Privileged account dynamic management and behavior risk identification blocking method based on AI

Abstract

The invention relates to the technical field of electrical digital data processing and access control, and discloses an AI-based privileged account dynamic management and behavior risk identification blocking method, which comprises the following steps of: learning a data structure containing an operation time sequence and a host context binding relationship according to a background model; according to the method, the binding verification rule of the operation time sequence and execution of the host context is established, whether the operation time sequence of the current session and the host context of the current session are matched with a legal mode pre-stored in the data structure or not is verified in real time, and if any one of the operation time sequence and the host context is not matched, operation is blocked. And the access control has the capability of identifying and blocking legal credentials for executing an operation sequence which does not conform to expectation or performing malicious replay.

Description

Technical Field

[0001] This invention relates to an AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts, belonging to the field of electronic digital data processing and access control technology. Background Technology

[0002] Current access control is the first line of defense for system security, with the mainstream approach being identity-based static authorization. This method is mature and efficient in verifying legitimate user identities and granting them preset permissions, and has become an industry-recognized basic configuration. However, access control mechanisms relying on static identities rely on the absolute reliability of identities. In real-world environments, the leakage of privileged account credentials or identity theft remains a significant and persistent threat. Once an attacker obtains a legitimate high-privilege identity, the static access control mechanism loses its protective function. Therefore, the industry has evolved to develop User and Entity Behavior Analysis (UEBA) as a second line of defense. UEBA typically utilizes data processing tools to analyze massive amounts of historical operation logs. Access control points (ACCPs) establish historical behavior baselines for privileged accounts, aiming to identify anomalies by comparing current behavior with historical baselines. However, this approach creates a separation between control and analysis in engineering practice. To ensure extremely low response latency, ACCPs must maintain their atomic and stateless decision logic, while behavior analysis systems require significant computing resources and time for sequence analysis to perform contextual judgments. This architectural separation is a default technical compromise in the industry, stemming from the conflict between the real-time performance of ACCPs and the depth of security analysis. The cost is that behavior analysis systems can only provide alerts after the fact, while ACCPs lack the ability to perceive the context of the operation sequence at the moment a risk occurs.

[0003] Current mainstream improvement approaches remain limited to optimizing the analysis module, failing to overcome the architectural bottleneck of separating control and analysis. For example, Chinese invention patent CN120151031A discloses an account dynamic monitoring and management system based on a data transmission protocol. This solution relies on a protocol parsing module to capture network communication traffic, and an abnormal behavior detection module to build a behavior baseline based on historical operation logs, thereby identifying risky operations. This approach is essentially a typical UEBA architecture, where analysis and decision-making are based on network layer data and historical statistical baselines, failing to delve into the operational timing context of the host layer. It is also limited by the inherent defects of separating control and analysis, making it difficult to provide access control points with the ability to detect and block malicious operation sequences in real time without sacrificing performance.

[0004] Therefore, the technical problem to be solved by this invention is how to provide a new access control method that maintains the low-latency response capability of access control points, obtains the ability to identify context risks based on operation sequences in real time during an event, and blocks malicious operation sequences executed by legitimate identities. Summary of the Invention

[0005] This invention provides an AI-based method for dynamic management of privileged accounts and identification and blocking of behavioral risks. Its main purpose is to solve the problem that existing access control mechanisms cannot simultaneously take into account low latency and context analysis, resulting in their inability to identify and block malicious operation sequences executed by legitimate identities during the event.

[0006] To achieve the above objectives, this invention provides an AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts, the method comprising: Step a, the collaborative modeling step of intent profiling and host context, involves the background AI model analyzing and generating a legitimate intent anchor point library based on the historical operation logs of privileged accounts. The legitimate intent anchor point library stores multiple data tuples, each of which includes an operation sequence template and a legitimate host context profile associated with that operation sequence template. Step b, the timing buffer establishment step, when a privileged account starts a new session, establishes a temporary timing buffer in the computing device memory for the new session; Step c, the dual-coordinated verification and blocking step of timing and host: Step c1, capture the current operation request in the new session, send the current operation request into the timing buffer to form the current operation sequence, and obtain the current host context of the new session in real time; Step c2, a real-time AI model executes the dual verification rules: determine whether the current operation sequence matches the operation timing template contained in any data tuple in the legitimate intent anchor library; when the current operation sequence matches the operation timing template, the real-time AI model additionally determines whether the current host context matches the legitimate host context profile bound to the data tuple; Step c3, execute the coordinated blocking according to the dual verification rules: if the current operation sequence does not match the operation timing template, and if the current host context does not match the legitimate host context profile, then trigger the access control module to block the execution of the current operation request.

[0007] Preferably, in step c3, if the real-time AI model determines that the current operation sequence matches the operation timing template and the current host context matches the legitimate host context profile, then the access control module is triggered to allow the execution of the current operation request.

[0008] Preferably, the background AI model in step a is a sequence analysis-based model; the real-time AI model in step c2 is a model implemented based on a finite state machine or prefix tree matching algorithm, wherein the data tuples in the legitimate intent anchor point library define the rules for valid host context profile verification of the legitimate state transition path of the finite state machine or prefix tree in each state.

[0009] Preferably, step a further includes: the background AI model assigns quantified risk weights to one or more operations based on the preset risk level of the operation and stores them; and the collaborative blocking method in step c3 is replaced by a graded response method based on cumulative risk, the graded response method including: maintaining the cumulative risk score of the session in the memory of the computing device for the new session; when the real-time AI model determines that the current operation sequence does not match the operation timing template, or determines that the current host context does not match the legitimate host context profile, querying the quantified risk weight corresponding to the current operation request and adding it to the cumulative risk score of the session; comparing the cumulative risk score of the session with a preset response threshold, and selecting a corresponding response action from a set of preset response actions to execute according to the comparison result, the response action including: recording and blocking the execution of the current operation request and terminating the new session.

[0010] Preferably, the hierarchical response method further includes: introducing a preset legal operation weight, and when the real-time AI model determines that the current operation sequence matches the operation timing template and the current host context matches the legal host context profile, the preset legal operation weight is added to the session cumulative risk score; wherein the value of the preset legal operation weight is set to be less than the minimum value among the preset response thresholds.

[0011] Preferably, step a further includes: the background AI model calculates and maintains a model maturity score for the privileged account based on statistical indicators from historical operation logs used for modeling; and the collaborative blocking logic in step c3 is executed based on the model maturity score condition: if the model maturity score is lower than a preset maturity threshold, the blocking action is suppressed, and the execution of the current operation request is allowed, while the current operation sequence and the current host context are submitted to the background AI model as learning data; if the model maturity score is not lower than the preset maturity threshold, the blocking action is activated.

[0012] Preferably, before step b, the method further includes: receiving declarative intent data actively submitted by a privileged account; based on the declarative intent data, filtering and generating a temporary session-level constraint library from the legitimate intent anchor library, wherein the session-level constraint library contains one or more data tuples from the legitimate intent anchor library; the double verification rule in step c2 is replaced by: determining whether the current operation sequence matches the operation timing template contained in any data tuple in the session-level constraint library; when the current operation sequence matches the operation timing template, the real-time AI model additionally determines whether the current host context matches the legitimate host context profile bound to the matched data tuple; wherein operation timing templates that exist in the legitimate intent anchor library but not in the session-level constraint library are also judged as mismatched by the real-time AI model and trigger collaborative blocking.

[0013] Preferably, before the intent profiling and host context collaborative modeling step, a data source purification step is also included. The data source purification step includes: obtaining the privileged account identity corresponding to the historical operation log; querying the access control policy library to determine whether the privileged account identity is classified into a preset untrusted learning role; only when the privileged account identity is not classified into a preset untrusted learning role is the historical operation log background AI model allowed to be used to perform the intent profiling and host context collaborative modeling step.

[0014] Preferably, the historical operation logs collected in step a and the current operation requests captured in step c1 are both operation information of the host layer or application layer of the electronic digital data processing device, including information selected from system call API requests and database query statements, but excluding data packet content of the network layer.

[0015] Preferably, step c2, determining whether the current operation sequence matches an operation timing template, further includes: determining whether the current operation sequence matches one or more operation timing templates in the legitimate intent anchor point library, and generating a matching count value; the method also includes an accompanying audit step: if the matching count value is greater than a preset ambiguity threshold, the execution of the current operation request is not blocked; instead, an accompanying action is triggered, including: raising the audit level of the new session or adding an intent ambiguity risk label to the operation log of the new session.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. By separating the background modeling of intent profiling from real-time verification and blocking, a two-layer data processing flow is constructed. The background AI model pre-compiles complex analysis and clustering of historical operation sequences at the data processing level, extracting a simplified library of legitimate intent anchor points. At the access control point, the real-time AI model performs lightweight matching and verification based on finite state machines or prefix trees. This architecture separates the computationally expensive analysis task from the low-latency real-time blocking task, thereby improving the ability to understand the context of operation sequences without affecting the performance of the access control point, and avoiding the system latency and unavailability risks caused by placing complex AI models directly on the access control path.

[0017] 2. This method introduces a temporal dimension to access control. By establishing a temporary temporal buffer for the session and performing prefix matching between each current operation sequence entering the buffer and the legitimate intent anchor point library, the decision-making basis of access control shifts from traditional, identity-based static permission checks to dynamic intent verification based on the operation sequence context. This enables the access control point to identify intent drift and block malicious sequences initiated by legitimate identities but whose operation sequences do not conform to any known legitimate task templates, thus overcoming the limitation of traditional access control that recognizes identity but not intent. Furthermore, the intent profile modeling of the background AI model is coordinated with the host context profile. While generating legitimate operation sequence templates, legitimate process context information, such as process hash values ​​or parent process information, is bound. In the real-time verification step, the access control point not only performs temporal matching but also immediately performs introspection to obtain the real-time host context of the current session and compares it. This dual anchoring verification mechanism of temporal and host ensures that if a legitimate operation sequence temporal matching is executed in an illegitimate host process (host mismatch), it will also be blocked by the access control point, thus addressing the threat of malicious replay in unexpected processes after legitimate credentials are stolen.

[0018] 3. By assigning quantified risk weights to operations and maintaining the cumulative risk score, the binary blocking logic of the main solution is reconstructed into a hierarchical response mechanism based on cumulative risk. When intent drift is detected, the real-time AI no longer invariably executes blocking. Instead, it updates the session score according to the risk weight of the drifting operation and compares it with the response threshold. This gives the access control system flexibility and proportionality, enabling it to distinguish between low-risk benign drifts (e.g., logging and allowing) and high-risk malicious attacks (e.g., terminating the session). This avoids alarm fatigue, improves system availability, and provides more powerful handling measures. This method also introduces an AI model. The system's self-state perception is achieved through collaborative calculation of model maturity scores by the backend AI model during modeling. Blocking logic in the process is verified in real time and placed under maturity gating based on this score. When the model maturity is below the threshold, such as during a cold start or with a new account, the system suppresses blocking actions and automatically switches to a learning mode that records and allows access, submitting the operation sequence to the backend AI to accelerate modeling. When the model maturity is not below the threshold, the blocking logic is activated. This design enables the access control policy to adapt throughout its entire lifecycle, avoiding the availability problem of blocking all legitimate operations during the learning phase due to an incomplete anchor library. Attached Figure Description

[0019] Figure 1 This is a timing diagram of the graded response control based on cumulative risk in this invention; Figure 2 This is a flowchart analyzing the problems and limitations of existing access control technologies in this invention. Figure 3 This is a schematic diagram of the state transition for the dual timing and host verification of this invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be described in detail below with reference to specific embodiments. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of protection of the present invention.

[0021] This invention discloses an AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts. It employs a two-layer architecture, including a background stage for collaborative modeling of intent profiling and host context, and a real-time stage at the access control point for dual collaborative verification and blocking based on timing and host characteristics. The background stage learns from historical data and generates a library of legitimate intent anchor points containing the binding relationship between operation timing and host profiling. The real-time stage utilizes this library to verify whether the current operation matches a preset pattern in both timing and host dimensions during privileged session execution, achieving in-process blocking without relying on network layer packet analysis. Before the intent profiling and host context collaborative modeling step begins, the system can be configured to perform a data source purification step. This step first acquires historical operation logs collected at the host layer, such as system calls or database query statements, and extracts the privileged account identity corresponding to each log entry. Next, the system queries the access control policy library, which contains a preset list of untrusted learning roles, such as high-risk roles like Account_Break_Glass. If a... If the identity corresponding to a log entry is categorized into this list, the log entry is considered to have a polluted data source and is discarded. Only logs with uncategorized but trustworthy sources are allowed to be sent to the backend AI model. Subsequently, the backend AI model, such as a sequence analysis-based model like Long Short-Term Memory (LSTM) or Transformer architecture, performs session segmentation and unsupervised learning on these cleaned log data. During the analysis process, while extracting the operation sequence template, such as the sequence connecting_db->lock_tables->dump_data representing a database backup, the process context information of the process executing the sequence is analyzed and bound synchronously. Finally, the model generates and outputs a legitimate intent anchor library. This library is a data structure that stores multiple data tuples. Each tuple contains two strongly bound parts: the operation sequence template and a legitimate host context profile uniquely associated with the template. The profile is a feature vector, and specific fields include at least the typical parent process information of the process running the operation sequence, the hash value of the process's binary file itself, and the operating system user ID of the process running the process.

[0022] When a privileged account logs in via SSH and starts a new session, the access control module immediately allocates a temporary timing buffer for it in the computing device's memory. Subsequently, for each current operation request executed within that session, such as an SQL query, the request is copied and sent to the timing buffer before the access control point is executed, forming a continuously growing sequence of current operations. Simultaneously, an introspection action is triggered to obtain the current host context of the process running the new session in real time. A real-time AI model is activated; this model can be implemented as an algorithm based on prefix tree matching or a finite state machine. The legitimate intent anchor point library generated in step a is compiled and defines all preset state transition paths of the state machine and the host profile rules required for verification in each state. The real-time AI model receives the current operation sequence and the current host context as input and performs a double-check rule: First, it determines whether the current operation sequence matches a valid prefix of the operation sequence template contained in any data tuple in the anchor library. If they do not match, the access control module is immediately triggered to block the execution of the current operation request. If the current operation sequence matches an operation sequence template, the real-time AI model immediately performs a second check, that is, it additionally checks whether the real-time acquired current host context matches the valid host context profile bound to the matched data tuple. If this second check does not match, the access control module is also triggered to block the execution of the current operation request. Only when the current operation sequence matches an operation sequence template... Furthermore, the access control module only allows the execution of the current operation request when the current host context completely matches the legitimate host context profile bound to the template. To further improve the availability and resilience of access control, in a preferred embodiment, the background AI model in step a is configured to assign and store quantified risk weights to various operations based on their sensitivity or destructiveness during modeling. For example, the weight of the ls command is 0.1, while the weight of rm-rf / is 10.0. Correspondingly, the collaborative blocking method in step c3 is replaced by a graded response method based on cumulative risk. This method maintains an initial cumulative risk score of 0 in memory when establishing a time buffer for a new session in step b. When the implementation of step c2... When the real-time AI model determines that an operation matches both the timing and the host, it adds a preset legal operation weight, such as 0.01, to the score. This legal operation weight is set to be less than the minimum value among the response thresholds. When the real-time AI model determines that any verification mismatch occurs, the system queries the weight library for the quantified risk weight corresponding to the current operation request and adds it to the session's cumulative risk score. Finally, the system compares this cumulative score with a set of preset response thresholds and executes the corresponding response action. If the score is below the threshold of 1.0, it records and allows the operation; if the score is not lower than 1.0 but lower than 10.0, it blocks the execution of the current operation request; and if the score is not lower than 10.0, it terminates the new session.

[0023] To address the availability issue of operation blocking caused by an incomplete anchor library during cold starts or when encountering new privileged accounts, this method may also include a dynamic gating mechanism based on model maturity. In this mechanism, the background AI model in step a calculates and continuously updates the model maturity score for each privileged account based on internal statistical indicators, such as the amount of analyzed logs or the confidence level of generated anchors. Correspondingly, the execution of the collaborative blocking logic in step c3, or the tiered response method replaced by step c3, is conditionally activated based on the model maturity score: when an operation is captured in step c2, the system checks whether the account's maturity score is lower than a preset maturity threshold. If it is, the system automatically suppresses all blocking actions and allows the execution of the current operation request. Simultaneously, the system submits the current operation sequence and the current host context as learning data to the background AI model to accelerate its modeling process. Only when the model maturity score is not lower than the maturity threshold is the system activated the collaborative blocking or tiered response logic. To further address the false alarm issue of the AI ​​model misjudging new tasks as intent drift, this method is further optimized. In a preferred embodiment, this method may also introduce cross-validation of declarative intent and behavior inference. Before establishing the timing buffer in step b, an intent declaration step is added, requiring users or automated scripts to actively submit declarative intent data, such as ticket number Ticket-12345, through a data interface like a Just-In-Time portal when requesting a privileged session. Upon receiving this data, the system maps it to specific data tuples generated in step a of the legitimate intent anchor point library and filters these tuples from the main library to generate a temporary session-level constraint library containing only these tuples. In step c2, the dual-validation rule is replaced; the real-time AI model no longer matches the entire anchor point library but instead determines whether the current operation sequence and current host context match any data tuple in the temporary session-level constraint library. Operation timing templates that exist in the entire legitimate intent anchor point library but not in the current session's session-level constraint library, such as performing a database backup operation in a session declaring a troubleshooting intent, are judged as mismatched by the real-time AI model, triggering the access control module to block them.

[0024] Furthermore, to address the potential risks posed by intent ambiguity, the verification logic in step c2 can be further enhanced. In this enhancement, the real-time AI model, when performing matching, is configured to traverse all possible preset paths instead of stopping upon finding the first match. This determines whether the current operation sequence simultaneously matches the legitimate intent anchor library or multiple operation sequence templates, and generates a match count. The method additionally includes an accompanying audit step: if the match count is greater than a preset ambiguity threshold, for example, greater than 1, the system does not block the execution of the current operation request; instead, it automatically triggers accompanying actions in parallel. These accompanying actions may include adjusting the audit level of the new session. Dynamically adjust the settings to automatically add intent-ambiguous risk labels to all subsequent operation logs of the session, prompting security operations personnel to conduct post-event manual audits. The data sources processed by this method have specific technical boundaries. The historical operation logs collected in step a for modeling and the current operation requests captured in real time at the access control point in step c1 are operation information of the host layer or application layer of the electronic digital data processing equipment. The specific information types include one or more types of information selected from system calls, application programming interface (API) requests, and database query statements. The design of this method, especially the verification logic, is configured to not rely on the inspection or parsing of network layer packet content.

[0025] Example 1: In a core financial system where the method of this invention is deployed, there exists a privileged account used for automated database backup, whose credentials are used by the automated script; when the background AI model executes the intent profiling and host context collaborative modeling steps, it has generated corresponding data tuples in the legitimate intent anchor point library by analyzing the historical operation logs of the automated script; these data tuples define an operation sequence template, denoted as... The sequence is connect_db->lock_tables->dump_data->unlock_tables, and this tuple is also bound to a valid host context profile, denoted as... The profile explicitly states that the binary file hash value of the process executing this sequence must be [value missing]. The process running user ID must be 0. Attackers compromised the web server running on the system through other means and gained access to the web application process (user ID: The hash value is The attacker then steals the session credentials held by the automated script by means of memory reading and other methods, enabling the script to perform operations within the script.

[0026] When an attacker uses the stolen credentials in a web application process When attempting to initiate a new session to perform malicious operations, the method of this invention establishes a temporary time-series buffer in memory for the new session; the attacker first issues an operation request connect_db, which is sent to the time-series buffer to form the current operation sequence. The real-time AI model obtains its current host context through an introspection mechanism, i.e. The real-time AI model executes a dual-validation rule. In the first-level temporal validation, it determines whether the current operation sequence `connect_db` matches a template in the legitimate intent anchor library. If the sequence matches... The template prefix; subsequently, the real-time AI model immediately performs a second layer of host verification to determine the current host context. Does it match? The legitimate host context profile bound to the template ,Right now ;because and Mismatch, and and The mismatch caused the second host verification to fail; therefore, the real-time AI model determined that this operation was a risk of context hijacking and triggered the access control module to immediately block the execution of the connect_db request; the request was not executed as an operation that matched the template in time but did not match the profile in the host context.

[0027] Example 2: To objectively verify the effectiveness of the method of the present invention in access control compared with traditional user and entity behavior analysis methods in identifying malicious sequences executed using credentials, an access control test platform was constructed. This platform simulates a production database environment containing sensitive data tables and sets up a high-privilege database administrator account. Two security monitoring schemes are deployed on the platform: a control group and the sample group of the present invention. The control group uses a user and entity behavior analysis method based on historical baselines. Its backend model has learned and confirmed that the database administrator account has historically independently executed SELECT queries and EXPORT operations, therefore both operations are within its historical behavior baseline. The sample group of the present invention uses the complete method as described in the aforementioned specific implementation. Its backend AI model, through analyzing 30 days of historical operation logs, has generated multiple data tuples in the legitimate intent anchor point library, for example, corresponding to database backups (…). ) and troubleshooting ( The system provides an operation sequence template, but its library does not contain an operation sequence template that connects the query targeting the high-sensitivity representative with the public network export (EXPORT_TO_S3_BUCKET). The experiment simulates an attack scenario in which the attacker has obtained the credentials of the database administrator's privileged account and attempts to execute a sequence of operations, each of which is within the historical baseline, under two monitoring schemes. This sequence includes: executing connect_db at T=1s; executing SELECT*FROM user_credit_card_table at T=2s; executing EXPORT_TO_S3_BUCKET(...) at T=3s. The responses and internal status records of the two systems are shown in Table 1.

[0028] Table 1: Comparison of Attack Simulation and System Response

[0029] Experimental data shows that in the control group, because each atomic operation (connect, select, export) performed by the attacker conformed to the historical behavior baseline of the database administrator, the user and entity behavior analysis system determined that it conformed to the baseline and allowed the data at each step of T=1s, T=2s, and T=3s, ultimately resulting in the export of sensitive data at T=3s. In the sample group of this invention, the connect_db operation at T=1s was allowed because it matched multiple template prefixes, but at T=2s, after the SELECT*FROM user_credit_card_table operation was sent to the timing buffer, the current operation sequence [connect_db, select_credit_card] formed was determined by the real-time AI model to not match any known operation timing template prefix in the legitimate intent anchor point library, and the access control module immediately executed a blocking action. The subsequent EXPORT_TO_S3_BUCKET(...) operation request issued by the attacker at T=3s was not processed by the access control point because the operation at T=2s had been blocked.

[0030] Example 3: This example combines Figures 1 to 3 This section explains the AI-based methods for dynamic management and behavioral risk identification and blocking of privileged accounts, such as... Figure 1As shown, when a new session is started, the risk calculation engine initializes the session's cumulative risk score to 0. During the session, when an operation request initiated by a privileged account undergoes double verification by a real-time AI model, if it is determined that the timing or host does not match, the risk calculation engine queries the operation risk weight to obtain the quantified risk weight of the current operation and adds it to the score. Subsequently, the system compares it with the response threshold. If the score is less than threshold 1, the access control module allows the operation and records the risk. If threshold 1 is less than or equal to the score but less than threshold 2, the system blocks the operation. If the score is greater than or equal to threshold 2, the system terminates the entire session. In contrast, if the double verification determines that both the timing and host match, the risk calculation engine adds a negative value to the legitimate operation weight to reduce the risk, and the access control module allows the operation and executes it.

[0031] like Figure 2 As shown, this diagram reveals the limitations of traditional access control mechanisms, including reliance on static identity authorization, loss of protection after credential leakage, and the lack of context awareness in post-event alerts and access control points due to the separation of control and analysis in the UEBA architecture. The diagram further illustrates the conflict between performance and analysis: access control points require extremely low latency while sequence analysis consumes significant resources and time, and the failures of existing improvement paths such as using complex AI models or pre-emptive AI analysis. Finally, the diagram summarizes the core problem addressed by this invention: existing mechanisms cannot identify and block malicious operation sequences executed by legitimate identities during an event. Figure 3 As shown, the state machine starts from the session start state. When it receives the operation "Connect to database", if the verification "Time Sequence + Host" both match, the response is "Allow" and it transitions to state 1. At this time, the content of the time sequence buffer is "Connect to database and match database backup template prefix". Subsequently, if it receives the operation "Lock table" and the verification "Time Sequence + Host" both match, the response is "Allow" and it transitions to state 2. The buffer is updated to "[...Lock table]", and so on. After receiving the operation "Unlock table" in state 3 and the verification passes, it enters the template matching complete state. However, at any node in this process, if a verification failure occurs, for example, if the verification "Host" does not match when the session starts (e.g., the Web process hash and script process hash do not match), or if the operation "Query sensitive data" is detected in state 1 causing the verification "Time Sequence" to not match any known template, the state machine immediately transitions to the blocking state and executes the response "Block".

[0032] Example 4: To further verify the necessity of dual collaborative verification of timing templates and host context profiles in the method of the present invention, the following comparative example 1 is set up; this comparative example aims to evaluate the impact of the missing link on identifying and blocking specific access control attack scenarios, such as the context hijacking attack in Example 1, by removing the host context verification link in the method of the present invention and retaining the operation timing verification; for this purpose, a comparative sample group is set up. The technical solution adopted by this sample group is different from that of the sample group of the present invention, such as in Example 1 and Example 2, mainly in that its background AI model only learns and generates operation timing templates, for example It does not generate or bind a corresponding legitimate host context profile, and its real-time AI model only performs the first-level time-series verification when performing verification; apart from this difference, the experimental platform, attack scenario, privileged account, stolen credentials, and the sequence of operations performed by the attacker in the comparative sample group, connect_db->lock_tables->dump_data->unlock_tables, simulate backup intent, but are executed in an erroneous web application process, are all consistent with the conditions described in Example 1. The experimental process reproduces the attack scenario in Example 1: after obtaining the database administrator credentials, the attacker performs an operation in the web application process. In the process, the system uses this credential to attempt a database backup operation sequence; the response and internal status records of the comparative sample system are shown in Table 2.

[0033] Table 2: Comparative Example 1 (Timing Verification Only) Attack Simulation and System Response Table

[0034] Experimental data shows that, in the comparative sample group, because the sequence of operations performed by the attacker is chronologically consistent with the database backup template... Consistently, the real-time AI model determined the sequence to be a match for the template prefix or template at each step from T=1s to T=4s during time-series verification; however, due to the lack of a second host context verification step, the system failed to recognize that the sequence occurred within an unexpected web application process. Execution occurs, rather than within the expected batch script process. Therefore, the access control module performs permission at every step, ultimately resulting in sensitive data being stolen through the dump_data operation at T=3s.

[0035] Example 5: This example describes a standardized engineering procedure for establishing and calibrating the key data structures and parameters in the aforementioned method. To generate a legitimate intent anchor point library, the system first selects a time window covering the operation records of the most recent 90 days from the historical operation logs that have undergone data source purification. The background AI model is specifically configured to use the PrefixSpan algorithm for sequence pattern mining to process the dataset to identify frequently occurring operation sequences. The standard for considering a sequence as frequent is that the number of times it appears in the dataset is greater than the minimum support count, which is set to 5 times. This value is determined through offline analysis based on the total number of operations in the dataset and the preset template coverage. For frequently identified sequences, the system aggregates process-level context information corresponding to all historical session instances executing that sequence, including process parent process information, process binary file hash value, and process running user ID. By statistically analyzing this context information, the system calculates the most frequent value of each context feature field, determines and binds a typical host context profile for the operation sequence template. At the same time, the system assigns initial quantitative risk weights to operation types in historical logs based on a predefined operation risk level mapping table based on the potential impact of operations, setting SELECT to 0.5 and DELETE to 5.0, and stores them in a data structure for subsequent real-time calculations.

[0036] To determine the response threshold in the cumulative risk-based graded response method and the maturity threshold in the model maturity gating mechanism, the following calibration procedure is performed: First, for the response threshold, a portion of independent historical log data containing labeled information is used, which includes sequences known to be normal operation sequences. Benign drift sequence and malicious attack sequences The samples are input into the constructed real-time AI model for simulation, and the cumulative risk score of the final session corresponding to the sequence is recorded; the calculation is performed. , and The statistical distribution characteristics of the risk score sets corresponding to the three types of sequences were analyzed by plotting their probability density functions. Risk scores that can statistically effectively distinguish these three distributions were selected as response thresholds. One approach is to select a threshold that lowers the probability of classifying a benign drift sequence as a suspicious drift than a preset value. (set up The minimum score (=0.05) is used as the threshold 1, and the probability of classifying a malicious attack sequence as a suspicious drift is selected to be lower than a preset value. (set up The minimum score (=0.01) is used as threshold 2. Under this procedure, through analysis of sample data, threshold 1 is determined to be 1.0 and threshold 2 to be 10.0. Regarding the model maturity threshold, when the background AI model is processing historical logs for modeling, it simultaneously monitors model status indicators, such as the total number of generated operation time sequence templates. Where t represents the amount of data processed; calculate the new template discovery rate. ,in To record the period, a calculation is performed every 10GB of log data processed; monitoring The changing trend, when Compared to its historical peak Decrease to preset ratio The following (settings) =5%), in the subsequent at least During the duration (set) When the model training is maintained below this level (corresponding to the processing of an additional 50GB of data), it is determined that the model training has reached a stable state; the model state indicators at this point, and the total number of anchor points at this point, are then used to determine the model's stable state. Set as the maturity threshold.

[0037] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0038] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for dynamic management and behavioral risk identification and blocking of privileged accounts based on AI, characterized in that, The method includes: Step a, the collaborative modeling step of intent profiling and host context, involves the background AI model analyzing and generating a legitimate intent anchor point library based on the historical operation logs of privileged accounts. The legitimate intent anchor point library stores multiple data tuples, each of which includes an operation sequence template and a legitimate host context profile associated with that operation sequence template. Step b, the timing buffer establishment step, when a privileged account starts a new session, establishes a temporary timing buffer in the computing device memory for the new session; Step c, the timing and host dual collaborative verification blocking step, includes: Step c1, capturing the current operation request in the new session, sending the current operation request into the timing buffer to form the current operation sequence, and obtaining the current host context of the new session in real time; Step c2, the real-time AI model executes the dual verification rules: determining whether the current operation sequence matches the operation timing template contained in any data tuple in the legitimate intent anchor library; when the current operation sequence matches the operation timing template, the real-time AI model additionally determines whether the current host context matches the legitimate host context profile bound to the data tuple; Step c3, executing collaborative blocking according to the dual verification rules: if the current operation sequence does not match the operation timing template, and if the current host context does not match the legitimate host context profile, the access control module is triggered to block the execution of the current operation request.

2. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, In step c3, if the real-time AI model determines that the current operation sequence matches the operation timing template and the current host context matches the legitimate host context profile, then the access control module is triggered to allow the execution of the current operation request.

3. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, The background AI model in step a is a sequence analysis-based model; the real-time AI model in step c2 is a model implemented based on a finite state machine or prefix tree matching algorithm, wherein the data tuples in the legitimate intent anchor point library define the rules for valid host context profile verification of the legitimate state transition path of the finite state machine or prefix tree in each state.

4. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, Step a further includes: the background AI model assigns quantified risk weights to one or more operations based on the preset risk level of the operation and stores them; and the collaborative blocking method in step c3 is replaced by a graded response method based on cumulative risk, which includes: maintaining the cumulative risk score of the session in the memory of the computing device for the new session; when the real-time AI model determines that the current operation sequence does not match the operation timing template, or determines that the current host context does not match the legitimate host context profile, querying the quantified risk weight corresponding to the current operation request and adding it to the cumulative risk score of the session; comparing the cumulative risk score of the session with the preset response threshold, and selecting a corresponding response action from a set of preset response actions to execute based on the comparison result, the response actions include: recording and blocking the execution of the current operation request and terminating the new session.

5. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 4, characterized in that, The graded response method also includes: introducing a preset legal operation weight, and when the real-time AI model determines that the current operation sequence matches the operation timing template and the current host context matches the legal host context profile, the preset legal operation weight is added to the session cumulative risk score; wherein the value of the preset legal operation weight is set to be less than the minimum value among the preset response thresholds.

6. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, Step a further includes: the background AI model calculates and maintains the model maturity score for the privileged account based on the statistical indicators of the historical operation logs used for modeling; and the collaborative blocking logic in step c3 is executed based on the model maturity score condition: if the model maturity score is lower than the preset maturity threshold, the blocking action is suppressed and the execution of the current operation request is allowed, while the current operation sequence and the current host context are submitted to the background AI model as learning data; if the model maturity score is not lower than the preset maturity threshold, the blocking action is activated.

7. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, Before step b, the process includes: receiving declarative intent data actively submitted by a privileged account; based on the declarative intent data, filtering and generating a temporary session-level constraint library from the legitimate intent anchor library, the session-level constraint library containing one or more data tuples from the legitimate intent anchor library; the double verification rule in step c2 is replaced by: determining whether the current operation sequence matches the operation timing template contained in any data tuple in the session-level constraint library; when the current operation sequence matches the operation timing template, the real-time AI model additionally determines whether the current host context matches the legitimate host context profile bound to the matched data tuple; operation timing templates that exist in the legitimate intent anchor library but not in the session-level constraint library are also judged as mismatched by the real-time AI model and trigger collaborative blocking.

8. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, Before the intent profiling and host context co-modeling steps, there is also a data source purification step, which includes: obtaining the privileged account identity corresponding to the historical operation logs; querying the access control policy library to determine whether the privileged account identity is classified into a preset untrusted learning role; only when the privileged account identity is not classified into a preset untrusted learning role is the historical operation log background AI model allowed to perform the intent profiling and host context co-modeling steps.

9. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, The historical operation logs collected in step a and the current operation requests captured in step c1 are both operation information of the host layer or application layer of the electronic digital data processing device, including information selected from system call API requests and database query statements, but excluding data packet content of the network layer.

10. The AI-based method for dynamic management and behavioral risk identification and blocking of privileged accounts according to claim 1, characterized in that, The determination of whether the current operation sequence matches the operation timing template in step c2 further includes: determining whether the current operation sequence matches one or more operation timing templates in the legitimate intent anchor point library, and generating a matching count value; the method also includes an accompanying audit step: if the matching count value is greater than a preset ambiguity threshold, the execution of the current operation request is not blocked; instead, an accompanying action is triggered, which includes: raising the audit level of the new session or adding an intent ambiguity risk label to the operation log of the new session.

Images