Network information security access control system based on dynamic trust evaluation

Abstract

The application discloses a network information security access control system based on dynamic trust evaluation, comprising: a behavior collection module: collecting original behavior log data, and constructing a behavior characteristic sequence reflecting the security state of an entity through a preset stream processing engine; a behavior analysis module: performing long-term and short-term behavior modeling analysis on the behavior characteristic sequence, obtaining long-term and short-term behavior mode representation, outputting potential causal chain data based on the long-term and short-term behavior mode representation and an abnormal cause and effect inference model with context awareness, and constructing a dynamic trust portrait according to the potential causal chain data; the long-term and short-term behavior modeling analysis comprises long-term behavior modeling analysis and short-term behavior modeling analysis; a strategy generation module: driving a strategy engine in real time based on the dynamic trust portrait, performing attribute extraction and dynamic attribute coding based on a behavior sequence in a software-defined boundary framework, and dynamically generating and issuing an attribute-based optimal dynamic access strategy according to the principle of least privilege.

Description

Technical Field

[0001] This invention relates to the field of technology, and in particular to a network information security access control system based on dynamic trust assessment. Background Technology

[0002] With the increasing complexity of network applications and the diversification of security threats, dynamic access control technology has evolved from static permission management to dynamic policy optimization. Early methods used static permission allocation, such as role-based access control (RBAC). Once configured, permissions remained fixed for a long time, making it difficult to cope with dynamic changes in entity trust levels and behavioral risks, such as user identity forgery and the evolution of malicious behavior. Subsequently, rule-based dynamic access control, such as access control combined with trust values, began to emerge. It achieved dynamic adjustment of permissions through predefined rules. However, the matching logic of the rules was simple (such as linear matching), which could not handle the uncertainty of attributes and multi-dimensional security requirements. In recent years, the development of programmable data plane technology has provided a new implementation carrier for dynamic access control. It supports real-time parsing and execution of policies on the data plane, improving the real-time performance of access control. Currently, existing network information security access control systems suffer from a lack of permission optimization. Most dynamic policies only focus on the dynamic adjustment of permissions without optimizing policies from the perspective of minimizing permissions. For example, they do not quantify the scope of permission coverage, nor do they select policies that minimize access resources and restrict operations. This leads to excessive permission allocation, increasing security risks such as unauthorized access and the spread of malicious operations. Furthermore, traditional network architectures, such as hardware-based switches, have limited policy execution capabilities, making it difficult to respond to dynamic access requests in the session lifecycle in real time. Moreover, policy update latency is high, making it unable to adapt to changes in the network environment. Therefore, this paper proposes a network information security access control system based on dynamic trust assessment. Summary of the Invention

[0003] In order to overcome the above-mentioned defects of the prior art and to achieve the above objectives, the present invention proposes the following technical solution: A network information security access control system based on dynamic trust assessment includes: Behavior acquisition module: Collects raw behavior log data and constructs a sequence of behavioral features reflecting the security status of an entity through a preset streaming processing engine; Behavior Analysis Module: Performs long-term and short-term behavior modeling and analysis on behavioral feature sequences to obtain long-term and short-term behavior pattern representations. Based on the long-term and short-term behavior pattern representations and a context-aware abnormal causal inference model, it outputs potential causal chain data and constructs a dynamic trust profile based on the potential causal chain data. The long-term and short-term behavioral modeling analysis includes long-term behavioral modeling analysis and short-term behavioral modeling analysis; Policy generation module: Based on dynamic trust profile, the real-time policy engine performs attribute extraction and dynamic attribute encoding based on behavior sequence within the software-defined boundary framework, and dynamically generates and issues an attribute-based best dynamic access policy according to the principle of least privilege. Policy enforcement module: Through the programmable data plane, it executes the best dynamic access policy for network traffic throughout the entire session lifecycle, realizing adaptive network information security access control.

[0004] The process of obtaining behavioral feature sequences is as follows: Deploy global log collection nodes to collect raw behavioral log data The collected raw behavior log data The input is a preset streaming engine. Logs are grouped according to entity identifiers. For each entity in the original behavior log data, its behavior logs are sorted by timestamp. Then, features of each behavior are extracted to construct a multi-dimensional behavior feature vector. Let the feature vector of an entity at time i be... ; These feature vectors are concatenated in chronological order to form the behavioral feature sequence of the entity. , where d is the feature dimension.

[0005] The process of long-term behavioral pattern analysis is as follows: Sequence modeling methods are used to extract long-term behavioral sequences from behavioral feature sequences, represented as follows: Then, through an autoregressive model, the long-term behavioral sequences are input into the autoregressive model to learn the dependencies of long-term behaviors and output a long-term behavioral pattern representation. The process is represented as follows: ,in, This is a mapping function based on an autoregressive model.

[0006] The process of short behavior modeling and analysis is as follows: Focusing on behavioral sequences at short timescales S, we can mine short-term behavioral sequences of entities at the hourly level. Then, a sliding window mechanism is used to directly encode short-term behavioral sequences using a recurrent neural network LSTM. The process is represented as follows: ,in, Given the hidden state of the entity at time t-1, the final output is a representation of its short-term behavioral pattern. .

[0007] The implementation process of the context-aware anomaly causal inference model is as follows: The abnormal causal inference model includes an abnormal output part, a causal inference part, and a potential cause identification part; The abnormal output section uses an abnormal detection function 'a' to output an abnormal flag, where a=1 indicates an abnormality and a=0 indicates normality. If an abnormality is detected, causal inference is performed, and the process proceeds to the causal inference section. The causal inference part involves tracing back behavioral feature sequences. For the preceding behaviors related to the abnormal behavior, construct a causal graph G=(D,E), where D is the behavior node and E is the causal edge between behaviors. Then, traverse the behavior feature sequence. The behavior most relevant to the anomaly detection time is recorded as the anomaly behavior segment. Proceed to the potential cause identification section; The potential cause identification section is based on abnormal behavior fragments. By introducing a causal correlation degree C, we backtrack through the behavioral feature sequence S to find the preceding behaviors that led to the anomaly. And set a correlation threshold. , all greater than Corresponding pre-action As abnormal behavior The potential causes of behavior are traced back to the beginning of the sequence, forming a potential causal chain data. .

[0008] The calculation process for the causal correlation degree C is as follows: ; in: It is the time similarity function, defined as , It is the attenuation coefficient. It is the feature dependency function, with values ​​between [0,1]. and It is the weighting coefficient.

[0009] The process of building a dynamic trust profile is as follows: From potential causal chain data Extract causal chain depth and behavioral malice score; The causal chain depth is directly obtained by recording the total number of nodes from the initial behavior to the anomalous behavior, and is represented as the causal chain depth. For each behavioral maliciousness score in the chain, a basic maliciousness score M is predefined based on its type and historical data. Based on causal chain depth Calculate the dynamic trust value for different entities using the base malice score M. Calculation process: ; in, It is the basic trust value of a certain entity. This represents the sum of the base malice scores of all behavioral nodes in the chain, reflecting the degree of malice of the behavior, and ultimately obtaining a dynamic trust profile of different entities. .

[0010] The implementation process of dynamic attribute encoding based on behavior sequences is as follows: Define entity attribute sets based on dynamic trust profiles Including basic trust value Causal chain depth Total degree of malice in behavior and dynamic trust value For entity attribute sets Each attribute in is defined as follows: Extract its most recent A sequence of time steps And through trend standardization, it is transformed into a vector reflecting the direction of change, represented as: ; in, Represents a dynamic attribute encoding vector. Represents entity attribute set Sub-attributes in This represents the value of the sub-attribute over the past k time steps, i.e., at time t-k.

[0011] The process of obtaining the optimal dynamic access strategy is as follows: A policy rule base containing attributes and permission mapping relationships is defined based on a decision tree, and the policy with the least permission in the policy rule base is selected as the candidate policy. Get each strategy Permission coverage The best dynamic access strategy is... The acquisition process is as follows: .

[0012] The present invention has the following beneficial effects: 1. By combining dynamic attribute encoding based on behavior sequences with lightweight policy execution in a programmable data plane, a dual breakthrough in resource management efficiency and system adaptability is achieved. Dynamic attribute encoding encodes entity attributes... The recent trend of change is quantified into a standardized vector. This enables the policy engine to perceive subtle evolutions in behavioral patterns, such as the slow decay of trust values. When a server experiences a sudden surge in access during non-business hours, the system automatically shrinks the range of resources it can access to prevent resource abuse. This closed-loop mechanism of dynamic perception and real-time control significantly reduces the latency of policy updates, allowing the system to adapt to changes in business load and threat landscape.

[0013] 2. Through the collaborative mechanism of dynamic trust profiling and least privilege policy optimization, a qualitative leap in security protection capabilities has been achieved. The system's causal chain depth is based on behavioral sequence analysis. And behavioral malice score ∑ It accurately quantifies the risk level of entities and uses decision tree matching logic from a strategy rule base to dynamically assign trust values. Dynamically associate permissions with multiple attributes such as resource sensitivity level and operation type to generate permission coverage. Minimal optimal dynamic access strategy When a sudden increase in the maliciousness of a user's behavior is detected, the system automatically restricts the types of operations that the user can perform to access sensitive resources, such as prohibiting write access, thus curbing the risk of unauthorized access at the source. Compared to traditional static permission allocation, this solution upgrades security protection from passive response to proactive prediction and dynamic suppression. Attached Figure Description

[0014] Figure 1 This is a system block diagram of the network information security access control system based on dynamic trust assessment proposed in this invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] Example 1 like Figure 1 As shown, the network information security access control system based on dynamic trust assessment proposed in this invention includes: Behavior acquisition module: Collects raw behavior log data and constructs a sequence of behavioral features reflecting the security status of an entity through a preset streaming processing engine; First, deploy global log collection nodes to collect raw behavior log data, covering all entities in the network, including user terminals, servers, and network devices, and the types of behavior log data collected include: user login operations, file access operations, network connection operations, command execution operations, etc. For each type of operation, record its operation subject (entity identifier), operation timestamp t, operation object, and operation type attributes. For example, if user u performs a read operation on a file at time t, the raw behavior log data can be obtained through a distributed collection architecture. Where i is the time index, i.e., time. This represents the entity's behavior log data at time i; The collected raw behavior log data Input a preset streaming engine. The streaming engine groups logs according to entity identifiers. For each entity, it sorts its behavior logs by timestamp. Then, it extracts features from each behavior to construct a multi-dimensional behavior feature vector. Let the feature vector of an entity at time i be... ; These feature vectors are concatenated in chronological order to form the behavioral feature sequence of the entity. , where d is the feature dimension, and the behavioral feature sequence S fully reflects the security-related behaviors of an entity over a period of time, and is the core input for subsequent analysis.

[0017] Behavior Analysis Module: Performs long-term and short-term behavior modeling and analysis on behavioral feature sequences to obtain long-term and short-term behavior pattern representations. Based on the long-term and short-term behavior pattern representations and a context-aware abnormal causal inference model, it outputs potential causal chain data and constructs a dynamic trust profile based on the potential causal chain data. Long-term and short-term behavioral modeling analysis includes long-term behavioral modeling analysis and short-term behavioral modeling analysis; The process of long-term behavioral pattern analysis is as follows: Long-term behavioral pattern analysis employs sequence modeling methods to uncover behavioral patterns of entities over longer time scales, such as days or weeks. It extracts long-term behavioral sequences from behavioral feature sequences, represented as... ,in, A feature vector representing the behavioral characteristics of an entity within a certain long-term period of a month L, such as counting the frequency of various operations within that period to form a feature vector; Then, an autoregressive model is used to learn the dependencies between long-term behaviors by inputting the long-term behavior sequences into the model, and outputs a long-term behavior pattern representation. The process is represented as follows: ,in, It is a mapping function based on the autoregressive model, which is the core computational component of the autoregressive model; Long-term behavioral pattern representation Originating from the mining of entity behavior sequences over longer time scales, such as monthly cycles (L), this reveals the baseline of entity behavior habits. For example, a server typically performs database backups at 3 AM daily and processes business requests from 8 AM to 6 PM on weekdays. It encodes these periodic and stable features; The process of short behavior modeling and analysis is as follows: Focusing on behavioral sequences at short timescales S, we mine short-term behavioral sequences of entities at hourly levels. ,in, This represents a short-term behavioral sequence of an entity within a short time period S. A sliding window mechanism is then used to capture recent behavioral changes in real time. A recurrent neural network (LSTM) is then used to directly encode the short-term behavioral sequence. The process is as follows: ,in, Given the hidden state of the entity at time tI, the final output is a representation of its short-term behavioral pattern. ; Short-term behavioral pattern representation Focusing on the behavioral sequences of entities on short timescales, such as minutes or hours, it captures real-time fluctuations and abrupt changes in behavior. For example, a user terminal suddenly initiates a large number of external network connections during non-working hours. This will highlight these immediate anomalies; Then, the long-term behavioral pattern is represented. and short-term behavioral pattern representation By fusing the data, we obtain the fused long and short behavioral pattern representations. , where g is the fusion function used for splicing; Furthermore, the fusion function g needs to organically combine the two types of features, and The feature vectors are directly concatenated. This method preserves the original information of long-term and short-term features, which can be used for the subsequent model to learn high-dimensional feature vectors in parallel. The process of analyzing results using a context-aware anomaly causal inference model is as follows: The abnormal causal inference model includes an abnormal output part, a causal inference part, and a potential cause identification part; First, we'll address the abnormal output of the model: Based on the fused long and short behavior pattern representation Construct an anomaly causal inference model that combines context awareness to determine whether the current behavior is abnormal; First, define an anomaly detection function 'a', and output an anomaly flag: a=1 indicates an anomaly, and a=0 indicates normal. If an anomaly is detected, perform causal inference, that is, analyze the behavioral chain that led to the anomaly. Specifically, the anomaly detection function 'a' is implemented based on unsupervised learning, employing an autoencoder unsupervised model to learn feature representations of normal behavior, and for inputting long and short behavior pattern representations... If the reconstruction error score exceeds the preset threshold, then a=1 is determined; Furthermore, the detection results are verified from multiple dimensions simultaneously: Behavioral frequency dimension: If the frequency of a certain type of behavior is similar to the long-term baseline... Compared to a change of orders of magnitude, such as a user's login frequency suddenly increasing from an average of 5 times per day to 500 times, an anomaly flag a=1 is triggered. Behavioral type dimension: If an entity exhibits an operational type never seen before in its long-term behavior, such as a database server suddenly executing a large number of command-line scripts, then this should be combined with short-term characteristics. It can be determined that a = 1; After the anomaly detection function outputs a=1, the causal inference part is performed: By tracing back the behavioral feature sequence For the preceding behaviors related to the abnormal behavior, construct a causal graph G=(D,E), where D is the behavior node and E is the causal edge between behaviors to clarify the cause of the abnormality. Furthermore, behavior node V: Abnormal behavior and its preceding behaviors that are related by time sequence and features are abstracted into nodes. For example, if the abnormal behavior is that the database is illegally downloaded, then the preceding behavior nodes include abnormal account login, suspicious command execution, and illegal privilege escalation. Causal edge E: Represents the causal relationship between behavior nodes, such as abnormal account login, unauthorized privilege escalation, and unauthorized database download. The weight of the edge is directly set based on the time interval between behaviors, reflecting the strength of the causal relationship. Traversing the behavioral feature sequence Find the one or a group of behaviors most relevant to the anomaly detection time and record them as the anomaly behavior segment. ,in, It is the behavior vector that most directly causes an exception to be triggered. This is the action vector at the k-th time step before the trigger time t; Then, the potential cause identification section is performed: Based on abnormal behavior fragments By tracing back through the complete behavioral feature sequence S, we can find the preceding behaviors that led to the anomaly. We define the causal correlation degree, and let the preceding behavior vector be... The abnormal behavior vector is We introduce a causal correlation degree C, where j and m are the times of occurrence, and j is less than m, meaning that time j is before time m. The calculation process for the causal correlation degree C is as follows: ; in: It is the time similarity function, defined as , It is the attenuation coefficient. It is the feature dependency function, taking values ​​between [0,1]. and When there is a strong dependency between the features, this value is close to 1; otherwise, it is close to 0. and These are weighting coefficients; From abnormal behavior vectors Begin by calculating its causal relationship with all preceding behaviors. Set a correlation threshold , all greater than Corresponding pre-action As abnormal behavior The potential causes of the behavior are traced back to the beginning of the sequence, forming one or more potential causal chains from the initial behavior to the abnormal behavior, ultimately outputting the data. Subsequent behaviors are presented as potential causes, ultimately pointing to abnormal behavior. , Represents potential causal chain data; Specifically, for removing redundant nodes, if all the features of a certain behavior node in the chain are completely contained or covered by its successor node, and the occurrence of this behavior node does not directly depend on the specific details of the successor node, then its successor node is a redundant node and is removed directly. Finally, based on potential causal chain data To construct a dynamic trust profile, we analyze the structure and attribute characteristics of causal chains to calculate dynamic trust values. First, we start with potential causal chain data. Extract causal chain depth and behavioral malice score; The causal chain depth is directly obtained by recording the total number of nodes from the initial behavior to the anomalous behavior, and is represented as the causal chain depth. , The larger the value, the more complex the attack path, the stronger the premeditation, and the higher the risk. Maliciousness score: For each behavioral node in the chain, a basic maliciousness score M is predefined based on its type and historical data; Based on causal chain depth Calculate the dynamic trust value for different entities using the base malice score M. Calculation process: ; in, It is the basic trust value of a certain entity. This represents the sum of the base malice scores of all behavioral nodes in the chain, reflecting the degree of malice of the behavior; Ultimately, dynamic trust profiles of different entities are obtained, represented as ; Specifically, dynamic trust profile The representation is based on dynamic trust values. At its core, it integrates the fundamental trust of entities. Causal chain depth Maliciousness of behavior Features are presented in a visual format, intuitively and quantitatively depicting how an entity's trust status changes over time.

[0018] Policy generation module: Based on dynamic trust profile, the real-time policy engine performs attribute extraction and dynamic attribute encoding based on behavior sequence within the software-defined boundary framework, and dynamically generates and issues an attribute-based best dynamic access policy according to the principle of least privilege. The attribute extraction process is as follows: Extracting entity attribute sets within a software-defined boundary framework ; Entity attribute set The construction of dynamic trust profiles Extract directly from the core, including: Basic Trust Value : Reflects the historical trust accumulated by an entity; Causal chain depth : Represents the complexity of the attack path; Total degree of malice in behavior : Reflects the overall risk level of the behavior; Dynamic Trust Value : Comprehensive real-time trust assessment results; The implementation process of dynamic attribute encoding based on behavior sequences is as follows: To more accurately capture the dynamic changes in attributes, dynamic attribute encoding based on behavioral sequences is introduced. This treats entity attributes as dynamic variables over time, extracting recent attribute trends through a sliding window rather than relying solely on static values. The specific encoding process is as follows: For entity attribute sets Each attribute in is defined as follows: ,(express (Any one), extract its most recent A sequence of time steps And through trend standardization, it is transformed into a vector reflecting the direction of change, represented as: ; Here, the numerator represents the recent change in the attribute, and the denominator is the maximum absolute value of the recent change, ensuring that the change trends of different attributes are comparable, representing the dynamic attribute encoding vector. Represents entity attribute set Sub-attributes in This represents the value of the sub-attribute over the past k time steps, i.e., at time t-k. Then, based on the principle of least privilege, an attribute-based optimal dynamic access strategy is dynamically generated and issued, combined with dynamic attribute encoding vectors. Access policies are generated through policy matching and optimization algorithms: First, strategy matching is performed to encode dynamic attribute vectors. Input a predefined policy rule base and find all candidate policies that satisfy the attribute constraints; The rule base contains the mapping relationship between attributes and permissions, such as high dynamic trust value + low malicious behavior → high access permission. The matching logic of the rule base is based on decision tree to handle the uncertainty of attributes and multi-dimensional constraints. Then, strategy optimization is performed. Among the candidate strategies, the strategy with the fewest permissions is selected, that is, the strategy that accesses the fewest resources and has the most restricted operation types. Let the set of candidate strategies be . Each candidate strategy Each corresponds to a permission coverage scope. ; Specifically, Defined as the number of resources accessed multiplied by the complexity of the operation type, the scope of permission coverage. Used to measure candidate strategies The scope of permissions is defined as the product of the number of resources accessed by the policy and the complexity of the operation type. The number of resources accessed reflects the scale of resources that the policy can operate on, and the complexity of the operation type reflects the degree of restriction on the operation. The greater the potential impact of the operation on system resources, the higher its preset complexity score. The policy's permission coverage is quantified by the product of the two. The best dynamic access strategy satisfy: ; Specifically, based on the generated optimal dynamic access strategy The policy can be distributed to the access gateway of the target entity and resource in an encrypted and lightweight manner through the policy distribution module of the SDP controller. After receiving the policy, the gateway verifies the entity's access request in real time through the policy execution engine.

[0019] Policy enforcement module: Implements optimal dynamic access policies for network traffic throughout the entire session lifecycle through a programmable data plane, achieving adaptive network information security access control; The generated optimal dynamic strategy The SDP controller sends the data to the programmable data plane forwarding devices, which then apply the optimal dynamic strategy. Configure flow table rules to specify which traffic (based on source / destination IP, port, protocol, dynamic attributes, etc.) is allowed or denied access, as well as the types of operations allowed (such as read / write, execution complexity limits). Then, traffic processing is performed throughout the session lifecycle, with the data plane executing optimal dynamic strategies at each stage. ; During the session establishment phase, when a new network connection (session) request arrives, the optimal dynamic strategy for the data plane is implemented. The rules check the traffic attributes, such as the dynamic trust value of the source IP and the malice level of the behavior, to determine whether it conforms to the optimal dynamic policy. If the permission requirements are met, the session can be established and the best dynamic strategy will be followed. The system restricts forwarding traffic; if the request does not meet the requirements, the connection will be rejected. During the session maintenance phase, the data plane monitors traffic attributes in real time, such as changes in dynamic trust values ​​and behavioral patterns, and combines this with optimal dynamic strategies. The rules dynamically adjust the way traffic is handled. For example, if the maliciousness of a session increases, the data plane can adjust the handling based on the optimal dynamic strategy. Least privilege logic This further restricts the resources or operations they can access; During the session termination phase, when the session ends, the data plane cleans up the policy bindings and traffic rules associated with that session, releases resources, and ensures secure isolation for subsequent sessions. When dynamic attributes of the system, such as user trust values ​​and network threat profile, change, the system will regenerate the optimal dynamic strategy. The controller then sends the rules to the data plane to adjust the traffic access control rules in real time, enabling the network to adaptively respond to changes in security threats and business needs, thus achieving adaptive network information security access control.

[0020] In the application, several formulas are calculated by removing dimensions and taking their numerical values. The formulas are established by collecting a large amount of data and simulating the most recent real situation. Some coefficients or weights in the formulas are set by those skilled in the art according to the actual situation, so they will not be elaborated here.

[0021] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0022] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network information security access control system based on dynamic trust assessment, characterized in that, include: Behavior acquisition module: Collects raw behavior log data and constructs a sequence of behavioral features reflecting the security status of an entity through a preset streaming engine; Behavior Analysis Module: Performs long-term and short-term behavior modeling and analysis on behavioral feature sequences to obtain long-term and short-term behavior pattern representations. Based on the long-term and short-term behavior pattern representations and a context-aware abnormal causal inference model, it outputs potential causal chain data and constructs a dynamic trust profile based on the potential causal chain data. The long-term and short-term behavioral modeling analysis includes long-term behavioral modeling analysis and short-term behavioral modeling analysis; The implementation process of the context-aware anomaly causal inference model is as follows: The abnormal causal inference model includes an abnormal output part, a causal inference part, and a potential cause identification part; The abnormal output section uses an abnormal detection function 'a' to output an abnormal flag, where a=1 indicates an abnormality and a=0 indicates normality. If an abnormality is detected, causal inference is performed, and the process proceeds to the causal inference section. The causal inference part involves tracing back behavioral feature sequences. For the preceding behaviors related to the abnormal behavior, construct a causal graph G=(D,E), where D is the behavior node and E is the causal edge between behaviors. Then, traverse the behavior feature sequence. The behavior most relevant to the anomaly detection time is recorded as the anomaly behavior segment. Proceed to the potential cause identification section; The potential cause identification section is based on abnormal behavior fragments. By introducing a causal correlation degree C, we backtrack through the behavioral feature sequence S to find the preceding behaviors that led to the anomaly. And set a correlation threshold. , all greater than Corresponding pre-action As abnormal behavior The potential causes of behavior are traced back to the beginning of the sequence, forming a potential causal chain data. ; The calculation process for the causal correlation degree C is as follows: ； in: It is the time similarity function, defined as , It is the attenuation coefficient. It is the feature dependency function, with values ​​between [0,1]. and These are weighting coefficients; The process of building a dynamic trust profile is as follows: From potential causal chain data Extract causal chain depth and behavioral malice score; The causal chain depth is directly obtained by recording the total number of nodes from the initial behavior to the anomalous behavior, and is represented as the causal chain depth. For each behavioral maliciousness score in the chain, a basic maliciousness score M is predefined based on its type and historical data. Based on causal chain depth Calculate the dynamic trust value for different entities using the base malice score M. Calculation process: ; in, It is the basic trust value of a certain entity. This represents the sum of the base malice scores of all behavioral nodes in the chain, reflecting the degree of malice of the behavior, and ultimately obtaining a dynamic trust profile of different entities. ; Policy generation module: Based on dynamic trust profile, the real-time policy engine performs attribute extraction and dynamic attribute encoding based on behavior sequence within the software-defined boundary framework, and dynamically generates and issues an attribute-based best dynamic access policy according to the principle of least privilege. Policy enforcement module: Through the programmable data plane, it executes the best dynamic access policy for network traffic throughout the entire session lifecycle, realizing adaptive network information security access control.

2. The network information security access control system based on dynamic trust assessment according to claim 1, characterized in that, The process of obtaining behavioral feature sequences is as follows: Deploy global log collection nodes to collect raw behavioral log data The collected raw behavior log data The input is a preset streaming engine. Logs are grouped according to entity identifiers. For each entity in the original behavior log data, its behavior logs are sorted by timestamp. Then, features of each behavior are extracted to construct a multi-dimensional behavior feature vector. Let the feature vector of an entity at time i be... ; These feature vectors are concatenated in chronological order to form the behavioral feature sequence of the entity. , where d is the feature dimension.

3. The network information security access control system based on dynamic trust assessment according to claim 2, characterized in that, The process of long-term behavioral pattern analysis is as follows: Sequence modeling methods are used to extract long-term behavioral sequences from behavioral feature sequences, represented as follows: Then, through an autoregressive model, the long-term behavioral sequences are input into the autoregressive model to learn the dependencies of long-term behaviors and output a long-term behavioral pattern representation. The process is represented as follows: ,in, This is a mapping function based on an autoregressive model.

4. The network information security access control system based on dynamic trust assessment according to claim 3, characterized in that, The process of short behavior modeling and analysis is as follows: Focusing on behavioral sequences at short timescales S, we can mine short-term behavioral sequences of entities at the hourly level. Then, a sliding window mechanism is used to directly encode short-term behavioral sequences using a recurrent neural network LSTM. The process is represented as follows: ,in, Given the hidden state of the entity at time t-1, the final output is a representation of its short-term behavioral pattern. .

5. The network information security access control system based on dynamic trust assessment according to claim 1, characterized in that, The implementation process of dynamic attribute encoding based on behavior sequences is as follows: Define entity attribute sets based on dynamic trust profiles Including basic trust value Causal chain depth Total degree of malice in behavior and dynamic trust value For entity attribute sets Each attribute in is defined as follows: Extract its most recent A sequence of time steps And through trend standardization, it is transformed into a vector reflecting the direction of change, represented as: ； in, Represents a dynamic attribute encoding vector. Represents entity attribute set Sub-attributes in This represents the value of the sub-attribute over the past k time steps, i.e., time tk.

6. The network information security access control system based on dynamic trust assessment according to claim 5, characterized in that, The process of obtaining the optimal dynamic access strategy is as follows: A policy rule base containing attributes and permission mapping relationships is defined based on a decision tree, and the policy with the least permission in the policy rule base is selected as the candidate policy. Get each strategy Permission coverage The best dynamic access strategy is... The acquisition process is as follows: .

Images