Access control attribute mining method and system based on large language model

Abstract

The invention relates to the technical field of information security, in particular to an access control attribute mining method and system based on a large language model.The method comprises the steps that a similar sample of each target text is selected from source domain data according to similarity, and a semantic association keyword candidate set of the target domain data is obtained based on the similar samples; constructing a target domain sample generation template according to the task instruction in combination with the prompt example and the domain adaptation knowledge, and driving the large model to generate target domain structured sample data based on the target domain sample generation template; and performing fine tuning on the attribute mining model by using the target domain structured sample data, mining the access control attribute in the target domain data of the to-be-marked attribute tag by using the fine-tuned model, and indicating the attribute mining model to examine and verify the attribute mining logic through the thinking chain in the access control attribute mining. According to the method, efficient access control data mining can be realized under the condition of keeping relatively low cost and annotated data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an access control attribute mining method and system based on a large language model. BACKGROUND

[0002] In the digital era, ensuring that information and resources are only accessed by authorized users is the cornerstone of information security. As a new access control model, attribute-based access control (ABAC) realizes fine-grained permission decision through dynamic evaluation of multi-dimensional attributes of subjects, objects and environments. The core lies in accurately describing the key attributes of resources, which are the underlying basis and decisive basis for defining authorization policies. However, with the explosive growth of information systems, the number and types of resources have increased dramatically. Relying on expert manual annotation of attributes or rule making becomes inefficient, costly and difficult to adapt to dynamic changes in the environment. The lack, lag or inaccuracy of attribute definition will directly lead to the failure or inaccurate execution of access control policies, becoming a bottleneck restricting the effective landing of security mechanisms. The field of intelligent access control attribute mining has emerged as the times require. It uses intelligent data analysis and machine learning methods to automatically identify, extract and verify these key attributes supporting access policies from massive resources and their use data. This not only innovates the traditional manual method, but also is the inevitable demand of access control technology to adapt to new complex network environments such as big data, Internet of Things and zero trust. Researching efficient and accurate access control attribute mining methods has important academic value and practical significance for building scalable and adaptive access control systems, and is a key research direction in the current information security field.

[0003] The core of attribute mining is to extract, correlate and generalize key attributes from heterogeneous data to support fine-grained access control. Current attribute mining methods mainly revolve around deep learning models, especially focusing on graph neural networks (GNN), capsule networks, multi-model collaboration, convolutional neural networks (CNN) and contrastive learning. There are also models that use fused heterogeneous graph neural networks (HGNN) and knowledge graph attribute mining attention (KGAM) to achieve this. The model constructs a heterogeneous graph containing multiple types of nodes, uses HGNN to learn node embeddings, and introduces an attention mechanism in the KGAM module to dynamically calculate the weights of related attributes in the knowledge graph, strengthening key attribute features. Finally, the node embeddings and attribute weights are fused to improve the prediction accuracy of attribute mining. For the extraction of organizational attributes in access control, there are also hybrid capsule networks (HCN) designed. Capsule networks are good at capturing part-whole hierarchical relationships and combining local features into high-level attributes through a dynamic routing mechanism. The "hybrid" design may combine CNN preprocessing text to enhance the robustness of attributes such as abbreviations and numbers, making it suitable for fine-grained access control scenarios. Some people have proposed using a multi-model collaboration framework to address the robustness issues of single models. Candidate attribute extraction uses collaborative TF-IDF, TextRank, and BERT algorithms to generate Top-K candidate attributes, combining text-specific features, attribute interaction features, and cross-text association features. Integrated gradient boosting trees and XGBoost base models are used for multi-model voting to determine security attributes, significantly improving noise tolerance. CNN has been applied to access control attribute mining in unstructured text for the first time. Pre-trained word vector models are used to map words to dense vectors, and multi-size convolution kernels are used to capture key phrase patterns. After ReLU activation and max pooling, the attribute category is output. This method is a typical application of CNN in the field of permission attributes. There are also attribute mining multi-view contrastive learning networks (AMMCLN) that construct multiple views of users, items, and other entities to mine core attribute features in each view. Through contrastive learning, the attribute representations of the same entity in different views are pulled closer together, while the attributes of different entities are pushed further apart. The attribute-driven contrast mechanism enhances the expressiveness of the embedding and improves the accuracy of recommendations.

[0004] In summary, the current access control attribute mining based on machine learning and neural networks still faces a certain degree of performance bottleneck: on the one hand, with the explosive growth of information systems, the number and variety of resources have increased dramatically, and the manual labeling of attributes or the formulation of rules by machine learning has become inefficient, costly and difficult to adapt to dynamic changes. On the other hand, the lack, lag or inaccuracy of attribute definition will directly lead to the failure or inaccurate execution of access control policies, and the accuracy of neural network models for attribute mining depends on a large amount of labeled data and large computational overhead, which has inherent contradictions in model complexity and computer device resource constraints. SUMMARY

[0005] The purpose of the present application is to overcome the problems of insufficient labeled data, complex attribute semantics and tedious manual annotation in large-scale dynamic emerging data resource access control attribute mining, and to provide an access control attribute mining method and system based on a large language model. The method uses the powerful semantic reasoning capability of the large language model to construct a guided sentence for the access control attribute mining task, realizes sample data enhancement from the source domain to the target domain, and through the fine-tuning training of the large language model and the use of the thinking chain technology, it can realize efficient access control data mining at a lower cost and with less labeled data.

[0006] According to the design scheme provided by the present application, on the one hand, an access control attribute mining method based on a large language model is provided, comprising:

[0007] Obtain source domain data with access control attribute labels and target domain data to be labeled with access control attribute labels and preprocess them, select similar samples for each target text from the source domain data according to similarity, and obtain a semantic association keyword candidate set for the target domain data based on the similar samples;

[0008] Construct a target domain sample generation template according to the task instructions and in combination with the prompt examples and domain adaptation knowledge, drive the large model to generate target domain structured sample data based on the target domain sample generation template, the task instructions are used to describe the target domain task and attribute specifications and constraints through a natural language template, the prompt examples are used to guide the model to migrate the target domain knowledge points by using a few sample instances related to the target domain and through category learning, the domain adaptation knowledge is obtained through cross-domain migration knowledge based on the semantic association keyword candidate set through feature alignment, and the target domain structured sample data is represented by a triple consisting of access control task instructions, original text input and structured access control attribute labels;

[0009] The attribute mining model is fine-tuned by using the target field structured sample data, the access control attribute in the target field data to be labeled is mined by using the fine-tuned attribute mining model, and the attribute mining model is instructed by a thinking chain to review and verify the attribute mining logic in the access control attribute mining.

[0010] As the access control attribute mining method based on the large language model, further, the data is preprocessed, including:

[0011] The data of the source domain and the target field is filtered, the blank characters at the beginning and the end of the original string are removed, and the visible and control symbols in the standard ASCII character set are retained;

[0012] An iterator-based lazy segmentation strategy is adopted to preferentially segment the sentence related to the access control attribute mining, and effective information is extracted, each preliminary segmentation unit is subjected to blank cutting at the beginning and the end and non-empty segmentation units are retained as effective word groups, and a token set is obtained;

[0013] The token set is subjected to null set verification, if the verification is passed, the normalized text and the effective token array are obtained, and if the verification is not passed, the normalized text and the null mark are obtained.

[0014] As the access control attribute mining method based on the large language model, further, the similar sample of each target text is selected from the source domain data according to the similarity, including:

[0015] The pre-trained sentence encoding model is used to obtain the semantic vectors of the target field text and the source domain text respectively;

[0016] The cosine similarity is used to quantify the proximity of the target field semantic vector and the source domain semantic vector in the semantic space;

[0017] For each target field text, the K samples with the highest semantic similarity are selected from the source domain text to construct a cross-domain sample pair set.

[0018] As the access control attribute mining method based on the large language model, further, the semantic association keyword candidate set of the target field data is obtained based on the similar sample, including:

[0019] The statistical-based unsupervised keyword phrase extraction algorithm is used to extract the P highest-scoring keyword phrases in the source domain text in each sample pair;

[0020] The keyword phrases extracted by all sample pairs are aggregated to obtain the implied association keyword candidate set of the target field data.

[0021] As the access control attribute mining method based on the large language model of the present application, further, the template driven large model is used to generate the target field structured sample data based on the target field sample, and further comprises:

[0022] The structured sample data generated by the large model is subjected to format verification, and non-specified format samples are removed.

[0023] The attribute completeness of the structured sample data is checked, and the sample data missing the essential attributes, including the subject attribute, the object attribute, the operation attribute and the environment attribute, is discarded.

[0024] Based on the data content, the duplicate sample data is removed.

[0025] The structured sample data of the target field is fused with the source domain structured data to obtain a data set for model training.

[0026] As the access control attribute mining method based on the large language model of the present application, further, the attribute mining model is fine-tuned using the target field structured sample data, comprising:

[0027] The weights of the model are frozen based on the low-rank adaptive method, the injected low-rank matrix is trained, and the model is supervised trained in combination with the supervision data. The low-rank matrix parameters are optimized through the cross-entropy loss function in the supervised fine-tuning scene, and the attribute decision boundary is strengthened by using the training enhancement strategy in the model training, and the noise is suppressed by using the dynamic rank adjustment rule.

[0028] Wherein, the cross-entropy loss function in the supervised fine-tuning scene is represented as: y t represents the t-th label of the output sequence, θ represents the set of LoRA trainable parameters, T represents the length of the target sequence, inst represents the access control task instruction, in represents the original text input, y θ represents the first t-1 output sequence labels, logP t inst,in,y ＜t represents the probability logarithm of the model predicting the t-th label under the condition of given instruction, input and first t-1 labels; the training enhancement strategy is realized by adding attention mask in the access control attribute; the dynamic rank adjustment rule is to set corresponding rank parameters in stages to balance the model training stability and representation ability.

[0029] As the access control attribute mining method based on the large language model of the present application, further, the fine-tuned attribute mining model is used to mine the access control attribute in the target field data to be labeled attribute label, comprising:

[0030] The attribute mining model is guided by the attribute mining prompt template to perform preliminary mining reasoning according to a logic chain, and access control attribute primary is obtained;

[0031] The pre-trained sample detection model is used to verify whether the output of the attribute mining model meets preset requirements, and feedback information described by natural language instructions is generated according to output data that fails to pass the verification, wherein the preset requirements include attribute structure compliance requirements, attribute semantic integrity requirements and attribute reasoning conflict-free requirements;

[0032] The feedback information is submitted to the fine-tuned attribute mining model, and the attribute mining model is guided to correct the attribute mining reasoning logic.

[0033] In another aspect, the application further provides an access control attribute mining system based on a large language model, comprising a data acquisition module, a sample construction module and an attribute mining module, wherein,

[0034] The data acquisition module is used to acquire source domain data with access control attribute labels and target domain data to be labeled with access control attribute labels and perform preprocessing, select similar samples of each target text from the source domain data according to similarity, and obtain a semantic association keyword candidate set of the target domain data based on the similar samples;

[0035] The sample construction module is used to construct a target domain sample generation template according to a task instruction and in combination with a prompt example and domain adaptation knowledge, drive a large model to generate target domain structured sample data based on the target domain sample generation template, wherein the task instruction is used to describe a target domain task and attribute specifications and constraints through a natural language template, the prompt example is used to guide the model to perform target domain knowledge point migration through category learning by using a target domain related few sample instance, the domain adaptation knowledge is cross-domain migration knowledge obtained by feature alignment based on the semantic association keyword candidate set, and the target domain structured sample data is represented by a triple composed of an access control task instruction, an original text input and a structured access control attribute label;

[0036] The attribute mining module is used to fine-tune the attribute mining model by using the target domain structured sample data, and mine access control attributes in the target domain data to be labeled with attribute labels by using the fine-tuned attribute mining model, and indicate the attribute mining model to review and verify the attribute mining logic by thinking chain in the access control attribute mining.

[0037] The application has the following beneficial effects:

[0038] The application utilizes the powerful semantic reasoning capability of a large model to construct a guiding sentence for a cross-domain data resource security attribute mining task, realizes sample data enhancement from a source domain to a target domain, can dynamically filter and optimize training data with strong robustness, prepares for model training, combines the SFT and LoRA fine-tuning methods to realize the balance between full-parameter fine-tuning effect and efficient parameter updating, combines the access control attribute mining with the thinking chain technology to improve the attribute mining accuracy and dynamically optimize the attribute mining results, thereby better serving the access control attribute mining task, and has good application prospects in the information security field. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 An access control attribute mining process based on a large language model in the embodiment is shown;

[0040] Figure 2 An access control attribute mining algorithm framework in the embodiment is shown;

[0041] Figure 3 A target domain sample generation template process in the embodiment is shown;

[0042] Figure 4 An access control attribute mining model parameterization process in the embodiment is shown;

[0043] Figure 5 A structured thinking chain reasoning algorithm framework in the embodiment is shown;

[0044] Figure 6 A comparison of model performance before and after training in the embodiment is shown;

[0045] Figure 7 A comparison of model performance with and without using a thinking chain in the embodiment is shown;

[0046] Figure 8 A comparison of model performance in the embodiment is shown. DETAILED DESCRIPTION

[0047] To make the purpose, technical solutions and advantages of the application clearer and more apparent, the application will be further described in detail below with reference to the drawings and technical solutions.

[0048] To solve the problems of insufficient labeled data, complex attribute semantics and tedious manual annotation in large-scale dynamic emerging data resource access control attribute mining, an access control attribute mining method based on a large language model is provided in the embodiment, as shown in Figure 1 The specific contents include the following:

[0049] S101, source domain data with access control attribute labels and target domain data to be labeled with access control attribute labels are obtained and preprocessed, similar samples of each target text are selected from the source domain data according to similarity, and a semantic association keyword candidate set of the target domain data is obtained based on the similar samples;

[0050] S102, a target domain sample generation template is constructed according to a task instruction and in combination with a prompt example and domain adaptation knowledge, target domain structured sample data is generated based on the target domain sample generation template to drive a large model, the task instruction is used to describe a target domain task and attribute specifications and constraints through a natural language template, the prompt example is used to guide the model to migrate target domain knowledge points through category learning by using a few sample instances related to the target domain, the domain adaptation knowledge is cross-domain migration knowledge obtained by feature alignment based on the semantic association keyword candidate set, and the target domain structured sample data is represented by a triple composed of an access control task instruction, an original text input and a structured access control attribute label;

[0051] S103, the attribute mining model is fine-tuned using the target domain structured sample data, the access control attribute in the target domain data to be labeled with attribute labels is mined using the fine-tuned attribute mining model, and the attribute mining model is instructed to review and verify the attribute mining logic through a thinking chain in the access control attribute mining.

[0052] As shown in the algorithm architecture, Figure 2 by using the powerful semantic reasoning capability of the large model, a guide sentence for the cross-domain data resource security attribute mining task is constructed, sample data enhancement from the source domain to the target domain is realized, the accuracy of access control attribute mining is improved through fine-tuning training and thinking chain technology. First, the target domain data resource to be labeled with security attributes is obtained, irrelevant texts are removed through data filtering, text segmentation, cross-domain sample keyword extraction and other preprocessing operations, and the data resource after slicing and segmentation processing and the semantic association keyword candidate set are obtained; then, a task instruction composed of task description, attribute specification, output specification, etc. is combined with a prompt example and domain adaptation knowledge to construct a target domain sample generation template, and the target domain samples generated by the large model are optimized, so as to complete the preparation of the training data with the subject attribute, object attribute, operation attribute and environment attribute labels labeled; finally, the SFT and LoRA combination method is used for fine-tuning training, the general capability of the large model is adapted to the professional capability of a specific domain, and the thinking chain-based context learning is used to gradually strengthen the ability of attribute mining of the target domain data, so as to realize effective mining of the inherent security attributes of cross-domain data.

[0053] Specifically, the data is preprocessed, which can be designed to include:

[0054] Filter the data in the source and target domains, remove whitespace characters at the beginning and end of the original string, and retain visible and control characters in the standard ASCII character set;

[0055] A lazy segmentation strategy based on iterators is adopted to prioritize the segmentation of segments related to access control attribute mining, extract effective information, and each initial segmentation unit is cut by first and last blanks and retains non-empty segmentation units as effective word groups to obtain a set of word elements;

[0056] Perform an empty set check on the lexical set. If the check passes, obtain the normalized text and the valid lexical array. If the check fails, obtain the normalized text and the empty value marker.

[0057] To construct a processable text representation and provide effective data support for access control attribute mining, unstructured text data needs to be systematically and standardized. The data preprocessing algorithm is shown in Algorithm 1, and can be summarized as follows:

[0058] First, data filtering removes leading and trailing whitespace characters from the original string, retaining only visible and control characters within the standard ASCII character set. Second, semantic unit segmentation is performed using an iterator-based lazy segmentation strategy, prioritizing segments related to access control attribute mining and extracting valid information. Each initial segmentation unit undergoes leading and trailing whitespace trimming, retaining only non-empty segments as valid word groups. Finally, the generated word set undergoes empty set verification. If verification passes, normalized text and a valid word array are returned; otherwise, normalized text and an empty value marker are returned. This mechanism ensures the consistency of the output interface and provides strong robustness for downstream processing modules.

[0059]

[0060] In cross-domain text analysis tasks, the semantic gap between the source and target domains often leads to poor results in cross-domain access control attribute mining. Therefore, in this embodiment, cross-domain sample keyword extraction is utilized. By combining the SimCSE and RAKE algorithms, similar keywords across domains are extracted to prepare for the subsequent generation of the model training dataset. The specific algorithm is shown in Algorithm 2 and can be summarized as follows:

[0061] First, deep semantic similarity calculation is performed. A sentence encoding model pre-trained via contrastive learning (SimCSE) is used to encode both the target domain text and the source domain text into high-dimensional semantic vectors. Cosine similarity is then used to quantify their proximity in the semantic space. Next, high-similarity sample pair selection is implemented. For each target text, the top K samples with the highest semantic similarity are selected from the source domain to construct a cross-domain sample pair set. Finally, key phrase transfer is performed. For each sample pair, a statistically based unsupervised keyword phrase extraction algorithm (Rapid Automatic Keyword Extraction, RAKE) is applied to extract the top P keyword phrases with the highest scores from the source domain text. These phrases, originating from high-similarity samples, are considered to contain the core semantics of the target text. The phrases extracted from all sample pairs are aggregated to form a candidate set of semantically related keywords for the target text, preparing data for cross-domain access control attribute mining.

[0062]

[0063]

[0064] Generating target domain samples using large language models faces two major challenges: first, unstructured output is difficult to use directly for downstream task processing; second, large language models are prone to generating "illusionary" content that does not meet actual needs due to a lack of domain knowledge. These challenges are detrimental to the construction of datasets for access control attribute mining. Therefore, in this embodiment, templates can be generated using target domain samples, such as... Figure 3 As shown, a large-scale language model is driven by a triplet prompt template to generate structured data for the target domain, achieving the dual goals of accurate attribute-level information extraction and domain adaptation. First, a task instruction layer is constructed, defining the task objective, specifying attribute specifications that must include subject attributes, object attributes, operation attributes, and environment attributes, and enforcing JSON format output to ensure readability. Then, a prompt example layer is designed, introducing domain-relevant few-sample instances to suppress the generation of irrelevant content and improve attribute extraction accuracy. Finally, a domain adaptation layer is implemented, generating domain keywords and associated sample pairs based on text similarity calculations. Knowledge injection guides the large language model to generate structured text that conforms to domain characteristics and possesses content diversity. The large model, through the output of this prompt template, generates high-quality data, which can be further processed as part of the dataset used for training subsequent access control attribute mining models.

[0065] Although the quality of the large language model's output improves after using the above prompt template, the "illusion" problem still exists, specifically manifested in JSON formatting issues, missing attributes, and content duplication. Therefore, further optimization of the target domain samples is needed. Specifically, it can be designed as follows:

[0066] Perform format validation on the structured sample data generated by the large model and discard samples with non-specified formats;

[0067] Verify the completeness of attributes in the structured sample data and discard sample data that lacks essential attributes. The essential attributes include subject attributes, object attributes, operation attributes, and environment attributes.

[0068] Remove duplicate sample data based on data content;

[0069] The structured sample data of the target domain is heterogeneously fused with the structured data of the source domain to obtain the dataset for model training.

[0070] Although the quality of the output content of the large language model has improved after using the above prompt template, the "illusion" problem still exists, which is manifested in problems such as JSON formatting issues, missing attributes, and duplicate content. Therefore, it is still necessary to optimize the target domain samples.

[0071] The code implementation is shown in Algorithm 3. Design corresponding data generation checking rules: First, perform format verification, discarding invalid JSON format samples to ensure the uniformity of the generated data format; second, perform attribute completeness verification, discarding samples lacking necessary attributes, including subject attributes, object attributes, operation attributes, and environment attributes; finally, perform deduplication, eliminating duplicate samples based on content to ensure data uniqueness. The key pseudocode is Algorithm 3. The target domain data that passes quality verification is then fused heterogeneously with the source domain dataset to construct a domain training dataset.

[0072]

[0073]

[0074] To adapt the general capabilities of large models to access control attribute mining capabilities, in this embodiment, the weights of the model are frozen based on a low-rank adaptive method, the injected low-rank matrix is ​​trained, and supervised training of the model is performed in combination with supervised data. The parameters of the low-rank matrix are optimized by the cross-entropy loss function under supervised fine-tuning scenario. In addition, the attribute decision boundary is strengthened by training enhancement strategy and noise is suppressed by dynamic rank adjustment rules during model training.

[0075] The base model is fine-tuned and trained by combining Low-Rank Adaptation (LoRA) and Supervised Fine-Tuning (SFT), achieving a balance between the effects of full-parameter fine-tuning and efficient parameter updates. As Figure 4 shown, based on the pre-trained language model, the pre-trained model weight parameters are frozen, then additional network layers are added to the model, and finally only these newly added parameters are trained. Among them: h is the output of the model, x is the input of the model, x ∈ Rd×k, W is the pre-trained weight matrix, W ∈ Rd×d, A and B are low-rank matrices participating in the training, r is the size of the ranks of the low-rank matrices A and B; N(0, σ2) is the random Gaussian initialization.

[0076] The low-rank matrix decomposition formula is as follows:

[0077] W0 + ΔW = W0 + BA

[0078] In the formula, W0 is the initial matrix of the pre-trained weight matrix, and ΔW is the inserted new weight matrix.

[0079] During the training process, W0 is frozen, the model does not receive gradient updates, and only the parameters A and B are fine-tuned. Compared with the model fine-tuning with all parameters participating, the number of parameters fine-tuned in this step of the model changes from d×k to d×r + r×k at this time, and r << min(d, k). Therefore, the number of fine-tuned parameters is greatly reduced. Before fine-tuning, the output of the model h = W0x, and after reparameterization, it is modified to:

[0080] h = W0x + ΔWx = W0x + BAx

[0081] Based on the constructed domain training dataset D target , SFT performs task adaptation and adjusts the overall behavior of the model through labeled data. The training samples are constructed as triples:

[0082]

[0083] Among them, inst represents the access control task instruction, in represents the original text input, and out represents the structured access control attribute label.

[0084] The optimization objective is defined as minimizing the negative log-likelihood of the conditional probability distribution:

[0085]

[0086] Among them, y t represents the t-th token of the output sequence, θ = {A, B} represents the set of LoRA trainable parameters, and T represents the length of the target sequence.

[0087] Simultaneously, training enhancement strategies were developed during the training process, implemented by adding attention masks to access control attributes. On one hand, an access control attribute-aware masking mechanism was established, adding attention masks to subject attributes, object attributes, operational attributes, and environmental attributes to strengthen the decision boundary.

[0088]

[0089] On the other hand, a dynamic rank adjustment rule was formulated, setting corresponding rank parameters in stages to balance the model training stability and representation ability. In the early stage of training, low rank was used to suppress noise, and in the later stage, the representation ability was improved.

[0090]

[0091] When using the finely tuned model to perform access control attribute mining tasks, although preliminary results have been achieved, the accuracy of the mined access control attributes still has issues. Therefore, it is necessary to further enhance the model's inherent potential to improve accuracy. In this embodiment, the attribute mining model can first be guided by an attribute mining prompt template to perform preliminary mining and reasoning according to the logical chain, obtaining primary access control attributes. Then, a pre-trained sample detection model is used to verify whether the attribute mining model's output meets preset requirements. Feedback information described using natural language instructions is generated based on the output data that fails verification. The preset requirements include attribute structure compliance requirements, attribute semantic integrity requirements, and conflict-free attribute reasoning requirements. The feedback information is then submitted to the finely tuned attribute mining model to guide it in correcting its attribute mining reasoning logic.

[0092] The structured thought chain reasoning algorithm, as shown in Algorithm 4, is used in conjunction with the fine-tuned model to mine access control attributes.

[0093]

[0094] The core of the algorithm lies in establishing a three-layer closed-loop process of "generation → verification → feedback". First, an inference generation layer is built, in which the fine-tuned model generates an initial set of attributes based on the structured template constructed above. Second, a multi-level verification layer is built to verify whether the structure is compliant, whether the semantics are complete, and whether the logic is conflicting. Finally, a feedback repetition layer is built to convert the error parts in the above verification into feedback information into natural language instructions, which are then resubmitted to the fine-tuned model to guide it to make corrections.

[0095] Furthermore, based on the above method, this embodiment of the invention also provides an access control attribute mining system based on a large language model, comprising: a data acquisition module, a sample construction module, and an attribute mining module, wherein,

[0096] The data acquisition module is used to acquire source domain data with access control attribute labels and target domain data to be labeled with access control attribute labels and to perform preprocessing. Based on similarity, it selects similar samples of each target text from the source domain data and obtains a candidate set of semantic association keywords for the target domain data based on the similar samples.

[0097] The sample construction module is used to construct a target domain sample generation template based on task instructions, combined with prompt examples and domain adaptation knowledge. Based on the target domain sample generation template, the module drives a large model to generate structured sample data in the target domain. The task instructions are used to describe the target domain task, attribute specifications, and constraints through natural language templates. The prompt examples are used to guide the model to transfer target domain knowledge points by utilizing relevant few-sample instances in the target domain and through category learning. The domain adaptation knowledge is cross-domain transfer knowledge obtained by feature alignment based on a semantic association keyword candidate set. The target domain structured sample data is represented by a triple consisting of access control task instructions, raw text input, and structured access control attribute labels.

[0098] The attribute mining module is used to fine-tune the attribute mining model using structured sample data from the target domain. The fine-tuned attribute mining model is then used to mine access control attributes in the target domain data to be labeled. In the access control attribute mining, a thought chain is used to instruct the attribute mining model to review and verify the attribute mining logic.

[0099] To verify the effectiveness of this solution, the following explanation is provided in conjunction with specific experimental data:

[0100] The experiment was conducted under the Windows 11 operating system, equipped with an AMD Ryzen 97945HX processor with Radeon Graphics, clock speed of 2.50GHz; 64GB of RAM, of which 63.7GB is available; an NVIDIA GeForce RTX 4060 Laptop GPU with 8GB of video memory; 954GB of storage space; and Python version 3.11. Qwen2.5-1.5B-Instruct was used as the base model, employing the "High-Quality Training Dataset of 30 Industry Classifications" from the ModelScope community. This dataset covers multi-domain data, based on business data information from various industries, and outperforms other cross-domain datasets in terms of diversity and realism, making it ideal for model training using cross-domain data. During training, the dataset was converted to the standard Alpaca dataset format, and based on this, a large language model was used to construct a 1000-item validation dataset to test the performance of the proposed algorithm.

[0101] The experiment used accuracy, precision, and recall as performance evaluation metrics. The definitions of accuracy, precision, and recall are as follows:

[0102]

[0103] The key elements of the formula are defined as follows:

[0104] TPi: The i-th sample that is correctly classified as the i-th type of flow;

[0105] TNi: Non-i-th class samples that are correctly classified as non-i-th class flows;

[0106] FPi: Non-i-th class samples that are misclassified as i-th class streams;

[0107] FNi: Samples of class i that are correctly classified as non-class i flows;

[0108] The results of performance testing comparing the fine-tuned model with the base model are as follows: Figure 6 As shown in the figure, the fine-tuned model demonstrates improved accuracy, precision, and recall compared to the base model in access control attribute mining. This is because the fine-tuned model utilizes SFT and LoRA techniques to internalize access control attribute mining capabilities into its model parameters, thereby enhancing the model's ability to perform specific tasks.

[0109] Based on the large model after fine-tuning, we further compared the performance of using the thought chain for access control attribute mining with that of not using the thought chain, such as... Figure 7 As shown in the figure, the results demonstrate that using the Mind Chain technique in access control attribute mining breaks down complex problems into smaller ones, enhancing the generalization ability of the large model and making it better suited for cross-domain access control attribute mining. Compared to access control attribute mining methods without Mind Chain, using Mind Chain improves accuracy, precision, and recall during the mining process.

[0110] A horizontal performance comparison was conducted on the proposed solution, the base model, and other language models, including SmolLM2-1.7B and BERT. The results are as follows: Figure 8As shown in the figure, the method using large models significantly outperforms traditional machine learning methods in the process of access control attribute mining. Large models have strong semantic understanding capabilities, as well as strong generalization, prediction, and decision-making abilities, making them superior to machine learning in access control attribute mining. By combining SFT and LoRA to fine-tune the base model and using the thinking chain technique to enhance the ability to mine access control attributes, the accuracy, precision, and recall of the mining are significantly better than other language models.

[0111] The data above demonstrates that the proposed solution, combining LoRA and SFT fine-tuning methods, achieves a balance between full-parameter fine-tuning and efficient parameter updates. Furthermore, by integrating the MindChain technique to optimize the output of the large language model, it improves the accuracy of access control attribute mining. By maintaining low costs and labeled data, it enables efficient access control data mining through cross-domain data augmentation, hint engineering, model training, and MindChain technology, demonstrating promising application prospects in the field of information security.

[0112] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0113] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0114] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0115] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0116] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for mining access control attributes based on a large language model, characterized in that, Include: The source domain data with access control attribute labels and the target domain data with access control attribute labels to be labeled are obtained and preprocessed. Similar samples of each target text are selected from the source domain data based on similarity. Based on the similar samples, a candidate set of semantic association keywords for the target domain data is obtained. Based on task instructions and combined with prompt examples and domain adaptation knowledge, a target domain sample generation template is constructed. The target domain sample generation template drives a large model to generate structured sample data in the target domain. The task instructions are used to describe the target domain task, attribute specifications, and constraints through natural language templates. The prompt examples are used to guide the model to transfer target domain knowledge points by utilizing target domain-related few-sample instances and class learning. The domain adaptation knowledge is cross-domain transfer knowledge obtained by feature alignment based on a semantic association keyword candidate set. The target domain structured sample data is represented by a triple consisting of access control task instructions, original text input, and structured access control attribute labels. The attribute mining model is fine-tuned using structured sample data from the target domain. The fine-tuned attribute mining model is then used to mine access control attributes in the target domain data to be labeled. In the access control attribute mining, a thought chain is used to instruct the attribute mining model to review and verify the attribute mining logic.

2. The access control attribute mining method based on a large language model according to claim 1, characterized in that, Data preprocessing includes: Filter the data in the source and target domains, remove whitespace characters at the beginning and end of the original string, and retain visible and control characters in the standard ASCII character set; A lazy segmentation strategy based on iterators is adopted to prioritize the segmentation of segments related to access control attribute mining, extract effective information, and each initial segmentation unit is cut by first and last blanks and retains non-empty segmentation units as effective word groups to obtain a set of word elements; Perform an empty set check on the lexical set. If the check passes, obtain the normalized text and the valid lexical array. If the check fails, obtain the normalized text and the empty value marker.

3. The access control attribute mining method based on a large language model according to claim 1 or 2, characterized in that, Similar samples for each target text are selected from the source domain data based on similarity, including: Semantic vectors of target domain text and source domain text are obtained using a pre-trained sentence encoding model. The cosine similarity measure is used to measure the proximity between semantic vectors in the target domain and semantic vectors in the source domain in the semantic space. For each target domain text, select the K samples with the highest semantic similarity from the source domain text to construct a cross-domain sample pair set.

4. The access control attribute mining method based on a large language model according to claim 3, characterized in that, Based on similar samples, a candidate set of semantically related keywords for the target domain data is obtained, including: A statistically based unsupervised keyword and phrase extraction algorithm is used to extract the P highest-scoring keyword and phrase sentences from the source domain text in each sample pair. By aggregating the extracted keywords from all sample pairs, a candidate set of semantically related keywords for the target domain data is obtained.

5. The access control attribute mining method based on a large language model according to claim 1, characterized in that, Based on the target domain sample generation template-driven large model, it generates structured sample data in the target domain, and also includes: Perform format validation on the structured sample data generated by the large model and discard samples with non-specified formats; Verify the completeness of attributes in the structured sample data and discard sample data that lacks essential attributes. The essential attributes include subject attributes, object attributes, operation attributes, and environment attributes. Remove duplicate sample data based on data content; The structured sample data of the target domain is heterogeneously fused with the structured data of the source domain to obtain the dataset for model training.

6. The access control attribute mining method based on a large language model according to claim 1, characterized in that, Fine-tuning the attribute mining model using structured sample data from the target domain includes: The model weights are frozen using a low-rank adaptive method, a low-rank matrix is ​​injected during training, and supervised training is performed on the model using supervised data. The parameters of the low-rank matrix are optimized by fine-tuning the cross-entropy loss function under supervised fine-tuning scenarios. In model training, a training enhancement strategy is used to strengthen the attribute decision boundary and noise is suppressed by a dynamic rank adjustment rule. Among them, the cross-entropy loss function in the supervised fine-tuning scenario is expressed as: y t represents the t-th token of the output sequence, θ represents the set of LoRA trainable parameters, T represents the length of the target sequence, inst represents the access control task instruction, in represents the original text input, y<t represents the first t-1 output sequence tokens, and logP θ (y t ∣inst,in,y ＜t ) represents the logarithm of the probability that the model predicts the t-th token given the instruction, input, and the first t-1 tokens; the training enhancement strategy is achieved by adding an attention mask to the access control attributes; the dynamic rank adjustment rule is to set the corresponding rank parameters in stages to balance the model training stability and representational ability.

7. The access control attribute mining method based on a large language model according to claim 1, characterized in that, The fine-tuned attribute mining model is used to mine access control attributes in the target domain data for attribute labeling, including: The attribute mining model is guided by the attribute mining prompt template to perform preliminary mining and reasoning according to the logical chain, and the primary access control attributes are obtained. The pre-trained sample detection model is used to verify whether the output of the attribute mining model meets the preset requirements, and feedback information described by natural language instructions is generated based on the output data that fails the verification. The preset requirements include attribute structure compliance requirements, attribute semantic integrity requirements, and attribute inference conflict-free requirements. The feedback information is submitted to the fine-tuned attribute mining model to guide the model in correcting the attribute mining reasoning logic.

8. An access control attribute mining system based on a large language model, characterized in that, It includes: a data acquisition module, a sample construction module, and an attribute mining module, among which, The data acquisition module is used to acquire source domain data with access control attribute labels and target domain data to be labeled with access control attribute labels and to perform preprocessing. Based on similarity, it selects similar samples of each target text from the source domain data and obtains a candidate set of semantic association keywords for the target domain data based on the similar samples. The sample construction module is used to construct a target domain sample generation template based on task instructions, combined with prompt examples and domain adaptation knowledge. Based on the target domain sample generation template, the module drives a large model to generate structured sample data in the target domain. The task instructions are used to describe the target domain task, attribute specifications, and constraints through natural language templates. The prompt examples are used to guide the model to transfer target domain knowledge points by utilizing relevant few-sample instances in the target domain and through category learning. The domain adaptation knowledge is cross-domain transfer knowledge obtained by feature alignment based on a semantic association keyword candidate set. The target domain structured sample data is represented by a triple consisting of access control task instructions, raw text input, and structured access control attribute labels. The attribute mining module is used to fine-tune the attribute mining model using structured sample data from the target domain. The fine-tuned attribute mining model is then used to mine access control attributes in the target domain data to be labeled. In the access control attribute mining, a thought chain is used to instruct the attribute mining model to review and verify the attribute mining logic.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 7.

Images