Dynamic fine-grained access control system and method based on user behavior analysis
By constructing a dynamic fine-grained access control system based on a graph convolutional neural network-based access control decision model and incremental learning algorithm, the system solves the problem of insufficient decision-making in complex environments of existing models, realizes precise authorization and adaptive access control, and improves the security and responsiveness of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XINJIANG UNIVERSITY
- Filing Date
- 2025-12-04
- Publication Date
- 2026-04-28
AI Technical Summary
Existing access control models perform poorly in complex environments, lack fine-grained decision-making mechanisms, cannot learn complex security policies autonomously, are slow and prone to errors when responding to new threat patterns and changes in business needs, and lack solutions for dealing with malicious behavior within the organization.
An access control decision model based on graph convolutional neural networks is adopted, which combines deep learning and incremental learning algorithms. A dynamic fine-grained access control system is constructed through user behavior analysis. The system integrates policy execution points, policy decision points, attribute databases and historical behavior databases to achieve intelligent decision-making and policy updates.
It achieves context-aware and precise authorization decisions, finer-grained access control, improved adaptability and security protection timeliness, reduces the workload of manually formulating and maintaining rules, and realizes the automation and intelligence of authorization.
Smart Images
Figure CN121935945A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, specifically to a dynamic fine-grained access control system and method based on user behavior analysis. Background Technology
[0002] Access control, as a core technology for ensuring information security, effectively manages access to resources and is crucial for protecting valuable assets and preventing unauthorized access. Faced with increasingly complex network environments, traditional access control models are gradually failing to meet administrators' needs. Using artificial intelligence to optimize access control models can enhance their versatility in complex scenarios. In existing technologies, attribute-based access control models offer some flexibility by introducing dynamic attributes, but their decision-making logic still relies on manually defined policy rules and cannot autonomously learn complex, implicit security policies from massive amounts of historical data. Furthermore, when new threat patterns emerge or business requirements change, traditional models require administrators to manually update the policy database, resulting in slow response times and a high risk of errors.
[0003] Currently, researchers have proposed using access request metadata to train AI models, enabling them to make autonomous access decisions. While these models demonstrate advantages in generalization and accuracy in areas such as precise authorization and prediction of the legitimacy of access behavior, they still face many challenges in practical applications. Training with metadata primarily composed of static attributes results in poor model performance in complex environments. Furthermore, existing models lack fine-grained decision-making mechanisms based on user behavior. Regarding the problem of malicious individuals within an organization abusing their access privileges to the organization's internal networks, systems, and data to carry out malicious actions, the models lack learning capabilities and coping strategies.
[0004] Therefore, designing a more widely applicable computable access control model has certain practical value in promoting the application of automated decision-making models. Summary of the Invention
[0005] In view of the problems existing in the prior art, the present invention discloses a dynamic fine-grained access control system based on user behavior analysis, comprising: Policy execution point: Used to receive access requests initiated by users, extract features from the access requests, integrate the extracted request features, user and object attributes obtained from the attribute database, and user historical behavior features obtained from the historical behavior database, and send them to the policy decision point; also used to receive and execute the authorization decision returned by the policy decision point, and update the current user operation record to the historical behavior database; Policy Decision Point: Connected to the policy execution point and the access control decision engine, it receives integrated feature information sent by the policy execution point, calls the access control decision engine to make a decision, and returns the decision result returned by the access control decision engine as an authorization decision to the policy execution point. Attribute database: Used to store relevant attributes of users and objects; Historical Behavior Database: Used to store users' historical behavior data. The historical behavior data is aggregated based on a time window mechanism to form statistical characteristics including access frequency, operation type distribution, environment type, and success rate. A deep learning-based access control decision engine is integrated within or connected to the policy decision point. It is used to make intelligent decisions based on received feature information through a pre-trained deep learning model and output authorization results.
[0006] As a preferred embodiment of the present invention, the access control decision engine based on deep learning adopts a graph convolutional neural network-based access decision model, which embeds the access control list into Euclidean space for representation and learning.
[0007] As a preferred embodiment of the present invention, the construction of the access decision model based on graph convolutional neural networks includes the following steps: Step 1: Construct a four-layer graph structure model based on the access request metadata, containing user nodes, resource nodes, dynamic nodes, and user history nodes. Let the graph be G = (V, E), where V = {v1, v2, ..., v...} N Let} be the set of nodes, and N be the number of nodes; Let be the set of edges, representing the relationships between nodes; Adjacency matrix A∈R N×N If node v i With v j If connected, then A ij =1, otherwise 0, used to describe the connection relationship between nodes; The construction of user history nodes is based on a time window mechanism, creating a historical record node for each user's access behavior; Step 2: Construct the Laplacian matrix between graph nodes, including four edge types: user-environment, environment-resource, user-history, and history-environment. To better suit subsequent convolution operations, a regularized Laplacian matrix needs to be constructed so that the sum of the elements in each row is 0. The formula is as follows: L norm =ID -1 / 2 AD -1 / 2 ; Where I is the identity matrix, with diagonal elements all equal to 1 and all other elements equal to 0. D is the degree matrix, a diagonal matrix, where the diagonal elements represent the degree of the corresponding node (the number of edges connected to the node, or the sum of edge weights). A is the adjacency matrix, A∈R. N×N (N is the number of nodes), if node v i With v j If connected, then A ij =1 (or edge weight), otherwise 0, used to describe the connection relationship between nodes. Step 3: Construct a graph convolutional neural network based on heterogeneous graph data. The neural network consists of 3 graph convolutional layers, each of which processes information propagation at different granularities. The first graph convolutional layer maps the original features of the four heterogeneous nodes to a unified feature space. This layer does not perform message passing, but only standardizes the feature dimensions. The standardization method is as follows: Where, x i Let represent the original features of node i, i.e., the heterogeneous input, and γ and β be learnable scaling / offset parameters. μ is the output feature of node i after being normalized by the first graph convolutional layer. i Let be the mean of the original features of node i. Let be the variance of the original features of node i, and ∈: is the minimum value (usually close to 0), used to avoid the case where the denominator is 0, and to ensure the stability of the calculation. The second graph convolutional layer aggregates neighbor information and expands the feature dimension; the aggregation function uses an attention mechanism for weighted summation, the information transmission uses adjacency matrix normalization, and the edge weights are adjusted through learnable attention weights. in, Let N(i) be the output feature of node i after aggregating neighbor information through the second graph convolutional layer, and ReLU() be the activation function used to introduce non-linearity and enhance the model's expressive power. Let N(i) be the set of neighbor nodes of node i, and α be the value of N(i). ij These are learnable attention weights used to adjust the importance of the edge between node i and node j. The elements of the normalized adjacency matrix, W, are used to normalize the weights for information transmission. (2) This is the learnable weight matrix for the second graph convolutional layer, used for feature dimension transformation and information extraction. This represents the output feature of node j after passing through the first graph convolutional layer. The third graph convolutional layer integrates global information, maintaining the feature space while transmitting information between nodes; user nodes ultimately fuse historical and environmental information, as well as indirectly connected resource information; environmental nodes integrate the access patterns of user groups and the attribute distribution of resource sets; each layer is followed by a ReLU activation function and a Dropout layer to prevent overfitting. Concat() represents the feature concatenation operation. Final output features.
[0008] As a preferred embodiment of the present invention, the access control decision engine supports the use of incremental learning algorithms to update the deep learning model in order to achieve dynamic management of access policies.
[0009] As a preferred embodiment of the present invention, the incremental learning algorithm updates the deep learning model by using an incremental classifier and representation learning, i.e., iCaRL, to achieve local updates of the graph structure. For the old class, iCaRL selects the representative sample that is closest to the mean of each class; while for the new class, iCaRL adopts a sequential selection strategy. To prevent data skew and overfitting, the overall training loss function is expressed as follows: Where l(Θ) is the overall training loss function of the model, and Θ is the set of model parameters. D is a fixed number of training samples, consisting of selected new class samples and old class samples. i Let y be the i-th sample in the training set (e.g., feature data related to access requests). i Let be the true label of the i-th sample (the result of the access decision). s is the number of categories in the old class (the categories that have been trained). t is the number of categories in the new class (the currently added training categories). As an indicator function, when y = y i The value is 1 when it is active, otherwise it is not active. Similarly, when y≠y i The value is 1 if the condition is met, and 0 otherwise. y (x i ) is the classification pair of samples x i The predicted probability of belonging to category y. To classify samples x in the old class y before training iThe predicted probability is used to regularize old class knowledge and reduce forgetting. The first term in the equation is the cross-entropy loss function for selecting samples from the new class, where represents the new class of the current task, is the indicator function, and is the predicted probability of the classifier for the sample. The second term in the equation represents the old class regularization loss, where represents the old class, and is the predicted probability of the classifier selecting samples from the old class before training. The expression for the classifier selected by iCaRL is: in, Let y be the prototype of the y-th class in the space. This represents the sample embedding extracted by the feature extraction network; Calculate the k-hop neighbor subgraph of the user and resource nodes involved in the new sample, and perform incremental gradient updates on the nodes and edges in the subgraph.
[0010] In this model, "user" refers to any entity attempting to access a resource, including but not limited to users, processes, or services. "Object" refers to the resource that the user attempts to access; it is the object that receives the access request, such as a file, database, or network service.
[0011] A dynamic fine-grained access control method based on user behavior analysis, applied to the above-mentioned system, includes the following steps: Step S1: The policy enforcement point receives the access request initiated by the user; Step S2: The strategy execution point extracts features from the access request, extracts relevant user and object attributes from the attribute database, extracts user historical behavior features aggregated based on time windows from the historical behavior database, and integrates request features, user and object attributes, and user historical behavior features. Step S3: The strategy execution point sends the integrated feature information to the strategy decision point; Step S4: The policy decision point calls the deep learning-based access control decision engine. The engine makes intelligent decisions based on the integrated feature information and a pre-trained deep learning model, and returns the decision results to the policy decision point. Step S5: The policy decision point forms a final decision based on the authorization decision result and sends it to the policy execution point; Step S6: The strategy execution point executes the final decision and updates the user operation behavior record to the historical behavior database; Step S7: The administrator combines access records and uses incremental learning to dynamically update the access control decision engine.
[0012] As a preferred embodiment of the present invention, step S2, which involves feature extraction of the access request, includes the following steps: a: Data acquisition and preprocessing: The collection and organization of access records are achieved through multi-source sensors, device interfaces and data analysis technologies. The data is then denoised and standardized according to semantic features and actual needs. b: Treating access requests in the metadata as instances, select user, resource, and dynamic behavior features from the sample respectively. Then, use the chi-square test as a feature selection tool to screen out features with high influence on access control decisions, and construct an M-dimensional feature space X = R. M The access decisions are treated as a set of output labels, which together form the label space Y = {y1, y2, ..., y...} L The formula for the chi-square test is as follows: Where obs is the observed frequency and exp is the expected frequency; c: To address the balance of the access control dataset, the Borderline-SMOTE algorithm was first used to augment the minority class samples in the dataset, and then the Tomek Links algorithm was used to clean the dataset.
[0013] The beneficial effects of this invention are as follows: This invention's access control decision model, based on graph convolutional networks, incorporates real-time and historical user behavior into the graph model, enabling decisions to reflect dynamic changes in access patterns and achieving true context-aware access control. Leveraging the inherent ability of graph structures to represent complex relationships, and combined with multi-label classification, it can simultaneously make accurate authorization decisions for multiple access operations, resulting in finer-grained access control. By automatically learning access policies from data through a deep learning model, the workload of manually formulating and maintaining rules is reduced, achieving automation and intelligence in authorization. Based on representing heterogeneous access control rules with a unified semantic representation, incremental learning enables the access control model itself to update policies, greatly improving the system's adaptability and the timeliness of security protection. Attached Figure Description
[0014] Figure 1 This is a flowchart of the system access request processing and decision-making process of the present invention;
[0015] Figure 2 This is a diagram showing the overall structure of the access control decision engine of the present invention.
[0016] Figure 3 This is a diagram illustrating the overall system architecture in an embodiment of the present invention.
[0017] Figure 4 This is a diagram illustrating the access request feature extraction architecture in an embodiment of the present invention.
[0018] Figure 5 This is a user behavior feature evaluation architecture diagram in an embodiment of the present invention;
[0019] Figure 6 The diagram below shows the structure of the convolutional neural network algorithm in an embodiment of the present invention.
[0020] Figure 7 This is the timing diagram for the control system of the present invention. Detailed Implementation
[0021] Example 1
[0022] The following description is intended to explain the invention and should not be construed as limiting the scope of protection of the invention.
[0023] like Figures 1 to 7 As shown, this invention is a dynamic fine-grained access control system based on user behavior analysis, and the specific implementation process is as follows:
[0024] I. Data Acquisition and Preprocessing
[0025] 1.1. Access records are collected and organized using multi-source sensors, device interfaces, and data analysis techniques. The data is then denoised and standardized based on semantic features and actual needs.
[0026] II. Building the Dataset
[0027] 2.1 Treating access requests in metadata as instances, select user, resource, and dynamic behavior features from the sample. Then, use the chi-square test as a feature selection tool to filter out features with high impact on access control decisions, constructing an M-dimensional feature space X = R. M The access decisions are treated as a set of output labels, collectively forming the label space Y = {y1, y2, ..., y...}. L The model's task is to learn multiple sets of feature spaces from the training data, representing access requests to access operations. The mapping between access requests and each operation is stored in the model and dynamically updated.
[0028] 2.2 Addressing the Balance of Access Control Datasets: This study uses the Amazon access control dataset as the model training sample. However, in the real-world access control field, real datasets often suffer from data imbalance and an excessive number of features, especially in access control decision-making. This invention first employs the Borderline-SMOTE algorithm to augment the minority class samples in the dataset, and then uses the Tomek Links algorithm to clean the dataset. These preprocessing measures optimize the structure and balance of the dataset, freeing the model training from the limitations of imbalanced data, enabling more comprehensive learning and improved accuracy in identifying the minority class.
[0029] III. Feature Extraction and Selection
[0030] Following the core principles of "least privilege," "dynamic adaptation," and "compliance first" in the NIST security standards, and referencing the classic research framework of feature selection in existing ABAC (attribute-based access control) models, this paper constructs a feature selection scheme from three fundamental dimensions: user, resource, and environment, thereby building a dynamic, fine-grained access control system. Based on this, a user behavior feature database is creatively integrated with real-time user operation behavior and dynamic access scenario characteristics. Using behavioral characteristics such as user operation type, access frequency, and permission invocation preferences, more detailed data support is provided for fine-grained permission decisions.
[0031] In the precise selection of specific features across various dimensions, considering that ABAC model features are mostly discrete enumerated attributes (such as security level, permission level, network type, etc.), and that the correlation between features and permission decision results (allow / deny access) needs to be quantified, the chi-square test is adopted as the core selection method. By verifying the independence between feature variables and decision target variables, and quantifying the contribution of features to permission judgment, irrelevant features and redundant information can be effectively eliminated, and key features with strong representativeness and high discriminative power can be selected. The basic idea of the chi-square test is to compare the difference between the observed frequency and the expected frequency. In the context of feature selection, it is used to determine whether a feature and the label class are independent. For each feature, its chi-square statistic with the label class is calculated. The formula is as follows: Where obs is the observed frequency and exp is the expected frequency.
[0032] IV. Constructing an Access Decision Model
[0033] This system proposes an access decision model based on knowledge graphs, graph convolutional neural networks, and multi-task classification. This model can extract user features, user behavior features, and environmental features from the metadata of access requests to determine the matching degree between the access request and the access operation. The specific implementation steps are as follows:
[0034] 4.1 A four-layer graph structure model containing user nodes, resource nodes, dynamic nodes, and user history nodes is constructed based on the access request metadata. The specific implementation method is as follows: Let the graph be G = (V, E), where V = {v1, v2, ..., v}. N} is a set of nodes (N is the number of nodes). This is the set of edges (representing the relationships between nodes). Adjacency matrix A∈R N×N If node v i With v j If connected, then A ij=1 (or edge weight), otherwise 0, used to describe the connection relationship between nodes. The construction of user history nodes is based on a time window mechanism, creating a historical record node for each user's access behavior. The system divides time into hourly time windows, and user behavior within each time window is aggregated into a history node. The history node includes statistical characteristics such as the number of accesses, the distribution of operation types, the access environment type, and the success rate within that time period. Since the raw data lacks time information, this system achieves this by randomly generating timestamps that conform to the actual distribution based on the user-resource pair access patterns.
[0035] 4.2 Construct the Laplacian matrix between graph nodes. This includes four edge types: user-environment, environment-resource, user-history, and history-environment. The difference between the degree matrix and the adjacency matrix quantifies the "difference" between nodes. Closer connections between nodes have smaller element values. To better suit subsequent convolution operations, a regularized Laplacian matrix needs to be constructed, ensuring the sum of elements in each row is 0. The specific formula is as follows: L norm =ID -1 / 2 AD -1 / 2
[0036] 4.3 Constructing a graph convolutional neural network based on heterogeneous graph data. The neural network consists of three graph convolutional layers, each handling information propagation at different granularities. The first graph convolutional layer maps the original features of the four heterogeneous nodes to a unified feature space. This layer does not perform message passing; it only standardizes the feature dimensions. The standardization method is as follows: Where, x i Let be the original features of node i (heterogeneous input), and γ and β be learnable scaling / offset parameters. This is the output feature after standardization. The second graph convolutional layer aggregates neighbor information, expanding the feature dimension. The aggregation function uses an attention mechanism for weighted summation, and information transmission is achieved through adjacency matrix normalization. Edge weights are adjusted using learnable attention weights. in, These are learnable attention weights used to adjust edge importance, and the aggregated weights output features. The third graph convolutional layer integrates global information, maintaining the feature space while facilitating information transfer between nodes. User nodes ultimately fuse historical and environmental information, as well as indirectly connected resource information. Environmental nodes integrate user group access patterns and resource set attribute distributions. Each layer is followed by a ReLU activation function and a Dropout layer to prevent overfitting. Concat() represents the feature concatenation operation. Final output features.
[0037] V. Strategy Management Module Design
[0038] The incremental learning module supports receiving online feedback from administrators on permission decisions and dynamically updating model parameters. When a new access request arrives, the system uses the current graph convolutional model to predict the access decision and provides the result to the administrator as a suggestion. Each administrator decision is recorded as a new training sample, containing user ID, resource ID, environment ID, four permission tags, and a decision timestamp, thereby enabling the creation, maintenance, and deletion of access policies.
[0039] This invention employs Incremental Classifier and Representation Learning (iCaRL) to achieve local updates of the graph structure, fine-tuning parameters only in the neighborhoods of affected nodes. For old classes, iCaRL selects representative samples closest to the mean of each class; for new classes, the iCaRL algorithm uses a sequential selection strategy. Furthermore, the algorithm strictly controls the total number of selected samples and class balance to prevent data skew and overfitting. The overall training loss function is expressed as follows:
[0040] Where D is a fixed number of training samples, consisting of selected new class samples and old class samples. The first term in the equation is the cross-entropy loss function for the new class samples, where represents the new class of the current task, is the indicator function, and represents the predicted probability of the classifier for the sample. The second term in the equation represents the old class regularization loss, where represents the old class, and is the predicted probability of the classifier for the old class samples before training. The expression for the classifier selected by iCaRL is: in, Let y be the prototype of the y-th class in the space. This represents the sample embedding extracted by the feature extraction network. The iCaRL algorithm uses representative old class samples for knowledge distillation, thereby reducing the model's forgetting of old class knowledge.
[0041] Calculate the k-hop neighbor subgraph of the user and resource nodes involved in the new sample, and perform incremental gradient updates on the nodes and edges within the subgraph. Simultaneously, maintain a fixed-capacity experience replay buffer storing 1000 key historical decision samples. During incremental updates, these samples are jointly trained with the new samples. Regularization terms constrain the magnitude of model parameter changes to avoid catastrophic forgetting.
[0042] The parts not described in detail in this article are existing technologies.
[0043] While the specific embodiments of the present invention have been described in detail above, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention, and modifications or variations without creative effort are still within the protection scope of the present invention.
Claims
1. A dynamic fine-grained access control system based on user behavior analysis, characterized in that, include: Policy Enforcement Point (PEP), Policy Decision Point (PDP), attribute database, historical behavior database, and deep learning-based access control decision engine; The Policy Execution Point (PEP) is used to receive access requests initiated by users, extract features from the access requests, integrate the extracted request features, user and object attributes obtained from the attribute database, and user historical behavior features obtained from the historical behavior database, and send them to the Policy Decision Point (PDP); it is also used to receive and execute the authorization decision returned by the Policy Decision Point (PDP), and update the current user operation record to the historical behavior database. The Policy Decision Point (PDP) is connected to the Policy Execution Point (PEP) and the Access Control Decision Engine. It is used to receive the integrated feature information sent by the Policy Execution Point (PEP), call the Access Control Decision Engine to make a decision, and return the decision result returned by the Access Control Decision Engine as an authorization decision to the Policy Execution Point (PEP). The attribute database is used to store relevant attributes of users and objects. The historical behavior database is used to store users' historical behavior data. The historical behavior data is aggregated based on a time window mechanism to form statistical features including access frequency, operation type distribution, environment type, and success rate. The deep learning-based access control decision engine is integrated within or connected to the policy decision point (PDP) and is used to make intelligent decisions based on received feature information through a pre-trained deep learning model, and output authorization results.
2. The dynamic fine-grained access control system based on user behavior analysis according to claim 1, characterized in that: The deep learning-based access control decision engine uses a graph convolutional neural network-based access decision model.
3. The dynamic fine-grained access control system based on user behavior analysis according to claim 2, characterized in that: The construction of the access decision model based on graph convolutional neural networks includes the following steps: Step 1: Construct a four-layer graph structure model based on the access request metadata, containing user nodes, resource nodes, dynamic nodes, and user history nodes. Let the graph be G = (V, E), where V = {v1, v2, ..., v...} N Let} be the set of nodes, and N be the number of nodes; Let be the set of edges, representing the relationships between nodes; Adjacency matrix A∈R N×N If node v i With v j If connected, then A ij =1, otherwise 0, used to describe the connection relationship between nodes; The construction of user history nodes is based on a time window mechanism, creating a historical record node for each user's access behavior; Step 2: Construct the Laplacian matrix between graph nodes, including four edge types: user-environment, environment-resource, user-history, and history-environment. To better suit subsequent convolution operations, a regularized Laplacian matrix needs to be constructed so that the sum of the elements in each row is 0, as shown in the following formula: L norm =I-D -1 / 2 AD -1 / 2 ; Step 3: Construct a graph convolutional neural network based on heterogeneous graph data. The neural network consists of 3 graph convolutional layers, each of which processes information propagation at different granularities. The first graph convolutional layer maps the original features of the four heterogeneous nodes to a unified feature space. This layer does not perform message passing, but only standardizes the feature dimensions. The standardization method is as follows: Where, x i Let represent the original features of node i, i.e., the heterogeneous input, and γ and β be learnable scaling / offset parameters. The output features are standardized. The second graph convolutional layer aggregates neighbor information and expands the feature dimension; the aggregation function uses an attention mechanism for weighted summation, the information transmission uses adjacency matrix normalization, and the edge weights are adjusted through learnable attention weights. in, These are learnable attention weights used to adjust edge importance, and the aggregated weights output features. The third graph convolutional layer integrates global information, maintaining the feature space while transmitting information between nodes; user nodes ultimately fuse historical and environmental information, as well as indirectly connected resource information; environmental nodes integrate the access patterns of user groups and the attribute distribution of resource sets; each layer is followed by a ReLU activation function and a Dropout layer to prevent overfitting. Concat() represents the feature concatenation operation. Final output features.
4. The dynamic fine-grained access control system based on user behavior analysis according to claim 2, characterized in that: The access decision model of the graph convolutional neural network embeds access control lists (ACLs) into Euclidean space for representation and learning.
5. A dynamic fine-grained access control system based on user behavior analysis according to claim 1, characterized in that: The access control decision engine supports the use of incremental learning algorithms to update the deep learning model, thereby enabling dynamic management of access policies.
6. A dynamic fine-grained access control system based on user behavior analysis according to claim 5, characterized in that: The incremental learning algorithm updates the deep learning model by using an incremental classifier and representation learning, i.e., iCaRL, to achieve local updates of the graph structure. For the old class, iCaRL selects the representative sample that is closest to the mean of each class; while for the new class, iCaRL adopts a sequential selection strategy. To prevent data skew and overfitting, the overall training loss function is expressed as follows: Where D is a fixed number of training samples, consisting of selected new class samples and old class samples. The first term in the equation is the cross-entropy loss function for the new class samples, where represents the new class of the current task, is the indicator function, and represents the predicted probability of the classifier for the sample. The second term in the equation represents the old class regularization loss, where represents the old class, and is the predicted probability of the classifier for the old class samples before training. The expression for the classifier selected by iCaRL is: in, Let y be the prototype of the y-th class in the space. This represents the sample embedding extracted by the feature extraction network; it calculates the k-hop neighbor subgraph of the user and resource nodes involved in the new sample, and performs incremental gradient updates on the nodes and edges in the subgraph.
7. A dynamic fine-grained access control method based on user behavior analysis according to any one of claims 1-6, characterized in that, The steps include the following: Step S1: The Policy Enforcement Point (PEP) receives the access request initiated by the user; Step S2: The Policy Execution Point (PEP) extracts features from the access request, extracts relevant user and object attributes from the attribute database, extracts user historical behavior features aggregated based on time windows from the historical behavior database, and integrates the request features, user and object attributes, and user historical behavior features. Step S3: The Policy Execution Point (PEP) sends the integrated feature information to the Policy Decision Point (PDP); Step S4: The Policy Decision Point (PDP) calls the deep learning-based access control decision engine. The engine makes intelligent decisions based on the integrated feature information and a pre-trained deep learning model, and returns the decision results to the Policy Decision Point (PDP). Step S5: The Policy Decision Point (PDP) forms a final decision based on the authorization decision result and sends it to the Policy Execution Point (PEP); Step S6: The Policy Execution Point (PEP) executes the final decision and updates the user operation behavior record to the historical behavior database; Step S7: The administrator combines access records and uses incremental learning to dynamically update the access control decision engine.
8. A dynamic fine-grained access control method based on user behavior analysis according to claim 7, characterized in that, Step S2 involves feature extraction of the access request, including the following steps: a: Data acquisition and preprocessing: The collection and organization of access records are achieved through multi-source sensors, device interfaces and data analysis technologies. The data is then denoised and standardized according to semantic features and actual needs. b: Treating access requests in the metadata as instances, we select user, resource, and dynamic behavior features from the sample. Then, we use the chi-square test as a feature selection tool to filter out features that have a high impact on access control decisions, constructing an M-dimensional feature space X = R. M The access decisions are treated as a set of output labels, which together form the label space Y = {y1, y2, ..., y...} L The formula for the chi-square test is as follows: Where obs is the observed frequency and exp is the expected frequency; c: To address the balance of the access control dataset, the Borderline-SMOTE algorithm was first used to augment the minority class samples in the dataset, and then the Tomek Links algorithm was used to clean the dataset.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the dynamic fine-grained access control method based on user behavior analysis as described in claims 7-8.