Dynamic authority verification method and device based on user behavior analysis

Abstract

The invention relates to the technical field of user behavior analysis methods, and discloses a dynamic permission verification method based on user behavior analysis. Comprising the following steps: acquiring user operation log data, performing data processing on the operation log data, and storing the processed user operation log data into a user behavior database; analyzing the user operation log data through an LSTM model, identifying abnormal operation in the user operation log data through an anomaly detection algorithm, and constructing a risk operation prediction model in combination with the LSTM model and the anomaly detection algorithm; user operation information is obtained in real time, risk behavior detection and prediction are carried out through a risk operation prediction model, if a risk behavior is detected or predicted, warning information is generated, and permission adjustment is carried out for the risk behavior; the method has the advantages that the capability of resisting external attacks and preventing internal data leakage of the system is enhanced, and the security of enterprise core data is effectively guaranteed.

Description

Technical Field

[0001] This invention relates to the field of user behavior analysis methods, and in particular to a dynamic permission verification method and apparatus based on user behavior analysis. Background Technology

[0002] The existing dynamic configuration reporting system can quickly complete page queries and exports, but it cannot meet the business needs for some complex and customized functions on the page. Therefore, based on this, we have expanded and strengthened the existing business logic in combination with the original business requirements, so that most requirements can be achieved through overall configuration. This not only standardizes the unified management of interfaces, but also makes requirement development simpler.

[0003] Therefore, a dynamic permission verification method and device based on user behavior analysis is provided to solve the above problems. Summary of the Invention

[0004] The main objective of this invention is to solve the technical problems in the prior art, such as the inability to meet business needs for some complex and customized functions on the page.

[0005] The first aspect of this invention provides a dynamic permission verification method and apparatus based on user behavior analysis, wherein the dynamic permission verification method based on user behavior analysis includes: Acquire user operation log data, process the operation log data, and store the processed user operation log data in the user behavior database; The user operation log data is analyzed by using an LSTM model, and abnormal operations in the user operation log data are identified by an anomaly detection algorithm. A risk operation prediction model is constructed by combining the LSTM model and the anomaly detection algorithm. The system acquires user operation information in real time, detects and predicts risky behaviors through a risk operation prediction model, generates warning messages if risky behaviors are detected or predicted, and adjusts permissions accordingly for such behaviors.

[0006] Optionally, obtaining user operation log data includes: Obtain user account information and create user operation log data under the user account information; Based on different button categories, obtain the button click frequency information for each button in different time periods; Obtain the time period information for each user operation from start to completion; Obtain user data access scope information, including the type of data accessed, the module or functional area to which the data belongs, and the user's operation permissions for the data.

[0007] Optionally, it also includes obtaining environmental information related to user operations, specifically including: Obtain the device information for user login, which includes device type information, operating system information, and browser version information; Get the user's login address information and the user's login time information.

[0008] Optionally, the step of processing the operation log data and storing the processed user operation log data in the user behavior database includes: Perform data cleaning on the operation log data to remove duplicate, erroneous, or invalid data; Establish a user behavior database and configure its data format and storage structure. The processed user operation log data is stored in the user behavior database.

[0009] Optionally, the step of analyzing user operation log data using an LSTM model, identifying abnormal operations in the user operation log data using an anomaly detection algorithm, and constructing a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm includes: Establish an LSTM model, analyze the time series data of user behavior in user operation log data through the LSTM model, capture the patterns and trends of user operations in the time series, generate user prediction operations, and determine whether the actual user operation deviates from the user prediction operation. If so, mark it as an abnormal operation. By learning the characteristics of normal behavior from user operation log data using the Isolation Forest algorithm, operations that deviate significantly are considered abnormal operations. A risk operation prediction model is constructed by combining an LSTM model and an anomaly detection algorithm.

[0010] Optionally, the real-time acquisition of user operation information, the detection and prediction of risky behaviors through a risk operation prediction model, and the generation of warning information if risky behavior is detected or predicted, along with the adjustment of permissions for risky behaviors, include: Obtain user operation information, and use a risk operation prediction model to detect and predict risky behaviors based on the user operation information. If the operation is determined to be normal, no response is required. If the access is determined to be frequent or abnormal or an unauthorized operation attempt, the sensitive operation permissions will be temporarily frozen; at the same time, a warning message will be generated and sent to both the user's client and the management client. If an abnormal operation is determined to be of unknown risk level or requires further risk confirmation, a pending review information is generated and sent to the management terminal. The management terminal sends the review result, and the user terminal's permissions are adjusted according to the review result.

[0011] Optional, also includes: The client receives warning messages from the server, prompts the user, and provides options to continue or cancel the operation. If the user selects to continue, a command to continue the operation is generated and sent to the server. If the user selects to cancel the operation, a cancellation command is generated and sent to the server.

[0012] A second aspect of the present invention provides a dynamic permission verification device based on user behavior analysis, used in the dynamic permission verification method based on user behavior analysis as described above, characterized in that it includes: The operation log acquisition and processing module is used to acquire user operation log data, process the operation log data, and store the processed user operation log data into the user behavior database. The risk operation prediction model building module is used to analyze user operation log data through an LSTM model, identify abnormal operations in user operation log data through an anomaly detection algorithm, and build a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm. The risk operation warning module is used to acquire user operation information in real time, detect and predict risky behaviors through a risk operation prediction model, and generate warning information if a risky behavior is detected or predicted.

[0013] A third aspect of the present invention provides an electronic device, the electronic device comprising a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the electronic device to perform the steps of the dynamic permission verification method based on user behavior analysis as described above.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the dynamic permission verification method based on user behavior analysis as described above.

[0015] In the technical solution of this invention, user behavior data is collected and comprehensively recorded, including user operation logs and related environmental information. Combined with LSTM time-series prediction and anomaly detection algorithms in the dynamic permission decision model, this enables accurate identification of potential risky behaviors such as high-frequency abnormal access and unauthorized operation attempts. When an anomaly is detected, the system can automatically and temporarily freeze the sensitive operation permissions of high-risk users or trigger a manual review process, blocking unauthorized access and data theft at the source. This enhances the system's ability to resist external attacks and prevent internal data leakage, effectively protecting the security of core enterprise data. Attached Figure Description

[0016] Figure 1 A flowchart of a dynamic permission verification method based on user behavior analysis provided in the first embodiment of the present invention; Figure 2 A schematic diagram of the structure of a dynamic permission verification device based on user behavior analysis provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0017] This invention provides a dynamic permission verification method based on user behavior analysis, including: acquiring user operation log data; processing the operation log data; storing the processed user operation log data in a user behavior database; analyzing the user operation log data using an LSTM model; identifying abnormal operations in the user operation log data using an anomaly detection algorithm; constructing a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm; acquiring user operation information in real time; detecting and predicting risky behaviors using the risk operation prediction model; generating warning information if risky behaviors are detected or predicted; and adjusting permissions for risky behaviors. This invention solves the technical problem in the prior art where some complex and customized functions cannot meet business needs on the page.

[0018] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 The first embodiment of the dynamic permission verification method based on user behavior analysis in this invention includes: Acquire user operation log data, process the operation log data, and store the processed user operation log data in the user behavior database; The specific content of the user operation log data includes: Obtain user account information and create user operation log data under the user account information; We categorize buttons by type and obtain the button click frequency information for each button over different time periods. By recording the click frequency, we can clearly understand users' usage preferences and operating habits for different functions. The system obtains the time interval information for each user operation from start to finish; by analyzing the operation time, the efficiency of the user's operation can be evaluated, and potential system performance problems or situations where the operation process is too complex can be discovered. Obtain user data access scope information, including the type of data accessed, the module or functional area to which the data belongs, and the user's operation permissions for the data.

[0020] It also includes obtaining environmental information related to user operations, specifically including: Obtain the device information for user login, which includes device type information, operating system information, and browser version information; Get the user's login address information and the user's login time information.

[0021] The operation log data is processed, and the processed user operation log data is stored in the user behavior database. Specifically, this includes: Perform data cleaning on the operation log data to remove duplicate, erroneous, or invalid data; Establish a user behavior database and configure its data format and storage structure. The processed user operation log data is stored in the user behavior database.

[0022] The user operation log data is analyzed by using an LSTM model, and abnormal operations in the user operation log data are identified by an anomaly detection algorithm. A risk operation prediction model is constructed by combining the LSTM model and the anomaly detection algorithm. Specifically, this includes: establishing an LSTM model, analyzing the time-series data of user behavior in user operation log data through the LSTM model, capturing the patterns and trends of user operations in the time series, generating user prediction operations, judging whether the actual user operation deviates from the user prediction operation, and if so, marking it as an abnormal operation. By learning the characteristics of normal behavior from user operation log data using the Isolation Forest algorithm, operations that deviate significantly are considered abnormal operations. A risk operation prediction model is constructed by combining an LSTM model and an anomaly detection algorithm.

[0023] The system acquires user operation information in real time, detects and predicts risky behaviors through a risk operation prediction model, generates warning messages if risky behaviors are detected or predicted, and adjusts permissions accordingly for such behaviors.

[0024] Specifically, this includes: acquiring user operation information, and detecting and predicting risky behaviors based on the user operation information using a risk operation prediction model; If the operation is determined to be normal, no response is required. If the access is determined to be frequent or abnormal or an unauthorized operation attempt, the sensitive operation permissions will be temporarily frozen; at the same time, a warning message will be generated and sent to both the user's client and the management client. If an abnormal operation is determined to be of unknown risk level or requires further risk confirmation, a pending review information is generated and sent to the management terminal. The management terminal sends the review result, and the user terminal's permissions are adjusted according to the review result.

[0025] It also includes: the user receiving warning messages sent by the server, prompting the user, and providing options to continue or cancel the operation; If the user selects to continue, a command to continue the operation is generated and sent to the server. If the user selects to cancel the operation, a cancellation command is generated and sent to the server.

[0026] The second embodiment of the dynamic permission verification method based on user behavior analysis in this invention includes: Acquire user operation log data, process the operation log data, and store the processed user operation log data in the user behavior database; The purpose of acquiring user operation log data is to accurately capture various behavioral information of users during system use. Specifically, the following key data will be recorded in real time: Button Click Frequency: This feature provides detailed statistics on the number of times users click on various function buttons over different time periods. It covers all operable buttons on the system interface, such as function trigger buttons, navigation buttons, and submit buttons. By recording click frequency, it's possible to clearly understand users' usage preferences and operating habits for different functions. For example, some users may frequently click the data export button, while others may use the query button more often. Operation time: This precisely records the time a user spends from initiating an operation to its completion. This includes the entire time from when the user clicks a function button until the system returns the result or the user completes data input and submits it. Analyzing operation time allows for the assessment of user operation efficiency and the identification of potential system performance issues or overly complex operation processes. Data Access Scope: This section comprehensively records the specific scope of data accessed by users, including the data types accessed (e.g., basic user information, financial data, business-sensitive data); the modules or functional areas to which the data belongs (e.g., customer management, order processing, report analysis); and the specific files, tables, and records accessed. It also records the types of data operations performed by users, such as querying, modifying, deleting, and downloading, to gain a deeper understanding of how and for what purpose users use the data. In addition to the core data mentioned above, the client also collects environmental information related to user operations, such as the device information, login location, and login time. Device information specifically includes device type, operating system, and browser version; the login location is roughly located using the IP address; this environmental information helps in subsequent analysis of the context of user operations, such as determining whether the user is operating on a frequently used device or in a frequently used location, and whether there are any logins from different locations or from abnormal devices. The collected user operation logs are uploaded to the backend server in real time via a secure and reliable data transmission channel. During the upload process, the data is encrypted to ensure its security and integrity during transmission. Upon receiving the data, the backend server first performs data cleaning and preprocessing to remove duplicate, erroneous, or invalid data. Then, it stores the data in a specially designed user behavior database according to a preset data format and storage structure. This database possesses efficient data query and analysis capabilities, supporting subsequent large-scale data processing and machine learning model training.

[0027] The user operation log data is analyzed by using an LSTM model, and abnormal operations in the user operation log data are identified by an anomaly detection algorithm. A risk operation prediction model is constructed by combining the LSTM model and the anomaly detection algorithm. Specifically, this involves building an LSTM model, using a Long Short-Term Memory (LSTM) network to analyze time-series data of user behavior, capturing patterns and trends in user actions over time. LSTM models can handle data with long-term dependencies, making them suitable for predicting future user behavior. By training on historical user action data, such as button click frequency and action time distribution at different times, the model can learn the temporal patterns of normal user behavior. For example, users typically perform certain actions on weekday mornings, while their action patterns may differ on weekends. Based on these learned patterns, the LSTM model can predict future user actions and identify potentially risky actions that may deviate from normal patterns. This approach combines various anomaly detection algorithms, such as Isolation Forest and One-Class SVM, to identify anomalous user behavior. These algorithms learn the characteristics of normal behavior from large amounts of user behavior data and consider operations that deviate significantly from these characteristics as anomalous. Anomaly detection dimensions include, but are not limited to, abnormal increases or decreases in button click frequency, abnormal increases or decreases in operation time, sudden expansions in data access scope, or abnormal access involving sensitive data. For example, if a user frequently clicks the delete button for sensitive data within a short period, far exceeding their normal operation frequency, the anomaly detection algorithm will mark this behavior as anomalous. A risk operation prediction model is constructed by combining an LSTM model and an anomaly detection algorithm.

[0028] Through the analysis of the above machine learning model, the system can predict users' potential risky actions in real time, mainly including the following two categories: High-frequency abnormal access: This refers to a user's unusually frequent access to a certain function or data within a short period of time, which may indicate malicious attacks or data theft. For example, a user may attempt to access the same sensitive data file multiple times within a few minutes, or frequently call a function that may consume excessive system resources.

[0029] Unauthorized access attempt: This refers to a user attempting to access or manipulate functions or data beyond their current privileges. For example, a regular user attempting to access a system configuration page exclusive to an administrator, or a user with low privileges attempting to modify highly sensitive data.

[0030] Based on the model's output, the system will automatically trigger corresponding dynamic permission adjustment strategies: Temporarily Freezing Sensitive Operation Permissions: For users detected to be engaging in high-risk activities, the system will temporarily freeze some or all of their sensitive operation permissions. For example, when a user is detected to be frequently and abnormally accessing sensitive data, their permissions to download, modify, and delete that sensitive data will be temporarily frozen, preventing them from performing these high-risk operations. The duration and scope of the freeze will be dynamically adjusted according to the risk level; the higher the risk level, the longer the freeze period and the stricter the permission restrictions.

[0031] Triggering Manual Review Process: For abnormal behaviors where the risk level is difficult to determine directly or requires further confirmation, the system will trigger a manual review process. Relevant abnormal behavior records will be sent to the management console, where administrators can manually assess and judge the behavior by viewing detailed operation logs, user information, and historical behavior data. Based on the administrator's review results, a decision will be made regarding whether to adjust user permissions, such as restoring frozen permissions, further restricting permissions, or taking other security measures.

[0032] When the model detects abnormal behavior, it automatically sends an alert to the administrator and prompts the user through the front-end interface, with the message "The current operation is risky, please confirm whether to continue."

[0033] To ensure the system can respond promptly to abnormal behavior and safeguard system security and user experience, a comprehensive real-time feedback mechanism has been established, including alerts to the administrator's management terminal and notifications to users' client terminals.

[0034] When the model detects abnormal behavior, the system immediately sends alarm information to the management console through multiple methods to ensure that administrators are aware of and can handle the anomaly in a timely manner. Alarm methods include, but are not limited to: Internal system notification: Real-time alarm messages will pop up on the system interface where the administrator logs in, displaying key information such as the type of abnormal behavior, the time of occurrence, and the users involved. The administrator can click on the alarm message to view detailed operation logs and related data.

[0035] Email notification: An alert email will be sent to the administrator's registered email address. The email will contain a brief description of the abnormal behavior and a link. The administrator can log in to the system by clicking the link to view detailed information.

[0036] SMS notification: For urgent, high-risk abnormal behavior, the system will send an SMS alert to the administrator's mobile phone to ensure that the administrator can receive the notification in a timely manner even when they are not at their computer.

[0037] Simultaneously, the system will send relevant prompts to the user through the client interface, guiding the user to perform security confirmations or operations. When the user's operation is detected as risky, a prompt box will pop up on the client interface, displaying a message similar to "The current operation is risky, please confirm whether to continue." The prompt box will clearly inform the user of the potential risk type of the current operation, such as high-frequency access to sensitive data, unauthorized operation attempts, etc., and provide the following options: Continue Operation: Users can choose to continue the current operation, but the system will monitor and record the operation more strictly for subsequent analysis.

[0038] Cancel operation: The user can choose to cancel the operation, return to the previous step, or stop the current operation process.

[0039] The warning boxes will be designed with prominent colors and styles, such as red borders and warning icons, to attract the user's attention. The language of the warning messages will be concise and clear, avoiding overly technical jargon, ensuring that users understand the risks of the current operation and can make informed choices. A real-time feedback mechanism allows administrators to promptly grasp the system's security status and take appropriate action, while also informing users of the risks involved, enhancing their security awareness, and achieving a two-way guarantee of system security.

[0040] The above describes the dynamic permission verification method based on user behavior analysis in the embodiments of the present invention. The following describes the dynamic permission verification device based on user behavior analysis in the embodiments of the present invention. Please refer to [link / reference]. Figure 2 The dynamic permission verification device based on user behavior analysis in this embodiment of the invention includes, for the above embodiments: The operation log acquisition and processing module 201 is used to acquire user operation log data, process the operation log data, and store the processed user operation log data into the user behavior database. The risk operation prediction model construction module 202 is used to analyze user operation log data through an LSTM model, identify abnormal operations in user operation log data through an anomaly detection algorithm, and construct a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm. The risk operation warning module 203 is used to acquire user operation information in real time, detect and predict risky behaviors through the risk operation prediction model, and generate warning information if risky behaviors are detected or predicted.

[0041] above Figure 2 The dynamic permission verification device based on user behavior analysis in this embodiment of the invention will be described in detail from the perspective of modular functional entities. The electronic device in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0042] Figure 3 This is a schematic diagram of the structure of an electronic device 700 provided in an embodiment of the present invention. The electronic device 700 can vary significantly due to differences in configuration or performance. It may include one or more processors 710 (e.g., one or more processors) and a memory 720, and one or more storage media 730 (e.g., one or more storage devices, including RAM, FLASH, etc.) for storing application programs 733 or data 732. The memory 720 and storage media 730 can be temporary or persistent storage. The program stored in the storage media 730 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the electronic device 700. Furthermore, the processor 710 may be configured to communicate with the storage media 730 and execute the series of instruction operations in the storage media 730 on the electronic device 700.

[0043] The electronic device 700 may also include one or more power supplies 740, one or more input / output interfaces 750, and / or one or more operating systems 731, such as FreeRTOS, Android, etc. Those skilled in the art will understand that... Figure 3The illustrated electronic device structure does not constitute a limitation on electronic devices and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0044] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of a dynamic permission verification method based on user behavior analysis.

[0045] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0046] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, mobile device, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0047] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic permission verification method based on user behavior analysis, characterized in that, The dynamic permission verification method based on user behavior analysis includes: Acquire user operation log data, process the operation log data, and store the processed user operation log data in the user behavior database; The user operation log data is analyzed by using an LSTM model, and abnormal operations in the user operation log data are identified by an anomaly detection algorithm. A risk operation prediction model is constructed by combining the LSTM model and the anomaly detection algorithm. The system acquires user operation information in real time, detects and predicts risky behaviors through a risk operation prediction model, generates warning messages if risky behaviors are detected or predicted, and adjusts permissions accordingly for such behaviors.

2. The dynamic permission verification method based on user behavior analysis according to claim 1, characterized in that, The acquisition of user operation log data includes: Obtain user account information and create user operation log data under the user account information; Based on different button categories, obtain the button click frequency information for each button in different time periods; Obtain the time period information for each user operation from start to completion; Obtain user data access scope information, including the type of data accessed, the module or functional area to which the data belongs, and the user's operation permissions for the data.

3. The dynamic permission verification method based on user behavior analysis according to claim 2, characterized in that, It also includes obtaining environmental information related to user operations, specifically including: Obtain the device information for user login, which includes device type information, operating system information, and browser version information; Get the user's login address information and the user's login time information.

4. The dynamic permission verification method based on user behavior analysis according to claim 1, characterized in that, The step of processing the operation log data and storing the processed user operation log data in the user behavior database includes: Perform data cleaning on the operation log data to remove duplicate, erroneous, or invalid data; Establish a user behavior database and configure its data format and storage structure. The processed user operation log data is stored in the user behavior database.

5. The dynamic permission verification method based on user behavior analysis according to claim 1, characterized in that, The process of analyzing user operation log data using an LSTM model, identifying abnormal operations in the user operation log data using an anomaly detection algorithm, and constructing a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm includes: Establish an LSTM model, analyze the time series data of user behavior in user operation log data through the LSTM model, capture the patterns and trends of user operations in the time series, generate user prediction operations, and determine whether the actual user operation deviates from the user prediction operation. If so, mark it as an abnormal operation. By learning the characteristics of normal behavior from user operation log data using the Isolation Forest algorithm, operations that deviate significantly are considered abnormal operations. A risk operation prediction model is constructed by combining an LSTM model and an anomaly detection algorithm.

6. The dynamic permission verification method based on user behavior analysis according to claim 1, characterized in that, The process of acquiring user operation information in real time, detecting and predicting risky behaviors through a risky operation prediction model, generating warning information if risky behavior is detected or predicted, and adjusting permissions based on risky behavior includes: Obtain user operation information, and use a risk operation prediction model to detect and predict risky behaviors based on the user operation information. If the operation is determined to be normal, no response is required. If the access is determined to be frequent or abnormal or an unauthorized operation attempt, the sensitive operation permissions will be temporarily frozen; at the same time, a warning message will be generated and sent to both the user's client and the management client. If an abnormal operation is determined to be of unknown risk level or requires further risk confirmation, a pending review information is generated and sent to the management terminal. The management terminal sends the review result, and the user terminal's permissions are adjusted according to the review result.

7. The dynamic permission verification method based on user behavior analysis according to claim 6, characterized in that, Also includes: The client receives warning messages from the server, prompts the user, and provides options to continue or cancel the operation. If the user selects to continue, a command to continue the operation is generated and sent to the server. If the user selects to cancel the operation, a cancellation command is generated and sent to the server.

8. A dynamic permission verification device based on user behavior analysis, used in the dynamic permission verification method based on user behavior analysis as described in any one of claims 1-7, characterized in that, include: The operation log acquisition and processing module is used to acquire user operation log data, process the operation log data, and store the processed user operation log data into the user behavior database. The risk operation prediction model building module is used to analyze user operation log data through an LSTM model, identify abnormal operations in user operation log data through an anomaly detection algorithm, and build a risk operation prediction model by combining the LSTM model and the anomaly detection algorithm. The risk operation warning module is used to acquire user operation information in real time, detect and predict risky behaviors through a risk operation prediction model, and generate warning information if a risky behavior is detected or predicted.

9. An electronic device comprising a memory and at least one processor, wherein the memory stores instructions; characterized in that, The at least one processor invokes the instructions in the memory to cause the electronic device to perform the steps of the dynamic permission verification method based on user behavior analysis as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the steps of the dynamic permission verification method based on user behavior analysis as described in any one of claims 1-7.

Images