Dynamic authorization method based on software defined boundary and user behavior baseline

Abstract

The invention relates to a dynamic authorization method based on a software defined boundary and a user behavior baseline, and belongs to the field of network security. According to the method, initial strong authentication of a software defined boundary SDP is combined with continuous monitoring based on a user behavior baseline, and a dynamic authorization system throughout the full life cycle of a session is constructed; the abnormal risk is identified by comparing the current operation of a user with a dynamically updated behavior baseline in real time, and an authorization engine is triggered to automatically execute a complete method flow of authority adjustment according to the risk alarm, so that the fundamental conversion from'one-time authorization 'to'continuous self-adaptive authorization' is realized. According to the method, on the basis of a controlled channel established by the SDP, continuous learning and risk assessment of behaviors in a user session are introduced, and the access authority is automatically adjusted in real time according to an assessment result, so that a self-adaptive security closed loop integrating perception, analysis, decision making and execution is formed.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and particularly relates to a dynamic authorization method based on software-defined boundary and user behavior baseline. BACKGROUND

[0002] At present, in the field of cross-network security, the existing technical solutions mainly include two types of mainstream architectures. One is a virtual private network (VPN) based solution. This technology establishes an encrypted tunnel on a public network, enabling user terminals to simulate as a node of an internal network, thereby realizing access to internal network resources. Its access control usually relies on identity authentication at the initial connection and predefined static policies. The other is a software-defined perimeter (SDP) based technology. Its core idea follows the principle of "verifying identity first and then establishing connection". Through the separation of control plane and data plane architecture, the backend service assets are hidden by default. Only after the user passes strict authentication, the controller authorizes the gateway to establish a data channel to a specific application.

[0003] The authorization mechanism of the traditional model represented by VPN and the current mainstream SDP solution is still static or quasi-static in nature. They mostly rely on one-time authentication and context judgment at the beginning of session establishment, and consider the access process after session establishment as a continuous trusted state. This "one-time" authorization mode has inherent limitations: it cannot perceive and respond to dynamic security risks caused by user account hijacking, malicious operation of internal personnel or abnormal mutation of behavior patterns in the established session connection. This leads to the lack of ability to intervene and adjust permissions in real time during the session process when the system faces the threat of continuous evolution. In order to overcome this limitation, the present application proposes a dynamic authorization method based on software-defined boundary and user behavior baseline, aiming to extend security monitoring and authorization control from the connection moment to the entire session life cycle. SUMMARY

[0004] (I) Technical problems to be solved The technical problem to be solved by the present application is how to provide a dynamic authorization method based on software-defined boundary and user behavior baseline to solve the problem of lack of ability to intervene and adjust permissions in real time during the session process when the system faces the threat of continuous evolution.

[0005] (II) Technical solutions In order to solve the above technical problems, the present application proposes a dynamic authorization method based on software-defined boundary and user behavior baseline, which comprises: The SDP control layer serves as the security portal of the system, builds an invisible logical security boundary and implements initial access control; The user behavior baseline modeling module constructs a dynamically updated behavior baseline for each user through standardized data conversion and machine learning processes; The real-time risk analysis and trust evaluation module continuously monitors the real-time operation flow of the user according to the user behavior baseline, extracts features, calculates abnormalities, and comprehensively evaluates the risk; The dynamic authorization engine dynamically generates and issues access control instructions according to real-time risk intelligence, and realizes real-time adjustment of permissions.

[0006] (Three) beneficial effects The application proposes a dynamic authorization method based on software-defined boundaries and user behavior baseline, the key point of which is to combine the initial strong authentication of software-defined boundaries (SDP) with continuous monitoring based on user behavior baseline, and to build a dynamic authorization system throughout the life cycle of the session. The core protection point is to identify abnormal risks by comparing the user's current operation with the dynamically updated behavior baseline in real time, and to trigger the authorization engine to automatically perform permission adjustment (such as degradation, session termination) according to the risk alarm, so as to realize the fundamental change from "one-time authorization" to "continuous adaptive authorization".

[0007] The traditional network security model is usually based on the concepts of "boundary protection" and "static authorization", that is, after one-time identity authentication, the user obtains preset fixed permissions during the session period. However, this model is difficult to deal with risks such as user identity impersonation, internal malicious operation or session hijacking after authorization. The zero trust security paradigm emphasizes "from no trust, continuous verification", and requires dynamic and context-based risk assessment of access requests. Software-defined boundaries, as a key technology to realize zero trust, can realize the invisibility and minimal access of network resources through its "verification first, connection later" feature. However, existing SDP solutions focus more on the initial authentication and authorization of connection, and lack the ability of continuous behavior monitoring and dynamic control of established sessions.

[0008] Therefore, the application proposes an innovative dynamic authorization method, which deeply combines the strong access control capability of SDP with user behavior analysis based on machine learning. The core idea of this method is to introduce continuous learning and risk assessment of user session behavior based on the controlled channel established by SDP, and to automatically adjust access permissions in real time according to the evaluation results, thereby forming a self-adaptive security closed loop of perception, analysis, decision-making and execution. The application not only theoretically constructs the complete model of the method, but also deeply designs and describes the implementation mechanism and collaborative process of the key components. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 The application is a dynamic authorization method based on software-defined boundaries and user behavior baseline. Detailed Implementation

[0010] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0011] This invention belongs to the field of network security technology, specifically relating to a cross-network secure access method and system that integrates software-defined boundaries, user behavior analysis and dynamic access control, specifically a dynamic authorization method based on software-defined boundaries and user behavior baselines.

[0012] The purpose of this invention is to provide a dynamic authorization method based on software-defined boundaries and user behavior baselines, thereby solving the aforementioned technical problems. The method includes: The SDP control layer acts as the system's security gateway, constructing an invisible logical security boundary and implementing initial access control. The user behavior baseline modeling module constructs a dynamically updated behavior baseline for each user through standardized data transformation and machine learning processes. The real-time risk analysis and trust assessment module continuously monitors, extracts features, calculates anomalies, and conducts comprehensive risk assessments of users' real-time operation flow based on user behavior baselines. The dynamic authorization engine dynamically generates and issues access control instructions based on real-time risk intelligence, enabling real-time adjustment of permissions.

[0013] Example 1: To achieve the above objectives, the technical solution adopted by the present invention is as follows: This solution aims to overcome the static limitations of traditional authorization mechanisms by introducing continuous analysis of user behavior baselines into a software-defined boundary architecture, thereby achieving dynamic permission management throughout the entire session lifecycle. Its core lies in transforming security control from one-time authentication to continuous authorization based on real-time risk assessment. The specific process is as follows: 1. SDP Control Layer As the system's security gateway, the SDP control layer is responsible for building an invisible logical security boundary and implementing initial access control.

[0014] The SDP control layer first deploys a single-packet authorized SDP gateway at the network layer, making all service ports invisible to the network by default. Authorized users must use a dedicated client to generate an encrypted authentication packet. This packet consists of a timestamp accurate to milliseconds, a device fingerprint hashed using SHA-256, and a time-based one-time password, and is sent once via UDP to a specific port on the controller for pre-authentication.

[0015] Upon receiving a user request, the controller enforces multi-factor authentication and verifies device compliance by combining this with real-time device security status reports from the lightweight client (including operating system version and patch level, antivirus software installation and running status, recent vulnerability scan results, etc.). Once verification is successful, the integrated dynamic authorization engine is activated, invoking a predefined ABAC policy rule set. Based on the principle of least privilege, it generates an initial authorization policy specifying the host addresses, service ports, and operation permissions that the user can access, and immediately distributes this policy to the corresponding SDP gateway.

[0016] Throughout the session lifecycle, the SDP control layer continuously listens for alarm signals from the "Real-time Risk Analysis and Trust Assessment Module." The dynamic authorization engine recalculates and generates new, granular access control policies in real time based on the risk level and specific type (e.g., downgrading permissions from "read-write" to "read-only," reducing the number of accessible hosts or services, or immediately terminating the current session). These policies are then forcibly distributed to the SDP gateway through the SDP control layer, thereby achieving dynamic adjustment of permissions.

[0017] 2. User Behavior Baseline Modeling Module This module uses standardized data transformation and machine learning processes to build a dynamically updated behavioral baseline for each user. Its implementation involves the following four specific steps: Step S21: Raw Data Acquisition and Session Segmentation Collect user u's raw operation logs, and record each log entry as a single record R: R = {user_id: u, timestamp: t, resource: r, resource_type: rt, action: a, data_volume: vol} Wherein, `user_id` is the user's unique identifier; `timestamp: t` is the timestamp of the operation's occurrence; `resource: r` is the identifier of the accessed resource, the specific form of which is determined by `resource_type: rt`. For example, when `rt` is `HOST`, `r` might be the target host IP (e.g., 10.0.1.101); when `rt` is `FILE`, `r` is the file path (e.g., \\nas\finance\report.xlsx); when `rt` is `API`, `r` is the API endpoint (e.g., / api / v1 / order / query); when `rt` is `NETWORK`, `r` might be the target network segment (e.g., 192.168.1.0 / 24). `action: a` is the operation type, covering network, host, and file operations, such as: `READ`, `WRITE`, `EXECUTE`, `PING`, `TCP_CONNECT`, `SSH_LOGIN`, `DELETE`, etc. `data_volume: vol` is the data volume generated by this operation (unit: bytes). For network probing operations (e.g., `PING`), this value can be recorded as the packet size or fixed at 0.

[0018] The system then segments the logs by session. A timeout threshold is set. (like =1800 seconds, or 30 minutes), if user u has two adjacent operation records and time interval Then, it is segmented to form an independent session S. k Each session S k Contains a list of operation records sorted in ascending order by timestamp t. , where N is the total number of operations within the session.

[0019] Step S22, Feature Engineering (1) Sequence feature vector Generation: a. Uniform Resource Identifier and Vectorization: First, different types of resources *r* are uniformly encoded into a standard format based on their *resource_type*. For example, the host IP *10.0.1.101* is encoded as *host:10.0.1.101*, and the file path *\finance\report.xlsx* is encoded as *file:\finance\report.xlsx*. Then, a Skip-gram model (a type of Word2Vec) is pre-trained on all historically occurring uniform resource identifiers, mapping each identifier to a *d*-dimensional dense real-valued vector. (d is the preset embedding dimension, usually 128 or 256). The training objective of this model is to maximize the log probability of other resource identifiers c appearing within its context window, given a target resource identifier r. Where θ are model parameters, and P is usually derived from... Definition. After training, the parameters... That is, the vector representation of the resource identifier r.

[0020] b. Session sequence construction: For a session S k The N operations contained therein are converted into corresponding vectors according to their uniform resource identifiers r, and arranged in chronological order to form a sequence feature vector. : ,in For the i-th operation resource identifier r i The corresponding d-dimensional vector.

[0021] This vector sequence represents the order and pattern of user operations on various resources (hosts, files, APIs, etc.) during the session.

[0022] (2) Statistical eigenvectors Generation: For the same session S k Perform statistical calculations to generate an M-dimensional feature vector. Below are examples of key dimensions and their calculation formulas (let t...). start For session S k The timestamp of the first operation, t end (timestamp of the last operation) a. Temporal characteristics: hour_of_day:H(t start ), function H extracts t start The corresponding number of hours (0-23).

[0023] is_weekday:W(t start The function W determines t. start If it is a working day, output 1; otherwise, output 0.

[0024] b. Flow and frequency characteristics: total_volume: , representing traffic, the sum of all operations data_volume in the session.

[0025] request_rate: , representing frequency characteristics, where It is a very small positive number (such as 1×10). 6 To prevent division by zero, the unit of calculation is operands per second.

[0026] c. Operation type and target dispersion characteristics: unique_resources: That is, the size of the set of different resource identifiers in the session.

[0027] action_entropy: The Shannon entropy of operation type a, calculated using the following formula:

[0028] Where A is the set of all operation types. count(a) represents the number of times type 'a' appears in the session. A high entropy value indicates a variety of operation types, while a low entropy value indicates a concentration in a few operations.

[0029] d. Distribution of Operation Types and Risk Weights: ratio_read: That is, the percentage of read operations.

[0030] ratio_network_scan: This refers to the proportion of network probing operations, which typically carry a higher potential risk weight.

[0031] Combine all the statistical values ​​to obtain the original statistical vector. .

[0032] e. Feature standardization: For each user u, calculate all their historical sessions. mean vector and standard deviation vector Perform Z-scoire normalization on the user's new session vector:

[0033] Among them, symbols This indicates dividing element by element, dimension by dimension. and The initial value is calculated from user u's historical data and changes dynamically as the baseline is updated.

[0034] Step S23: Baseline Model Training Using user u's historical normal session dataset (e.g., data from the past 30 days, totaling K sessions), train its sequence behavior model and statistical behavior model respectively.

[0035] (1) Sequence baseline model

[0036] This model aims to learn and represent the user's inherent, habitual operating sequences and patterns.

[0037] This approach uses a one-dimensional convolutional neural network (1D-CNN) as the core of sequence modeling. This network is naturally well-suited for processing vector sequences with temporal relationships, such as operation sequences. .

[0038] The network comprises multiple one-dimensional convolutional layers and pooling layers. The convolutional layers slide multiple learnable filters (kernels) across the input sequence, automatically capturing short-range local dependency patterns (e.g., the common combination of "accessing host A first, then file B"). The pooling layers reduce the dimensionality of the convolutional features, extracting the most salient features. The network finally outputs a fixed-length session embedding vector of length L through fully connected layers. This vector is a highly abstract and digital "fingerprint" of the user's operation sequence in this session.

[0039] Training Methods and Objectives: To enable this "fingerprint" to effectively distinguish between normal and abnormal sequences, a triplet contrastive learning strategy is employed during training. Each training iteration inputs a triplet sample to the network: an anchored session S... a A positive example session S p (with S) a (User u) and a negative example session S n (Belongs to other users). The training objective is to minimize the triplet loss function, which forces the network to adjust its parameters. This makes the embedding vector of the anchor session... Embedding vector of positive example session The Euclidean distance in space should be minimized, while the embedding vector of the negative example session should be minimized. The distance should be as large as possible. The mathematical constraints of this process can be expressed as:

[0040] in, The L2 norm (Euclidean distance) of the vector is represented by α > 0, which is a preset margin parameter used to ensure that there is a clear separating boundary between positive and negative examples.

[0041] Baseline output: After training, the sequence baseline model is the set of trained network weight parameters. Full definition. Simultaneously, the system calculates the embedding vectors of all training sessions. The mean of the values ​​is used to obtain the reference centroid C of the user's normal sequence pattern. u :

[0042] (2) Statistical baseline model

[0043] This model aims to quantify the normal fluctuation range of various statistical characteristics of user u's behavior.

[0044] Assume that user u's normal behavior in the standardized statistical feature space follows a multivariate Gaussian distribution. This is a widely used and effective statistical model in anomaly detection, capable of describing the overall distribution of multiple relevant feature variables.

[0045] Parameter Calculation and Significance: The multivariate Gaussian distribution is determined by two parameters, based on the historical statistical feature set of user u. Perform the calculation: ① Mean vector This is an M-dimensional vector, where each component corresponds to the arithmetic mean of a statistical feature (such as average request rate, operation entropy, etc.) across all historical sessions. It represents the "center point" or "average state" of normal user behavior.

[0046]

[0047] ② Covariance matrix

[0048] This is an M The pairwise matrix of M. Its diagonal elements are the variances of each statistical feature itself, reflecting the normal fluctuation range of that feature; the off-diagonal elements are the covariances between different feature pairs, reflecting the linear correlation between features. This matrix collectively defines the normal data points in the feature space around the center point. The shape and direction of their distribution.

[0049]

[0050] Baseline output: parameter pair This constitutes the statistical baseline model for the user. This model provides a probabilistic framework: a statistical feature vector for a new session. This allows us to calculate the probability density of a distribution belonging to that normal distribution, thereby quantitatively assessing the degree to which it deviates from the normal range.

[0051] Model training completion indicator: When the sequence model parameters... With reference centroid and statistical model parameters Once all calculations are complete, the initial behavioral baseline model for user u is considered built. This baseline is based on a quadruple... The data is persistently stored in a specific format, providing a basis for judgment in the real-time risk analysis module.

[0052] 3. Real-time risk analysis and trust assessment module This module serves as the system's real-time risk perception and quantification center. After a user session is established, this module continuously monitors, extracts features, calculates anomalies, and conducts comprehensive risk assessments of the user's real-time operational flow based on the user's behavioral baseline. Its specific implementation process is as follows: Step S31: Real-time feature extraction This step maintains strict consistency with the feature engineering of the baseline modeling module to ensure a unified comparison benchmark. Once user u's session is activated, probes deployed on the SDP gateway and host agent capture its operational event stream in real time. The system establishes a sliding time window (e.g., ...). =60 seconds), and set up an event counter. (e.g., 10 operations). A feature calculation is triggered when any of the following conditions are met: (1) The time difference between the current time and the previous feature calculation is ≥ (2) The cumulative number of operation events since the last feature calculation is ≥ .

[0053] After being triggered, the system will process the set of operation events within that window / batch. Processing: ① Sequence Feature Extraction: The operations within the window are sorted by time to obtain their resource identifier sequences. These sequences are then mapped to resource vectors using the model trained by the baseline module, forming the real-time sequence feature vector for the current window. .

[0054] ② Statistical Feature Extraction: Based entirely on the M statistical dimensions (such as time, flow, entropy, operation type distribution, etc.) defined in the baseline module, calculate the statistical values ​​of operation events within the window to generate the original real-time statistical vector. Then, the normalized parameters of the corresponding user u are used. Z-score standardization was performed on it to obtain .

[0055] Step S32: Calculation of multi-dimensional anomaly scores This step utilizes the baseline model of user u. Calculate the degree of abnormal deviation of the current behavior in each dimension.

[0056] (1) Sequence anomaly Current sequence features Input user u's sequence baseline model (parameters are) The model outputs the real-time embedding vector of the current session window. .calculate Centroid of the user's normal sequence reference The cosine distance is used as the sequence deviation. :

[0057] Where · represents the dot product, This represents the L2 norm of a vector. The value range is [0,2], with larger values ​​indicating more abnormal sequence patterns. A sigmoid function is used to... Normalized to sequence anomalies between 0 and 1 :

[0058] in, The steepness factor (can be 4.0). The threshold for judgment (usually taken as the user's historical normal data) (a certain high quantile of the value).

[0059] (2) Statistical anomaly analysis Calculate the current standardized statistical eigenvector. Multivariate Gaussian lines relative to user u Mahalanobis distance .

[0060]

[0061] Mahalanobis distance takes into account the correlation between features and can more accurately measure the degree of deviation in multidimensional space. It is then transformed into statistical outlier analysis. :

[0062] in, It is the cumulative distribution function of a chi-square distribution with M degrees of freedom (statistical feature dimension).

[0063] (3) Contextual rules A lightweight rules engine runs in parallel, checking whether the current operation violates preset hard safety rules or context policies. Each rule outputs a binary value or a score. For example: Rule 1: IF access time is 02:00-05:00 AM THEN Score = 0.7.

[0064] Rule 2: If the source geolocation first appears THEN, score = 0.5.

[0065] Rule 3: IF operation target is "core database" and action is "DELETE" THEN Score = 1.0.

[0066] Take the highest score among all triggering rules as .

[0067] Step S33: Comprehensive Risk Fusion and Alarm Generation To obtain a unified risk assessment, a weighted geometric mean was used to fuse the three scores to reduce interference from individual noise signals and highlight multi-dimensional joint anomalies.

[0068] in, For configurable weights, satisfy The default value can be set to (0.4, 0.4, 0.2). It is a very small positive number to prevent the entire product from being 0.

[0069] Will With a dynamically adjusted global threshold Comparison. This threshold can be fine-tuned based on the accuracy of recent alerts.

[0070] If the risk is high, a structured risk alert event (Alert) will be generated immediately.

[0071] This alert is pushed in real time to the dynamic authorization engine within the SDP control layer via a high-priority message queue. 4. Dynamic Licensing Engine The dynamic authorization engine is the policy decision-making and execution hub of the SDP control layer. It is responsible for dynamically generating and issuing access control instructions based on real-time risk intelligence, so as to realize the real-time adjustment of permissions.

[0072] Step S41, Strategy Decision The dynamic authorization engine internally maintains a definable policy decision matrix, which is an ordered set of "condition-action" rules. Upon receiving a risk alert, the engine executes the following logic: Conditional matching: Matches the attributes in the Alert with the conditional parts of each rule in the policy decision matrix.

[0073] Action Decision: Upon successful matching, execute the action set A corresponding to the rule. The action set is a list of atomic control instructions, for example: (Permission downgraded to read-only, valid for 300 seconds). A={"action":"FORCE_REAUTH","factor":"SMS"} (Force two-factor authentication via SMS) A={"action":"SESSION_TERMINATE","notify":"SECURITY_ADMIN"} (Terminates the session and notifies the security administrator) Decision Priority: Rules are arranged by priority. When multiple rules are matched, the rule with the highest priority (usually corresponding to the most severe punishment) is executed.

[0074] Step S42, Strategy Execution After the decision is generated, the dynamic authorization engine sends control commands to the policy enforcement points in the network through the management interface of the SDP control layer.

[0075] This invention provides a dynamic authorization method based on software-defined boundaries (SDPs) and user behavior baselines. The key is combining initial strong authentication using SDPs with continuous monitoring based on user behavior baselines to construct a dynamic authorization system that spans the entire session lifecycle. Its core protection point is to identify abnormal risks by comparing the user's current actions with the dynamically updated behavior baseline in real time. Based on this risk alert, the authorization engine automatically executes a complete process of adjusting permissions (such as downgrading or terminating the session), thereby achieving a fundamental shift from "one-time authorization" to "continuous adaptive authorization."

[0076] Traditional network security models are typically based on the concepts of "perimeter protection" and "static authorization," meaning that after a one-time authentication, a user gains preset, fixed permissions for the duration of the session. However, this model struggles to address risks such as user identity theft, malicious internal operations, or session hijacking that occur after authorization. The zero-trust security paradigm emphasizes "never trusting, continuous verification," requiring dynamic, context-based risk assessments of access requests. Software-defined perimeters (SDPs), as a key technology for achieving zero trust, can achieve network resource invisibility and minimized access through their "verify first, connect later" characteristic. However, existing SDP solutions largely focus on initial authentication and authorization of connections, lacking the ability to continuously monitor and dynamically control the behavior of established sessions.

[0077] To address this, this invention proposes an innovative dynamic authorization method that deeply integrates the mandatory access control capabilities of SDP with user behavior analysis based on machine learning. The core idea of ​​this method is to introduce continuous learning and risk assessment of user session behavior on the basis of the controlled channel established by SDP, and to adjust access permissions in real time and automatically based on the assessment results, thereby forming an adaptive security closed loop integrating perception, analysis, decision-making, and execution. This invention not only theoretically constructs a complete model of the method, but also provides in-depth design and explanation of the implementation mechanisms and collaborative processes of its key components.

[0078] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A dynamic authorization method based on software-defined boundaries and user behavior baselines, characterized in that, The method includes: The SDP control layer acts as the system's security gateway, constructing an invisible logical security boundary and implementing initial access control. The user behavior baseline modeling module constructs a dynamically updated behavior baseline for each user through standardized data transformation and machine learning processes. The real-time risk analysis and trust assessment module continuously monitors, extracts features, calculates anomalies, and conducts comprehensive risk assessments of users' real-time operation flow based on user behavior baselines. The dynamic authorization engine dynamically generates and issues access control instructions based on real-time risk intelligence, enabling real-time adjustment of permissions.

2. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 1, characterized in that, The SDP control layer first deploys a single-packet authorized SDP gateway at the network layer, making all service ports invisible to the network by default. Legitimate users need to use a dedicated client to generate an encrypted authentication packet. This packet consists of a timestamp accurate to milliseconds, a device fingerprint processed by SHA-256 hashing, and a time-based one-time password. It is then sent once via UDP protocol to a specific port on the controller to complete pre-authentication. Upon receiving a user request, the controller enforces multi-factor authentication and verifies device compliance by combining the device security status reported in real time by the lightweight client. Once the verification is successful, the integrated dynamic authorization engine is immediately started, calling the predefined ABAC policy rule set, and generating an initial authorization policy that specifies the host addresses, service ports and operation permissions that users can access based on the principle of least privilege, and immediately sending it to the corresponding SDP gateway.

3. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 2, characterized in that, Throughout the session lifecycle, the SDP control layer continuously listens for alarm signals from the real-time risk analysis and trust assessment module. The dynamic authorization engine recalculates and generates new, refined access control policies in real time based on the risk level and specific type, and then forces the policies to be sent to the SDP gateway through the SDP control layer, thereby achieving dynamic adjustment of permissions.

4. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 1, characterized in that, The user behavior baseline modeling module specifically executes the following process: Step S21: Raw Data Acquisition and Session Segmentation Collect user u's raw operation logs, and record each log entry as a separate record R. R = {user_id: u, timestamp: t, resource: r, resource_type: rt, action: a, data_volume: vol} Wherein, user_id is the user's unique identifier; timestamp: t is the timestamp of the time the operation occurred; resource: r is the identifier of the accessed resource, the specific form of which is determined by resource_type: rt, where rt can be HOST, FILE, API endpoint, or NETWORK; action: a is the operation type, covering network, host, and file operations; data_volume: vol is the data volume generated by this operation. For network probing operations, this value can be recorded as the packet size or fixed at 0. The system then segments the logs by session and sets a timeout threshold. If user u has two adjacent operation records and time interval Then, it is segmented to form an independent session S. k Each session S k Contains a list of operation records sorted in ascending order by timestamp t. , where N is the total number of operations within the session; Step S22, Feature Engineering Unify the resource identification and vectorization of different types of resources r, and construct sequence feature vectors in chronological order. For the same session S k Perform statistical calculations to generate an M-dimensional feature vector; Step S23: Baseline Model Training Using user u's historical normal session dataset Sequence behavior model and statistical behavior model were trained respectively.

5. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 4, characterized in that, The unified resource identification and vectorization of different types of resources r are used to construct a sequence feature vector in chronological order. include: a. Uniform Resource Identification and Vectorization: First, different types of resources *r* are uniformly encoded into a standard format based on their *resource_type*. Then, a Skip-gram model is used to pre-train all historically occurring uniform resource identifiers, mapping each identifier to a d-dimensional dense real-valued vector. d is the preset embedding dimension; the training objective of this model is to maximize the log probability of other resource identifiers c appearing within its context window for a given target resource identifier r. Where θ are model parameters, and P is determined by... Definition; after training, the parameters That is, the vector representation of the resource identifier r; b. Session sequence construction: For a session S k The N operations contained therein are converted into corresponding vectors according to their uniform resource identifiers r, and arranged in chronological order to form a sequence feature vector. : ,in For the i-th operation resource identifier r i The corresponding d-dimensional vector.

6. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 5, characterized in that, The same session S k Statistical calculations are performed to generate an M-dimensional feature vector, including: a. Temporal characteristics: hour_of_day:H(t start ), function H extracts t start The corresponding number of hours; is_weekday:W(t start The function W determines t. start If it is a working day, output 1; otherwise, output 0. b. Flow and frequency characteristics: total_volume: , representing the traffic, the sum of all operations data_volume in the session; request_rate: , representing frequency characteristics, where Given a very small positive number to prevent division by zero, the unit of calculation is operands per second; c. Operation type and target dispersion characteristics: unique_resources: That is, the size of the set of different resource identifiers in the session; action_entropy: The Shannon entropy of operation type a, calculated using the following formula: Where A is the set of all operation types. count(a) is the number of times type a appears in the session; a high entropy value indicates a variety of operation types, while a low value indicates that the operation types are concentrated in a few operations; d. Distribution of Operation Types and Risk Weights: ratio_read: The percentage of read operations; ratio_network_scan: This refers to the proportion of network probing operations, which have a higher potential risk weight. Combine all the statistical values ​​to obtain the original statistical vector. ; e. Feature standardization: For each user u, calculate all their historical sessions. mean vector and standard deviation vector Perform Z-scoire normalization on the user's new session vector: Among them, symbols This indicates division by element-wise along each dimension. and The initial value is calculated from user u's historical data and changes dynamically as the baseline is updated.

7. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 5, characterized in that, The training sequence behavior model includes: Sequence baseline model The aim is to learn and represent the user's inherent, habitual operation sequence and patterns; One-dimensional convolutional neural networks (1D-CNNs) are used as the core for sequence modeling. The network contains multiple one-dimensional convolutional layers and pooling layers. The convolutional layers slide across the input sequence using multiple learnable filters to automatically capture short-range local dependency patterns in the sequence. The pooling layers reduce the dimensionality of the convolutional features and extract the most salient features. Finally, the network outputs a fixed-length L session embedding vector through a fully connected layer. This vector is a highly abstract and digital "fingerprint" of the user's operation sequence in this session; Training Methods and Objectives: To enable the "fingerprint" to effectively distinguish between normal and abnormal sequences, a triplet contrastive learning strategy is employed during training. Each training iteration inputs a triplet sample to the network: an anchored session S... a A positive example session S p , with S a Both belong to user u, and a negative example session S n It belongs to other users; the training objective is to minimize the triplet loss function, which forces the network to adjust its parameters. This makes the embedding vector of the anchor session... Embedding vector of positive example session The Euclidean distance in space should be minimized, while the embedding vector of the negative example session should be minimized. The distance should be as large as possible; the mathematical constraints of this process can be expressed as: in, The L2 norm of the vector is represented by α > 0, which is a preset margin parameter used to ensure a clear separation boundary between positive and negative examples. Baseline output: After training, the sequence baseline model is the set of trained network weight parameters. Full definition; simultaneously, compute the embedding vectors of all training sessions. The mean of the values ​​is used to obtain the reference centroid C of the user's normal sequence pattern. u : 。 8. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 7, characterized in that, The training statistical behavior model includes: Statistical baseline model The aim is to quantify the normal fluctuation range of various statistical characteristics of user behavior; Assume that the normal behavior of user u in the standardized statistical feature space follows a multivariate Gaussian distribution; the multivariate Gaussian distribution is determined by two parameters based on the historical statistical feature set of user u. Perform the calculation: ① Mean vector This is an M-dimensional vector, where each component corresponds to the arithmetic mean of a statistical feature across all historical sessions; representing the "center point" or "average state" of normal user behavior. ② Covariance matrix This is an M The pairwise matrix of M; its diagonal elements are the variances of each statistical feature, reflecting the normal fluctuation range of that feature; the off-diagonal elements are the covariances between different feature pairs, reflecting the linear correlation between features; this matrix collectively defines the normal data points in the feature space around the center point. The shape and direction of the distribution; Baseline output: parameter pair This constitutes the statistical baseline model of the user; this model provides a probabilistic framework: the statistical feature vector for a new session. Calculate the probability density of its belonging to the normal distribution, thereby quantitatively assessing the degree to which it deviates from the normal range; Model training completion indicator: When the sequence model parameters... With reference centroid and statistical model parameters Once all calculations are complete, the initial behavioral baseline model for user u is considered built; this baseline is based on a quadruple. The data is persistently stored in a specific format, providing a basis for judgment in the real-time risk analysis module.

9. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 8, characterized in that, The real-time risk analysis and trust assessment module performs the following steps: Step S31: Real-time feature extraction Once user u's session is activated, probes deployed on the SDP gateway and host agent capture its operation event stream in real time; the system establishes a sliding time window. And set up an event counter. A feature calculation is triggered if any of the following conditions are met: (1) The time difference between the current time and the previous feature calculation is greater than or equal to the previous time. (2) The cumulative number of operation events since the last feature calculation is ≥ ; After being triggered, the system will process the set of operation events within that window / batch. Processing: ① Sequence Feature Extraction: The operations within the window are sorted by time to obtain their resource identifier sequences. These sequences are then mapped to resource vectors using the model trained by the baseline module, forming the real-time sequence feature vector for the current window. ; ② Statistical Feature Extraction: Based entirely on the M statistical dimensions defined in the baseline module, calculate the statistical values ​​of operation events within the window to generate the original real-time statistical vector. Subsequently, the standardized parameters of the corresponding user u are used. Z-score standardization was performed on it to obtain ; Step S32: Calculation of multi-dimensional anomaly scores This step utilizes the baseline model of user u. Calculate the degree of abnormal deviation of the current behavior in each dimension; (1) Sequence anomaly Current sequence features Input the sequence baseline model of user u, with parameters as follows: The model outputs the real-time embedding vector of the current session window. ;calculate Centroid of the user's normal sequence reference The cosine distance is used as the sequence deviation. : Where · represents the dot product, The L2 norm of a vector; The value range is [0,2], and the larger the value, the more abnormal the sequence pattern; a sigmoid function is used to... Normalized to sequence anomalies between 0 and 1 : in, Steepness factor To determine the threshold; (2) Statistical anomaly analysis Calculate the current standardized statistical eigenvector. Multivariate Gaussian lines relative to user u Mahalanobis distance ; Mahalanobis distance takes into account the correlation between features and can more accurately measure the degree of deviation in multidimensional space; it transforms it into statistical outlier analysis. : in, It is the cumulative distribution function of a chi-square distribution with M degrees of freedom; (3) Contextual rules A lightweight rules engine runs in parallel, checking whether the current operation violates preset hard safety rules or context policies; each rule outputs a binary value or a score; the highest score among all triggered rules is taken as the [unclear]. ; Step S33: Comprehensive Risk Fusion and Alarm Generation A weighted geometric mean is used to fuse the three scores to reduce interference from single noise signals and highlight multi-dimensional joint anomalies. in, For configurable weights, satisfy , ; It is a very small positive number; Will With a dynamically adjusted global threshold Comparison; this threshold is fine-tuned based on the accuracy of recent alarms; If the risk is high, a structured risk alert event (Alert) will be generated immediately. The alert is pushed in real time to the dynamic authorization engine within the SDP control layer via a high-priority message queue.

10. The dynamic authorization method based on software-defined boundaries and user behavior baselines as described in claim 9, characterized in that, The dynamic authorization engine performs the following steps: Step S41, Strategy Decision The dynamic authorization engine internally maintains a definable policy decision matrix, which is an ordered set of "condition-action" rules. When a risk alert is received, the engine executes the following logic: Conditional matching: Matches the attributes in the Alert with the conditional components of each rule in the policy decision matrix; Action decision: After a successful match, the action set A corresponding to the rule is executed; the action set is a list of atomic control instructions; Decision Priority: Rules are arranged according to priority; when multiple rules are matched, the rule with the highest priority is executed. Step S42, Strategy Execution After the decision is generated, the dynamic authorization engine sends control commands to the policy enforcement points in the network through the management interface of the SDP control layer.

Images