malicious payloads. Session duration monitoring introduces a TCP state tracker to record the establishment time, data transmission stage, and termination reason for each session. Access frequency distribution statistics combine Bloom filters and counting sketches to achieve high-frequency IP detection within limited memory. Collected real-time behavioral data is transmitted to the central node via an encrypted channel, and Apache Kafka is used for data buffering and asynchronous processing.

[0050] The construction process of spatiotemporal graph convolutional networks is divided into two stages: topology modeling and dynamic graph sequence generation. Network topology partitioning is based on enterprise security policies, dividing each VLAN into an independent security domain, with core business systems in separate domains. Connections between supernodes are automatically established by analyzing cross-domain traffic in firewall logs, with edge weights reflecting historical communication frequencies. The node feature cube uses a fixed 5-minute interval for its time dimension, records the physical location and logical area of ​​probe deployments for its spatial dimension, and includes traffic statistics, protocol distribution entropy values, and abnormal behavior counts for its feature dimensions. The dynamic graph sequence generator maintains a circular buffer of 64 time slices, each slice containing a complete network topology snapshot and node feature matrix.

[0051] The spatiotemporal graph neural network employs a three-stage processing architecture. The preprocessing layer standardizes node features and fills in missing values, using linear interpolation to handle probe packet loss. The spatiotemporal convolutional layer contains parallel temporal and spatial convolutional modules. The temporal convolution uses causal kernels to capture historical dependencies, while the spatial convolution uses learnable filters designed based on spectral graph theory. The feature fusion layer dynamically adjusts the spatiotemporal feature weights through a gating mechanism, outputting node-level threat embedding vectors. The threat level labeling system interfaces with the SIEM platform, mapping security events to three-level threat labels based on CVSS scores. The multi-step prediction module uses an encoder-decoder structure. The encoder uses stacked GRU layers to compress historical sequence features, and the decoder combines an attention mechanism to generate predicted outputs for the next three time slices.

[0052] The anomaly correlation analysis system comprises online matching and offline modeling. The online channel employs an improved dynamic time warping algorithm to calculate the similarity between the predicted sequence and known attack patterns in the CVE database, setting adaptive thresholds to trigger alarms. The offline channel runs an attack scenario reconstruction engine, generating novel threat feature templates through causal reasoning. The prediction result visualization system uses a force-directed graph layout, with red gradient edges representing threat propagation paths and node sizes reflecting risk levels.

[0053] The storage of real-time behavioral data and prediction results adopts a layered architecture. Raw traffic packets are stored in a distributed file system, feature data is stored in a time-series database, and graph relationships are managed using a graph database. For system performance optimization, the probe acquisition module employs zero-copy technology to reduce CPU load, and the graph neural network inference process is accelerated using TensorRT. Fault tolerance mechanisms include modules for data verification and retransmission, model hot standby switching, and rollback in abnormal states.

[0054] Emphasis is placed on the timing consistency between components, and global clock synchronization ensures the coordinated operation of behavior collection, graph updates, and threat prediction. A graph reconstruction process is triggered when the network topology changes, automatically identifying new nodes and failed connections. The system maintenance module continuously monitors resource utilization and dynamically adjusts computing task scheduling strategies to ensure real-time requirements.

[0055] It is important to ensure the interpretability of feature engineering and to establish manual verification interfaces for key features. The spatiotemporal graph convolutional network is trained using a transfer learning strategy, first pre-trained on a large-scale simulation dataset, and then fine-tuned using actual network data. The confidence assessment of threat prediction results employs an ensemble method, combining the prediction variances of multiple sub-models to calculate an uncertainty index.

[0056] The system deployment phase employs a canary release strategy, first verifying functional integrity in non-core areas before gradually expanding coverage. Operation and maintenance include automated testing suites to regularly verify the integrity of data collection, the accuracy of model predictions, and the effectiveness of strategy execution. Version upgrades utilize a rolling update mechanism to ensure uninterrupted service while completing component iterations.

[0057] By employing fine-grained behavior acquisition, precise topology modeling, and efficient neural network computation, an intelligent system for dynamically perceiving network security posture is constructed. The data flow design between modules fully considers real-time processing requirements, ensuring both analytical depth and enterprise-level performance. The system possesses excellent scalability, supporting adaptation to network environments of varying sizes by adding probe nodes or expanding the neural network layers.

[0058] Example 2: See Figure 3 This study employs a collaborative analysis method involving identity anomaly index prediction and data flow sensitivity estimation. It achieves fine-grained security risk assessment by constructing a causal inference model and a temporal feature extraction system. The implementation process integrates probabilistic graphical models and deep learning techniques to form a dynamically evolving security analysis system.

[0059] The core of the identity anomaly index prediction system lies in constructing an interpretable causal reasoning network. During the system initialization phase, four types of observation nodes and their probability distributions are defined. The authentication failure frequency node uses a truncated Poisson distribution to process the count data, setting a maximum threshold of 20 times per hour to avoid outlier interference. The session geographic offset node calculates the great circle distance between two consecutive login locations by fusing GPS positioning and IP geographic database information. The permission change frequency node monitors RBAC policy additions, deletions, and modifications, distinguishing between normal operational activities and suspicious privilege escalation behaviors. The access time anomaly node establishes a user behavior baseline model, comparing the statistical differences between current operation times and historical patterns.

[0060] The causal graph is constructed using a combination of expert knowledge and data-driven methods. Directed edges are established based on two types of evidence: temporal correlation patterns in security event logs and causal chains of typical attack scenarios annotated by domain experts. The system pre-defines three main influencing paths while retaining an adaptive adjustment mechanism to allow the discovery of new causal relationships during operation. The Bayesian network structure learning employs a scoring search algorithm to optimize model fit while maintaining the sparsity of the graph structure.

[0061] The preprocessing of historical training data includes a multi-step cleaning process. Raw security event logs are de-identified, and personal privacy information is removed to generate an anonymized dataset. Continuous variables are binned and discretized, while categorical variables are represented using embeddings. During model training, variational inference methods are used to approximate the posterior distribution, and stochastic gradient descent is used to optimize network parameters. The inference process implements real-time incremental updates; when new observations arrive, the system completes evidence propagation and probability recalculation within milliseconds.

[0062] During the online prediction phase, the system maintains statistics on sliding time windows. Authentication failure frequency statistics track abnormal login attempts within the last 15 minutes, distinguishing between different types such as incorrect passwords and expired tokens. Session geographic offset detection, combined with user-reported travel plans, performs context-aware assessments of behaviors such as cross-border logins. The permission change monitor tracks permission propagation paths and identifies abnormal role inheritance relationships. The access time analysis module considers different patterns for weekdays and holidays, dynamically adjusting normal time intervals.

[0063] The data flow sensitivity assessment system adopts a layered processing architecture. The network sniffing layer is deployed at the core switching node, acquiring full traffic data through port mirroring. The protocol identification engine includes dual channels of feature matching and behavioral analysis, accurately distinguishing between encrypted business traffic and potential data leaks. The deep packet inspection module implements application layer protocol parsing, supporting semantic analysis of HTTP headers, SQL queries, and other content.

[0064] The temporal feature extraction system employs a dedicated sampling strategy. A fixed time window of 30 seconds is set, and six core features are statistically analyzed within each window: payload byte entropy reflects the degree of data randomness; transmission direction indicates a tendency for monitored data to be transmitted outwards; byte distribution moments characterize the occurrence pattern of specific values; protocol nesting depth detects tunnel encapsulation behavior; encryption flags identify unconventional encryption modes; and stream duration correlates with the duration of sensitive operations. A robust scaling method is used in the feature standardization process to reduce interference from abnormal traffic.

[0065] The architecture of the temporal variational autoencoder considers both computational efficiency and feature representation capability. The encoder employs a causal convolutional network to capture local temporal patterns, combined with an attention mechanism to highlight key time points. The latent space is modeled using a diagonal Gaussian distribution, and end-to-end training is achieved through reparameterization techniques. The decoder uses gated recurrent units to progressively reconstruct the input sequence, and the output layer employs a hybrid density network to handle multimodal distributions. Regularization constraints are introduced during model training to prevent excessive shrinkage of the latent space.

[0066] The clustering analysis phase employs a hierarchical density clustering algorithm. The preprocessing step uses principal component analysis for dimensionality reduction, retaining 90% of the original information. The clustering process automatically determines the optimal number of clusters, naturally forming groups based on data distribution density. Each cluster center represents a typical data flow pattern, and after manual review, it is labeled with a predefined sensitivity level. The online matching phase implements approximate nearest neighbor search, using product quantization to compress feature vectors, improving query speed while maintaining recall.

[0067] In terms of system implementation, identity anomaly prediction and data flow analysis are deployed using a microservice architecture. The message bus uses a publish-subscribe pattern to deliver real-time events, ensuring decoupling between components. A caching layer stores recent calculation results and supports fast historical queries. Monitoring dashboards visualize key indicators, including anomaly index trend charts and sensitive traffic heatmaps. A configuration management interface allows security administrators to adjust threshold parameters to adapt to different business scenario requirements.

[0068] The fault tolerance mechanism includes multiple safeguards. During data acquisition, it enables breakpoint resumption and automatically caches local data in case of network interruptions. Multiple replicas of the model service are deployed, and failover is achieved through heartbeat detection. Regular snapshots save the system state, allowing rollback to a stable version in case of anomalies. For performance optimization, in-memory computing is used for critical paths to reduce disk I / O overhead. Batch processing operations are executed in parallel, fully utilizing multi-core CPU resources.

[0069] By integrating probabilistic reasoning and deep learning technologies, a security risk assessment system adapted to dynamic network environments is constructed. The identity anomaly index prediction module provides interpretable analysis results, while the data flow sensitivity estimation system achieves fine-grained content awareness. The two subsystems generate a comprehensive security posture judgment through feature-level fusion. The system design emphasizes a balance between real-time performance and computational efficiency, enabling stable operation in enterprise-level network environments.

[0070] Example 3: See Figure 4 This approach focuses on constructing a multi-dimensional feature matrix and predicting policy conflict risks, using a deep learning model to intelligently optimize dynamic access control policies. The implementation process is based on a deep correlation analysis of identity anomaly indices and data flow sensitivity, resulting in an adaptive policy management system.

[0071] The construction of the multidimensional feature matrix employs a spatiotemporal alignment mechanism to fuse two types of security indicators into a unified representation. The feature fusion window T is defined as 8 consecutive sampling periods, with each period containing observations in four dimensions: the logarithmic transformation of authentication failure frequency, the normalized distance of geographical offset, the cumulative number of permission changes, and the KL divergence of temporal anomalies. The data stream sensitivity estimate outputs 5-level discrete labels, which are converted into a 3D continuous vector representation through an embedding layer. The matrix construction process follows these calculation rules:

[0072]

[0073] in This represents the element in the i-th row and j-th column of the generated feature matrix. Let be the attenuation coefficient for the k-th time slice. This represents the value of the i-th identity feature in the k-th period. The value of the j-th dimension sensitivity feature in the k-th period, This represents element-wise multiplication. This formula ensures that features from different time scales are reasonably weighted and integrated while maintaining numerical stability.

[0074] The deep learning model employs a dual-branch heterogeneous network architecture. The identity feature branch consists of three one-dimensional convolutional networks, each with 64 filters of width 3, using causal padding to preserve temporal positional information. The sensitivity feature branch uses bidirectional LSTM layers with 32 hidden units; the forward and backward states are concatenated before being fed into the attention layer. Policy priority encoding uses a 7-dimensional one-hot vector, projected onto the same embedding space as the feature branches through a fully connected layer. A gated crossover mechanism is designed in the feature fusion stage to dynamically adjust the contribution weights of the two feature classes.

[0075] The quantitative definition of conflict risk prediction objectives considers the coverage relationships of policy rules. For a given set of policies... Define conflict risk value for:

[0076]

[0077] in This represents the sigmoid function. Calculate the cardinality of the intersection of the conditional predicates of strategies p and q. This indicates the number of objects to which strategy p applies. This is the priority weight of strategy q. This definition considers both the degree of logical conflict between strategies and the impact of execution priority, and obtains a risk score between 0 and 1 through normalization.

[0078] The model training process employs a phased optimization strategy. In the pre-training phase, a large-scale dataset is constructed using historical policy decision records, and a mean squared error loss function is used to initially fit the mapping relationship between features and risk. In the fine-tuning phase, policy importance weighting is introduced, increasing the loss weight for samples corresponding to high-priority policies. The optimizer is configured with an adaptive learning rate, initially set to 0.001, decaying by 50% every 10 epochs. Regularization measures include Dropout layers and L2 weight decay to prevent overfitting.

[0079] The dynamic adjustment mechanism for conflict thresholds is implemented based on sliding window statistics. It maintains the moving average and standard deviation of the most recent 100 predictions and sets three levels of warning thresholds: the baseline threshold is the moving average plus 1.5 times the standard deviation, the severe threshold is 3 times the standard deviation, and the emergency threshold is 5 times the standard deviation. The comparison module implements multi-granularity responses: when an instantaneous risk value exceeds the emergency threshold, it immediately triggers strategy reconstruction; when three consecutive predictions exceed the severe threshold, it initiates preventative analysis; the baseline threshold is used for daily monitoring and trend warnings.

[0080] The policy reconstruction process employs a genetic algorithm-based optimization method. The initial population contains multiple variants of the current policy set, with each individual encoding a set of policy parameters. The fitness function comprehensively considers three factors: the reduction in conflict risk, the preservation of policy coverage, and execution overhead. A tournament-style selection operation is used, with a crossover probability of 0.8 and a mutation probability of 0.05. The optimization process is run in a sandbox environment, and the policy effectiveness is verified through traffic replay before deployment to the production environment.

[0081] The system implementation employs a distributed architecture. The feature matrix builder is deployed on edge nodes, close to the data source to reduce transmission latency. The model inference service runs on a GPU-accelerated cluster, supporting high-concurrency prediction requests. The policy management module implements version control, generating a new policy snapshot with each refactoring and retaining a complete change history. The monitoring system visualizes key metrics, including risk trend charts, policy coverage heatmaps, and resource consumption dashboards.

[0082] Performance optimization measures include a multi-level caching design. Raw feature data is cached in an in-memory database, while calculation results from the most recent 10 minutes are retained in a local cache. Model parameters are compressed using quantization techniques, and accuracy is dynamically restored during inference. The parallel computing framework processes the feature matrix in blocks, fully utilizing multi-core processor resources. A fault-tolerance mechanism enables automatic fault detection and recovery, automatically switching to a backup model copy when the prediction service times out.

[0083] Through rigorous feature engineering and advanced deep learning techniques, an intelligent system capable of dynamically perceiving policy conflict risks is constructed. A multi-dimensional feature matrix effectively integrates heterogeneous security indicators, and a dual-branch network architecture fully explores the deep correlations between features. The quantitative definition of conflict risk accurately reflects the complex interactions between policies, and genetic algorithm optimization ensures the quality of policy reconstruction. The system design balances computational efficiency and decision accuracy, meeting the real-time requirements of enterprise-level network security management.

[0084] Example 4: See Figure 5 The paper discusses the incremental updates of the network security posture knowledge graph and the reconstruction and optimization of dynamic access control policies, demonstrating the system's operational mechanism in a real-world network environment through specific examples. Taking a targeted attack on a financial institution's network as an example, the paper details the collaborative working process of the system's various modules.

[0085] The financial institution's network comprises three security domains: a core transaction system, a customer management system, and an internal office system. During the initial construction of the network security posture knowledge graph, three types of nodes were defined: terminal device nodes recording IP-MAC binding information, user nodes associating AD accounts with department attributes, and application nodes labeling service ports and access permissions. Edge relationships included four types: device-user login relationships, user-application access relationships, device-network zone affiliation relationships, and application-data flow dependency relationships. Probes were deployed at the core switches, DMZ zone boundaries, and in front of the database server, with a sampling frequency set to one sampling cycle per minute.

[0086] One day, the security operations center received an anomaly alert, detecting suspicious behavior on multiple terminal devices within the customer management system domain. Policy enforcement module logs showed that dynamic access control policies had triggered three session blocking operations: targeting an abnormal connection on TCP port 445, a database query during an abnormal time period, and a lateral movement attempt. The system response table recorded that these operations successfully blocked the suspicious sessions, but it was subsequently discovered that the attacker switched to TCP port 3389 to continue penetration. In the security feedback data repository, this event was marked as a "lateral movement-credential theft" attack pattern, associated with 5 terminal nodes, 2 user accounts, and 3 application service nodes in the knowledge graph.

[0087] The incremental learning task generator analyzes the characteristics of this event and creates a specialized training task package. This task contains 1200 positive samples extracted from network behavior sequences in actual attack traffic; and 800 negative samples from normal business traffic during the same period. The meta-learning optimizer adopts a model-independent meta-learning framework. The inner loop quickly adapts to the task package data with a learning rate of 0.01 and performs 5 gradient updates. The outer loop adjusts the global parameters of the knowledge graph with a learning rate of 0.001. Differential privacy protection is implemented during the update process by adding random noise conforming to a Gaussian distribution during gradient calculation.

[0088] During the knowledge graph update phase, the system first creates a subgraph copy in an isolated environment, containing the affected network regions and their three-hop neighbor nodes. The subgraph model fine-tunes the node embedding representation, focusing on optimizing the edge type weights representing lateral movement behavior. In the validation phase, 200 retained samples are used for testing. Once the subgraph confirms improved detection accuracy against similar attacks, the updated parameters are synchronized to the main knowledge graph. A new "Remote Desktop Protocol Abuse" attack mode has been added to the scenario model library, recording the RDP connection characteristics, time distribution, and target selection patterns used by attackers.

[0089] The policy restructuring process analyzed the control blind spots exposed by this attack. The policy adjustment suggestion vector generation module output six optimization directions: downgrading the default RDP protocol permission from "allow" to "approval-based release"; adding time constraints to database query operations; increasing the encryption strength requirements for cross-security domain access; limiting the number of concurrent sessions per account; implementing two-factor authentication for management terminals; and narrowing the range of usable IPs for privileged accounts. The security policy distribution channel pushes updates via the blockchain network, and each execution node loads the new policy after verifying the digital signature.

[0090] In subsequent operation, the system continuously monitored the effectiveness of the policy implementation. Within the first hour after the new policy was implemented, four RDP connection approval requests were recorded, one of which was rejected due to an unusual country of origin. The optimized session termination conditions effectively prevented attackers from maintaining persistent connections, and the increased data encryption strength made network sniffing attacks more difficult. Security feedback data recorded these operational results in real time, forming new incremental learning tasks to begin the next round of knowledge graph optimization.

[0091] The system architecture is designed to support deployment requirements in large-scale network environments. Feedback data processing utilizes a streaming computing framework, completing feature extraction and task classification within 5 seconds of event logs entering the system. The model update service is deployed on a Kubernetes cluster, automatically scaling computing resources based on load. The version control system retains all policy change history, supporting backtracking to specific versions of policy rules by time point. A visual interface displays the evolution of the knowledge graph, using different colors to mark newly added nodes, modified edges, and deleted components.

[0092] Through a closed-loop feedback learning mechanism, the network security protection system possesses the ability to continuously evolve. Knowledge graph updates driven by specific attack events ensure the system can quickly adapt to new threats. The policy refactoring process not only resolves currently detected conflicts but also prevents potential risks through proactive adjustments. Feedback data accumulated during system operation forms a virtuous cycle, continuously improving the ability to identify and handle complex attack scenarios.

[0093] Example 5: Focusing on rapid response to cybersecurity threats and analysis of unknown attack behaviors, this example utilizes a multi-level analysis pipeline to achieve timely handling and feature learning of emerging threats. The implementation process demonstrated its technical characteristics in the actual operating environment of a large cloud service provider, which includes over 5,000 virtual hosts and 200 business microservices.

[0094] When the threat embedding vector of a supernode in a business cluster exhibits abnormal fluctuations, the system initiates a three-level matching analysis process. The first level calculates the Euclidean distance between the current threat vector and 300 known attack patterns in the historical feature database. These patterns cover various threats, ranging from port scanning to zero-day exploits. On a certain weekday morning, the system detected that the distance between the threat vector of a certain group of web servers and a historical SQL injection attack pattern reached 0.82, exceeding the preset matching threshold of 0.8. The system immediately activated a rapid response channel. The response engine queried the asset criticality tags of the business cluster and, combined with the characteristic parameters of the attack pattern, generated access blocking instructions containing specific rules: immediately terminating all HTTP sessions containing suspicious SQL fragments, limiting the number of concurrent connections from the source IP to three, and mandating human verification for subsequent requests.

[0095] When the behavioral characteristics of an edge computing node fail to match a known pattern, the system transitions to a deep analysis process. During a security inspection, an anomaly was discovered in the traffic protocol distribution of a group of IoT gateway devices. The proportion of CoAP protocol traffic suddenly increased from the usual 15% to 62%, but the similarity to any documented attack pattern was less than 0.7. The protocol layer analyzer extracted TCP flag combination features, discovering a large number of unconventional URG flag uses; the application layer parser identified abnormal resource request frequencies; and the behavior layer tracker reconstructed the communication topology changes between devices. These features were combined into an incremental threat feature vector, containing 27 dimensions of behavioral indicators, and stored in a feature library awaiting review by security experts. After confirmation, this feature vector was marked as a new attack pattern of "IoT device botnets," updated to the historical security event database, and corresponding detection rules were generated.

[0096] The analysis of permission change trajectories employed process mining techniques. During an internal audit, the system detected 17 permission changes for a certain operations and maintenance account within 8 hours, far exceeding the normal operational frequency for this role. The behavior reconstruction engine transformed this operation sequence into a state transition graph, visually displaying the entire process of the account's abnormal escalation from ordinary operations and maintenance privileges to domain administrator privileges. The analysis model identified two key transitions: the first was obtaining temporary escalation of privileges through an API vulnerability in a configuration management system, and the second was solidifying privileges using a group policy modification tool. This abnormal trajectory pattern was abstracted as a characteristic template for privilege escalation attacks, used for the early identification of similar subsequent behaviors.

[0097] The multi-level anomaly detection model employs a weighted fusion strategy for its output. For a suspected data breach, the system simultaneously outputs evaluation results across three dimensions: the protocol deviation score, reflecting abnormal modifications to SSL handshake parameters, reaches 78 points; the privilege escalation probability is calculated at 0.43, exceeding the baseline value by more than double; and the time-series anomaly density indicator shows periodic abrupt changes in the data outflow rate. The comprehensive evaluation engine combines these indicators with business sensitivity weights to ultimately generate a threat confidence score of 87, triggering data encryption and backup isolation operations.

[0098] The system implementation adopts a modular design. The rapid response channel is implemented as an independent microservice cluster, ensuring instruction generation and distribution within 100 milliseconds. The deep analysis engine is deployed on GPU-accelerated computing nodes, with an average processing time of 2.3 seconds for complex analysis tasks. The signature database update service implements version control and rollback mechanisms, generating complete audit logs for each change. The visualization interface presents the analysis results according to the network topology, using gradient colors to indicate threat propagation paths and dynamically displaying the attacker's lateral movement trajectory.

[0099] By employing a layered and progressive analysis approach, the conflicting demands for response speed and detection depth are effectively balanced. Rapid matching of known threats ensures immediate blocking of common attacks, while deep behavioral analysis provides the technical means to identify emerging threats. Visual reconstruction of permission change trajectories helps understand complex attack chains, and multi-indicator fusion assessment enhances decision-making reliability. The threat signature database is continuously enriched during system operation, resulting in the synchronous evolution of defensive capabilities and attack methods.

[0100] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0101] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer network security access control management method based on big data, characterized in that, include: A network security situation knowledge graph is constructed by collecting real-time access behavior sequences through probes deployed at network boundaries and internal nodes, and synchronizing the real-time access behavior sequences to the network security situation knowledge graph. Simulate network entity interaction states in the network security situation knowledge graph to predict threat propagation paths and potential intrusion behaviors; A dynamic access control policy is set up. This policy combines the correlation between real-time access behavior sequences and policy execution priority constraints to determine whether there are policy conflicts in the rule engine. If so, the dynamic access control policy is restructured, specifically as follows: The dynamic access control policy constructs a multi-dimensional feature matrix based on the correlation mapping between the predicted value of the identity anomaly index and the estimated value of the data flow sensitivity. Combined with the preset policy execution priority, the policy conflict risk value of the rule engine is calculated through a deep learning model. The policy conflict risk value of the rule engine is then compared with the preset conflict threshold to determine whether there is a policy conflict. The system automatically executes access blocking, session termination, and data encryption operations based on the reconstructed dynamic access control policy, and continuously records policy execution logs and security feedback data. The network security situation knowledge graph is updated in real time based on the security feedback data.

2. The computer network security access control management method based on big data according to claim 1, characterized in that, The probe is used to collect real-time access behavior sequences, including user authentication records, protocol type distribution, data packet payload characteristics, session duration, and access frequency distribution, which are used to construct a multi-level, regional network security situation knowledge graph input feature set.

3. The computer network security access control management method based on big data according to claim 1, characterized in that, Spatiotemporal graph convolutional networks are used to predict threat propagation paths and potential intrusion behaviors, specifically including: The entire network topology is divided into multiple security domains, each corresponding to a super node in the graph structure; the connection relationship between super nodes is established based on network traffic paths, permission inheritance relationships, or vulnerability dependency chains; each super node is associated with real-time access behavior sequences collected by multiple probes, forming the spatiotemporal feature tensor of the node; an initial network security graph structure is constructed, which includes a set of nodes, a set of edges, and a node feature cube; The network state of each acquisition cycle is represented as a dynamic graph sequence, and continuous time windows form a spatiotemporal graph evolution sequence; combining the node feature changes in each graph with the network topology invariance, a spatiotemporal graph convolutional network input is constructed; the labeled data are threat level labels or intrusion behavior markers for each super node within a preset future time period; Spatiotemporal graph convolutional networks are used to extract the spatiotemporal correlation features of super nodes; the spatiotemporal graph convolutional network performs convolution operations on the dynamic graph at each time slice and outputs the threat embedding vector of the node; The threat embedding vector is input into the multi-step prediction module; the future time window traffic anomaly index or permission change frequency of each supernode is predicted; the prediction results are analyzed for anomalies in conjunction with the historical security event database; if the predicted value of a supernode deviates from the baseline behavior model, it is marked as a potential intrusion behavior.

4. The computer network security access control management method based on big data according to claim 3, characterized in that, The method for obtaining the predicted value of the identity anomaly index is as follows: construct a causal reasoning graph for identity authentication, determine the variable nodes in the causal reasoning graph related to the identity anomaly index, including authentication failure frequency, session geographical offset, permission change frequency and access time anomaly, establish causal dependency chains between variable nodes, form a directed acyclic reasoning graph, and set the predicted value of the identity anomaly index as the target variable node. Collect real-time monitoring data from historical cybersecurity incidents and train a Bayesian inference network. During access control, real-time observations of authentication failure frequency, session geographic offset, permission change frequency, and access time anomaly are acquired; these observations are input into the Bayesian inference network as known nodes; the probability distribution of network nodes is updated through the evidence propagation algorithm; and the probability distribution result of the predicted identity anomaly index is output as the current predicted identity anomaly index value.

5. The computer network security access control management method based on big data according to claim 4, characterized in that, The method for obtaining data flow sensitivity estimation is as follows: Deep packet inspection engines are deployed at core network switching nodes to collect data stream characteristics at fixed time windows; each data stream characteristic sequence represents the trajectory of changes in data stream transmission sensitivity within a specific time window, forming a sensitivity time series; A temporal variational autoencoder is used to extract features from sensitivity time series: the encoder network automatically learns the feature vector of sensitivity change pattern in each sensitivity time series; the decoder network attempts to reconstruct the original sensitivity curve; after training, the encoder compresses the newly acquired sensitivity time series into a low-dimensional feature representation. Density clustering algorithm is used to classify the feature vectors of sensitivity change patterns; each cluster represents a sensitivity change pattern of a class of data; after clustering, a preset sensitivity level label is assigned to each pattern. During access control operation, the system continuously collects the sensitivity time series of the current data stream; extracts the sensitivity change pattern feature vector of the current data stream using a trained temporal variational autoencoder; performs similarity matching between the sensitivity change pattern feature vector of the current data stream and the cluster center to determine the sensitivity change pattern category to which the sensitivity time series of the current data stream belongs; and outputs the sensitivity estimate of the current data stream based on the matching result.

6. The computer network security access control management method based on big data according to claim 5, characterized in that, The predicted value of the identity anomaly index and the estimated value of data flow sensitivity are fused into a multi-dimensional feature matrix. This multi-dimensional feature matrix is ​​used as the input of a deep learning model. Combined with the currently configured policy execution priority, the deep learning model uses the predicted risk value of the rule engine policy conflict for each set of feature matrices as the training objective and minimizes the prediction error of all rule engine policy conflict risk values ​​as the optimization objective. The deep learning model is continuously trained until the error converges. The rule engine policy conflict risk value is determined based on the output value of the deep learning model. The deep learning model adopts a spatiotemporal convolutional neural network architecture.

7. The computer network security access control management method based on big data according to claim 6, characterized in that, The obtained rule engine policy conflict risk value is compared with the preset conflict threshold. If the rule engine policy conflict risk value reaches or exceeds the conflict threshold, it is determined that there is a policy conflict in the rule engine. At this time, a policy reconstruction instruction is triggered and the dynamic access control policy is optimized. If the risk value of the policy conflict in the rule engine is lower than the conflict threshold, it is determined that there is no policy conflict in the rule engine, and the current policy execution state is maintained.

8. The computer network security access control management method based on big data according to claim 1, characterized in that, The system updates the cybersecurity situation knowledge graph in real time based on security feedback data. Specifically, this includes: initializing the system by building the basic structure of the cybersecurity situation knowledge graph, simultaneously establishing a feedback data repository, and linking each policy execution record, system response result, and the output of the cybersecurity situation knowledge graph; constructing an incremental learning task set using historical security feedback data, with each task corresponding to a specific network attack scenario, including training and validation sample sets; fine-tuning the parameters of the cybersecurity situation knowledge graph in each task; iteratively optimizing the embedding representation of the cybersecurity situation knowledge graph through multi-task iterations. In actual operation, the real-time security feedback data collected after each policy execution is used to construct new tasks; inputting the new tasks into the meta-learning optimizer for incremental training, updating local parameters of the current cybersecurity situation knowledge graph, and retaining the updated sub-graph model; periodically verifying the prediction accuracy of the sub-graph model; and if the error decreases to a preset threshold, synchronizing the fine-tuned parameters to the main cybersecurity situation knowledge graph, updating global graph parameters, or storing them in the scenario model library.

9. The computer network security access control management method based on big data according to claim 8, characterized in that, The reconstructing process of the dynamic access control policy also includes: when a policy conflict is detected, extracting the key dimensions from the current multidimensional feature matrix and generating a policy adjustment suggestion vector; co-optimizing the access blocking rules, session termination conditions, and data encryption strength based on the policy adjustment suggestion vector; and synchronizing the optimized policy parameters to all execution nodes through the security policy distribution channel.

10. The computer network security access control management method based on big data according to claim 3, characterized in that, The prediction of the future time window traffic anomaly index or permission change frequency for each supernode includes: If the similarity between the threat embedding vector of the current supernode and the known threat patterns in the historical security event database reaches a preset matching threshold, the fast response analysis channel is activated, and an access blocking instruction is directly generated based on the threat feature matching results. If the similarity is lower than the preset matching threshold, the traffic protocol distribution features and permission change trajectory features in the spatiotemporal feature tensor are extracted, and the unidentified threat behaviors are analyzed through a multi-level anomaly detection model to generate incremental threat feature vectors and update the historical security event database.

Images