ABAC dynamic risk assessment method and device based on improved MLP and electronic equipment

Abstract

The invention relates to an improved MLP-based ABAC dynamic risk assessment method and apparatus, and an electronic device. The method comprises the steps of obtaining multi-dimensional attribute data and dynamic permission state data associated with an access request; preprocessing the multi-dimensional attribute data and the dynamic permission state data to generate an attribute feature vector and a state feature vector; the attribute feature vector and the state feature vector are input into an improved multi-layer perceptron neural network model, and a coding layer carries out feature coding on the attribute feature vector and the state feature vector; the feature fusion layer performs weighted fusion on the encoded attribute features and state features to generate a fusion feature vector; carrying out nonlinear transformation on the fusion feature vector by the plurality of hidden layers to extract risk features; the output layer outputs the risk level probability distribution of the access request based on the extracted risk features; and determining a final risk level of the access request. According to the invention, the efficiency and accuracy of risk assessment are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to an ABAC dynamic risk assessment method and device based on an improved MLP and electronic equipment. BACKGROUND

[0002] Access control is the first line of defense for information security, and its core is to block unauthorized operations by clearly defining "who (subject) can access what (resource) in what way", to protect the confidentiality, integrity and availability of information systems. In the digital business scenario, access control needs to adapt to the dynamic and cross-scenario permission management requirements. The traditional static access control mode (such as role-based access control RBAC) has been difficult to cope with complex security challenges. The ABAC (attribute-based access control) model dynamically determines access permissions through user attributes (such as roles, departments, permission levels), resource attributes (such as data security levels, file types), environmental attributes (such as access time, network type) and preset policy rules. Compared with the traditional RBAC model, it has stronger flexibility and finer granularity, and can adapt to various business scenarios through attribute combination. However, the risk assessment of the ABAC model needs to focus on the "attribute-strategy-access behavior" whole link, and there are potential risks such as incomplete identification attribute collection, policy logic conflict, and permission abuse. The traditional static control mode cannot effectively handle the dynamic changes of multi-dimensional attributes and complex nonlinear relationships, resulting in low risk assessment efficiency and poor accuracy, and it is difficult to realize real-time automatic identification, which cannot meet the real-time security needs of large-scale distributed organizations for dynamic permission management. SUMMARY

[0003] Therefore, it is necessary to provide an ABAC dynamic risk assessment method and device based on an improved MLP and electronic equipment to solve the technical problem that the traditional static control mode cannot effectively handle the dynamic changes of multi-dimensional attributes and complex nonlinear relationships, resulting in low risk assessment efficiency and poor accuracy.

[0004] The ABAC dynamic risk assessment method based on the improved MLP provided by the present application comprises: Obtaining multi-dimensional attribute data and dynamic permission state data associated with an access request; Preprocessing the multi-dimensional attribute data and the dynamic permission state data respectively to generate attribute feature vectors and state feature vectors; input the attribute feature vector and the state feature vector into an improved multilayer perceptron neural network model, wherein the improved multilayer perceptron neural network model comprises: an encoding layer for respectively performing feature encoding on the attribute feature vector and the state feature vector, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer for performing weighted fusion on the independently encoded attribute feature and state feature to generate a fusion feature vector; a plurality of hidden layers for performing nonlinear transformation on the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features. determining a final risk level of the access request according to the risk level probability distribution.

[0005] In one of the embodiments, the obtaining of the multi-dimensional attribute data associated with the access request comprises: real-time obtaining of user basic attributes and identity security attributes from a user identity management and authentication system; querying of resource basic attributes and resource security attributes of the accessed resource from a resource metadata management system and a security policy library; real-time collection of basic environment attributes at the time of access occurrence, querying of business context attributes from a business context service, and obtaining of network security attributes from a network security monitoring system; continuous monitoring and reporting of terminal security states from a terminal agent program, real-time calculation of user behavior posture based on a user behavior analysis engine, and subscription of global threat intelligence from a threat intelligence platform.

[0006] In one of the embodiments, the obtaining of the dynamic permission state data associated with the access request comprises: obtaining of a policy execution indicator of the current request from a policy decision point, and querying of permission life cycle indicators from a permission management service. In one of the embodiments, the preprocessing of the multi-dimensional attribute data and the dynamic permission state data respectively comprises: performing processing on the real-time obtained category type attributes by using one-hot encoding, performing standardization processing on the numerical value type attributes to reduce to a preset numerical value interval, converting the Boolean type attributes into binary values, and converting the time sequence attributes into fixed length features by using a sliding window method.

[0007] In one of the embodiments, the encoding layer includes an attribute feature block sub-layer and a state feature block sub-layer, the attribute feature block sub-layer has a first preset number of neurons and adopts a Leaky ReLU activation function, and is configured to encode the attribute feature vector, and the state feature block sub-layer has a second preset number of neurons and adopts an ELU activation function, and is configured to encode the state feature vector.

[0008] In one of the embodiments, the plurality of hidden layers include a plurality of fully connected hidden layers, each hidden layer has a corresponding preset number of neurons and adopts a ReLU activation function, a Dropout layer is arranged between the hidden layers, the Dropout rate of the Dropout layer is a preset ratio, and L2 regularization is added to the Dropout layer, and the weight decay coefficient of the L2 regularization is a preset coefficient, and the hidden layers are provided with batch normalization layers, and the hidden layers adopt residual connection.

[0009] In one of the embodiments, the output layer has the same number of neurons as the number of risk level categories and adopts a Softmax activation function, and outputs the probability distribution of each risk level, and the determination of the final risk level of the access request according to the risk level probability distribution includes: comparing the probability value or the highest probability value with a corresponding preset risk threshold to determine the final risk level.

[0010] In one of the embodiments, the method further includes training the improved multilayer perceptron neural network model, specifically including: collecting training samples from access logs, audit logs, authorized operation logs, terminal security logs, threat intelligence data and business system data; performing attribute mapping on the samples related to ABAC selected from the public security data set through domain adaptation data enhancement to expand the training sample set; training the model based on the training sample set.

[0011] In one of the embodiments, the training of the improved multilayer perceptron neural network model further includes: annotating each access request training sample as a high-risk, medium-risk or low-risk level according to the threat occurrence probability and impact degree; balancing the sample distribution of each risk level through oversampling; dividing the annotated data set into a training set, a validation set and a test set according to a preset division ratio. In one of the embodiments, the training of the improved multilayer perceptron neural network model further includes: adopting a weighted cross-entropy loss function and an AdamW optimization algorithm to optimize the model, wherein the initial learning rate, the batch size and the iteration number are all preset values; adopting a learning rate pre-warming strategy, linearly increasing the learning rate from an initial value to the initial learning rate in the initial training stage; adopting a learning rate decay strategy, when the validation set loss does not decrease for a preset number of times, reducing the learning rate by a decay factor until a minimum learning rate is reached; adopting an early stopping strategy, when the validation set F1 value does not improve for a preset number of times, stopping training.

[0012] The application also provides an ABAC dynamic risk assessment device based on an improved MLP, which comprises: a data acquisition module configured to acquire multi-dimensional attribute data and dynamic permission state data associated with an access request; a data preprocessing module configured to preprocess the multi-dimensional attribute data and the dynamic permission state data to generate attribute feature vectors and state feature vectors, respectively; a feature vector input module configured to input the attribute feature vectors and the state feature vectors into an improved multilayer perceptron neural network model, wherein the improved multilayer perceptron neural network model comprises: an encoding layer configured to encode the attribute feature vectors and the state feature vectors, respectively, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer configured to fuse the independently encoded attribute features and state features to generate a fused feature vector; a plurality of hidden layers configured to perform nonlinear transformation on the fused feature vector to extract risk features; and an output layer configured to output a risk level probability distribution of the access request based on the extracted risk features. a risk level determination module configured to determine a final risk level of the access request according to the risk level probability distribution.

[0013] The application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the ABAC dynamic risk assessment method based on the improved MLP when executing the computer program.

[0014] The ABAC dynamic risk assessment method, device and electronic equipment based on the improved MLP, by acquiring multi-dimensional attribute data and dynamic permission state data associated with the access request, and preprocessing these data to generate attribute feature vectors and state feature vectors, and then inputting them into the improved multilayer perceptron neural network model, the model encodes the attribute feature vectors and the state feature vectors independently through the encoding layer, wherein the encoding layer adopts the double-track structure of the attribute feature block sublayer and the state feature block sublayer, uses Leaky ReLU and ELU activation functions respectively to optimize the feature extraction of static attributes and dynamic states, then weights and fuses the independently encoded attribute features and state features through the feature fusion layer to generate a fusion feature vector, and further uses multiple hidden layers to perform nonlinear transformation on the fusion feature vector to extract risk features, and finally outputs the risk level probability distribution of the access request based on the extracted risk features through the output layer, and determines the final risk level according to the distribution, thereby effectively solving the problem that the traditional static access control mode cannot handle multi-dimensional attribute dynamic changes and complex nonlinear relationships, realizing real-time comprehensive analysis of the attribute-policy-access behavior through the introduction of dynamic permission state data and the branch encoding and weighted fusion of the improved model, overcoming potential risks such as incomplete attribute collection, policy logic conflict and permission abuse, and further improving the efficiency and accuracy of risk assessment, meeting the real-time and automatic security needs of dynamic permission governance of large-scale distributed organizations. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0016] Figure 1 A flow chart of an embodiment of the ABAC dynamic risk assessment method based on the improved MLP; Figure 2 A flow chart of another embodiment of the ABAC dynamic risk assessment method based on the improved MLP; Figure 3 A flow chart of another embodiment of the ABAC dynamic risk assessment method based on the improved MLP; Figure 4 A flow chart of another embodiment of the ABAC dynamic risk assessment method based on the improved MLP; Figure 5 A schematic diagram of an embodiment of the ABAC dynamic risk assessment device based on the improved MLP; Figure 6An internal structure diagram of an electronic device of an embodiment. DETAILED DESCRIPTION

[0017] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0018] The embodiments of the present application will be described below with reference to the drawings. Figures 1-6 The ABAC dynamic risk assessment method, device and electronic device based on improved MLP of the present application are described.

[0019] As shown in Figure 1 In one embodiment, an ABAC dynamic risk assessment method based on improved MLP includes the following steps: In step S110, multi-dimensional attribute data and dynamic permission state data associated with an access request are obtained. The multi-dimensional attribute data includes user attributes, resource attributes, environment attributes and security posture attributes, and the dynamic permission state data includes policy execution indicators and permission life cycle indicators.

[0020] By real-time integration of multi-source system data, comprehensive attribute and state information associated with access requests are obtained. The specific process is as follows: First, the user's basic attributes (including user unique ID, role, unit affiliation, and job level) and identity security attributes (including security qualifications, historical violation records, and identity authentication strength) are extracted from the user identity management and authentication system in real time to uniquely identify the user's identity and reflect their security background. User attributes include both basic attributes and identity security attributes. At the same time, the resource's basic attributes (including resource ID, resource type, and business domain) and security attributes (including sensitivity level, operation type of this request, and access restriction conditions) are queried from the resource metadata management system and security policy library to accurately describe the resource's security features and operation constraints. Resource attributes include both basic attributes and security attributes. Real-time collection of basic environmental attributes (including access time, access source IP address, network type, and terminal type) and business context attributes (including the user's current scheduling task, the current state of the accessed resource, and the physical location of the resource) from the business context service, as well as network security attributes (including access network security level and current network threat situation) from the network security monitoring system, comprehensively capture the environmental and business context of the access occurrence. Environmental attributes include basic environmental attributes, business context attributes, and network security attributes. In addition, terminal security status (including operating system version, patch coverage, antivirus software status, trusted hardware enablement status, and terminal security score) is continuously monitored and reported through the terminal agent program, user behavior patterns (including access frequency, access path abnormality, and operation success rate within a predetermined period) are calculated in real-time based on the user behavior analysis engine, and global threat intelligence (including malicious IP / domain name library hit status, terminal virus infection warning, and existence of similar security events) is subscribed from the threat intelligence platform, dynamically sensing the terminal security level and user behavior risk. Security situation attributes include terminal security status, user behavior patterns, and global threat intelligence. In terms of dynamic permission state acquisition, policy execution indicators (including PDP decision results, policy matching time consumption, and PEP execution status code) for this request are obtained from the policy decision point (PDP), and permission lifecycle indicators (including permission validity remaining time, recent permission change type, and session continuous active duration) are queried from the permission management service to reflect the real-time results of policy execution and dynamic permission context. Through the collaborative acquisition of multi-dimensional attribute data and dynamic permission state data, comprehensive, real-time, and structured input features are provided for subsequent risk assessment models, ensuring that the models can perform comprehensive analysis based on both static attribute rules and dynamic system state.Through real-time integration of multi-source data, the defects of incomplete attribute collection or delayed state update in traditional methods are overcome; through the introduction of dynamic attributes such as business context, behavior situation and threat intelligence, the comprehensive perception ability of potential internal threats and environmental risks is enhanced; through the fusion of policy execution indicators and permission life cycle data, the risk assessment can respond to the real-time decision changes of the ABAC policy engine and the time effectiveness constraints of permissions, thereby significantly improving the identification accuracy and real-time of risks such as permission abuse, policy conflict and abnormal access, and providing a reliable data foundation for subsequent automatic risk grading.

[0021] In step S120, the multi-dimensional attribute data and the dynamic permission state data are respectively pre-processed to generate attribute feature vectors and state feature vectors.

[0022] The category type attribute obtained in real time is processed by One-Hot Encoding, the numerical type attribute is standardized to a preset numerical interval, the Boolean type attribute is converted into a binary value, and the time sequence attribute is converted into a fixed length feature by a sliding window method. Specifically, first, the category type attribute obtained in real time, including user post role, resource type, network type and terminal type, is processed by One-Hot Encoding to convert it into a binary vector form to eliminate the unordered difference between categories. Further, the numerical type attribute, including terminal security score, access frequency, policy matching time consumption and permission effective remaining time, is processed by Min-Max standardization to linearly transform it into a preset numerical interval of [0, 1] interval to eliminate the negative impact of different attribute dimensions on model training. Subsequently, the Boolean type attribute, including trusted hardware enabled state, whether it hits a malicious library and multi-factor authentication enabled state, is directly converted into a binary value of 0 or 1. Finally, the time sequence attribute, including the access frequency in a preset period, is converted into a fixed length feature vector by a sliding window method, so as to characterize the dynamic behavior sequence as a fixed dimension input that can be processed by the model. After the above processing, the multi-dimensional attribute data is integrated into an attribute feature vector, and the dynamic permission state data is integrated into a state feature vector. Thus, the original data with different sources, various types and different dimensions is converted into a standardized feature representation with a unified numerical range and fixed dimensions, providing consistent input for subsequent feature coding and fusion. Therefore, by One-Hot Encoding, the false numerical relationship introduced by category attributes is avoided, by standardization processing, the model convergence process is accelerated and the optimization stability is improved, and by sliding window conversion, the effective capture of time sequence dynamic features is realized, the overall preprocessing process significantly improves the quality and consistency of feature data, ensuring that the subsequent neural network model can efficiently and accurately extract risk-related features from multi-modal data, laying a solid foundation for the reliability and accuracy of risk assessment.

[0023] Step S130, input the attribute feature vector and the state feature vector into the improved multi-layer perceptron neural network model, wherein the improved multi-layer perceptron neural network model comprises: an encoding layer for respectively encoding the attribute feature vector and the state feature vector, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer for weighting and fusing the independently encoded attribute feature and state feature to generate a fusion feature vector; a plurality of hidden layers for performing non-linear transformation on the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features.

[0024] The encoding layer comprises an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer has a first preset number of neurons and adopts a Leaky ReLU activation function for encoding the attribute feature vector, and the state feature block sublayer has a second preset number of neurons and adopts an ELU activation function for encoding the state feature vector; the feature fusion layer adopts attention weights to weighting and fuse the independently encoded attribute feature and state feature to generate a fusion feature vector of a preset dimension; the plurality of hidden layers comprise a plurality of fully connected hidden layers, each hidden layer has a corresponding preset number of neurons and adopts a ReLU activation function, a Dropout layer is arranged between the hidden layers, the Dropout rate of the Dropout layer is a preset ratio, L2 regularization is added, the weight decay coefficient of the L2 regularization is a preset coefficient, the hidden layer is further provided with a Batch Normalization layer, and the hidden layer adopts residual connections; the output layer has the same number of neurons as the number of risk level categories and adopts a Softmax activation function to output a probability distribution of each risk level, and the Softmax activation function is used to map the feature vector to a risk level probability distribution: , wherein z is a hidden layer output vector.

[0025] According to the risk level probability distribution, a final risk level of the access request is determined, comprising: comparing the probability value or the highest probability value with a corresponding preset risk threshold to determine the final risk level.

[0026] The preprocessed feature vectors are subjected to deep feature extraction and risk classification by an improved multi-layer perceptron neural network model. As an option, the generated attribute feature vectors and state feature vectors are first input into two independent sub-layers of the encoding layer for processing, wherein the attribute feature block sub-layer adopts a first preset number structure with 128 neurons and applies a Leaky ReLU activation function, and is specifically used for encoding static attribute features, and the negative interval small slope characteristic effectively alleviates the attribute feature gradient disappearance problem in the low-risk scenario; the state feature block sub-layer adopts a second preset number structure with 64 neurons and applies an ELU activation function, and is specifically used for encoding dynamic state features, and the smooth negative value response characteristic enhances the sensitivity to small changes in the authority state. Subsequently, the feature fusion layer adopts an attention weight mechanism to weight and fuse the two types of encoded features, calculates the feature importance weight and weighted sum to generate a 192-dimensional attribute-state collaborative fusion feature vector, thereby realizing adaptive feature integration of static attribute constraints and dynamic system state. The fusion vector is then input into multiple hidden layers for non-linear transformation, the hidden layer adopts a modular structure including three fully connected layers, the number of neurons is configured in a preset sequence of

[256] ,

[256] ,

[128] , and the ReLU activation function is used in each layer to improve the feature expression capability; the Dropout layer is introduced between the hidden layers to randomly discard neurons at a preset rate of 0.3, and L2 regularization constraint with a weight decay coefficient of 1e-4 is added, at the same time, a batch normalization layer is added before each activation function to stabilize the training process, and a residual connection structure is used to alleviate the gradient disappearance problem, which together ensures the training stability and generalization ability of the deep network. The final output layer adopts a Softmax activation function, which outputs the probability distribution of high-risk, medium-risk and low-risk through three neurons, and makes a final grade determination according to the preset risk threshold: when the high-risk probability is ≥0.6, or the high-risk probability is the highest and ≥0.4, it is determined as high-risk; when the medium-risk probability is ≥0.5, or the medium-risk probability is the highest and ≥0.3, it is determined as medium-risk; when the low-risk probability is ≥0.6, or the low-risk probability is the highest and ≥0.4, it is determined as low-risk. Thus, the feature representation of static attributes and dynamic states is optimized respectively by the divide-and-conquer encoding strategy, the cross-modal feature correlation is captured by the attention fusion mechanism, the complex risk patterns are extracted by the deep non-linear network, and the risk grading is realized by the structured output. The double-branch encoding structure effectively balances the stability of static attributes and the sensitivity of dynamic states; the attention weighted fusion improves the focusing ability of the model on key risk features; the deep hidden layer with regularization and residual connection ensures the efficient extraction of complex risk patterns and the generalization performance of the model; the threshold determination mechanism ensures the explainability and business adaptability of risk grading, and the overall model achieves an accuracy of ≥90% and a high-risk F1 value of ≥92% on the test set, significantly improving the accuracy and reliability of risk identification in the ABAC environment.

[0027] Step S140, determining the final risk level of the access request according to the risk level probability distribution.

[0028] Based on the three-class risk probability distribution generated by the output layer, a multi-level threshold decision mechanism is adopted to determine the final risk level. The decision process prioritizes high-risk scenarios in turn: when the high-risk probability reaches the absolute threshold 0.6 or the relative threshold (the probability is the highest and ≥0.4), it is immediately determined as high risk; if not, it is determined whether the medium-risk probability reaches 0.5 or is the highest and ≥0.3; finally, the low-risk probability ≥0.6 or is the highest and ≥0.4 is used to complete the determination. This mechanism ensures the reliability of high-risk determination through absolute threshold, deals with the flat boundary situation of probability distribution through relative threshold, and ensures zero-miss identification of high-risk through prioritized grading strategy. The final output of discrete risk level can directly drive the graded security response: high risk triggers real-time blocking, medium risk starts secondary authentication, and low risk directly releases, thereby achieving a balance between security and access efficiency based on accurate quantitative evaluation, effectively supporting dynamic permission management in ABAC environment.

[0029] The ABAC dynamic risk assessment method based on improved MLP of the embodiment, by acquiring multi-dimensional attribute data (including user attributes, resource attributes, environment attributes and security posture attributes) and dynamic permission state data (including policy execution indicators and permission life cycle indicators) associated with the access request, and pre-processing these data to generate attribute feature vectors and state feature vectors, then inputting into the improved multilayer perceptron neural network model, the model encodes the attribute feature vectors and state feature vectors through the encoding layer respectively, then the attribute features and state features encoded independently are weighted and fused through the feature fusion layer to generate the fusion feature vector, and then the fusion feature vector is nonlinearly transformed through multiple hidden layers to extract risk features, finally the risk level probability distribution of the access request is output based on the extracted risk features through the output layer, and the final risk level is determined according to the distribution, thereby effectively solving the problem that the traditional static access control mode cannot handle multi-dimensional attribute dynamic changes and complex nonlinear relationships, through the introduction of dynamic permission state data and the branch coding and weighted fusion of the improved model, realizing real-time comprehensive analysis of the "attribute-policy-access behavior" whole link, overcoming potential risks such as incomplete attribute collection, policy logic conflict and permission abuse, improving the efficiency and accuracy of risk assessment, and meeting the real-time and automated security needs of dynamic permission governance in large-scale distributed organizations.

[0030] As shown in Figure 2 In one embodiment, the method of the present application further comprises training the improved multilayer perceptron neural network model, specifically comprising the following steps: Step S210, training samples are collected from the access log, audit log, authorized operation log, terminal security log, threat intelligence data and business system data.

[0031] Step S220, samples related to ABAC are filtered from the public security dataset and attribute mapping is performed through domain adaptation data enhancement to expand the training sample set.

[0032] The public security dataset includes CSE-CIC-IDS2018, KDD Cup 99, and ABAC-related samples such as unauthorized access by fake IP and permission application after terminal vulnerability exploitation. Attribute mapping includes mapping Linux terminal vulnerability to terminal security score 50 and mapping HTTP attack to access path anomaly degree 0.8. The public data and enterprise internal data are mixed in a ratio of 1:4 for training.

[0033] Step S230, the model is trained based on the training sample set.

[0034] By constructing a high-quality training set from multiple sources of logs and intelligence, and using cross-domain data enhancement to improve the model's ability to generalize and recognize new threats, the sample diversity and authenticity are enhanced, and the adaptability and robustness of the model in the actual ABAC environment are improved.

[0035] As shown in Figure 3 , in one embodiment, the improved multilayer perceptron neural network model is trained, and the following steps are further included: Step S310, according to the threat occurrence probability and impact degree, each access request training sample is labeled as high risk, medium risk or low risk level.

[0036] Step S320, balance the sample distribution of each risk level by oversampling.

[0037] High-risk samples can be balanced by duplication, with a final distribution of 20% high-risk, 30% medium-risk and 50% low-risk.

[0038] Step S330, the labeled dataset is divided into training set, validation set and test set according to a predetermined division ratio.

[0039] As an option, the labeled dataset is divided into training set 70%, validation set 15% and test set 15% according to the predetermined division ratio. Thus, the sample labels meet the business risk definition, the class imbalance problem is alleviated by oversampling, the evaluation reliability is ensured by standardized division, the sensitivity of the model to a small number of high-risk samples is improved, the evaluation bias caused by data skewness is avoided, and a structured data foundation is provided for model training and validation.

[0040] As shown in Figure 4As shown, in one embodiment, the training of the improved multi-layer perceptron neural network model further comprises the following steps: At step S410, the model is optimized using a weighted cross-entropy loss function and an AdamW optimization algorithm, wherein the initial learning rate, batch size, and iteration number are all preset values.

[0041] The model is optimized using a weighted cross-entropy loss function and an AdamW optimization algorithm. The weighted cross-entropy loss is used to address the class imbalance problem: , where N is the number of samples, is the class weight (high risk: 1.5, medium risk: 1.2, low risk: 1.0), is the true label, is the model prediction probability. The AdamW optimizer is used, with an initial learning rate of η0=0.001, a batch size of BatchSize=64, and an iteration number of Epochs=100. The weight decay parameter of AdamW is set to 0.01.

[0042] At step S420, a learning rate warm-up strategy is used to linearly increase the learning rate from an initial value to the initial learning rate at the beginning of training. Optionally, the learning rate is linearly increased from 0.0001 to the initial learning rate of 0.001 for the first 5 epochs.

[0043] At step S430, a learning rate decay strategy is used. When the validation set loss does not decrease for a preset number of times in a row, the learning rate is reduced by a decay factor until a minimum learning rate is reached.

[0044] Optionally, when the validation set loss does not decrease for 5 epochs in a row, the learning rate is reduced by a decay factor of 0.5 until a minimum learning rate of 0.00001 is reached.

[0045] At step S440, an early stopping strategy is used. When the validation set F1 value does not improve for a preset number of times in a row, the training is stopped. Optionally, when the validation set F1 value does not improve for 10 epochs in a row, the training is stopped.

[0046] Through the adaptive optimization strategy, the convergence speed and stability are coordinated. Relying on the warm-up mechanism, the gradient update at the beginning of training is smoothed. Using the decay and early stopping mechanisms, overfitting is suppressed, the model training efficiency and generalization performance are improved, and the convergence quality and robustness of the final model are ensured.

[0047] The overall accuracy of the trained model on the test set and the F1 value of each risk level need to meet the corresponding preset performance index requirements, that is, the overall accuracy is greater than or equal to 90%, the F1 value of the high-risk level is greater than or equal to 92%, the F1 value of the medium-risk is greater than or equal to 88%, and the F1 value of the low-risk is greater than or equal to 85%; the classification performance of the quantitative evaluation model on the ABAC dynamic risk is especially emphasized on the accurate identification of the high-risk scene; the accuracy and reliability requirements of the model output conforming to the actual safety control are ensured, and a reliable basis is provided for the automatic risk assessment of the ABAC system.

[0048] The ABAC dynamic risk assessment device based on the improved MLP provided by the application is described below, and the ABAC dynamic risk assessment device based on the improved MLP described below can be correspondingly referred to the ABAC dynamic risk assessment method based on the improved MLP described above.

[0049] As shown in Figure 5 In one embodiment, an ABAC dynamic risk assessment device based on an improved MLP includes a data acquisition module 510, a data preprocessing module 520, a feature vector input module 530, and a risk level determination module 540.

[0050] The data acquisition module 510 is configured to acquire multi-dimensional attribute data and dynamic permission state data associated with an access request.

[0051] The data preprocessing module 520 is configured to preprocess the multi-dimensional attribute data and the dynamic permission state data to generate attribute feature vectors and state feature vectors, respectively.

[0052] The feature vector input module 530 is configured to input the attribute feature vectors and the state feature vectors into an improved multi-layer perceptron neural network model, wherein the improved multi-layer perceptron neural network model includes: an encoding layer configured to encode the attribute feature vectors and the state feature vectors, respectively, the encoding layer includes an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopts a Leaky ReLU activation function, and the state feature block sublayer adopts an ELU activation function; a feature fusion layer configured to fuse the independently encoded attribute features and state features to generate a fusion feature vector; a plurality of hidden layers configured to perform nonlinear transformation on the fusion feature vector to extract risk features; and an output layer configured to output a risk level probability distribution of the access request based on the extracted risk features.

[0053] The risk level determination module 540 is configured to determine a final risk level of the access request according to the risk level probability distribution.

[0054] Figure 6An example of a schematic diagram of the physical structure of an electronic device, which can be a smart terminal, is shown in Figure 6 The electronic device includes a processor, a memory and a network interface connected by a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the electronic device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement an ABAC dynamic risk assessment method based on an improved MLP, which includes: obtaining multi-dimensional attribute data and dynamic permission state data associated with an access request; preprocessing the multi-dimensional attribute data and the dynamic permission state data to generate attribute feature vectors and state feature vectors, respectively; inputting the attribute feature vectors and the state feature vectors into an improved multi-layer perceptron neural network model, wherein the improved multi-layer perceptron neural network model includes: an encoding layer for encoding the attribute feature vectors and the state feature vectors, respectively, the encoding layer including an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer using a Leaky ReLU activation function, and the state feature block sublayer using an ELU activation function; a feature fusion layer for weighting and fusing the independently encoded attribute features and state features to generate a fusion feature vector; a plurality of hidden layers for nonlinearly transforming the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features; determining the final risk level of the access request according to the risk level probability distribution.

[0055] Those skilled in the art can understand that Figure 6 the structure shown in the figure is only a block diagram of part of the structure related to the present application, and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0056] On the other hand, the present application also provides a computer storage medium storing a computer program, which is executed by a processor to implement an ABAC dynamic risk assessment method based on an improved MLP, which includes: obtaining multi-dimensional attribute data and dynamic permission state data associated with an access request; preprocessing the multi-dimensional attribute data and the dynamic permission state data to generate attribute feature vectors and state feature vectors, respectively; input the attribute feature vector and the state feature vector into an improved multilayer perceptron neural network model, wherein the improved multilayer perceptron neural network model comprises: an encoding layer for respectively performing feature encoding on the attribute feature vector and the state feature vector, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer for performing weighted fusion on the independently encoded attribute feature and state feature to generate a fusion feature vector; a plurality of hidden layers for performing nonlinear transformation on the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features. determining a final risk level of the access request according to the risk level probability distribution.

[0057] In another aspect, a computer program product or computer program is provided, the computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor implements an ABAC dynamic risk assessment method based on an improved MLP when executing the computer instructions, the method comprising: obtaining multi-dimensional attribute data and dynamic permission state data associated with an access request; respectively pre-processing the multi-dimensional attribute data and the dynamic permission state data to generate an attribute feature vector and a state feature vector; inputting the attribute feature vector and the state feature vector into an improved multilayer perceptron neural network model, wherein the improved multilayer perceptron neural network model comprises: an encoding layer for respectively performing feature encoding on the attribute feature vector and the state feature vector, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer for performing weighted fusion on the independently encoded attribute feature and state feature to generate a fusion feature vector; a plurality of hidden layers for performing nonlinear transformation on the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features. determining a final risk level of the access request according to the risk level probability distribution.

[0058] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory.

[0059] By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0060] The technical features of the above embodiments can be combined in any way. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0061] The above embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the present application. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. An improved MLP based ABAC dynamic risk assessment method, characterized in that, The method comprises: acquiring multi-dimensional attribute data and dynamic permission state data associated with an access request; respectively preprocessing the multi-dimensional attribute data and the dynamic permission state data to generate attribute feature vectors and state feature vectors; inputting the attribute feature vectors and the state feature vectors into an improved multi-layer perceptron neural network model, wherein the improved multi-layer perceptron neural network model comprises: an encoding layer for respectively encoding the attribute feature vectors and the state feature vectors, the encoding layer comprising an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer adopting a Leaky ReLU activation function, and the state feature block sublayer adopting an ELU activation function; a feature fusion layer for weighting and fusing the independently encoded attribute features and state features to generate a fusion feature vector; a plurality of hidden layers for nonlinearly transforming the fusion feature vector to extract risk features; and an output layer for outputting a risk level probability distribution of the access request based on the extracted risk features; determining a final risk level of the access request according to the risk level probability distribution.

2. The improved MLP based ABAC dynamic risk assessment method according to claim 1, wherein, The acquisition of the multi-dimensional attribute data associated with the access request comprises: real-time acquisition of user basic attributes and identity security attributes from a user identity management and authentication system; querying resource basic attributes and resource security attributes of the accessed resource from a resource metadata management system and a security policy library; real-time collection of basic environment attributes at the time of access, querying of business context attributes from a business context service, and acquisition of network security attributes from a network security monitoring system; continuous monitoring and reporting of terminal security states from a terminal agent program, real-time calculation of user behavior posture based on a user behavior analysis engine, and subscription of global threat intelligence from a threat intelligence platform.

3. The improved MLP based ABAC dynamic risk assessment method of claim 1, wherein, The acquisition of the dynamic permission state data associated with the access request comprises: acquisition of a policy execution indicator of the current request from a policy decision point, and querying of permission life cycle indicators from a permission management service.

4. The improved MLP based ABAC dynamic risk assessment method of claim 1, wherein, The preprocessing of the multi-dimensional attribute data and the dynamic permission state data comprises: processing of real-time acquired category type attributes by one-hot encoding, standardization of numerical value type attributes to a preset numerical value interval, conversion of Boolean type attributes into binary values, and conversion of time series attributes into fixed length features by a sliding window method.

5. The improved MLP based ABAC dynamic risk assessment method according to claim 1, wherein, The encoding layer comprises an attribute feature block sublayer and a state feature block sublayer, the attribute feature block sublayer has a first preset number of neurons and adopts a Leaky ReLU activation function for encoding attribute feature vectors, and the state feature block sublayer has a second preset number of neurons and adopts an ELU activation function for encoding state feature vectors.

6. The improved MLP based ABAC dynamic risk assessment method of claim 1, wherein, The plurality of hidden layers comprises a plurality of fully connected hidden layers, each hidden layer having a preset number of neurons and adopting a ReLU activation function; a Dropout layer is arranged between the hidden layers, the Dropout rate of the Dropout layer being a preset ratio, and L2 regularization is added, the weight decay coefficient of the L2 regularization being a preset coefficient; the hidden layers are further provided with a batch normalization layer, and the hidden layers adopt residual connection.

7. The improved MLP based ABAC dynamic risk assessment method according to claim 1, wherein, The output layer has the same number of neurons as the risk level categories and adopts a Softmax activation function to output the probability distribution of each risk level. The final risk level of the access request is determined according to the risk level probability distribution, comprising: Comparing the probability value or the highest probability value with a corresponding preset risk threshold to determine the final risk level.

8. The improved MLP based ABAC dynamic risk assessment method of claim 1, wherein, The method further comprises training the improved multilayer perceptron neural network model, specifically comprising: Collecting training samples from access logs, audit logs, authorized operation logs, terminal security logs, threat intelligence data and business system data; Through domain adaptive data augmentation, samples related to ABAC are screened from a public security data set and attribute mapping is performed to expand the training sample set; Training the model based on the training sample set.

9. The improved MLP based ABAC dynamic risk assessment method of claim 8, wherein, The training of the improved multilayer perceptron neural network model further comprises: According to the probability of threat occurrence and the degree of influence, each access request training sample is labeled as a high-risk, medium-risk or low-risk level; Balancing the sample distribution of each risk level through oversampling; The labeled data set is divided into a training set, a validation set and a test set according to a preset division ratio.

10. The improved MLP based ABAC dynamic risk assessment method of claim 8, wherein, The training of the improved multilayer perceptron neural network model further comprises: Using a weighted cross-entropy loss function and an AdamW optimization algorithm to optimize the model, wherein the initial learning rate, batch size and iteration number are all preset values; Using a learning rate warm-up strategy to linearly increase the learning rate from an initial value to the initial learning rate in the early stage of training; Using a learning rate decay strategy to reduce the learning rate by a decay factor when the validation set loss does not decrease for a preset number of times until a minimum learning rate; Using an early stopping strategy to stop training when the validation set F1 value does not improve for a preset number of times.

11. An improved MLP based ABAC dynamic risk assessment apparatus, characterized in that, The device comprises: A data acquisition module for acquiring multi-dimensional attribute data and dynamic permission state data associated with access requests; A data preprocessing module for preprocessing the multi-dimensional attribute data and dynamic permission state data to generate attribute feature vectors and state feature vectors, respectively; The feature vector input module is configured to input the attribute feature vector and the state feature vector into an improved multi-layer perceptron neural network model, wherein the improved multi-layer perceptron neural network model comprises: an encoding layer configured to encode the attribute feature vector and the state feature vector respectively, the encoding layer comprising an attribute feature block sub-layer and a state feature block sub-layer, the attribute feature block sub-layer adopting a Leaky ReLU activation function, and the state feature block sub-layer adopting an ELU activation function; a feature fusion layer configured to fuse the independently encoded attribute feature and state feature by weighting to generate a fusion feature vector; a plurality of hidden layers configured to perform non-linear transformation on the fusion feature vector to extract risk features; and an output layer configured to output a risk level probability distribution of the access request based on the extracted risk features. The risk level determination module is configured to determine a final risk level of the access request according to the risk level probability distribution.

12. An electronic device, comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor implements the computer program to implement the ABAC dynamic risk assessment method based on the improved MLP in any one of claims 1 to 10.

Images