System online and offline authorization scheme design and implementation method

Abstract

The application provides a system online and offline authorization scheme design and implementation method, relates to the field of computer security, and comprises the following steps: obtaining terminal state information, collecting resource data, calculating a security score, and generating an encryption strategy matrix; constructing an online monitoring module and an offline analysis module of an application program call chain, analyzing a call relationship, and generating an authorization key; seamless authorization switching in online and offline states is realized, the security and reliability of system authorization are improved, authorization risks are reduced, and identity authentication requirements in various network environments are met.

Description

Technical Field

[0001] This invention relates to the field of computer security, and in particular to the design and implementation methods of online and offline authorization schemes for systems. Background Technology

[0002] With the rapid development of information technology, software system licensing management has become a crucial aspect of ensuring secure software use and protecting intellectual property rights. Traditional software licensing typically employs methods such as serial number activation, hardware binding, or online verification. In enterprise applications and professional software, licensing management needs to meet the usage requirements of both online and offline environments to address different network conditions and application scenarios.

[0003] Current software licensing technologies mainly include network-based online licensing, local offline licensing, and hybrid licensing models. Online licensing typically requires the user terminal to maintain a network connection with the licensing server, verifying the licensing status in real time to ensure the legality of software use; offline licensing, on the other hand, uses pre-downloaded license files or hardware dongles to enable software to run normally in environments without a network; hybrid licensing models combine the advantages of both methods, switching between licensing verification methods under different network conditions.

[0004] However, existing online and offline authorization schemes still have the following shortcomings: Existing authorization schemes have limited ability to perceive the security status of terminals. Most systems only use static authorization verification mechanisms, which cannot dynamically adjust authorization policies according to the real-time resource status and security risks of the terminal, leading to reduced authorization security in complex or harsh environments. The selection of authorization encryption algorithms is usually preset and fixed, lacking the ability to adaptively adjust based on terminal performance and network status. This results in significant differences in authorization performance and security across different terminal devices, making it difficult to simultaneously meet the authorization needs of high-performance terminals and low-configuration terminals. Existing authorization schemes generally lack the ability to deeply analyze software runtime behavior, failing to effectively identify abnormal application call chains and potential authorization bypass behaviors. This makes the authorization system vulnerable to attacks using techniques such as simulation environments and code injection, reducing the effectiveness of authorization protection. Summary of the Invention

[0005] The embodiments of the present invention provide a design and implementation method for online and offline authorization schemes, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a method for designing and implementing online and offline authorization schemes for a system, comprising:

[0007] Obtain the status information of the user terminal. When it is detected that the user is online, collect real-time resource data. When it is detected that the user is offline, read the resource data from the local cache when the user was online the most recently.

[0008] The resource data is used to plot a load curve, calculate the curve inflection point and fluctuation period, extract the feature value within the fluctuation period, and calculate the terminal security score in combination with the status information; the terminal security score is mapped to a preset encryption algorithm library to generate an encryption strategy matrix, the optimal encryption algorithm is selected based on the encryption strategy matrix, a secure encryption cipher is generated, and an encrypted communication channel is established.

[0009] Upon receiving authorization approval information from the server, an online monitoring module and an offline analysis module are constructed to build the application call chain. The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph. The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology graph, and identifies call patterns by combining a dynamic kernel function. By fusing the results of online and offline analysis, key program nodes are identified, the operational characteristics of the key program nodes are extracted, risk coefficients are calculated, and an authorization key is generated based on the key program nodes and the risk coefficients.

[0010] The authorization key is sent to the user terminal, the verifier status is monitored, and the authorization strategy is dynamically adjusted according to the online / offline status of the terminal.

[0011] Using the resource data, a load curve is plotted, the curve inflection point and fluctuation period are calculated, feature values ​​within the fluctuation period are extracted, and the terminal security score is calculated in conjunction with the status information, including:

[0012] The resource data is divided into adjacent time intervals based on a preset time axis, and a load curve is generated by a polynomial piecewise mapping that satisfies the second-order smoothness constraint.

[0013] Curvature analysis is performed on the load curve to obtain the curvature distribution characteristics of the load curve. A dynamic curvature threshold is generated based on the curvature distribution characteristics, and the time points in the load curve where the curvature value exceeds the dynamic curvature threshold are marked as inflection point sequences.

[0014] Pair adjacent inflection points in the inflection point sequence, calculate the time interval between paired inflection points to obtain the fluctuation duration, and extract the amplitude change of the curve between paired inflection points to obtain the fluctuation intensity.

[0015] The duration and intensity of the fluctuations at each pair of inflection points are organized into a feature matrix in chronological order. The corresponding feature weights are calculated based on the information entropy distribution of each feature dimension in the feature matrix. Combined with the fluctuation features in the feature matrix, a terminal security score is generated.

[0016] The terminal security score is mapped to a preset encryption algorithm library to generate an encryption policy matrix. The optimal encryption algorithm is selected based on the encryption policy matrix, including:

[0017] Extract the key length and computational complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; divide the numerical range of the terminal security score, set a mapping reference point within the numerical range, establish the correspondence between the mapping reference point and the encryption algorithm feature set, and extend the correspondence to the entire numerical range to form a complete mapping relationship;

[0018] Set a piecewise nonlinear activation function, perform piecewise activation in each numerical interval of the mapping relationship, apply a smoothing constraint at the boundary of the numerical interval, calculate the deviation of the terminal security score in the numerical interval, input the deviation into the exponential decay rule to determine the feature coefficient, calibrate the upper and lower limits of the feature coefficient, construct a mapping matrix based on the feature coefficient and the piecewise nonlinear activation function, apply the mapping matrix to the feature set of the encryption algorithm to output the encryption strategy matrix;

[0019] Extract the security policy vector and execution time of each encryption algorithm in the encryption policy matrix, calculate the Euclidean distance between each security policy vector and the target vector, construct the objective function value based on the Euclidean distance and the normalized execution time, iteratively update the encryption algorithm parameters using the objective function value until convergence, and select the encryption algorithm with the smallest objective function value as the optimal encryption algorithm.

[0020] The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph, including:

[0021] A time window queue is constructed based on the call sequence, and the call data and the call relationship are input into the time window queue to generate a continuous data stream;

[0022] Each application in the continuous data stream is assigned a globally unique identifier as a node. The processing capacity and call status of the node are recorded. Combined with the call relationship, directed edges between nodes are constructed. The processing capacity and call status are mapped to a two-dimensional plane using a space filling method based on a two-dimensional Z-order curve. The similarity of nodes is obtained by calculating the spatial position of nodes on the Z-order curve. Locality-sensitive hashing is used to group nodes with similar processing capacity and call status. An affinity matrix is ​​constructed based on the similarity of nodes in each group. The affinity matrices are concatenated according to the access order of the Z-order curve to generate an adjacency matrix.

[0023] The system continuously receives call data from the continuous data stream. When a new call relationship is discovered, the corresponding node and directed edge are added to the adjacency matrix. Based on the latest processing capacity and call status, the spatial position and similarity of the node on the Z-order curve are recalculated, and the node grouping is dynamically adjusted. At the same time, edges that have not been called within a preset time period and the resulting isolated nodes are deleted, and finally a dynamic call graph is generated.

[0024] The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology diagram, and, combined with a dynamic kernel function, identifies call patterns, including:

[0025] Extract the call initiating service and call target service recorded in the historical call data, connect them in sequence according to timestamp to form a call chain, and integrate all the call chains to generate a call chain topology diagram;

[0026] The degree of all nodes in the call chain topology graph is counted to obtain the node degree distribution. Any two nodes are selected from the call chain topology graph, and the minimum number of nodes traversed between the two nodes is counted and recorded as the call path length. A path feature vector is constructed based on the node degree distribution and the call path length.

[0027] The path feature vector is input into the radial basis function and the inner product polynomial function respectively, and the output results are linearly superimposed to obtain the dynamic kernel function value; the distance between the historical call data is calculated using the dynamic kernel function value, and the number of nodes whose distance is less than the preset truncation distance is counted to obtain the density value. Among the nodes with a distance greater than the density value, the minimum distance value with the current node is selected.

[0028] Cluster centers are determined based on the density value and the minimum distance value. The historical call data is then divided into categories corresponding to the nearest cluster centers to obtain the call pattern.

[0029] By integrating online and offline analysis results, key program nodes are identified, their operational characteristics are extracted, and risk coefficients are calculated, including:

[0030] The call path is extracted from the dynamic call graph, and the path importance is calculated based on the edge weight of the call path and the density value in the call pattern.

[0031] The call path is recursively decomposed according to the path importance to generate a critical path set; in the critical path set, the frequency and location information of the nodes in the critical path are extracted to generate the node criticality, and the node with the highest node criticality is determined as the critical program node.

[0032] For the key program nodes, the call timing patterns and response time sequences during their operation are collected, the call timing pattern distribution features are extracted to generate timing entropy, and the response time sequences are extracted to generate timing stability features.

[0033] Using the temporal entropy as a state node and the temporal stability feature as a transition boundary, a state space graph is generated. A state transition matrix is ​​generated based on the transition direction between adjacent temporal entropies. Feature value sequences are extracted from the state transition matrix to generate state persistence. The maximum connected subgraph in the state space graph is identified to generate state convergence. A risk coefficient is calculated based on the state persistence and the state convergence.

[0034] A second aspect of this invention provides a system for designing and implementing online and offline authorization schemes, comprising:

[0035] The first unit is used to obtain the status information of the user terminal. When it is detected that the user is online, it collects real-time resource data; when it is detected that the user is offline, it reads the resource data from the local cache when the user was online the most recently.

[0036] The second unit is used to draw a load curve using the resource data, calculate the curve inflection point and fluctuation period, extract the feature value within the fluctuation period, and calculate the terminal security score in combination with the status information; establish a mapping relationship between the terminal security score and a preset encryption algorithm library to generate an encryption strategy matrix; select the optimal encryption algorithm based on the encryption strategy matrix to generate a secure encryption cipher and establish an encrypted communication channel.

[0037] The third unit comprises an online monitoring module and an offline analysis module for constructing the application call chain when authorization approval information is received from the server. The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph. The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology graph, and identifies call patterns by combining dynamic kernel functions. By integrating the online and offline analysis results, key program nodes are identified, the operational characteristics of the key program nodes are extracted, risk coefficients are calculated, and authorization keys are generated based on the key program nodes and the risk coefficients.

[0038] The fourth unit is used to send the authorization key to the user terminal, monitor the verifier status, and dynamically adjust the authorization strategy according to the online / offline status of the terminal.

[0039] A third aspect of the present invention,

[0040] An electronic device is provided, comprising:

[0041] processor;

[0042] Memory used to store processor-executable instructions;

[0043] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0044] Fourth aspect of the embodiments of the present invention,

[0045] A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0046] The beneficial effects of this application are as follows:

[0047] By dynamically monitoring terminal status and calculating security scores based on resource data, intelligent selection of encryption strategies is achieved, ensuring the security of data transmission during the authorization process and effectively resisting the risks of network attacks and data theft.

[0048] By combining online monitoring and offline analysis mechanisms, a complete application call chain analysis system has been built, which can accurately identify key program nodes and call patterns, improve the authorization system's ability to identify abnormal behavior, and enhance system security.

[0049] The authorization policy is dynamically adjusted based on the online and offline status of the terminal, enabling the system to maintain stable operation in various network environments, improving the user experience, and ensuring the continuity and reliability of the authorization mechanism to meet the needs of various complex application scenarios. Attached Figure Description

[0050] Figure 1 This is a flowchart illustrating the design and implementation method of the online and offline authorization schemes in an embodiment of the present invention;

[0051] Figure 2 Choose an architecture diagram for the adaptive encryption algorithm based on terminal security scores. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0054] Figure 1 This is a flowchart illustrating the design and implementation method of the online and offline authorization schemes in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0055] Obtain the status information of the user terminal. When it is detected that the user is online, collect real-time resource data. When it is detected that the user is offline, read the resource data from the local cache when the user was online the most recently.

[0056] The resource data is used to plot a load curve, calculate the curve inflection point and fluctuation period, extract the feature value within the fluctuation period, and calculate the terminal security score in combination with the status information; the terminal security score is mapped to a preset encryption algorithm library to generate an encryption strategy matrix, the optimal encryption algorithm is selected based on the encryption strategy matrix, a secure encryption cipher is generated, and an encrypted communication channel is established.

[0057] Upon receiving authorization approval information from the server, an online monitoring module and an offline analysis module are constructed to build the application call chain. The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph. The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology graph, and identifies call patterns by combining a dynamic kernel function. By fusing the results of online and offline analysis, key program nodes are identified, the operational characteristics of the key program nodes are extracted, risk coefficients are calculated, and an authorization key is generated based on the key program nodes and the risk coefficients.

[0058] The authorization key is sent to the user terminal, the verifier status is monitored, and the authorization strategy is dynamically adjusted according to the online / offline status of the terminal.

[0059] In one optional implementation, the resource data is used to plot a load curve, calculate the curve inflection point and fluctuation period, extract feature values ​​within the fluctuation period, and combine the status information to calculate the terminal security score, including:

[0060] The resource data is divided into adjacent time intervals based on a preset time axis, and a load curve is generated by a polynomial piecewise mapping that satisfies the second-order smoothness constraint.

[0061] Curvature analysis is performed on the load curve to obtain the curvature distribution characteristics of the load curve. A dynamic curvature threshold is generated based on the curvature distribution characteristics, and the time points in the load curve where the curvature value exceeds the dynamic curvature threshold are marked as inflection point sequences.

[0062] Pair adjacent inflection points in the inflection point sequence, calculate the time interval between paired inflection points to obtain the fluctuation duration, and extract the amplitude change of the curve between paired inflection points to obtain the fluctuation intensity.

[0063] The duration and intensity of the fluctuations at each pair of inflection points are organized into a feature matrix in chronological order. The corresponding feature weights are calculated based on the information entropy distribution of each feature dimension in the feature matrix. Combined with the fluctuation features in the feature matrix, a terminal security score is generated.

[0064] The collected resource data is divided into multiple adjacent time intervals according to a preset time axis, such as intervals every 5 minutes, 10 minutes, or every hour. For resource data points within each time interval, a polynomial piecewise mapping method is applied to generate a smooth load curve. When generating the curve, a second-order smoothness constraint must be satisfied; that is, at the segmentation points, not only are the curve values ​​continuous, but their first and second derivatives must also remain continuous to ensure a smooth transition of the curve. For example, for CPU utilization data, a cubic spline interpolation method can be used for time points [t1, t2, ..., t...]. n] The corresponding CPU utilization values ​​[v1, v2, ..., v] n The system is fitted to generate a smooth CPU load curve.

[0065] Curvature analysis is performed on the generated load curve to calculate the curvature value at each point on the curve. By analyzing the curvature distribution characteristics of the entire curve, such as the mean, variance, and maximum value of curvature, a dynamic curvature threshold is generated. This threshold is not a fixed value but is dynamically adjusted according to the characteristics of the current load curve. For example, the mean curvature plus twice the standard deviation of curvature can be used as the dynamic threshold. If the mean curvature of the CPU utilization curve for a certain period is 0.05 and the standard deviation is 0.03, then the dynamic curvature threshold can be set to 0.11. Points in the load curve where the curvature value exceeds the dynamic threshold are marked as inflection points, forming an inflection point sequence [p1, p2, ..., p...]. m ].

[0066] Adjacent inflection points in the inflection point sequence are paired, such as (p1, p2), (p3, p4), etc. For each pair of inflection points, the time interval between them is calculated as the fluctuation duration. For example, if the time difference between inflection points p1 and p2 is 30 seconds, it means that the fluctuation lasted for 30 seconds. At the same time, the amplitude change of the curve between the paired inflection points is extracted as the fluctuation intensity. For example, if the CPU utilization rate is 20% at p1 and 80% at p2, the fluctuation intensity is 60%.

[0067] The fluctuation duration and intensity of each pair of inflection points are organized into a feature matrix in chronological order. For example, if there are n pairs of inflection points, an n×2 matrix can be constructed, where each row contains the fluctuation duration and intensity of a pair of inflection points. Information entropy is calculated for each feature dimension in the feature matrix to evaluate the uncertainty and information content of each feature. Based on the information entropy distribution, the corresponding feature weights are calculated; features with higher information entropy have larger weights. For example, if the information entropy of fluctuation duration is 0.8 and the information entropy of fluctuation intensity is 0.5, then the weight of fluctuation duration can be set to 0.615, and the weight of fluctuation intensity can be set to 0.385.

[0068] By combining the fluctuation characteristics and corresponding weights in the feature matrix with the terminal's state information, a terminal security score is generated. The calculation process may include multiplying the fluctuation characteristics by the corresponding weights to obtain a weighted score, and then adjusting it based on the state information. For example, if an abnormal process is running on the terminal or a suspicious application is installed, the security score will be lowered; conversely, if the terminal runs stably and resource usage is regular, the security score will be higher. The final security score can be a value from 0 to 100, with a higher score indicating a better terminal security status.

[0069] A concrete example: CPU usage data for a terminal over one hour was collected and divided into 60 data points at 1-minute intervals. A smooth CPU load curve was generated after applying cubic spline interpolation. Curvature analysis showed a mean curvature of 0.04 and a standard deviation of 0.025, with a dynamic curvature threshold set to 0.09. Six inflection points exceeding the threshold were identified, located at time points [5 minutes, 12 minutes, 27 minutes, 35 minutes, 48 ​​minutes, 56 minutes]. These inflection points were paired into three groups: (5 minutes, 12 minutes), (27 minutes, 35 minutes), and (48 minutes, 56 minutes). The fluctuation duration of the first group of inflection points was 7 minutes, with a fluctuation intensity of 45%; the second group had 8 minutes and 35%; and the third group had 8 minutes and 30%. The feature matrix was constructed as [[7,45],[8,35],[8,30]]. After calculating the information entropy, the fluctuation duration weight was 0.4, and the fluctuation intensity weight was 0.6. Terminal status information indicates that an uncommon system process is consuming high resources. The final calculated terminal security score is 78, indicating that the terminal's security status is good but there are minor anomalies that require attention.

[0070] Figure 2 An architecture diagram is selected for the adaptive encryption algorithm based on terminal security scores. In one optional implementation, a mapping relationship is established between the terminal security scores and a preset encryption algorithm library to generate an encryption policy matrix. The optimal encryption algorithm is selected based on the encryption policy matrix, including:

[0071] Extract the key length and computational complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; divide the numerical range of the terminal security score, set a mapping reference point within the numerical range, establish the correspondence between the mapping reference point and the encryption algorithm feature set, and extend the correspondence to the entire numerical range to form a complete mapping relationship;

[0072] Set a piecewise nonlinear activation function, perform piecewise activation in each numerical interval of the mapping relationship, apply a smoothing constraint at the boundary of the numerical interval, calculate the deviation of the terminal security score in the numerical interval, input the deviation into the exponential decay rule to determine the feature coefficient, calibrate the upper and lower limits of the feature coefficient, construct a mapping matrix based on the feature coefficient and the piecewise nonlinear activation function, apply the mapping matrix to the feature set of the encryption algorithm to output the encryption strategy matrix;

[0073] Extract the security policy vector and execution time of each encryption algorithm in the encryption policy matrix, calculate the Euclidean distance between each security policy vector and the target vector, construct the objective function value based on the Euclidean distance and the normalized execution time, iteratively update the encryption algorithm parameters using the objective function value until convergence, and select the encryption algorithm with the smallest objective function value as the optimal encryption algorithm.

[0074] First, a pre-defined encryption algorithm library is established, containing various encryption algorithms such as AES, RSA, and SM4. By extracting the key length and computational complexity features of each encryption algorithm, a feature set of the encryption algorithm is generated. For example, an algorithm library may contain algorithms such as AES-128, AES-256, and RSA-2048, with key lengths of 128 bits, 256 bits, and 2048 bits respectively, and computational complexities of 25, 40, and 80 (in normalized units). These feature values ​​are stored as a two-dimensional array, serving as the basis for subsequent mapping.

[0075] Terminal security scores are typically values ​​from 0 to 100, divided into five intervals: [0, 20), [20, 40), [40, 60), [60, 80), and [80, 100]. Mapping reference points are set at the center of each interval: 10, 30, 50, 70, and 90. A correspondence is established between these reference points and encryption algorithm characteristics: a security score of 10 corresponds to a lightweight algorithm with a 128-bit key, a score of 50 corresponds to a medium-strength algorithm, and a score of 90 corresponds to a high-strength algorithm. This correspondence is then extended to the entire numerical range using interpolation, forming a complete mapping table.

[0076] To achieve a smooth transition in the mapping relationship, a piecewise nonlinear activation function is used to handle the security score. In the actual implementation, an improved sigmoid function is used as the activation function. A gentler curve is used when the security score is in the range [40, 60), while a steeper curve is used in the ranges [0, 20) and [80, 100] to reflect the greater sensitivity to changes in encryption strategy at extremely low or high security risks. At the boundaries of the ranges, such as the numerical points of 20, 40, 60, and 80, smoothing constraints are applied to ensure the continuity of the function and avoid abrupt policy changes.

[0077] The deviation of the terminal's security score within its assigned interval is calculated to measure its distance from the interval's center. For example, when the security score is 35, the center of its interval [20, 40) is 30, and the deviation is (35-30) / 10 = 0.5. This deviation is input into the exponential decay rule to determine the characteristic coefficient. When the deviation is 0.5, e is calculated... (-0.5×0.5) The characteristic coefficient is approximately 0.78. The characteristic coefficient is then limited to the range [0.1, 1.0] to prevent over-adjustment in extreme cases.

[0078] Based on feature coefficients and a piecewise nonlinear activation function, a mapping matrix is ​​constructed. Specifically, the activation function output is multiplied by the feature coefficients to form an adjustment factor matrix. Each element in this matrix represents the weight adjustment value of the feature at the corresponding position. When the terminal security score is 35, the corresponding mapping matrix might be a 2×2 matrix, with elements corresponding to the weight adjustment factors for key length and computational complexity. This mapping matrix is ​​then applied to the feature set of the encryption algorithm, and the encryption strategy matrix is ​​output through matrix multiplication.

[0079] During the optimal encryption algorithm selection phase, the security policy vector and execution time of each encryption algorithm are extracted from the encryption policy matrix. The security policy vector includes the adjusted key length and computational complexity value. A target vector is predefined, representing the ideal combination of security parameters under the current security score. The Euclidean distance between each security policy vector and the target vector is calculated. For example, if the target vector corresponding to a security score of 35 is [160, 35], and the security policy vector of a certain algorithm A is [192, 45], then the Euclidean distance is 38.6.

[0080] Simultaneously considering the execution time of the encryption algorithm, the original execution time is normalized using a maximum-minimum method to obtain a normalized time value between 0 and 1. For example, if the execution time range in the algorithm library is 10ms to 100ms, then the normalized value of an algorithm with an execution time of 40ms is (40-10) / (100-10) = 0.33. Based on the Euclidean distance and the normalized execution time, the objective function value is constructed as: F = w1 × Euclidean distance + w2 × normalized execution time, where w1 and w2 are weight coefficients, set according to security and performance requirements, typically w1 + w2 = 1.

[0081] The encryption algorithm parameters are iteratively optimized by adjusting them until the objective function value converges or the maximum number of iterations is reached. The encryption algorithm with the smallest objective function value is then selected as the optimal encryption algorithm. For example, in a certain optimization, if the objective function value of algorithm A is 0.48, that of algorithm B is 0.52, and that of algorithm C is 0.41, then algorithm C is selected as the optimal encryption algorithm for the current terminal security score.

[0082] In one optional implementation, the online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph, including:

[0083] A time window queue is constructed based on the call sequence, and the call data and the call relationship are input into the time window queue to generate a continuous data stream;

[0084] Each application in the continuous data stream is assigned a globally unique identifier as a node. The processing capacity and call status of the node are recorded. Combined with the call relationship, directed edges between nodes are constructed. The processing capacity and call status are mapped to a two-dimensional plane using a space filling method based on a two-dimensional Z-order curve. The similarity of nodes is obtained by calculating the spatial position of nodes on the Z-order curve. Locality-sensitive hashing is used to group nodes with similar processing capacity and call status. An affinity matrix is ​​constructed based on the similarity of nodes in each group. The affinity matrices are concatenated according to the access order of the Z-order curve to generate an adjacency matrix.

[0085] The system continuously receives call data from the continuous data stream. When a new call relationship is discovered, the corresponding node and directed edge are added to the adjacency matrix. Based on the latest processing capacity and call status, the spatial position and similarity of the node on the Z-order curve are recalculated, and the node grouping is dynamically adjusted. At the same time, edges that have not been called within a preset time period and the resulting isolated nodes are deleted, and finally a dynamic call graph is generated.

[0086] The online monitoring module collects call information between applications in a distributed system through instrumentation or proxy methods, including the caller identifier, the callee identifier, the timestamp of the call, and related performance metrics. Taking a microservice architecture as an example, when service A calls service B, recording (A, B, 1623142536000, 200ms) indicates that A called B at timestamp 1623142536000, taking 200ms.

[0087] When constructing a time window queue based on call timing, a sliding window mechanism is used. The window size is set to 10 seconds, and the sliding step is 2 seconds. A queue structure is maintained, with each window containing all call data within that time period. For example, the first window contains call data from timestamps 1623142530000 to 1623142540000, and the second window contains data from timestamps 1623142532000 to 1623142542000. The window queue length is set to 30, meaning it retains call information from the most recent 60 seconds. As new data arrives, the queue head window automatically pops out when it exceeds the retention range, ensuring that the queue always contains the latest call information, thus forming a continuous data stream.

[0088] When assigning a globally unique identifier as a node to each application in a continuous data stream, a UUID generation mechanism is used to ensure the uniqueness of the identifier throughout the distributed system. For each node, its processing capacity and call status are recorded. Processing capacity metrics include CPU utilization, memory usage, and response time; call status metrics include call frequency, success rate, and error rate. For example, the attributes of service A can be represented as: {Processing capacity: [CPU: 30%, Memory: 500MB, Response time: 150ms], Call status: [Call frequency: 100 times / minute, Success rate: 98%, Error rate: 2%]}. Directed edges are constructed between nodes based on call relationships, and the weight of the edge represents the call frequency or importance.

[0089] When mapping processing capacity and call status to a two-dimensional plane using a space-filling method based on a two-dimensional Z-order curve, the first step is to normalize each indicator, unifying its value range to the [0,1] interval. The response time in processing capacity and the success rate in call status are selected as the two coordinate axes in the two-dimensional space. For example, if service A has a normalized response time of 0.3 and a success rate of 0.98, its coordinates in the two-dimensional plane are (0.3, 0.98). The Z-order curve is a space-filling curve that can map multidimensional data to a one-dimensional space while maintaining data locality. Converting two-dimensional coordinates to positions on the Z-order curve is specifically achieved by interleaving the binary representations of the two coordinates. For example, the binary representations of (0.3, 0.98) are 0.010011... and 0.111110..., which, after interleaving, result in 01.101101..., which represents the spatial position of the node on the Z-order curve.

[0090] The similarity of nodes is obtained by calculating their spatial positions on the Z-order curve. The similarity calculation uses Manhattan distance. For example, if the position values ​​of node A and node B on the Z-order curve are 0.42 and 0.45 respectively, then their similarity is 1-|0.42-0.45|=0.97, which means that the processing capabilities and calling states of these two nodes are very similar.

[0091] Locality-Sensitive Hash (LSH) is used to group nodes with similar processing capabilities and call states. Multiple hash functions are used to hash the Z-order curve position values; nodes with similar positions are highly likely to be hashed into the same bucket. In a practical implementation, 10 hash functions can be created, dividing the space into 20 buckets. For example, with 100 nodes, 5-8 different groups may be formed, each containing 10-30 similar nodes.

[0092] An affinity matrix is ​​constructed based on the similarity of nodes within each group. For each group, an n×n matrix is ​​created, where n is the number of nodes in the group. The element a[i][j] in the matrix represents the affinity between node i and node j. For example, in group 1, there are nodes A, B, and C, and the pairwise affinities between them are a[A][B]=0.97, a[A][C]=0.85, and a[B][C]=0.88, respectively.

[0093] The affinity matrices are concatenated according to the access order of the Z-order curves to generate a complete adjacency matrix. The access order of the Z-order curves ensures that similar nodes are also adjacent in the adjacency matrix, which is beneficial for subsequent processing. The complete adjacency matrix has a dimension of N×N, where N is the total number of nodes.

[0094] The system continuously receives call data from a continuous data stream, dynamically updates the adjacency matrix and call graph, and adds a corresponding directed edge to the adjacency matrix when service D calls service E for the first time. The value of the adjacency matrix element a[D][E] is set to the initial call frequency. Simultaneously, based on the processing capabilities and call states of the two nodes, the system calculates their positions and similarity on the Z-order curve.

[0095] Based on the latest processing capabilities and call status, the spatial position and similarity of nodes on the Z-order curve are recalculated. A global recalculation is performed every 5 seconds. If a node's key metrics change significantly, such as response time increasing from 150ms to 450ms, an immediate recalculation is triggered, dynamically adjusting node groups. For example, node A, which originally belonged to group 1, may be reassigned to group 3 due to performance degradation.

[0096] Edges are set to expire in 300 seconds. When an edge is detected as having been inactive for the past 300 seconds, it is removed from the adjacency matrix. If deleting an edge results in a node having no incoming or outgoing edges, that node becomes an orphan and will also be removed from the graph. For example, if service F has not been called by any service and has not called any service in the past 5 minutes, all edges associated with F are deleted, and F is removed from the call graph.

[0097] The above dynamic maintenance mechanism can reflect changes in the call relationships between applications in real time, generate an accurate dynamic call graph, and provide a foundation for distributed system monitoring and anomaly detection.

[0098] In one optional implementation, the offline analysis module periodically performs cluster analysis on historical call data to generate a call chain topology diagram. Combined with a dynamic kernel function, it identifies call patterns, including:

[0099] Extract the call initiating service and call target service recorded in the historical call data, connect them in sequence according to timestamp to form a call chain, and integrate all the call chains to generate a call chain topology diagram;

[0100] The degree of all nodes in the call chain topology graph is counted to obtain the node degree distribution. Any two nodes are selected from the call chain topology graph, and the minimum number of nodes traversed between the two nodes is counted and recorded as the call path length. A path feature vector is constructed based on the node degree distribution and the call path length.

[0101] The path feature vector is input into the radial basis function and the inner product polynomial function respectively, and the output results are linearly superimposed to obtain the dynamic kernel function value; the distance between the historical call data is calculated using the dynamic kernel function value, and the number of nodes whose distance is less than the preset truncation distance is counted to obtain the density value. Among the nodes with a distance greater than the density value, the minimum distance value with the current node is selected.

[0102] Cluster centers are determined based on the density value and the minimum distance value. The historical call data is then divided into categories corresponding to the nearest cluster centers to obtain the call pattern.

[0103] In practical applications, a large amount of service call data is collected. This data includes information such as the initiating service identifier, the target service identifier, the call timestamp, and the call parameters. The offline analysis module extracts historical call data from the data storage system, such as retrieving all service call records from the database within the past week. For example, one retrieved call record might be: Service A called Service B on 2023-01-01 at 08:00:15, with the parameter {user_id: 12345}.

[0104] The offline analysis module constructs a call chain topology based on this call data. Specifically, it first extracts the identifiers of the initiating and target services from each record and connects them in timestamp order. For example, if service A calls service B, and then service B calls service C, a call chain is formed: A→B→C. The offline analysis module integrates all such chains to form a complete call chain topology. In real-world scenarios, this may result in a topology containing hundreds of service nodes and thousands of call relationships.

[0105] After constructing the call chain topology graph, the offline analysis module analyzes the node characteristics in the graph. For each node, it calculates its in-degree and out-degree and generates a node degree distribution. For example, in a system with 100 service nodes, 60% of the nodes may have a degree between 1 and 3, 30% may have a degree between 4 and 8, and 10% may have a degree greater than 8. The offline analysis module uses this distribution characteristic as the basis for subsequent analysis.

[0106] The offline analysis module also analyzes call path lengths. For any two nodes in the topology graph, it calculates the minimum number of nodes between them as the path length. For example, if traveling from service A to service E requires passing through three intermediate services B, C, and D, the path length is 3. By analyzing the path lengths between a large number of node pairs, the typical call depth distribution in the system can be obtained, such as 80% of call path lengths being less than 4, 15% of call path lengths being between 5 and 7, and 5% of call path lengths being greater than 7.

[0107] Based on node degree distribution and call path length, the offline analysis module constructs path feature vectors. For each call path, it extracts the degree of each node and the length of the entire path to form a feature vector. For example, for a call path A→B→C→D, if the degree of A is 3, the degree of B is 5, the degree of C is 2, the degree of D is 1, and the path length is 3, then the feature vector [3,5,2,1,3] can be constructed.

[0108] The offline analysis module uses a dynamic kernel function to calculate the similarity between different calling paths. This dynamic kernel function consists of a radial basis function and an inner product polynomial function. The radial basis function captures the Euclidean distance information between feature vectors, assigning higher similarity values ​​to feature vectors that are close together. The inner product polynomial function captures the similarity in vector directions by calculating the inner product of feature vectors and performing a polynomial transformation. The outputs of these two functions are linearly superimposed to obtain the final dynamic kernel function value.

[0109] In practice, for two path feature vectors, a similarity value is first calculated using the radial basis function, and another similarity value is calculated using the inner product polynomial function. The two values ​​are then weighted and summed according to preset weights to obtain the final dynamic kernel function value. For example, for feature vectors [3,5,2,1,3] and [4,6,2,2,3], the possible radial basis function value is 0.85, and the inner product polynomial function value is 0.92. If the weights are the same, the dynamic kernel function value is 0.885.

[0110] The offline analysis module uses the dynamic kernel function value to calculate the distance between historical data calls. The distance is defined as 1 minus the dynamic kernel function value; therefore, the larger the kernel function value, the smaller the distance. For example, if the dynamic kernel function value is 0.885, the distance is 0.115.

[0111] The offline analysis module sets a cutoff distance threshold, such as 0.2, and counts the number of other data points whose distance to each data point is less than this threshold. This number is defined as the density value of that point. For example, if a certain call path is less than 0.2 from all 50 other paths, its density value is 50.

[0112] After calculating the density values ​​of all data points, the offline analysis module finds the point with the smallest distance among all data points with a density value greater than that point for each data point and records this minimum distance. For example, for data point A with a density value of 50, if the smallest distance to data point B among all data points with a density value greater than 50 is 0.15, then the minimum distance of A is recorded as 0.15.

[0113] Based on density values ​​and minimum distances, the offline analysis module identifies cluster centers. Specifically, it selects points with higher density values ​​and larger minimum distances as cluster centers. For example, if the density threshold is set to the average density value in the system and the distance threshold is set to the average minimum distance in the system, then points that simultaneously satisfy both the density value being greater than the density threshold and the minimum distance being greater than the distance threshold are determined as cluster centers.

[0114] After determining the cluster centers, the offline analysis module assigns each data point to the category of the nearest cluster center. For example, if data point A is 0.1 away from cluster center C1, 0.3 away from cluster center C2, and 0.2 away from cluster center C3, then A is assigned to the category of C1.

[0115] Through the clustering process described above, the offline analysis module divides historical call data into different categories, each representing a call pattern. For example, it may identify different call patterns such as "read-write separation," "cache access," and "compute-intensive." This call pattern information will be used for subsequent anomaly detection and system optimization.

[0116] In one optional implementation, the analysis results from online and offline methods are combined to identify key program nodes, extract the operational characteristics of the key program nodes, and calculate risk coefficients, including:

[0117] The call path is extracted from the dynamic call graph, and the path importance is calculated based on the edge weight of the call path and the density value in the call pattern.

[0118] The call path is recursively decomposed according to the path importance to generate a critical path set; in the critical path set, the frequency and location information of the nodes in the critical path are extracted to generate the node criticality, and the node with the highest node criticality is determined as the critical program node.

[0119] For the key program nodes, the call timing patterns and response time sequences during their operation are collected, the call timing pattern distribution features are extracted to generate timing entropy, and the response time sequences are extracted to generate timing stability features.

[0120] Using the temporal entropy as a state node and the temporal stability feature as a transition boundary, a state space graph is generated. A state transition matrix is ​​generated based on the transition direction between adjacent temporal entropies. Feature value sequences are extracted from the state transition matrix to generate state persistence. The maximum connected subgraph in the state space graph is identified to generate state convergence. A risk coefficient is calculated based on the state persistence and the state convergence.

[0121] This method first extracts call paths from a dynamic call graph, a directed graph composed of method call relationships during program execution. Nodes represent methods, edges represent call relationships, and edge weights reflect call frequency and importance. For example, in an e-commerce system, on the call path from user login to order payment, the edge weight for the core transaction service is 0.85, while the edge weight for non-critical functions such as logging is 0.23. Simultaneously, the method analyzes the density values ​​in the call patterns, which represent the tightness of connections between nodes in the call path. For the aforementioned e-commerce scenario, the density value for the core transaction process is 0.92, indicating high coupling between components. Based on edge weights and density values, path importance is calculated; for example, the importance of the core payment path is 0.89, while the importance of the user browsing path is 0.45.

[0122] The call path is recursively decomposed according to its importance, generating a set of critical paths. The recursive decomposition process starts with the path of highest importance and gradually includes paths of second-highest importance until all important paths are covered. In the e-commerce system example, a set of 5 critical paths was generated, including "user verification - product selection - inventory confirmation - payment processing - order creation". The frequency and location information of nodes within these critical paths are extracted. For example, the payment processing node appears 4 times in the 5 critical paths, and frequently appears in key positions, therefore its node criticality is 0.78; while the log recording node, although appearing frequently, has an unimportant location, resulting in a node criticality of only 0.23. The payment processing node with the highest node criticality is identified as the critical program node.

[0123] For identified key program nodes, their call timing patterns and response time sequences were collected during operation. The call timing patterns recorded the time sequence characteristics of node calls. For example, the payment processing node was called 20-25 times per minute under normal conditions, reaching a peak of 40-45 times per minute, exhibiting regular fluctuations. The response time sequence recorded the time required for the node to respond to requests. Under normal circumstances, the response time of the payment processing node was 15-40 milliseconds, with a stable fluctuation range.

[0124] Distribution features are extracted from the call timing pattern to generate timing entropy, which reflects the uncertainty and complexity of the call pattern. Under normal circumstances, the timing entropy value of the payment processing node is 2.34, indicating that its call pattern is relatively stable and predictable; when attacked, the timing entropy value rises to 4.56, indicating that the call pattern becomes irregular and chaotic. Simultaneously, timing stability features are extracted from the response time series, including the fluctuation range and rate of change of response time. Under normal circumstances, the timing stability feature value of the payment processing node is 0.15, indicating small response time fluctuations; under abnormal conditions, this value rises to 0.67, indicating a significant increase in response time fluctuations.

[0125] Using temporal entropy as state nodes and temporal stability features as transition boundaries, a state space graph is generated. For example, when the temporal entropy is in the range of 2.0-2.5 and the temporal stability feature is in the range of 0.1-0.2, it is in a "stable state"; when the temporal entropy is in the range of 3.5-4.5 and the temporal stability feature is in the range of 0.5-0.7, it is in a "high-risk state". Based on the transition direction between adjacent temporal entropies in the state space graph, a state transition matrix is ​​generated, recording the probability of transitioning from one state to another. For example, the probability of transitioning from a "stable state" to a "slightly fluctuating state" is 0.23, while the probability of transitioning to a "high-risk state" is only 0.03.

[0126] From the state transition matrix, feature value sequences are extracted to generate state durability, which represents the length of time a state is maintained. For example, the durability of a "stable state" is 0.85, indicating that it can remain stable for a long time; while the durability of a "high-risk state" is 0.32, indicating that it will not remain in a high-risk state for a long time. The maximally connected subgraph in the state space graph is identified to generate state convergence. State convergence represents the ability to recover from any state to a stable state. For example, the state convergence of a normal system is 0.79, indicating strong self-recovery ability.

[0127] Finally, a risk coefficient is calculated based on state durability and state convergence. The risk coefficient comprehensively considers the stability and resilience of the system state and is a comprehensive indicator for measuring the system's security risk. For example, when the state durability is 0.85 and the state convergence is 0.79, the calculated risk coefficient is 0.18, indicating a low system risk; when the state durability drops to 0.32 and the state convergence drops to 0.25, the risk coefficient increases to 0.76, indicating a serious security risk.

[0128] Through the above process, this method can effectively identify key nodes in the program, monitor their operational characteristics, and promptly detect potential security risks, providing strong protection for system security.

[0129] A second aspect of this invention provides a system for designing and implementing online and offline authorization schemes, comprising:

[0130] The first unit is used to obtain the status information of the user terminal. When it is detected that the user is online, it collects real-time resource data; when it is detected that the user is offline, it reads the resource data from the local cache when the user was online the most recently.

[0131] The second unit is used to draw a load curve using the resource data, calculate the curve inflection point and fluctuation period, extract the feature value within the fluctuation period, and calculate the terminal security score in combination with the status information; establish a mapping relationship between the terminal security score and a preset encryption algorithm library to generate an encryption strategy matrix; select the optimal encryption algorithm based on the encryption strategy matrix to generate a secure encryption cipher and establish an encrypted communication channel.

[0132] The third unit comprises an online monitoring module and an offline analysis module for constructing the application call chain when authorization approval information is received from the server. The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph. The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology graph, and identifies call patterns by combining dynamic kernel functions. By integrating the online and offline analysis results, key program nodes are identified, the operational characteristics of the key program nodes are extracted, risk coefficients are calculated, and authorization keys are generated based on the key program nodes and the risk coefficients.

[0133] The fourth unit is used to send the authorization key to the user terminal, monitor the verifier status, and dynamically adjust the authorization strategy according to the online / offline status of the terminal.

[0134] A third aspect of the present invention provides an electronic device, comprising:

[0135] processor;

[0136] Memory used to store processor-executable instructions;

[0137] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0138] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0139] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for designing and implementing online and offline authorization schemes for a system, characterized in that, include: Obtain the status information of the user terminal, and collect real-time resource data when it is detected to be online; When an offline state is detected, read the resource data from the most recent online state from the local cache; The load curve is plotted using the resource data, the inflection point and fluctuation period of the curve are calculated, the feature value within the fluctuation period is extracted, and the terminal security score is calculated in combination with the status information. The terminal security score is mapped to a preset encryption algorithm library to generate an encryption strategy matrix. Based on the encryption strategy matrix, the optimal encryption algorithm is selected to generate a secure encryption cipher and establish an encrypted communication channel. When the authorization approval information is received from the server, an online monitoring module and an offline analysis module for the application call chain are constructed. The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph; the offline analysis module periodically performs cluster analysis on historical call data, generates a call link topology graph, and identifies call patterns by combining dynamic kernel functions; the online and offline analysis results are integrated to determine key program nodes, extract the running characteristics of the key program nodes, calculate risk coefficients, and generate authorization keys based on the key program nodes and the risk coefficients; The authorization key is sent to the user terminal, the verifier status is monitored, and the authorization strategy is dynamically adjusted according to the online / offline status of the terminal.

2. The method according to claim 1, characterized in that, Using the resource data, a load curve is plotted, the curve inflection point and fluctuation period are calculated, feature values ​​within the fluctuation period are extracted, and the terminal security score is calculated in conjunction with the status information, including: The resource data is divided into adjacent time intervals based on a preset time axis, and a load curve is generated by a polynomial piecewise mapping that satisfies the second-order smoothness constraint. Based on the load curve, curvature analysis is performed to obtain the curvature distribution characteristics of the load curve. A dynamic curvature threshold is generated based on the curvature distribution characteristics, and the time points in the load curve where the curvature value exceeds the dynamic curvature threshold are marked as inflection point sequences. Pair adjacent inflection points in the inflection point sequence, calculate the time interval between paired inflection points to obtain the fluctuation duration, and extract the amplitude change of the curve between paired inflection points to obtain the fluctuation intensity. The duration and intensity of the fluctuations at each pair of inflection points are organized into a feature matrix in chronological order. The corresponding feature weights are calculated based on the information entropy distribution of each feature dimension in the feature matrix. The terminal security score is generated by combining the fluctuation features in the feature matrix.

3. The method according to claim 1, characterized in that, The terminal security score is mapped to a preset encryption algorithm library to generate an encryption policy matrix. The optimal encryption algorithm is selected based on the encryption policy matrix, including: Extract the key length and computational complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; divide the numerical range of the terminal security score, set a mapping reference point within the numerical range, establish the correspondence between the mapping reference point and the encryption algorithm feature set, and extend the correspondence to the entire numerical range to form a complete mapping relationship; Set a piecewise nonlinear activation function, perform piecewise activation in each numerical interval of the mapping relationship, apply a smoothing constraint at the boundary of the numerical interval, calculate the deviation of the terminal security score in the numerical interval, input the deviation into the exponential decay rule to determine the feature coefficient, calibrate the upper and lower limits of the feature coefficient, construct a mapping matrix based on the feature coefficient and the piecewise nonlinear activation function, apply the mapping matrix to the feature set of the encryption algorithm to output the encryption strategy matrix; Extract the security policy vector and execution time of each encryption algorithm in the encryption policy matrix, calculate the Euclidean distance between each security policy vector and the target vector, construct the objective function value based on the Euclidean distance and the normalized execution time, iteratively update the encryption algorithm parameters using the objective function value until convergence, and select the encryption algorithm with the smallest objective function value as the optimal encryption algorithm.

4. The method according to claim 1, characterized in that, The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph, including: A time window queue is constructed based on the call sequence, and the call data and the call relationship are input into the time window queue to generate a continuous data stream; Each application in the continuous data stream is assigned a globally unique identifier as a node. The processing capacity and call status of the node are recorded. Combined with the call relationship, directed edges between nodes are constructed. The processing capacity and call status are mapped to a two-dimensional plane using a space filling method based on a two-dimensional Z-order curve. The similarity of nodes is obtained by calculating the spatial position of nodes on the Z-order curve. Locality-sensitive hashing is used to group nodes with similar processing capacity and call status. An affinity matrix is ​​constructed based on the similarity of nodes in each group. The affinity matrices are concatenated according to the access order of the Z-order curve to generate an adjacency matrix. The system continuously receives call data from the continuous data stream. When a new call relationship is discovered, the corresponding node and directed edge are added to the adjacency matrix. Based on the latest processing capacity and call status, the spatial position and similarity of the node on the Z-order curve are recalculated, and the node grouping is dynamically adjusted. At the same time, edges that have not been called within a preset time period and the resulting isolated nodes are deleted, and finally a dynamic call graph is generated.

5. The method according to claim 1, characterized in that, The offline analysis module periodically performs cluster analysis on historical call data, generates a call chain topology diagram, and, combined with a dynamic kernel function, identifies call patterns, including: Extract the call initiating service and call target service recorded in the historical call data, connect them in sequence according to timestamp to form a call chain, and integrate all the call chains to generate a call chain topology diagram; The degree of all nodes in the call chain topology graph is counted to obtain the node degree distribution. Any two nodes are selected from the call chain topology graph, and the minimum number of nodes traversed between the two nodes is counted and recorded as the call path length. A path feature vector is constructed based on the node degree distribution and the call path length. The path feature vector is input into the radial basis function and the inner product polynomial function respectively, and the output results are linearly superimposed to obtain the dynamic kernel function value; the distance between the historical call data is calculated using the dynamic kernel function value, and the number of nodes whose distance is less than the preset truncation distance is counted to obtain the density value. Among the nodes with a distance greater than the density value, the minimum distance value with the current node is selected. Cluster centers are determined based on the density value and the minimum distance value. The historical call data is then divided into categories corresponding to the nearest cluster centers to obtain the call pattern.

6. The method according to claim 1, characterized in that, By integrating online and offline analysis results, key program nodes are identified, their operational characteristics are extracted, and risk coefficients are calculated, including: The call path is extracted from the dynamic call graph, and the path importance is calculated based on the edge weight of the call path and the density value in the call pattern. The call path is recursively decomposed according to the path importance to generate a critical path set; in the critical path set, the frequency and location information of the nodes in the critical path are extracted to generate the node criticality, and the node with the highest node criticality is determined as the critical program node. For the key program nodes, the call timing patterns and response time sequences during their operation are collected, the call timing pattern distribution features are extracted to generate timing entropy, and the response time sequences are extracted to generate timing stability features. Using the temporal entropy as a state node and the temporal stability feature as a transition boundary, a state space graph is generated. A state transition matrix is ​​generated based on the transition direction between adjacent temporal entropies. Feature value sequences are extracted from the state transition matrix to generate state persistence. The maximum connected subgraph in the state space graph is identified to generate state convergence. A risk coefficient is calculated based on the state persistence and the state convergence.

7. A system for designing and implementing online and offline authorization schemes, used to implement the method as described in any one of claims 1-6, characterized in that, include: The first unit is used to obtain the status information of the user terminal. When it is detected that the user is online, it collects real-time resource data. When an offline state is detected, read the resource data from the most recent online state from the local cache; The second unit is used to draw a load curve using the resource data, calculate the curve inflection point and fluctuation period, extract the feature value within the fluctuation period, and calculate the terminal security score in combination with the status information. The terminal security score is mapped to a preset encryption algorithm library to generate an encryption strategy matrix. Based on the encryption strategy matrix, the optimal encryption algorithm is selected to generate a secure encryption cipher and establish an encrypted communication channel. The third unit is used to build an online monitoring module and an offline analysis module for the application call chain when the authorization pass information returned by the server is received; The online monitoring module collects the call sequence and call relationships between applications in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph; the offline analysis module periodically performs cluster analysis on historical call data, generates a call link topology graph, and identifies call patterns by combining dynamic kernel functions; the online and offline analysis results are integrated to determine key program nodes, extract the running characteristics of the key program nodes, calculate risk coefficients, and generate authorization keys based on the key program nodes and the risk coefficients; The fourth unit is used to send the authorization key to the user terminal, monitor the verifier status, and dynamically adjust the authorization strategy according to the online / offline status of the terminal.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images