Intelligent park data security access method and system based on dynamic identification

Abstract

The application discloses a smart park data security access method and system based on dynamic identification, and relates to the technical field of data security, which comprises the following steps: collecting access characteristic data of a target user, and calculating the access correlation degree of the target user; based on a preset rule, the target user is marked as one of a normal user, an abnormal user or a suspected abnormal user in combination with the access correlation degree; if the target user is marked as a suspected abnormal user, the normal behavior cluster of the target user is obtained, and the target user whose distance between the normal behavior cluster and a real-time behavior characteristic vector is greater than a preset distance threshold is marked as an abnormal user, otherwise, no change is made; if the target user is still marked as a suspected abnormal user, a pre-trained behavior trend prediction model is called to make a prediction, if a correlation degree sequence meets a preset screening rule, the target user is marked as an abnormal user, otherwise, the target user is marked as a normal user. The application solves the technical problem of high misjudgment rate of the data access security mechanism in the prior art.

Description

A Smart Park Data Security Access Method and System Based on Dynamic Recognition Technical Field

[0001] This invention relates to the field of data security technology, specifically to a method and system for secure data access in smart parks based on dynamic identification. Background Technology

[0002] With the rapid development of smart parks, data security access control has become a crucial link in ensuring park information security. Traditional data access control technologies mainly rely on static permission allocation, such as role-based access control. These methods authorize access through predefined user roles or attributes, ensuring data security to a certain extent. However, this static approach is difficult to adapt to the dynamically changing access environment in smart parks, especially in scenarios where user behavior is complex and varied, and access contexts such as time, location, and operation type are constantly evolving. Existing technologies reveal significant limitations: First, static models cannot capture subtle changes in user behavior in real time, leading to misjudgments of normal users as abnormal or missed abnormal users, thus causing security vulnerabilities or false alarms. Second, existing methods lack the ability to comprehensively analyze multi-dimensional features such as identity and access time, relying on only a single factor for decision-making, making it difficult to accurately reflect the true intent of user behavior. In addition, traditional technologies often rely on fixed thresholds for anomaly judgment, failing to proactively identify risks, resulting in passive and lagging security protection. These shortcomings not only reduce the accuracy of access control but may also affect the access experience of normal users and increase the risk of data leakage in the park. Summary of the Invention

[0003] This application provides a method and system for secure data access in smart parks based on dynamic identification, which is used to address the technical problem of high false judgment rate in existing data access security mechanisms.

[0004] In view of the above problems, this application provides a method and system for secure data access in smart parks based on dynamic identification.

[0005] Firstly, this application provides a method for secure data access in a smart park based on dynamic identification, the method comprising:

[0006] Collect the target user's identity, access spatiotemporal information, and operation data as access feature data, and calculate the access relevance of the target user based on the access feature data;

[0007] Based on preset rules and combined with access relevance, target users are marked as normal users, abnormal users, or suspected abnormal users.

[0008] If a target user is marked as a suspected abnormal user, the normal behavior cluster of the target user is obtained based on the access feature data of the target user within a preset time window, and the target user whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold is marked as an abnormal user; otherwise, no changes are made.

[0009] If the target user is still marked as a suspected abnormal user, a pre-trained behavioral trend prediction model is invoked to predict the correlation sequence of the target user within a preset time range. If the correlation sequence meets the preset filtering rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user.

[0010] Secondly, this application provides a smart park data security access system based on dynamic identification, including:

[0011] The information collection module is used to collect the target user's identity, access time and space information, and operation data as access feature data, and to calculate the access relevance of the target user based on the access feature data;

[0012] The user tagging module is used to tag target users as normal users, abnormal users, or suspected abnormal users based on preset rules and access relevance.

[0013] The secondary judgment module is used to obtain the normal behavior cluster of the target user based on the access feature data of the target user within a preset time window if the target user is marked as a suspected abnormal user, and mark the target user whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold as an abnormal user; otherwise, no changes are made.

[0014] The three-step judgment module is used to call a pre-trained behavior trend prediction model if the target user is still marked as a suspected abnormal user, to predict the correlation sequence of the target user within a preset time range. If the correlation sequence meets the preset screening rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user.

[0015] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0016] This application proposes a method and system for secure data access in smart parks based on dynamic identification. By integrating multi-dimensional features such as user identity, access spatiotemporal information, and operational data, it dynamically calculates access correlation and constructs a multi-level progressive identification mechanism from immediate judgment to historical behavior cluster analysis and future trend prediction. This significantly improves the accuracy and adaptability of data access security monitoring in smart parks. Compared to traditional methods, the technical solution provided in this application significantly overcomes the lack of flexibility of static permission models in dynamic environments. It can effectively identify suspected abnormal access with atypical behavior patterns, thereby reducing false alarm rates while enhancing the ability to detect and intercept potential security threats. This achieves the technical effect of continuous, adaptive, and precise security monitoring of data access behavior in smart park operating environments, effectively balancing security control and access experience. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 is a flowchart illustrating the smart park data security access method based on dynamic identification provided in an embodiment of this application.

[0019] Figure 2 is a schematic diagram of the structure of the smart park data security access system based on dynamic identification provided in the embodiment of this application.

[0020] The components represented by each number in the attached diagram are explained below:

[0021] Information collection module 100, user tagging module 200, secondary judgment module 300, and tertiary judgment module 400. Detailed Implementation

[0022] This application provides a method and system for secure data access in smart parks based on dynamic identification, which addresses the technical problem of high false judgment rate in existing data access security mechanisms.

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0024] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0025] Example 1, as shown in Figure 1, this application provides a method for secure data access in a smart park based on dynamic identification, wherein the method includes:

[0026] S10: Collect the target user's identity, access time and space information, and operation data as access feature data, and calculate the access correlation degree of the target user based on the access feature data.

[0027] In data security access control within smart parks, existing technologies often rely on single or static characteristics, such as fixed user roles, for security assessment, lacking a multi-dimensional and dynamic comprehensive perception of access behavior. Because the context of user access, such as time, geographical location, and specific operational intent, is complex and ever-changing, it is difficult to accurately quantify the rationality and risk level of a single access behavior based solely on identity information.

[0028] Step S10 in the method provided in this application embodiment includes:

[0029] Based on the target user's account information, the target user's identity, access time and space information, and operation data are collected as access feature data, wherein the operation data includes the access object and operation type.

[0030] Based on the target user's identity and operation data, assign operation permissions matching degree to the target user's access operations;

[0031] Based on the target user's access time and space information, the target user's access behavior is given scenario adaptability;

[0032] The access relevance of the target user is obtained by weighted summation of the operation permission matching degree and the scenario adaptability degree.

[0033] In this embodiment of the application, the identity of the target user is collected based on the account information of the target user when logging in. The identity of the target user includes the target user's role information in the organizational structure, such as the company accountant; the target user's identity also includes the department to which the target user belongs, such as the finance department; the target user's identity also includes the target user's permission level, which is a level of permission to be granted to the target user to access data based on the importance of the data to be accessed. The higher the permission level, the greater the access permission. For example, level 1 access permission can only access department attendance data, level 3 access permission can access department personnel information, and level 5 access permission can access salary data.

[0034] Based on the account information of the target user when logging in, collect the target user's access time and space information, which includes the access timestamp, IP address, building area, etc.

[0035] Based on the account information of the target user upon login, the system collects the target user's operation data. This operation data includes the accessed object and the operation type. The accessed object refers to the data type accessed by the target user, such as salary data from the finance department. The operation type can include, for example, accessing, adding, and deleting data.

[0036] The target user's identity, access time and space information, and operation data are integrated to form the target user's access feature data.

[0037] Based on the target user's identity and operation data, an operation permission matching score is assigned to the target user's access operations. A higher operation permission matching score indicates that the target user's access operation is more in line with their operating permissions and is considered normal access behavior. A lower operation permission matching score indicates that the target user's access operation is less in line with their operating permissions and is considered abnormal access information. The operation permission matching score can be set to a range of 0.1 to 1.0. For example, an accountant accessing payroll data could have an operation permission matching score of 1.0, representing normal access; a visitor accessing an industrial control interface could have an operation permission matching score of 0.1, representing abnormal access information.

[0038] Based on the target user's access time and space information, a scenario fit score is assigned to the target user's access behavior. A higher scenario fit score indicates that the target user's access scenario is more consistent with their normal access scenario, representing normal access behavior. Conversely, a lower operation permission fit score indicates that the target user's access scenario is less consistent with their normal access scenario, representing abnormal access information. The operation permission fit score can be set to an exemplary range of 0.1 to 1. For example, an accountant accessing payroll data in the finance department office could have a scenario fit score of 1.0, representing normal access; a visitor accessing transaction data outside the park could have a scenario fit score of 0.1, representing abnormal access.

[0039] The access relevance of the target user is obtained by weighting and summing the operation permission matching degree and the assigned scenario adaptation degree. Access Relevance = (Identity Weight × Operation Permission Matching Degree) + (Scenario Weight × Scenario Adaptability Degree). Where Identity Weight + Scenario Weight = 1. Identity weight and scenario weight can be obtained by evaluating the importance of the access operation permission matching degree and the scenario adaptation degree. For example, when the operation permission matching degree is low, the probability of abnormal access is higher, so a higher identity weight is assigned. For instance, if the identity weight is set to 0.65, then the scenario weight = 1 - 0.65 = 0.35.

[0040] By comprehensively collecting and integrating target users' identity, access time and space information, and operation data, a multi-dimensional access feature dataset is constructed. Based on this dataset, a comprehensive access correlation degree is calculated. This method can conduct a preliminary security posture assessment of a single access behavior from a more comprehensive and richer perspective, enabling subsequent assessments to be based on more accurate data and improving the reliability of the assessment.

[0041] S20: Based on preset rules and combined with access relevance, the target user is marked as one of the following: normal user, abnormal user, or suspected abnormal user.

[0042] After obtaining the quantitative indicator of access relevance, the key to improving judgment efficiency lies in how to perform rapid and efficient preliminary classification. Directly performing complex analysis and processing of all access requests would incur huge computational costs and would not meet the need for immediate blocking of high-risk access. On the other hand, a simple binary judgment with only a fixed threshold is too rigid and is prone to misclassifying access with inconspicuous behavioral characteristics as normal or abnormal, resulting in either missing potential threats or frequently issuing false alarms that interfere with normal users.

[0043] Step S20 in the method provided in this application embodiment includes:

[0044] Preset upper and lower limits for correlation;

[0045] If the access relevance of the target user is greater than the upper limit of the relevance, the user is marked as a normal user and access is allowed.

[0046] If the access relevance of the target user is less than the lower limit of the relevance, the user is marked as an abnormal user, access is blocked and an alarm is triggered.

[0047] If the access relevance of a target user is less than or equal to the upper limit of the relevance and greater than or equal to the lower limit of the relevance, then the user is marked as a suspected abnormal user.

[0048] In this embodiment, an upper limit and a lower limit for relevance are preset. These limits can be set based on the relevance of abnormal accesses in historical access patterns; for example, the upper limit can be set to 0.8 and the lower limit to 0.2.

[0049] If the access relevance of the target user is greater than the upper limit of relevance, the user is marked as a normal user and access is allowed.

[0050] If the access relevance of a target user is less than the lower limit of relevance, the user is marked as an abnormal user, access is blocked and an alarm is triggered. For example, a text warning message can be sent to the security administrator: "Abnormal access has occurred, please handle it in time."

[0051] If the access relevance of a target user is less than or equal to the upper limit of relevance and greater than or equal to the lower limit of relevance, it is marked as a suspected abnormal user.

[0052] By establishing preset rules for upper and lower limits of relevance, a rapid and efficient three-element preliminary classification of user access requests is achieved. Behaviors with extremely high relevance and confirmed as safe are directly marked as normal user access, ensuring the smooth flow of the vast majority of legitimate accesses; behaviors with extremely low relevance and confirmed as high-risk are immediately marked as abnormal user access and blocked, enabling rapid response to obvious threats; while accesses in the middle, which are difficult to classify immediately, are marked as suspected abnormal user access. This classification method not only significantly improves processing efficiency and avoids the computational waste of performing in-depth analysis on all requests, but also accurately filters out target objects for subsequent more refined analysis stages, thus greatly optimizing judgment efficiency while ensuring security.

[0053] S30: If the target user is marked as a suspected abnormal user, based on the target user's access feature data within a preset time window, obtain the target user's normal behavior cluster, and mark the target user whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold as an abnormal user; otherwise, no changes are made.

[0054] General security rules or group behavior models are difficult to apply to the unique behavioral habits of each user. This may lead to misjudging a user’s occasional but reasonable abnormal behavior, such as accessing the site outside of working hours for an urgent task, as a security threat.

[0055] Step S30 in the method provided in this application embodiment includes:

[0056] Extract the access feature data of the target user within a preset time window, and extract the access correlation, access time period and access area as the core feature vector to form a historical access feature vector set;

[0057] Based on DBSCAN, obtain the normal behavior clusters of the target user;

[0058] Specifically, based on DBSCAN, the normal behavior clusters of the target user are obtained, including:

[0059] Obtain the set of historical access feature vectors and filter out noise;

[0060] Set the neighborhood radius parameter and minimum sample number parameter of the DBSCAN algorithm. The neighborhood radius parameter is dynamically adjusted based on the average distance between vectors in the historical access feature vector set, and the minimum sample number parameter is set proportionally according to the access frequency within the preset time window.

[0061] Cluster analysis of the historical access feature vector set after filtering out noise was performed using the DBSCAN algorithm to obtain multiple behavioral clusters;

[0062] Calculate the vector density of each behavior cluster, and identify the behavior cluster with the highest vector density and a sample size exceeding a preset threshold as the normal behavior cluster of the target user.

[0063] If the proportion of samples contained in the behavior cluster with the highest vector density does not exceed the preset proportion threshold, then the access feature vector with the highest frequency in the historical access feature vector set is used as the reference vector, and a set of vectors containing the reference vector and vectors whose distance from the reference vector is less than a set value is constructed as the normal behavior cluster of the target user.

[0064] Obtain the target user's current access relevance, access time period, and access region as a real-time behavior feature vector, and calculate the Euclidean distance between the real-time behavior feature vector and the center vector of the normal behavior cluster.

[0065] If the Euclidean distance is greater than a preset distance threshold, the target user will be marked as an abnormal user, access will be blocked, and an alarm will be triggered.

[0066] In this embodiment of the application, if the target user is marked as a suspected abnormal user, the access feature data of the target user within a preset time window is extracted, and the access correlation, access time period and access area are extracted from it and integrated as the core feature vector to form a historical access feature vector set.

[0067] Based on DBSCAN, we can obtain clusters of normal behaviors of target users. DBSCAN is a density-based clustering algorithm that defines a cluster as the largest set of density-connected points and can discover clusters of arbitrary shapes in data.

[0068] Specifically, the historical access feature vector set is obtained and noise is filtered out. For example, the isolated forest algorithm can be used to filter out noise, that is, to filter out abnormal vectors that deviate significantly.

[0069] The neighborhood radius parameter and minimum sample number parameter of the DBSCAN algorithm are set. The neighborhood radius parameter is dynamically adjusted based on the average distance between vectors in the historical access feature vector set. For example, if the average distance between vectors is 0.2, the neighborhood radius range is 0.15-0.25 to facilitate dynamic adjustment. The minimum sample number parameter is set proportionally according to the access frequency within a preset time window. For example, if the access frequency within the preset time window is 50 times according to the access log, and the proportion is preset to 0.2, then the minimum sample number parameter is set to 50 × 0.2 = 10.

[0070] Using the DBSCAN algorithm, based on the neighborhood radius parameter and minimum sample parameter obtained in the aforementioned steps, cluster analysis is performed on the historical access feature vector set after filtering out noise to obtain multiple behavioral clusters.

[0071] The vector density of each behavior cluster is calculated. For example, the mean similarity of each random vector pair in each behavior cluster can be calculated as the vector density. The higher the vector density, the higher the similarity of the vectors in the behavior cluster, and the more likely the behavior cluster is a normal behavior cluster. The behavior cluster with the highest vector density and whose sample size exceeds a preset threshold is identified as the normal behavior cluster of the target user. The preset threshold is a pre-set threshold to prevent behavior clusters with a small sample size that are not representative from being mistakenly identified as normal behavior clusters. For example, it can be set to 0.4.

[0072] If the proportion of samples contained in the behavior cluster with the highest vector density does not exceed a preset threshold (i.e., the number of samples is less than the preset threshold), then the access feature vector with the highest frequency in the historical access feature vector set is used as the baseline vector. A set of vectors containing the baseline vector and vectors whose distance from the baseline vector is less than a set value is constructed as the normal behavior cluster of the target user. For example, the distance setting value can be set to 0.08 to select vectors that are closer to the baseline vector and construct the normal behavior cluster of the target user.

[0073] Obtain the target user's current access relevance, access time period, and access region as a real-time behavior feature vector, and calculate the Euclidean distance between the real-time behavior feature vector and the center vector of the normal behavior cluster.

[0074] If the Euclidean distance is greater than a preset distance threshold, the target user is marked as an abnormal user, access is blocked, and an alarm is triggered. The distance threshold is a pre-set Euclidean distance threshold, which can be set based on the average Euclidean distance between the vectors within a normal behavior cluster and the center vector. For example, if the average Euclidean distance between the vectors within a normal behavior cluster and the center vector is 0.12, the distance threshold can be set to 0.12 × 1.1 = 0.132 to ensure the accuracy of marking abnormal users while accommodating possible small deviations and reducing false positives. If the Euclidean distance is less than the preset distance threshold, the target user's label is not changed; that is, the target user remains marked as a suspected abnormal user.

[0075] Cluster analysis is used to extract stable, core, and normal behavioral patterns from users' historical data, and these patterns are then used as a personalized benchmark to measure whether their current behavior is abnormal. This method can effectively identify potential threats that seem to conform to general rules but actually deviate significantly from the user's personal habits, such as account theft, while tolerating reasonable and occasional fluctuations in the user's behavior. Thus, while accurately detecting abnormal behavior, it significantly reduces the false alarm rate and improves the accuracy of personalized security protection.

[0076] S40: If the target user is still marked as a suspected abnormal user, the pre-trained behavior trend prediction model is invoked to predict the correlation sequence of the target user within a preset time range. If the correlation sequence meets the preset filtering rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user.

[0077] For suspected anomalous users whose behavior patterns are complex and cannot be definitively identified after the first two rounds of assessment, existing technologies are typically limited to analyzing the current or historical state, lacking the ability to proactively predict future risks. Existing static analysis methods cannot capture the evolution of such potential risks, resulting in a lag in the detection of progressive threats.

[0078] Step S40 in the method provided in this application embodiment includes:

[0079] Obtain a pre-trained behavioral trend prediction model;

[0080] The acquisition of a pre-trained behavioral trend prediction model includes:

[0081] Collect multiple sets of access characteristic data from multiple users within the park's historical time period;

[0082] Each access behavior in the multiple sets of access feature data is labeled with an access correlation degree tag;

[0083] The behavioral trend prediction model was built using TFT.

[0084] The behavioral trend prediction model is trained using the multiple sets of access feature data until it converges.

[0085] The system obtains access correlation data of target users in the past preset time zone, inputs it into the behavior trend prediction model, and the behavior trend prediction model predicts and outputs the correlation sequence of target users in the future preset time zone.

[0086] Calculate the number of correlations in the correlation sequence that are greater than or equal to the lower limit of correlation, and calculate the ratio of the number of correlations to the total number of correlations in the correlation sequence as the prediction compliance ratio;

[0087] A preset compliance ratio threshold is set. When the predicted compliance ratio is less than the compliance ratio threshold, it is determined that the correlation sequence meets the preset filtering rules. The compliance ratio threshold is inversely proportional to the access correlation of the target user.

[0088] In this embodiment of the application, a pre-trained behavior trend prediction model is obtained.

[0089] Specifically, multiple sets of access characteristic data from multiple users within the park's historical time period are collected.

[0090] For each access behavior in multiple sets of access feature data, an access correlation label is labeled one by one.

[0091] A behavioral trend prediction model is built using TFT (Thinking-Thinking Multilevel Time Series Prediction). TFT is a hybrid architecture combining attention mechanisms and recurrent networks, designed to address complex dependencies in multilevel time series prediction. For example, the TFT model structure includes an encoder and a decoder. The encoder, used to understand patterns in past input sequences, is configured with two encoding layers, each with 4 attention heads and 32 hidden units. The decoder, used to predict future sequences, is also configured with two decoding layers, each with 4 attention heads and 32 hidden units.

[0092] The trend prediction model is trained until convergence by taking multiple sets of access feature data from multiple users over a historical period as input and using labeled access correlation labels as supervision. For example, if multiple sets of access feature data not used for training are input into the trend prediction model, and the error between the access correlation output of the model and the labeled access correlation is less than or equal to 0.08, then the trend prediction model training is complete.

[0093] Obtain the access correlation data of the target user in the past preset time zone, input the access correlation data of the target user in the past preset time zone into the behavior trend prediction model, and the behavior trend prediction model predicts and outputs the correlation sequence of the target user in the future preset time zone.

[0094] Calculate the number of correlations in the correlation series that are greater than or equal to the lower correlation limit, and then calculate the ratio of this number to the total number of correlations in the correlation series. This ratio is used as the prediction compliance rate. Prediction compliance rate = Number of correlations greater than or equal to the lower correlation limit ÷ Total number of correlations in the correlation series.

[0095] A preset compliance ratio threshold is established. When the predicted compliance ratio is less than the threshold, the correlation sequence is judged to meet the preset screening rules. The compliance ratio threshold is inversely proportional to the target user's access correlation. Specifically, the compliance ratio threshold is a pre-set threshold representing the predicted correlation of the target user based on their access correlation. For example, if the user's access correlation is 0.8, the compliance ratio threshold can be set to (1-0.8)×1.2=0.24, where 1.2 is a coefficient used to appropriately increase the compliance ratio threshold to reduce the probability of false positives. The system then checks whether the predicted compliance ratio is less than the compliance ratio threshold. If it is, it indicates that the target user's access correlation may be low in the future preset time zone, i.e., there is a risk, and the target user is marked as an abnormal user; otherwise, the target user is marked as a normal user.

[0096] By introducing a pre-trained behavioral trend prediction model, the system predicts the future access correlation sequences of users, achieving a leap from static analysis to dynamic prediction and providing a forward-looking security risk detection capability. By analyzing the time-series patterns contained in historical behavioral data, it predicts what target users might do next, enabling the early identification of access requests whose current behavior is within acceptable limits but whose development trend clearly points to high risk. This allows for early detection and proactive defense against progressive and latent security threats.

[0097] Example 2, as shown in Figure 2, based on the same inventive concept as the smart park data security access method based on dynamic identification provided in Example 1, this embodiment of the invention also provides a smart park data security access system based on dynamic identification, including:

[0098] Information collection module 100 is used to collect the target user's identity, access time and space information, and operation data as access feature data, and to calculate the access correlation degree of the target user based on the access feature data;

[0099] User tagging module 200 is used to tag target users as one of normal users, abnormal users or suspected abnormal users based on preset rules and access relevance.

[0100] The secondary judgment module 300 is used to obtain the normal behavior cluster of the target user based on the access feature data of the target user within a preset time window if the target user is marked as a suspected abnormal user, and mark the target user whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold as an abnormal user; otherwise, no changes are made.

[0101] The three-stage judgment module 400 is used to call a pre-trained behavior trend prediction model if the target user is still marked as a suspected abnormal user, to predict the correlation sequence of the target user within a preset time range. If the correlation sequence meets the preset screening rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user.

[0102] In one embodiment, the information acquisition module 100 is further configured to:

[0103] Based on the target user's account information, the target user's identity, access time and space information, and operation data are collected as access feature data, wherein the operation data includes the access object and operation type.

[0104] Based on the target user's identity and operation data, assign operation permissions matching degree to the target user's access operations;

[0105] Based on the target user's access time and space information, the target user's access behavior is given scenario adaptability;

[0106] The access relevance of the target user is obtained by weighted summation of the operation permission matching degree and the scenario adaptability degree.

[0107] In one embodiment, the user tagging module 200 is further configured to:

[0108] Preset upper and lower limits for correlation;

[0109] If the access relevance of the target user is greater than the upper limit of the relevance, the user is marked as a normal user and access is allowed.

[0110] If the access relevance of the target user is less than the lower limit of the relevance, the user is marked as an abnormal user, access is blocked and an alarm is triggered.

[0111] If the access relevance of a target user is less than or equal to the upper limit of the relevance and greater than or equal to the lower limit of the relevance, then the user is marked as a suspected abnormal user.

[0112] In one embodiment, the secondary judgment module 300 is further configured to:

[0113] Extract the access feature data of the target user within a preset time window, and extract the access correlation, access time period and access area as the core feature vector to form a historical access feature vector set;

[0114] Based on DBSCAN, obtain the normal behavior clusters of the target user;

[0115] Specifically, based on DBSCAN, the normal behavior clusters of the target user are obtained, including:

[0116] Obtain the set of historical access feature vectors and filter out noise;

[0117] Set the neighborhood radius parameter and minimum sample number parameter of the DBSCAN algorithm. The neighborhood radius parameter is dynamically adjusted based on the average distance between vectors in the historical access feature vector set, and the minimum sample number parameter is set proportionally according to the access frequency within the preset time window.

[0118] Cluster analysis of the historical access feature vector set after filtering out noise was performed using the DBSCAN algorithm to obtain multiple behavioral clusters;

[0119] Calculate the vector density of each behavior cluster, and identify the behavior cluster with the highest vector density and a sample size exceeding a preset threshold as the normal behavior cluster of the target user.

[0120] If the proportion of samples contained in the behavior cluster with the highest vector density does not exceed the preset proportion threshold, then the access feature vector with the highest frequency in the historical access feature vector set is used as the reference vector, and a set of vectors containing the reference vector and vectors whose distance from the reference vector is less than a set value is constructed as the normal behavior cluster of the target user.

[0121] Obtain the target user's current access relevance, access time period, and access region as a real-time behavior feature vector, and calculate the Euclidean distance between the real-time behavior feature vector and the center vector of the normal behavior cluster.

[0122] If the Euclidean distance is greater than a preset distance threshold, the target user will be marked as an abnormal user, access will be blocked, and an alarm will be triggered.

[0123] In one embodiment, the three-step judgment module 400 is further configured to:

[0124] Obtain a pre-trained behavioral trend prediction model;

[0125] The acquisition of a pre-trained behavioral trend prediction model includes:

[0126] Collect multiple sets of access characteristic data from multiple users within the park's historical time period;

[0127] Each access behavior in the multiple sets of access feature data is labeled with an access correlation degree tag;

[0128] The behavioral trend prediction model was built using TFT.

[0129] The behavioral trend prediction model is trained using the multiple sets of access feature data until it converges.

[0130] The system obtains access correlation data of target users in the past preset time zone, inputs it into the behavior trend prediction model, and the behavior trend prediction model predicts and outputs the correlation sequence of target users in the future preset time zone.

[0131] Calculate the number of correlations in the correlation sequence that are greater than or equal to the lower limit of correlation, and calculate the ratio of the number of correlations to the total number of correlations in the correlation sequence as the prediction compliance ratio;

[0132] A preset compliance ratio threshold is set. When the predicted compliance ratio is less than the compliance ratio threshold, it is determined that the correlation sequence meets the preset filtering rules. The compliance ratio threshold is inversely proportional to the access correlation of the target user.

[0133] In summary, the embodiments of this application have at least the following technical effects:

[0134] This application proposes a method and system for secure data access in smart parks based on dynamic identification. By integrating multi-dimensional features such as user identity, access spatiotemporal information, and operation data, the method and system dynamically calculates access correlation and constructs a multi-level progressive identification mechanism that progresses from immediate judgment to historical behavior cluster analysis and future trend prediction. This significantly improves the accuracy and adaptability of data access security monitoring in smart parks. Specifically, by comprehensively calculating access correlation and performing preliminary classification based on preset rules, basic screening and rapid response to user access behavior are achieved. Furthermore, for initially flagged suspected abnormal users, DBSCAN clustering technology is used to extract normal behavior clusters representing their individual normal behavior from their historical behavior data. A secondary screening is then performed by comparing the deviation between real-time behavior feature vectors and these clusters, enabling personalized judgments based on the user's historical behavior patterns and effectively distinguishing between occasional reasonable anomalies and genuinely suspicious behavior. Finally, for complex cases that cannot be determined after the first two rounds of screening, a behavior trend prediction based on the TFT model is introduced. By analyzing the potential changing trends of user access correlation over a future period, behavioral risks are proactively predicted, achieving a leap from static judgment to dynamic prediction and improving the detection capability of complex abnormal behaviors. Compared with traditional methods, the technical solution provided in this application significantly overcomes the shortcomings of static permission models in terms of flexibility in dynamic environments. It can effectively identify suspected abnormal access with atypical behavior patterns, thereby reducing the false alarm rate and enhancing the ability to detect and intercept potential security threats. It achieves the technical effect of continuous, adaptive, and precise security monitoring of data access behavior in a smart park operation environment, and effectively balancing security control and access experience.

[0135] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0136] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0137] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for secure data access in smart parks based on dynamic identification, characterized in that: include: Collect the target user's identity, access spatiotemporal information, and operation data as access feature data, and calculate the access relevance of the target user based on the access feature data; Based on preset rules and combined with access relevance, target users are marked as normal users, abnormal users, or suspected abnormal users. If a target user is marked as a suspected abnormal user, the normal behavior cluster of the target user is obtained based on the access feature data of the target user within a preset time window. Target users whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold are marked as abnormal users. Otherwise, no changes are made. If the target user is still marked as a suspected abnormal user, the pre-trained behavioral trend prediction model is invoked to predict the correlation sequence of the target user within a preset time range. If the correlation sequence meets the preset screening rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user. The pre-trained behavioral trend prediction model is built based on a deep learning multi-level time series prediction model.

2. The smart park data security access method based on dynamic identification according to claim 1, characterized in that, Collect the target user's identity, access spatiotemporal information, and access operation data as access feature data. Calculate the target user's access relevance based on the access feature data, including: collecting the target user's identity, access spatiotemporal information, and operation data based on the target user's account information, wherein the operation data includes the access object and operation type; assigning operation permission matching degree to the target user's access operations based on the target user's identity and operation data; assigning scenario adaptability degree to the target user's access behavior based on the target user's access spatiotemporal information; and weighted summing the operation permission matching degree and scenario adaptability degree to obtain the target user's access relevance.

3. The smart park data security access method based on dynamic identification according to claim 1, characterized in that, Based on preset rules and combined with access relevance, target users are marked as normal users, abnormal users, or suspected abnormal users. This includes: preset upper and lower limits for relevance; if the target user's access relevance is greater than the upper limit, it is marked as a normal user and access is allowed; if the target user's access relevance is less than the lower limit, it is marked as an abnormal user, access is blocked, and an alarm is triggered; if the target user's access relevance is less than or equal to the upper limit and greater than or equal to the lower limit, it is marked as a suspected abnormal user.

4. The smart park data security access method based on dynamic identification according to claim 1, characterized in that, If a target user is marked as a suspected abnormal user, based on the target user's access feature data within a preset time window, a normal behavior cluster of the target user is obtained. Target users whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold are marked as abnormal users. This includes: extracting the target user's access feature data within the preset time window, extracting access correlation, access time period, and access area from it as core feature vectors to form a historical access feature vector set; obtaining the target user's normal behavior cluster based on DBSCAN; obtaining the target user's current access correlation, access time period, and access area as real-time behavior feature vectors, and calculating the Euclidean distance between the real-time behavior feature vector and the center vector of the normal behavior cluster; if the Euclidean distance is greater than a preset distance threshold, the target user is marked as an abnormal user, access is blocked, and an alarm is triggered.

5. The smart park data security access method based on dynamic identification according to claim 4, characterized in that, Based on DBSCAN, the normal behavior clusters of the target user are obtained, including: obtaining the historical access feature vector set and filtering noise; setting the neighborhood radius parameter and minimum sample number parameter of the DBSCAN algorithm, wherein the neighborhood radius parameter is dynamically adjusted based on the average distance between each vector in the historical access feature vector set, and the minimum sample number parameter is set proportionally according to the access frequency within a preset time window; performing cluster analysis on the noise-filtered historical access feature vector set using the DBSCAN algorithm to obtain multiple behavior clusters; calculating the vector density of each behavior cluster, and determining the behavior cluster with the highest vector density and the proportion of samples contained therein exceeding a preset proportion threshold as the normal behavior cluster of the target user; if the proportion of samples contained in the behavior cluster with the highest vector density does not exceed the preset proportion threshold, then the access feature vector with the highest frequency in the historical access feature vector set is used as the reference vector, and a set of vectors containing the reference vector and vectors whose distance from the reference vector is less than a set value is constructed as the normal behavior cluster of the target user.

6. The smart park data security access method based on dynamic identification according to claim 3, characterized in that, If the target user is still marked as a suspected abnormal user, a pre-trained behavioral trend prediction model is invoked to predict the target user's correlation sequence within a preset time range. If the correlation sequence meets preset filtering rules, the target user is marked as an abnormal user; otherwise, it is marked as a normal user. This includes: obtaining a pre-trained behavioral trend prediction model; obtaining the target user's access correlation data within a preset time zone in the past, inputting it into the behavioral trend prediction model, and having the behavioral trend prediction model predict and output the target user's correlation sequence in a preset time zone in the future; calculating the number of correlations in the correlation sequence that are greater than or equal to the lower limit of correlation, and calculating the ratio of the number of correlations to the total number of correlations in the correlation sequence as the prediction compliance ratio; and setting a preset compliance ratio threshold. When the prediction compliance ratio is less than the compliance ratio threshold, it is determined that the correlation sequence meets the preset filtering rules, wherein the compliance ratio threshold is inversely proportional to the target user's access correlation.

7. The smart park data security access method based on dynamic identification according to claim 6, characterized in that, Obtaining a pre-trained behavior trend prediction model includes: collecting multiple sets of access feature data from multiple users within a historical time period in the park; labeling each access behavior in the multiple sets of access feature data with an access correlation label; building the behavior trend prediction model using TFT; and training the behavior trend prediction model using the multiple sets of access feature data until convergence.

8. A smart park data security access system based on dynamic recognition, characterized in that: To implement the smart park data security access method based on dynamic identification as described in any one of claims 1-7, the system comprises: an information collection module, used to collect the identity, access spatiotemporal information, and operation data of a target user as access feature data, and calculate the access correlation degree of the target user based on the access feature data; a user marking module, used to mark the target user as a normal user, an abnormal user, or a suspected abnormal user based on preset rules and the access correlation degree; a secondary judgment module, used to, if the target user is marked as a suspected abnormal user, obtain the normal behavior cluster of the target user based on the access feature data of the target user within a preset time window, and mark the target user whose distance between the normal behavior cluster and the real-time behavior feature vector is greater than a preset distance threshold as an abnormal user, otherwise, no change is made; a tertiary judgment module, used to, if the target user is still marked as a suspected abnormal user, call a pre-trained behavior trend prediction model to predict the correlation degree sequence of the target user within a preset time range, and if the correlation degree sequence meets the preset filtering rules, mark the target user as an abnormal user, otherwise, mark it as a normal user.

Images