Zero-trust core management and control system and method based on user behavior and osi seven-layer authentication

Abstract

The application discloses a zero-trust core management and control system and method based on user behavior and OSI seven-layer authentication, and relates to the technical field of network security guarantee.The application comprises the following steps: converting OSI seven-layer protocol features into computable vector parameter factors, combining user identity and behavior vector information to form a three-dimensional trust evidence chain, and adopting a designed state vector similarity algorithm to realize zero-trust closed-loop verification.The application eliminates cross-level blind areas by adopting eight-layer full-stack collection of user behavior and OSI seven-layer protocol, improves all-around attack resistance, solves the defects of the existing security defense system, which only provides protection for a specific function, has single security function and lacks overall security protection means, unifies OSI seven layers and user behavior into computable vectors, realizes credibility quantification through a similarity algorithm and a corresponding AI recognition model, avoids the roughness of the existing automatic discrimination system based on levels, and improves control accuracy.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security guarantee, in particular to a zero-trust core management and control system and method based on user behavior and OSI seven-layer authentication. BACKGROUND

[0002] With the deep popularization of hybrid cloud, remote office and IoT technology, the traditional protection model based on clear internal and external network boundary has gradually failed, and network attacks have shown new features of using legal identity, penetrating multiple levels and spreading horizontally along the whole link.

[0003] Under this background, as the core nerve of the security system, the core management and control device bears the key functions of core business access audit, risk identification, policy execution, resource scheduling, etc., and its importance is increasingly prominent, but at the same time it also faces the severe challenges of explosive access scale and complex attack means. The concept of zero-trust architecture "never trust, always verify" points out the direction for breaking through the situation, however, the current mainstream zero-trust core management and control technology still has fundamental defects in actual application, which is difficult to cope with the increasingly complex threat environment. The core defects of the existing technology deeply restrict the effectiveness of zero-trust protection:

[0004] Firstly, the traditional scheme is generally limited to two-dimensional authentication of "identity + device", lacks the ability to perceive and associate the OSI seven-layer full-stack network state, resulting in that attackers can implement malicious operations under the guise of holding a legal identity through means such as fake device information and hijacking network sessions, forming a blind area of protection "legal identity but abnormal behavior and network state";

[0005] Secondly, the state collection of OSI seven-layer protocol is scattered, and the protocol states of physical layer to application layer are isolated from each other, which cannot be integrated into a unified, computable and traceable trust evidence chain, making it difficult to detect cross-level coordinated attacks; moreover, the trust evaluation mechanism is rigid and static, relying on initial authentication or fixed strategies, and cannot be continuously adapted according to the dynamic changes of user behavior, device state and network environment, which is essentially a variant of "one-time authentication, long-term trust";

[0006] Finally, the abnormal identification capability is weak, and only single-point and single-layer alarms can be handled, lacking deep research and judgment on cross-OSI multi-layer and user behavior linkage, so that attackers can easily bypass detection by using the tactic of "single-layer compliance, multi-layer linkage violation".

[0007] Therefore, how to break the network state island of each layer, and convert heterogeneous and massive protocol features into computable unified trust parameters in real time to respond to changing threats has become a technical problem to be solved. SUMMARY

[0008] The purpose of the present application is to provide a zero-trust core management system and method based on user behavior and OSI seven-layer authentication, which converts OSI seven-layer protocol features into computable vector parameter factors, combines user identity and behavior vector information to form a three-dimensional trust evidence chain, and uses a designed state vector similarity algorithm to realize zero-trust closed-loop verification; an eight-layer full-stack trust authentication model of user behavior + OSI seven-layer network state is adopted to provide active defense function for core business systems of enterprise organizations, which is suitable for security management of business core domain computing environment, and solves the existing problems.

[0009] To solve the above technical problems, the present application is realized by the following technical solutions:

[0010] As a first aspect provided by the present application, the present application is a zero-trust core management method based on user behavior and OSI seven-layer authentication, comprising the following steps:

[0011] Step S1: When the terminal initiates a network or application access request, the edge management agent synchronously collects OSI seven-layer state vectors and user behavior vectors;

[0012] Step S2: Encode the vectors using the Word2Vec model, and then normalize the vector data through the Min-Max normalization algorithm;

[0013] Step S3: Based on historical vector data, use the RWKV model to automatically learn the normal state threshold interval of each layer to construct a physical device-transmission network-user behavior three-element dynamic trust baseline, the historical data time period used for generating the dynamic baseline is greater than 3 months, and the sample number is greater than 100,000;

[0014] Step S4: Use an integrated discriminant algorithm to calculate single-layer similarity through a weighted cosine similarity algorithm, and then calculate the global trustworthiness by weighted summation of the similarity of each layer;

[0015] Step S5: Assign permissions according to the trustworthiness level, and perform access authorization according to the corresponding disposal measures, the trustworthiness level includes high trust, medium trust, low trust and very low trust;

[0016] Step S6: After successful access, continuously collect real-time vector data and update the global trustworthiness, and trigger permission adjustment, alarm or blocking operation according to the change of the global trustworthiness; perform baseline adaptive update through regular iteration or emergency iteration, and generate an iteration report after iteration is completed and store it to the audit log.

[0017] Further, the management method further comprises the following steps:

[0018] After disposing the abnormal terminal, the central management node issues a disposal result instruction;

[0019] If it is determined that it is a false positive, the isolation is removed and the trust level is reset.

[0020] If it is determined that it is a real attack, the isolation is maintained.

[0021] Further, in the step S1, the collected OSI seven-layer state vector and user behavior vector content includes:

[0022] Collecting physical media type, hardware device fingerprint, and device specification compliance vector data of the physical layer;

[0023] Collecting data frame format, MAC address binding relationship, link encryption state, and MAC address change trajectory vector data of the data link layer;

[0024] Collecting source IP address, destination IP address, route hop number mutation information, IP geolocation, and gateway access frequency vector data of the network layer;

[0025] Collecting TCP / UDP connection establishment frequency, connection rate fluctuation, port usage compliance, and data transmission volume vector data of the transport layer;

[0026] Collecting session establishment process, session timeout time, session reconnection number, and session associated terminal identifier vector data of the session layer;

[0027] Collecting data encoding format, data compression algorithm, encryption key negotiation process, and data verification result vector data of the presentation layer;

[0028] Collecting API call frequency, API parameter compliance, application permission usage trajectory, and application log exception code vector data of the application layer;

[0029] Collecting mouse / keyboard operation frequency, operation interval, access time period, single access duration, high-frequency operation period, permission call sequence, sensitive permission usage frequency, and permission application rationality vector data of the user.

[0030] Further, in the step S2, the normalization formula used by the Min-Max normalization algorithm is:

[0031] ;

[0032] Wherein, X is the original value of a feature item in the OSI seven-layer state vector or the user behavior vector, Xmin and Xmax are respectively the minimum value and the maximum value in the data set composed of all original values of the same feature item as X; X* is the value mapped to the interval [0, 1] after normalization.

[0033] Further, in the step S4, the algorithm for calculating single-layer similarity and global trust level is:

[0034] Single layer similarity: ;

[0035] Global reliability: Reli Global = ;

[0036] Wherein, n is the total number of feature vectors collected in each layer; is the i-th feature vector; is the i-th feature vector baseline; is the i-th feature vector baseline range; is the i-th feature vector weight, and satisfies ; Single layer similarity corresponding to each layer respectively, W k is the weight coefficient of each layer, and the weight coefficient satisfies: =1.

[0037] Further, the step S5, the method of assigning permissions according to the reliability level comprises the following steps:

[0038] When the reliability is greater than or equal to X1, it is determined as high trust, and the user's role is granted complete business permission, allowing access to all authorized resources;

[0039] When X2≤reliability<X1, it is determined as medium trust, only open basic business functions, limit core database, sensitive API access;

[0040] When X3≤reliability<X2, it is determined as low trust, freeze the current session and report to the central control node;

[0041] When 0≤reliability<X3, it is determined as extremely low trust, edge control agent directly blocks terminal access and isolation, and reports to the central control node;

[0042] Wherein, X1, X2, X3 are preset values.

[0043] Further, the method of periodically updating the baseline adaptively through periodic iteration or emergency iteration is:

[0044] At a preset time point every day, adjust the baseline threshold based on the new vector data of the previous day to perform periodic iteration, and the adjustment range of the baseline threshold is not more than 5%;

[0045] When the proportion of the number of new terminals exceeds the preset proportion, the business system is upgraded or the network topology is changed, the emergency iteration is triggered, and the new limit is updated in real time after being generated.

[0046] As a second aspect provided by the present application, the present application is a zero-trust core management and control system based on user behavior and OSI seven-layer authentication, which is used to implement the management and control method of the first aspect, and comprises:

[0047] a terminal management and control object, which comprises a core database, a core network device and other core terminal devices;

[0048] an edge management and control agent, which is deployed at the entrance of each core business area, is used to collect OSI seven-layer state vectors and user behavior vectors, pre-process the collected vectors, encode the pre-processed vectors by using a Word2Vec model, map the vector data to the [0, 1] interval by using a Min-Max normalization algorithm, calculate single-layer similarity by using a weighted cosine similarity algorithm, calculate global trustworthiness by using weighted summation, and perform access authorization, permission adjustment and abnormal blocking according to the global trustworthiness level;

[0049] a central management and control node, which is used to define trustworthiness levels and disposal measures, train a dynamic trust baseline by using an RWKV model based on historical data, and perform secondary research and judgment on low-trust and extremely low-trust events.

[0050] Further, the edge management and control agent comprises:

[0051] a data collection module, which is used to synchronously collect OSI seven-layer state vectors and user behavior vectors;

[0052] a vector disposal module, which is used to encode and Min-Max normalize the collected vectors;

[0053] a trust evaluation engine, which is used to calculate single-layer similarity by using a weighted cosine similarity algorithm, and calculate global trustworthiness by using weighted summation;

[0054] a policy execution engine, which is used to perform access authorization, permission adjustment and abnormal blocking according to the global trustworthiness level;

[0055] a data caching and synchronization agent, which is used to cache local data and synchronize increments to the central management and control node.

[0056] Further, the central management and control node comprises:

[0057] a trust policy module, which is used to define trustworthiness levels and disposal measures;

[0058] a baseline training module, which is used to train a dynamic trust baseline by using an RWKV model based on historical data; and a high-risk research and judgment module, which is used to perform secondary research and judgment according to the trustworthiness level;

[0059] a data audit module for storing full-network vector data, trust evaluation logs and abnormality handling records;

[0060] a linkage handling module for formulating a joint handling strategy and issuing it to the edge control agent for execution.

[0061] The present application has the following beneficial effects:

[0062] The present application converts the OSI seven-layer protocol features into unified computable vector parameter factors by establishing an eight-layer full-stack authentication model covering the OSI physical layer, data link layer, network layer, transmission layer, session layer, presentation layer, application layer and user behavior layer, combines user identity and behavior vector information to form a three-dimensional trust evidence chain of "physical device - transmission network - user behavior", completely eliminates cross-layer protection blind spots, and calculates the similarity between real-time state and baseline after standardizing the eight-layer vector data through a state vector similarity algorithm to realize trust quantitative evaluation; a ternary dynamic trust baseline of "physical device - transmission network - user behavior" is constructed. The baseline can be adaptively iterated according to network environment changes, user behavior evolution and device state updates without human intervention, and is suitable for dynamic complex scenarios.

[0063] Of course, implementing any product of the present application does not necessarily need to achieve all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0065] Figure 1 a flowchart of the zero-trust core control method of the present application based on user behavior and OSI seven-layer authentication;

[0066] Figure 2 a full-stack eight-layer zero-trust authentication model diagram of the present application user + OSI seven-layer;

[0067] Figure 3 a schematic diagram of the zero-trust core control system of the present application based on user behavior and OSI seven-layer authentication;

[0068] Figure 4 a schematic diagram of the central control node of the present application;

[0069] Figure 5 a schematic diagram of the edge control agent of the present application;

[0070] Figure 6Fig. 1 is a schematic diagram of a terminal control object of the present application. DETAILED DESCRIPTION

[0071] In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular architectures, techniques, etc., in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0072] It is to be understood that the terminology "includes", "has", "holds", "contains" or "comprises", "comprising", or "including" when used in this specification and in the following claims, specifies the presence of stated features, integers, steps, operations, elements, or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof.

[0073] It is also to be understood that the terminology "and / or" when used in this specification and in the following claims, refers to at least one of the items, or any combination of the items, or all of the items, and includes all possible combinations of the items.

[0074] As used in this specification and in the claims, the terms "if" and "when" can be interpreted to mean "upon" or "in response to a determination" or "in response to a detection" depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted to mean "upon determining" or "in response to a determination" or "upon detecting [the described condition or event]" or "in response to a detection [of the described condition or event]" depending on the context.

[0075] In addition, the terms "first", "second", "third", etc. in the description of the present application are only used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0076] Reference in the specification to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, although it can. The terms "including", "containing", "having" and variations thereof are meant to encompass the terms "including but not limited to", unless otherwise expressly specified or limited by context.

[0077] Embodiment One:

[0078] The application is a zero-trust core management method based on user behavior and OSI seven-layer authentication, which takes "full-stack authentication-vector modeling-dynamic baseline-continuous evaluation" as the core to build a zero-trust management method, including the following steps:

[0079] Step S1: When the terminal initiates a network or application access request, the edge management agent synchronously collects OSI seven-layer state vectors and user behavior vectors;

[0080] Step S2: Encode the vectors using the Word2Vec model, and then normalize the vector data through the Min-Max normalization algorithm;

[0081] Step S3: Based on historical vector data, use the RWKV model to automatically learn the normal state threshold interval of OSI seven layers and user behavior layer to build a physical device-transmission network-user behavior three-element dynamic trust baseline;

[0082] Step S4: Calculate the single-layer similarity through the weighted cosine similarity algorithm, and then calculate the global trustworthiness through weighted summation of the similarity of each layer;

[0083] Step S5: Assign permissions according to the trustworthiness level and perform access authorization;

[0084] Step S6: After the terminal access is successful, continuously collect real-time vector data and update the global trustworthiness, and trigger permission adjustment, alarm or blocking operation according to the change of the global trustworthiness; perform baseline adaptive update through regular iteration or emergency iteration.

[0085] The application breaks the traditional zero-trust "identity + device" two-dimensional authentication framework, and through the eight-layer full-stack authentication model covering OSI physical layer, data link layer, network layer, transmission layer, session layer, presentation layer, application layer and user behavior layer, it converts OSI seven-layer protocol features into unified computable vector parameter factors, combines user identity and behavior vector information, forms a three-dimensional trust evidence chain of "physical device-transmission network-user behavior", and completely eliminates the cross-layer protection blind area.

[0086] Embodiment two:

[0087] Please refer to Figure 1 The application is a zero-trust core management method based on user behavior and OSI seven-layer authentication, including the following steps:

[0088] Step S1: Access request triggers eight-layer vector synchronization collection: When the terminal initiates a network or application access request, the edge management agent detects the request and automatically triggers the eight-layer full-stack data collection module: the OSI seven-layer state collection unit synchronously collects physical layer hardware fingerprint, data link layer MAC address, network layer IP, and other vector data through various layer agents; the user behavior collection unit collects terminal current access period, initial operation (such as "clicking the login button"), and other behavior vector data, performs preprocessing operations such as missing value filling and fixed length truncation on the collected raw data, and transmits the vector data to the vector processing module in real time; the terminal is an office computer, IoT device, and the access request is opening VPN, logging into a business system;

[0089] Step S2: Vector encoding and standardization: the preprocessed vector is encoded using the Word2Vec model to solve the defect that the data vector matrix is too sparse and requires longer dimension vectors to express words as the dimension of the feature space increases in the traditional One-hot encoding method, which is not conducive to the calculation of the deep learning model. Then, the Min-Max normalization algorithm is used to map each layer vector element to the [0, 1] interval, eliminating the dimension difference, such as the unification of different dimension parameters such as physical layer hardware fingerprint similarity and application layer API call frequency. The standardized vector data is temporarily stored in a time series database, and a vector ID is generated for subsequent tracing;

[0090] Step S3: Dynamic baseline construction: based on historical vector data, the RWKV model is used to automatically learn the normal state threshold interval of each layer to construct a physical device-transmission network-user behavior three-element dynamic trusted baseline. The historical data time period used to generate the dynamic baseline is greater than 3 months, and the sample size is greater than 100,000. A sufficient time period and sample size are required to ensure model recognition accuracy. The output is the normal distribution interval of each layer vector, such as physical layer hardware fingerprint similarity ≥ 95% being normal and application layer API call frequency deviation ≤ 20% being normal.

[0091] Step S4: Trustworthiness discrimination: an integrated discrimination algorithm is used to calculate the single-layer similarity through a weighted cosine similarity algorithm, calculate the similarity between the actual feature vector collected in real time and the corresponding baseline vector of each layer, take the value as 0-100 points, and judge the layer as abnormal when the single-layer similarity is less than 70 points. Then, the global trustworthiness is calculated by summing the weighted similarity of each layer.

[0092] Step S5: Dynamic permission allocation and access authorization: permissions are allocated according to trustworthiness levels, which include high trust, medium trust, low trust, and very low trust, and access authorization is performed according to corresponding handling measures;

[0093] Step S6: Post-access continuous trust assessment: After successful access, real-time vector data is continuously collected and global trust is updated, and according to the change of global trust, permission adjustment, alarm or blocking operation is triggered; baseline adaptive update is performed through periodic iteration or emergency iteration, and iteration report is generated after iteration is completed and stored in audit log; after successful access, the eight-layer full-stack authentication module continuously collects real-time state vector and user behavior data, for example, the standardized vector and trust score are updated every 1 second, such as:

[0094] Trust level is maintained: current permissions are maintained;

[0095] Trust level from high / medium to low trust: automatically trigger permission downgrade + local alarm;

[0096] Trust level drops to very low trust: immediately freeze the session + block access, report to the central control node;

[0097] Trust level is improved: report to the central control node for secondary confirmation, and perform trust level improvement after confirmation;

[0098] Step S7: Abnormal handling result feedback and terminal recovery step: after handling the abnormal terminal, the central control node issues a handling result instruction;

[0099] If it is determined to be a false alarm (e.g., the fingerprint changes after terminal hardware repair are not updated): the central control node instructs the edge node to remove the isolation, resets the terminal trust level to medium trust, and allows re-access;

[0100] If it is determined to be a real attack (e.g., the terminal is implanted with malicious programs): the central control node instructs the edge node to maintain isolation, and after the terminal removes the malicious programs and returns to normal state, the access process of steps S1-S5 is re-executed;

[0101] After the terminal recovers and accesses, the edge node monitors its trust level (e.g., the evaluation frequency is increased to 1 time per 100 milliseconds), and after a certain period of time (e.g., 12 hours) without abnormalities, the normal evaluation frequency is restored;

[0102] Step S8: Dynamic baseline adaptive iteration, the method for baseline adaptive update through periodic iteration or emergency iteration is:

[0103] At preset time points every day, such as 2-4 am every day, the central control node starts baseline periodic iteration, adjusts the baseline threshold based on the new vector data of the previous day to perform periodic iteration, and the adjustment range of the baseline threshold is not more than 5%; for example: synchronize the eight-layer vector data of the previous day from all edge nodes; fine-tune the eight-layer normal state threshold interval, and adjust the application layer API call frequency fluctuation threshold from ±20% to ±18%.

[0104] When the proportion of the number of newly added terminals exceeds the preset proportion, the business system is upgraded significantly, or the network topology is changed, an emergency iteration is triggered, and baseline retraining is completed within 2 hours. If the emergency iteration condition is triggered, such as the addition of 200 IoT terminals, accounting for 15% of the original terminals, the central control node automatically starts the emergency iteration, notifies all edge nodes to suspend the use of the baseline, re-completes the new baseline training, and immediately issues it to the edge nodes after the training is completed. The edge nodes resume normal evaluation after updating the baseline.

[0105] After the baseline iteration is completed, the central control node generates an iteration report, which is stored in the audit log. The iteration report includes the threshold comparison before and after iteration, iteration data volume, and iteration effect evaluation.

[0106] The normal threshold interval is automatically generated and iterated by the AI model and algorithm, which adapts to business and environmental changes without manual maintenance. It provides continuous evaluation and paradigm upgrade, upgrading from traditional "single authentication" to "continuous trust evaluation" of zero trust, and completely closes the zero trust logic loop.

[0107] Abandoning the traditional static whitelist mechanism, based on massive historical data, the RWKV model automatically learns to generate eight-layer "normal state threshold intervals" by fusing the efficient parallel training of Transformer and the efficient inference of RNN. It constructs a "physical device-transmission network-user behavior" three-element dynamic trust baseline. The baseline can be self-adapted and iterated according to changes in network environment, user behavior evolution, and device state updates, without human intervention, and adapts to dynamic complex scenarios.

[0108] As an embodiment provided by the present application, preferably, in the step S1, the collected OSI seven-layer state vector and user behavior vector content includes:

[0109] Collecting physical medium type, hardware device fingerprint, and device specification compliance vector data of the physical layer;

[0110] Collecting data frame format, MAC address binding relationship, link encryption state, and MAC address change trajectory vector data of the data link layer;

[0111] Collecting source IP address, target IP address, route hop number mutation information, IP geolocation, and gateway access frequency vector data of the network layer;

[0112] Collecting TCP / UDP connection establishment frequency, connection rate fluctuation, port usage compliance, and data transmission volume vector data of the transport layer;

[0113] Collecting session establishment process, session timeout time, session reconnection times, and session associated terminal identifier vector data of the session layer;

[0114] Collecting data encoding format of presentation layer, data compression algorithm, encryption key negotiation process, data check result vector data;

[0115] Collecting API call frequency of application layer, API parameter compliance, application permission usage track, application log exception code vector data;

[0116] Collecting mouse / keyboard operation frequency of user, operation interval, access time period, single access duration, high-frequency operation period, permission call sequence, sensitive permission usage frequency, and permission application rationality vector data.

[0117] The OSI seven layers and user behavior are uniformly converted into computable vectors, the similarity algorithm and the corresponding AI recognition model are used for realizing the credibility quantization, avoiding the deficiency of the existing automatic identification system based on the level that the control granularity is rough, improving the control accuracy, breaking through the two-dimensional limitation of identity + device, using the eight-layer full-stack collection of user behavior + OSI seven layers to eliminate the cross-level blind area, improving the all-around attack resistance, and solving the defects of the existing security defense system that only provides protection for a specific function, the security function is single, and the overall security protection means is lacked.

[0118] Embodiment three:

[0119] As shown in Figure 2 , the present application is a zero-trust core control method based on user behavior and OSI seven-layer authentication, constructs a full-stack eight-layer zero-trust authentication model of user + OSI seven layers, and the model structure is as shown in Figure 2 , for different types of dangerous ways, through real-time collection of multi-dimensional state vectors in each layer (physical layer to application layer) of OSI protocol stack, including: collecting physical medium type, hardware device fingerprint (CPU serial number, mainboard MAC, hard disk unique identifier) in physical layer; collecting data frame format, MAC address change track in data link layer; collecting IP address, route hop number mutation information in network layer; collecting connection rate fluctuation, protocol compliance data in transport layer; collecting session establishment / termination process, session duration in session layer; collecting data encoding format, encryption standard in presentation layer; collecting API call frequency, permission usage track in application layer. At the same time, the user behavior vector (operation habit, time period preference, resource access sequence) is collected, the state vector similarity algorithm is designed, the eight-layer vector data is standardized, the similarity between real-time state and baseline is calculated, and the credibility quantization evaluation is realized.

[0120] As an embodiment provided by the present application, preferably, the full-stack eight-layer zero-trust authentication model of user + OSI seven layers includes an OSI seven-layer state collection and coding unit and a user behavior state collection and coding unit.

[0121] More preferably, the OSI seven-layer state acquisition and coding unit: deploy protocol analysis agents at each layer, acquire multi-dimensional state vectors in the order of "physical layer → data link layer → network layer → transport layer → session layer → presentation layer → application layer", and convert each layer "feature item" into a calculable vector parameter factor, with specific contents as follows: Figure 2 Each layer "feature item" is converted into a calculable vector parameter factor, with specific contents as follows:

[0122] Physical layer:

[0123] Acquisition content: physical medium type, such as Ethernet, Wi-Fi, hardware device fingerprint, CPU serial number, motherboard MAC address, hard disk unique identifier, BIOS version, device specification compliance, etc., to detect whether there is tampering or replacement trace on the hardware;

[0124] Encoding method: physical medium type is encoded into a numerical value, such as Ethernet = 1, WIFI = 2; hardware fingerprint is normalized after using a hash algorithm; compliance is encoded as 0, compliant / 1, non-compliant;

[0125] Threats: hardware attacks, unlocking, hardware address attacks, physical line interception, etc.

[0126] Data link layer:

[0127] Acquisition content: analyze data frame format, such as Ethernet frame structure, MAC address binding relationship, link encryption state, such as whether to enable SM4 / AES encryption, MAC address change track, such as change frequency and source within the last 1 hour, etc.

[0128] Encoding method: frame format is encoded into a numerical value, such as Ethernet frame = 1, PPP frame = 2; MAC change frequency is normalized; encryption state is encoded as 0, unencrypted / 1, AES encryption / 2, SM4 encryption, etc.

[0129] Threats: active and passive sniffing attacks, MAC address spoofing, wired equivalent encryption cracking, etc.

[0130] Network layer:

[0131] Acquisition content: source IP address, target IP address, routing hop count (such as deviation value from historical baseline), IP geolocation (such as whether it matches the user's commonly used area), gateway access frequency (such as whether there is an abnormal jump), etc.

[0132] Encoding method: IP address is converted into a numerical vector; hop count deviation is normalized compared with the baseline; IP geolocation deviation is normalized; access frequency is normalized, and IP geolocation deviation can be in kilometers.

[0133] Threats: IP attacks, routing attacks, ARP poisoning attacks, MAC flooding, and ICMP attacks, etc.

[0134] Transport layer:

[0135] Collection content: Monitor TCP / UDP connection establishment frequency, connection rate fluctuation (such as deviation percentage from baseline), port usage compliance (such as whether to use unauthorized high-risk ports), data transmission volume (whether single-session transmission volume exceeds threshold);

[0136] Encoding method: Transmission rate Mbps uses normalized processing; protocol compliance is encoded as 0, compliant / 1, non-compliant; port permission is encoded as 0 (authorized) / 1 (unauthorized) and other methods;

[0137] Threats: Port scanning, DOS attacks, service exhaustion attacks, flag bit operation attacks, etc.

[0138] Session layer:

[0139] Collection content: Record session establishment process (such as whether it meets the standard three-way handshake / four-way handshake), session timeout time, session reconnection times (such as the number of reconnections within 10 minutes), session associated terminal identifier (such as whether there is multi-terminal shared session);

[0140] Encoding method: Establishment process compliance is encoded as 0, compliant / 1, non-compliant; session duration (seconds) uses normalized processing; reconnection times uses normalized processing;

[0141] Threats: Session hijacking, SYN attacks, and password attacks, etc.

[0142] Presentation layer:

[0143] Collection content: Verify data encoding format (such as JSON / XML compliance), data compression algorithm (such as whether it is an authorized algorithm), encryption key negotiation process (such as whether there is a risk of key leakage), data verification result (such as CRC32 / SHA256 verification passed);

[0144] Encoding method: Format encoding is a numerical value (such as JSON=1, XML=2, others=3), algorithm type encoding (such as SM4=1, AES=2, …); verification result is encoded as 0, pass / 1, fail;

[0145] Threats: NetBIOS exhaustion attacks, plaintext extraction, and protocol stack attacks, etc.

[0146] Application layer:

[0147] Collection content: Collection API call frequency (such as login API, data query API 1 minute call times), API parameter compliance (such as whether there is abnormal parameter injection), application permission usage track (such as whether to access the function module beyond the authority), application log abnormal code (such as login failure code, data reading error code);

[0148] Encoding method: call frequency (times / minute) adopts normalization processing; parameter compliance is encoded as 0, compliance / 1, non-compliance; permission track is encoded as a vector (such as [1, 0, 1] indicates "authorized - unauthorized - authorized");

[0149] Threats: application program attacks, buffer overflows, malicious code, malware (such as worm viruses and Trojan horses), and other threat methods.

[0150] As an embodiment provided by the application, preferably, the user behavior collection unit: through the triple mode of terminal agent, application log analysis, and network traffic analysis, the user behavior vector is collected, and the specific content is as follows:

[0151] Collection content:

[0152] Operation habit: common operation sequence (such as the fixed flow deviation of "login -> query -> export"), mouse / keyboard operation frequency (whether it matches the user's historical habits), operation interval (the time interval fluctuation of continuous operation);

[0153] Time preference: access time period (whether to access outside the user's common working time period, such as 1-6am), single access time length (deviation from the historical average time length), high-frequency operation time period (whether there is high-frequency operation in non-working time period);

[0154] Permission usage track: permission call sequence (whether there is an abnormal jump from "low permission" to "high permission"), sensitive permission usage frequency (such as the number of times of calling data deletion and batch export permissions), and permission application rationality (whether to temporarily apply for non-business related permissions).

[0155] Encoding method: similarity normalization processing of operation sequence and baseline, time period deviation (hour number) normalization processing, and usage frequency (times / hour) normalization processing;

[0156] Threats: social engineering, imperfect policies, garbage data mining, shoulder surfing, email fraud, and telephone fraud, and other threat methods.

[0157] Embodiment four:

[0158] Based on embodiments one to three, the application is a zero-trust core management method based on user behavior and OSI seven-layer authentication, in step S2, the normalization formula adopted by the Min-Max normalization algorithm is:

[0159] ;

[0160] Wherein, X is the original value of one feature item in the OSI seven-layer state vector or user behavior vector, Xmin and Xmax are respectively the minimum value and the maximum value in the data set composed of all original values of the same feature item as X; X* is the value mapped to the interval [0, 1] after normalization.

[0161] As an embodiment provided by the application, preferably, in the step S5, the method for assigning the authority according to the credibility level comprises the following steps:

[0162] When the credibility is greater than or equal to 85, it is determined as high trust, the complete business authority of the role to which the user belongs is granted, and all authorized resources are allowed to be accessed;

[0163] When 60 is less than the credibility, it is determined as medium trust, only the basic business function is opened, and the core database and sensitive API access are limited;

[0164] When 30 is less than the credibility, it is determined as low trust, the current session is frozen and reported to the central control node, the edge control agent suspends access, and the central control node is reported for secondary research and judgment to issue a disposal instruction;

[0165] When 0 is less than the credibility, it is determined as extremely low trust, the edge control agent directly blocks the terminal access and isolation, reports the central control node and notifies the security operation team.

[0166] Embodiment five:

[0167] Please refer to Figures 3 to 6 The application is a zero-trust core control system based on user behavior and OSI seven-layer authentication, which converts OSI seven-layer protocol features into computable vector parameter factors, combines user identity and behavior vector information to form a three-dimensional trust evidence chain, and uses a designed state vector similarity algorithm to realize zero-trust closed-loop verification. The control system is used to realize the control method provided by embodiments one to four, and the control system comprises:

[0168] The terminal control object comprises a core database, a core network device and other core terminal devices;

[0169] An edge control agent is deployed at the entrance of each core business area to collect OSI seven-layer state vectors and user behavior vectors, and to preprocess the collected vectors, encode the preprocessed vectors by using a Word2Vec model, map the vector data to the [0, 1] interval by using a Min-Max normalization algorithm, calculate single-layer similarity by using a weighted cosine similarity algorithm, and calculate global trustworthiness by using weighted summation, and perform access authorization, permission adjustment, and abnormal blocking according to the global trustworthiness level.

[0170] A central control node is deployed in the network core area to define trustworthiness levels and handling measures, and to train a dynamic trust baseline by using an RWKV model based on historical data, and to make a secondary judgment on low-trust and extremely low-trust events.

[0171] As an embodiment provided by the application, preferably, the control object refers to terminal equipment in the core area that is controlled by the core controller, including various core databases, core network equipment, and other core terminal equipment, which access the core controller through a local area network or a private network and are subject to unified management and control of the core controller.

[0172] As an embodiment provided by the application, preferably, the edge control agent is deployed at the entrance of each core business area, supports dynamic expansion, and undertakes local vector collection, real-time trust evaluation, low-risk event handling, continuous state monitoring, and the like, including an eight-layer full-stack authentication core data collection module, a vector handling module, a real-time trust evaluation engine, a local policy execution engine, and a data caching and synchronization agent, in particular:

[0173] The data collection module is used to synchronously collect OSI seven-layer state vectors and user behavior vectors, and the data collection module includes an OSI seven-layer state collection unit and a user behavior collection unit, and the data collection module realizes non-aware and low-loss collection by using a lightweight agent, the OSI seven-layer state collection unit collects multi-dimensional state vectors in the order of physical layer, data link layer, network layer, transmission layer, session layer, presentation layer, and application layer data audit modules by deploying protocol analysis agents at each layer, and the user behavior collection unit collects user behavior vectors by using a terminal agent, application log analysis, and network traffic analysis in a triple manner, and the collected content is shown in Embodiment Three and the accompanying drawings of the specification. Figure 2

[0174] The vector handling module is used to encode and Min-Max normalize the collected vectors.

[0175] The trust evaluation engine is used to calculate single-layer similarity by using a weighted cosine similarity algorithm, and to calculate global trustworthiness by using weighted summation.

[0176] ​A policy execution engine is configured to perform access authorization, permission adjustment and exception blocking according to a global trust level, automatically perform access authorization, permission adjustment, exception blocking and the like according to a centrally issued policy, and support a joint defense mechanism based on a linkage handling module of a central control node, and comprehensively and cooperatively control terminal control objects based on linkage instructions and corresponding tool sets provided by the linkage handling module.

[0177] A data caching and synchronization agent is configured to cache local data and synchronize increments to the central control node.

[0178] As an embodiment provided by the present application, preferably, a three-dimensional state vector is collected in real time at each layer (physical layer to application layer) of an OSI protocol stack, including: physical medium and hardware device fingerprint at the physical layer, data frame information and MAC abnormal change at the data link layer, IP address and route hop count mutation information at the network layer, connection rate fluctuation information at the transport layer, session establishment, termination and duration information at the session layer, data format and encryption information at the presentation layer, and API call frequency information at the application layer, combined with user behavior characteristics (operation habit, time preference, permission usage trajectory and the like), to construct a physical device-transmission network-user behavior three-dimensional dynamic trust baseline. Unlike a static white list or single-factor authentication, the model automatically generates a normal state threshold interval of each layer by using an AI learning algorithm, and identifies eight-layer linkage anomalies through continuous analysis, to realize paradigm upgrading from single authentication to continuous trust evaluation.

[0179] As an embodiment provided by the present application, preferably, the vector handling module converts unstructured / semi-structured data collected at the eight layers into standardized vectors that can be calculated and compared, to provide a unified data basis for trust evaluation, and the vector handling module includes:

[0180] A vector normalization unit: a Min-Max normalization algorithm is used to map vector parameters of different dimensions to the interval [0, 1], to eliminate the interference of numerical magnitude differences on the calculation results; the vector parameters are, for example, API call frequency and connection rate;

[0181] A vector storage unit: real-time vector data and historical vector data are stored, indexed by terminal ID + timestamp, support millisecond-level query, and 90 days of historical data are retained for baseline training.

[0182] As an embodiment provided by the present application, preferably, a trust evaluation engine is configured to calculate a trust level and identify anomalies in real time based on a dynamic baseline stored locally, and the dynamic baseline is generated and issued by a central control node. The trust evaluation engine includes two sub-modules, i.e., single-layer similarity calculation and global trust calculation, and specifically:

[0183] Single layer similarity calculation submodule: adopt weighted cosine similarity algorithm, calculate the similarity of eight layers of respective real-time standardized vectors and baseline vectors, single layer similarity value is 0-100 points;

[0184] Global credibility calculation submodule: get global credibility through weighted summation of each layer, global credibility value is 0-100 points, weight distribution is set according to risk influence degree.

[0185] As an embodiment provided by the application, preferably, the algorithm for calculating single layer similarity and global credibility is:

[0186] Single layer similarity: ;

[0187] Global credibility:

[0188]

[0189] Wherein, n is the total number of feature vectors collected in each layer; is the i th feature vector; is the i th feature vector baseline; is the i th feature vector baseline range; is the i th feature vector weight, and satisfies ; Simi is the single layer similarity corresponding to each layer respectively, W is the weight coefficient of each layer, and the weight coefficient satisfies:

[0190] Wherein, the physical layer weight coefficient is 15%, the data link layer weight coefficient is 10%, the network layer weight coefficient is 15%, the transport layer weight coefficient is 10%, the session layer weight coefficient is 4%, the presentation layer weight coefficient is 4%, the application layer weight coefficient is 20%, and the user behavior layer weight coefficient is 22% to calculate the global credibility.

[0191] As an embodiment provided by the application, preferably, the data cache and synchronization agent module caches local data and incrementally synchronizes to the central control node, reduces the core network bandwidth pressure, realizes the safe data synchronization between the central control node and the edge node, guarantees the global control consistency, and the data cache and synchronization agent module is used for:

[0192] Policy synchronization with baseline: the central control node issues credibility level standards, treatment measures rules and dynamic baseline to the edge node, the synchronization frequency is real-time synchronization of policy changes + timing synchronization of baseline updates, the transmission protocol uses SM2+SM4 for encryption and decryption and signature authentication to avoid data leakage;

[0193] Vector and log synchronization: the edge node synchronizes eight-layer real-time vector data (synchronized once every 5 minutes), trust evaluation logs (synchronized once every 1 minute) and abnormal event logs (synchronized immediately upon occurrence) to the central control node in increments, reducing core network bandwidth occupancy;

[0194] State synchronization: the edge node reports its own running state such as CPU occupancy, memory usage and network bandwidth to the central control node every 30 seconds, and the central control node performs load balancing based on the state data, such as migrating tasks from high-load nodes to low-load nodes.

[0195] As an embodiment provided by the present application, preferably, the central control node is deployed in the network core area and undertakes core functions such as global policy formulation, baseline training optimization, high-risk event research and judgment, data summary audit, etc., including: a trust policy module, a baseline training module, a high-risk research module, a data audit module and a linkage treatment module, in particular:

[0196] The trust policy module is used to define trust level and treatment measures, and the trust policy module defines eight-layer authentication rules, credibility level standards and treatment measure templates.

[0197] The baseline training module is used to train a dynamic trusted baseline based on historical data through an RWKV model, and a data audit module physical device-transmission network-user behavior data audit module ternary dynamic trusted baseline is constructed based on an AI model, so as to realize adaptive iteration of the data audit module with environmental changes, including two sub-modules of baseline training and baseline iteration:

[0198] Baseline training sub-module: the RWKV model combining efficient parallel training of Transformer with efficient inference of RNN is used for trusted baseline threshold training, and past historical vector data such as 6 months are input to automatically learn eight-layer respective data audit module normal state threshold baseline data audit module;

[0199] Baseline iteration sub-module: two iteration modes of regular iteration and emergency iteration are supported to ensure the timeliness of the baseline: regular iteration: by default, the baseline threshold is fine-tuned every day at 2-4 am combined with the new vector data of the previous day, and the adjustment amplitude is ≤5%; emergency iteration: when a preset condition is triggered, baseline retraining is started immediately, and the update is completed within 2 hours, the preset condition is that the proportion of the number of new terminals is ≥10%, the business system is upgraded significantly, and the network topology is changed.

[0200] A high-risk judgment module is used for secondary judgment according to the trust level. The high-risk judgment module receives the low / extremely low trust events reported by the edge node and conducts secondary judgment in combination with cross-regional data. The high-risk judgment module focuses on low / extremely low trust events that cannot be accurately determined by the edge node. Through the integration of multi-dimensional data resources across regions and the entire network, the high-risk judgment module realizes global perspective + deep correlation secondary judgment of risks, avoids misjudgment caused by the local perspective of the edge control agent, and ensures the accuracy, coordination and traceability of high-risk event disposal. It is the key support for decision-making intelligence in the zero trust closed loop.

[0201] A data audit module is used for storing full-network vector data, trust evaluation logs and abnormal disposal records. The data audit module aggregates full-network eight-layer vector data, trust evaluation logs and abnormal disposal records, and supports compliance tracing. At the data storage level, a dual mechanism of distributed time series database + blockchain storage is adopted: the time series database stores real-time full-network eight-layer feature vector data (such as one record per terminal per 100 milliseconds), trust evaluation logs (including trustworthiness calculation process, strategy matching logic), and abnormal disposal records (including action type, trigger condition, execution result), supporting millisecond-level retrieval of TB-level data; the blockchain storage chains high-risk judgment conclusions, abnormal disposal instructions and other key operations to ensure data tamper-proofing and traceability, fully meeting the compliance requirements of log integrity and authenticity;

[0202] A linkage disposal module is used for formulating joint disposal strategies and issuing them to the edge control agent for execution. Specifically, the linkage disposal module formulates corresponding joint disposal strategies for the secondary judgment results of the high-risk judgment module, in cooperation with existing security protection tools (such as firewalls, intrusion detection systems, antivirus tools, etc.) and corresponding security maintenance personnel, and issues the edge control agent to cooperate with the corresponding personnel and tools for linkage execution.

[0203] As an embodiment provided by the present application, preferably, in the traceability and audit scene, the data audit module can realize one-key generation of full-link three-dimensional evidence chain. For example, when a risk event of a terminal needs to be traced, the administrator inputs the terminal ID or time interval through the visual interface, and the system can automatically associate the physical layer hardware fingerprint collection record of the terminal, the vector similarity calculation process of each layer, the basis for determining the credibility level, and the execution track of the abnormal handling action, each step being attached with accurate time stamp, original data snapshot and system decision logic explanation, to form a complete evidence chain from data collection to disposal closed loop, providing irrefutable audit basis for security event accountability and attack traceability. At the same time, the center is built-in with a compliance analysis engine, which can automatically identify the compliance short board in the log (such as high-risk events that are not disposed in time, deviation of policy configuration from the requirements of the Cybersecurity Law), generate a visual compliance report, help enterprises complete compliance self-inspection in advance, upgrade the audit work from passive inspection to active defense, and greatly reduce the compliance cost and risk.

[0204] As an embodiment provided by the present application, preferably, the trust policy module includes a credibility level division sub-module, a handling measure configuration sub-module and a policy audit sub-module, in particular:

[0205] The credibility level division sub-module presets 4-level credibility standards covering different risk scenarios:

[0206] High trust: 85-100 points, no abnormality, the terminal and behavior completely comply with the baseline;

[0207] Medium trust: 60-84 points, there is a slight single-level abnormality, no linkage risk;

[0208] Low trust: 30-59 points, there is obvious single-level abnormality or low-risk linkage abnormality;

[0209] Extremely low trust: 0-29 points, there is serious single-level abnormality or high-risk linkage abnormality;

[0210] The handling measure configuration sub-module supports binding corresponding handling actions for each credibility level, and supports administrator self-defined adjustment:

[0211] High trust: grant the user the complete business permission of the role to which the user belongs, allow access to all authorized resources, and do not trigger alarm;

[0212] Medium trust: limit access to sensitive resources such as core database and high-risk API, only open basic business functions, trigger low-level alarm of the data audit module, and only notify the terminal user;

[0213] Low trust: freeze the current session, forcibly exit the application, prohibit re-access within 30 minutes, trigger medium-level alarm of the data audit module, and notify the terminal user and department administrator;

[0214] Very low trust: block terminal access, disable network connection, network isolation for terminal, limit communication with other terminals, trigger high-level alarm data audit module, notify security operation team, start emergency response;

[0215] The policy audit sub-module records the policy modification history such as the modifier, the modification time, the modification content, the disposal measure execution log such as the execution time, the terminal ID, the trustworthiness, the disposal result, and the like, and the log is stored in the data audit module in a blockchain manner to ensure that it cannot be tampered with, and supports searching and auditing according to time, terminal, and exception type.

[0216] The zero-trust core management and control system and method based on user behavior and OSI seven-layer authentication converts OSI seven-layer protocol features into unified computable vector parameter factors, combines user identity and behavior vector information, forms a three-dimensional trust evidence chain of physical equipment-transmission network-user behavior, completely eliminates cross-layer protection blind spots, calculates the similarity of real-time state and baseline after standardizing eight-layer vector data through a state vector similarity algorithm, realizes trustworthiness quantitative evaluation, and constructs a ternary dynamic trust baseline of physical equipment-transmission network-user behavior.

[0217] In the description of the present specification, the description referring to the terms "one embodiment", "an example", "a specific example" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0218] The preferred embodiments of the present application disclosed above are only used to help explain the present application. The preferred embodiments do not describe all the details and limit the present application to the specific embodiments described. Obviously, many modifications and variations can be made according to the content of the present specification. The present specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present application, so that those skilled in the art can well understand and utilize the present application. The present application is limited only by the claims and their entire scope and equivalents.

Claims

1. A zero-trust core control method based on user behavior and OSI seven-layer authentication, characterized in that, Includes the following steps: Step S1: When the terminal initiates a network or application access request, the edge management agent synchronously collects the OSI seven-layer state vector and user behavior vector; Step S2: Encode the vectors using the Word2Vec model, and then normalize the vector data using the Min-Max normalization algorithm; Step S3: Based on historical vector data, the RWKV model is used to automatically learn the normal state threshold range of the OSI seven layers and the user behavior layer to construct a three-element dynamic trust baseline of physical device-transmission network-user behavior. Step S4: Calculate the single-layer similarity using the weighted cosine similarity algorithm, and then calculate the global credibility by weighted summation of the similarities of each layer; Step S5: Assign permissions based on trust level and execute access authorization; Step S6: After the terminal successfully connects, continuously collect real-time vector data and update the global credibility. Trigger permission adjustment, alarm or blocking operations based on changes in global credibility; perform baseline adaptive updates through periodic iteration or emergency iteration.

2. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, The control method further includes: after handling the abnormal terminal, the central control node issues a handling result instruction, which includes: If the alert is determined to be a false alarm, the quarantine will be lifted and the trust level will be reset. If it is determined to be a real attack, then isolation will be maintained.

3. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, In step S1, the collected OSI seven-layer state vectors and user behavior vectors include: Collect physical media type, hardware device fingerprint, and device specification compliance vector data at the physical layer; Collect data frame format, MAC address binding relationship, link encryption status, and MAC address change trajectory vector data at the data link layer; Collect source IP address, destination IP address, routing hop count mutation information, IP geolocation, and gateway access frequency vector data at the network layer; Collect vector data on TCP / UDP connection establishment frequency, connection rate fluctuations, port usage compliance, and data transmission volume at the transport layer; Collect session establishment process, session timeout, session reconnection count, and session associated terminal identifier vector data at the session layer; Collect the data encoding format, data compression algorithm, encryption key negotiation process, and data verification result vector data of the presentation layer; Collect API call frequency, API parameter compliance, application permission usage trajectory, and application log exception code vector data at the application layer; Collect user data including mouse / keyboard operation frequency, operation interval, access time, single access duration, high-frequency operation period, permission call order, frequency of sensitive permission usage, and permission request rationality.

4. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, In step S2, the normalization formula used by the Min-Max normalization algorithm is: ； Where X is the original value of a feature term in the OSI seven-layer state vector or user behavior vector, Xmin and Xmax are the minimum and maximum values ​​in the data set of all original values ​​belonging to the same feature term as X, respectively; X* is the value of the normalized original value mapped to the interval [0, 1].

5. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, In step S4, the algorithm for calculating single-layer similarity and global credibility is as follows: Single-layer similarity: ; Global trustworthiness: Reli Global = ; Where n is the total number of feature vectors collected in each layer; Let i be the i-th eigenvector; The baseline of the i-th eigenvector; The baseline range of the i-th feature vector; Let be the weight of the i-th eigenvector, and satisfy . ; W represents the single-layer similarity for each layer. k Let be the weight coefficients for each layer, and let the weight coefficients satisfy . =1.

6. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, In step S5, the method for assigning permissions based on trust level includes the following steps: When the trust level is ≥X1, it is judged as high trust, and the user is granted full business permissions of the role, allowing access to all authorized resources; When X2 ≤ Trustworthiness < X1, it is determined to be medium trust, and only basic business functions are open, while access to core databases and sensitive APIs is restricted; When X3 ≤ Trustworthiness < X2, it is judged as low trust, the current session is frozen and reported to the central control node; When 0 ≤ Trustworthiness < X3, it is judged as extremely low trust. The edge control agent directly blocks terminal access, isolates and reports to the central control node. Among them, X1, X2, and X3 are preset values.

7. The zero-trust core control method based on user behavior and OSI seven-layer authentication as described in claim 1, characterized in that, The method for adaptive baseline updates through periodic iterations or emergency iterations is as follows: The system triggers regular iterations at preset times each day, adjusting the baseline threshold based on the newly added vector data from the previous day, with the adjustment range not exceeding 5%. Emergency iteration is triggered when the proportion of newly added terminals exceeds the preset proportion, when the business system is upgraded, or when the network topology changes. The new baseline is updated in real time after training is completed.

8. A zero-trust core control system based on user behavior and OSI seven-layer authentication, characterized in that: The control system is used to implement the control method according to any one of claims 1-7, and the control system includes: The objects under terminal management include core databases, core network devices, and other core terminal devices; The edge control agent is deployed at the entry point of each core business area to collect OSI seven-layer state vectors and user behavior vectors. It preprocesses the collected vectors, encodes the preprocessed vectors using the Word2Vec model, maps the vector data to the [0,1] interval using the Min-Max normalization algorithm, calculates the single-layer similarity using the weighted cosine similarity algorithm, and calculates the global credibility using weighted summation. Based on the global credibility level, it performs access authorization, permission adjustment, and anomaly blocking. The central control node is used to define trust levels and response measures. It trains a dynamic trust baseline based on historical data using the RWKV model and performs secondary analysis on low-trust and very low-trust events.

9. The zero-trust core control system based on user behavior and OSI seven-layer authentication as described in claim 8, characterized in that, The edge control agent includes: The data acquisition module is used to simultaneously acquire OSI seven-layer state vectors and user behavior vectors; The vector processing module is used to encode and perform Min-Max normalization on the acquired vectors. The trust assessment engine is used to calculate single-layer similarity using a weighted cosine similarity algorithm and to calculate global trustworthiness through weighted summation. The policy execution engine is used to perform access authorization, permission adjustment, and anomaly blocking based on the global trust level; Data caching and synchronization agent, which is used to cache local data and synchronize incremental data to the central control node.

10. The zero-trust core control system based on user behavior and OSI seven-layer authentication as described in claim 8, characterized in that, The central control node includes: The Trust Policy module is used to define trust levels and corresponding actions. The baseline training module is used to train a dynamic trustworthy baseline based on historical data using the RWKV model; the high-risk assessment module is used to perform secondary assessments based on the trust level. The data auditing module is used to store full network vector data, trust assessment logs, and anomaly handling records; The joint response module is used to formulate joint response strategies and distribute them to edge control agents for execution.

Images