GNN risk assessment-based system login permission accurate fusing system and method

Abstract

The invention relates to the technical field of crossing of information security and artificial intelligence, in particular to a system and method for accurately fusing system login permission based on GNN risk assessment, comprising the following steps: S1, constructing an initial permission topological graph comprising user nodes, token nodes and resource nodes, and setting risk weights for edges in the graph according to historical abnormal access behaviors; loading a plurality of sets of preset permission strategy libraries and preheating map neural network model parameters; s2, executing first-layer cryptographic signature verification of the token on the received access request to confirm the validity of the token; analyzing a session state identifier carried in the token after the signature verification is passed, and switching to a corresponding permission policy library at the current thread-level atom according to the identifier; according to the method, key technologies such as dynamic authority topology analysis based on the graph neural network, session-level real-time fusing and zero-copy auditing are introduced, so that millisecond-level accurate detection and isolation of the user access risk are realized.

Description

A system and method for precise circuit breaking of system login permissions based on GNN risk assessment. Technical Field

[0001] This invention relates to the field of information security and artificial intelligence, specifically to a system and method for precise circuit breaking of system login permissions based on GNN risk assessment. Background Technology

[0002] In a zero-trust architecture, the token carried by a user after logging in may represent a "not logged in", "logged in", or "privileged" state. Traditional systems cannot distinguish the token type in real time, making it difficult to isolate abnormal permission requests in a timely manner. At the same time, the high latency of audit log writing and the large CPU consumption slow down the overall throughput.

[0003] Existing technical solutions: a) Static RBAC: Permission rules are pre-configured, and permissions are fixed once the token is issued; b) Gateway-level circuit breaking: Circuit breaking is performed on the entire service based on threshold statistics (QPS, error rate), with coarse granularity; c) Traditional logging: Permission verification results are written to the audit database via gRPC or file IO, with an average latency of 200 ms+; Disadvantages and reasons for existing technical solutions: Lack of token semantic recognition: It is impossible to distinguish between "non-login" and "login" tokens, resulting in unauthorized access windows.

[0004] Static rules are outdated: After the attack path changes, the strategy needs to be updated manually, and the response time is measured in hours.

[0005] Logs drag down performance: Multiple memory copies and serializations lead to high CPU usage and a drop in system throughput of more than 20%. Summary of the Invention

[0006] The purpose of this invention is to address the problem in existing technologies where, under a zero-trust architecture, the token carried by a user after login may represent a "not logged in", "logged in", or "privileged" state. Traditional systems cannot distinguish the token type in real time, making it difficult to isolate abnormal permission requests in a timely manner. At the same time, the high latency of audit log writing and the large CPU consumption slow down the overall throughput.

[0007] To achieve the above objectives, the present invention provides the following technical solution: The present invention provides a method for precise circuit breaking of system login permissions based on GNN risk assessment, comprising the following steps: S1. Construct an initial permission topology graph containing user nodes, token nodes, and resource nodes, and set risk weights for edges in the graph based on historical abnormal access behavior; load multiple preset permission policy libraries and preheat graph neural network model parameters. S2. Perform first-level cryptographic verification on received access requests to confirm token validity; after successful verification, parse the session state identifier carried in the token and atomically switch to the corresponding permission policy library at the current thread level based on this identifier. S3. Write the user identifier, token identifier, and resource identifier corresponding to this access into the topology update stream, and use a graph neural network to perform risk scoring on the updated access path; when the risk score exceeds a preset threshold, issue a session-level circuit breaker command to the session management module to interrupt subsequent requests in the session. S4. Write the permission verification result into a memory-mapped log buffer, and push the result to the event bus through a zero-copy mechanism, where the event bus asynchronously writes it to the audit database in batches. S5. After a session is circuit-broken, place the corresponding token into a restricted access state, and periodically reassess its access path risk using a graph neural network; when the risk score is below a preset threshold, lift the circuit breaker restriction.

[0008] Furthermore, in step S1, an initial permission topology graph containing user nodes, token nodes, and resource nodes is constructed using user historical access records, and historical abnormal access behaviors are mapped to risk weights of edges in the graph.

[0009] Furthermore, in step S1, the initial input features of the graph neural network model are generated using the risk weights; at the same time, multiple sets of permission policy libraries corresponding to the unlogged-in state and the logged-in state are loaded respectively, and the graph neural network model is preheated with parameters to accelerate subsequent risk inference.

[0010] Furthermore, in step S2, after the gateway receives the access request, it uses a preset public key to verify the token based on the elliptic curve digital signature algorithm to confirm that the token has not been tampered with.

[0011] Furthermore, in step S2, if the signature verification is successful, the predefined session state identifier in the token is parsed, and the current thread is atomically switched to the permission policy library corresponding to the session state based on the identifier, so as to realize real-time identification of token type and millisecond-level dynamic adjustment of permission boundaries.

[0012] Furthermore, in step S3, the user identifier, token identifier, and resource identifier corresponding to the current access request are written into the update stream of the permission topology graph to establish a new access path or adjust the weight of an existing edge in the permission topology graph.

[0013] Furthermore, in step S4, following step S3, a risk score is performed on the updated access path based on the preheated graph neural network model. When the risk score exceeds a preset threshold, a session-level circuit breaker instruction is sent to the session management module to interrupt subsequent requests of the session.

[0014] Furthermore, in step S4, the permission verification result is encapsulated into structured log data, and the structured log data is written to a pre-allocated log buffer through memory mapping to avoid data copying between user mode and kernel mode; the ring buffer mechanism based on eBPF directly pushes the log data to the event bus, and the event bus asynchronously writes it to the audit database in batches.

[0015] Furthermore, in step S5, after an access session is determined to be abnormal and is circuit-broken, the token corresponding to the session is added to the restricted access observation bucket, so that it is only allowed to perform read-only operations during the observation period; and during the observation period, the risk score of the token access path is periodically recalculated using a graph neural network. When the risk score is lower than a preset threshold, the circuit-broken restriction on the token is automatically lifted and normal access is restored.

[0016] On the other hand, a system for precise circuit breaking of login permissions based on GNN risk assessment includes: a permission topology construction module: used to construct an initial permission topology graph composed of user nodes, token nodes, and resource nodes when the system starts, and to associate historical anomaly scores as edge weights in the graph, while loading pre-warmed graph neural network model parameters and multiple RBAC policy libraries; a two-layer token verification module: used to perform the first layer of ECDSA public key verification on the token to confirm the token's validity when an access request is received, and to parse the session state bits in the token to distinguish the token type, and to atomically switch the corresponding RBAC policy pointer locally based on the parsing result; a permission topology risk analysis module: used to map the currently accessing user, token, and resource to the update stream of the permission topology graph, and to use a graph neural network to perform forward propagation to calculate the risk score of the expanded access path, and to send a session-level circuit breaker instruction to the session manager when the risk score exceeds a preset risk threshold; and a zero-copy audit log module: used to write the permission verification result structure directly to the kernel-mode DMA buffer through memory mapping, and to pass it through an eBPF-based ring... The buffer's event bus performs asynchronous consumption and batch writing to the audit database to achieve low-latency audit log collection without kernel-mode or user-mode copying; the session circuit breaker recovery module is used to add the corresponding token to the restricted access observation bucket after a session is judged to be abnormal and restrict it to perform only read-only operations. During the observation period, it periodically uses a graph neural network to recalculate the risk score of the token's access path. When the risk score of multiple consecutive periods is lower than the preset threshold, the circuit breaker is automatically released and normal access is restored.

[0017] The beneficial effects of the technical solution provided by this invention, compared with known public technologies, are as follows: This invention, by introducing key technologies such as dynamic topology analysis of permissions based on graph neural networks, two-layer token semantic recognition, session-level real-time circuit breaking, and zero-copy auditing, achieves millisecond-level accurate detection and isolation of user access risks. Compared with traditional solutions based on static RBAC and service-level circuit breaking, this invention can distinguish the session state and dynamically adjust permission boundaries the moment a token enters the system, effectively eliminating unauthorized access windows; simultaneously, by real-time risk modeling of access paths, it achieves refined circuit breaking and intelligent self-healing for abnormal sessions, avoiding impact on normal user traffic. In terms of auditing, this invention constructs a copy-free log link through mmap and DMA passthrough, compressing log write latency to within 50 ms, reducing additional CPU usage by 40%, and significantly improving the system's throughput in high-concurrency scenarios. Overall, this invention achieves breakthroughs in security, performance, and availability, enabling the system's permission control to move from static configuration to a dynamic, intelligent, and low-overhead real-time risk control system. Attached Figure Description

[0018] Figure 1 is a flowchart of the method for precise circuit breaking of system login permissions based on GNN risk assessment according to the present invention; Figure 2 is a flowchart of the system for precise circuit breaking of system login permissions based on GNN risk assessment according to the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but includes other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] The present invention will be further described in detail below with reference to the accompanying drawings: Example: As shown in Figure 1, the method for precise circuit breaking of system login permissions based on GNN risk assessment of the present invention includes: S1, constructing an initial permission topology graph containing user nodes, token nodes, and resource nodes, setting risk weights for edges in the graph based on historical abnormal access behavior; and loading multiple preset permission policy libraries and preheating graph neural network model parameters. Further, in S1, S1.1: First, the access logs in the historical audit library are parsed, and three types of key entities are extracted: user nodes... Token Node Resource nodes Using three types of entities as node sets Using access relationships as edge sets Construct a tripartite graph , where each edge weight Used to indicate the risk level of a user or token accessing resources, the weight is determined by combining the frequency of historical abnormal events, using: ,in, For nodes Query nodes The overstepping of authority that occurred during this period To avoid smoothing parameters with a denominator of 0; S1.2: Construct a feature vector for each type of node: User node features It can include user roles, organizations, and distribution of frequently accessed resources; token node characteristics. It can include expiration time, issuer, and usage frequency; resource node characteristics: can include resource sensitivity level, call history, and access pattern; the overall feature matrix can be represented as: S1.3: GNN Model Warm-up: Load the pre-trained GNN model. A typical structure can be a message passing network based on GraphSAGE or GAT. The basic propagation formula is: ,in, For nodes Neighbors For edge weights, Nonlinear activation function For the first The layer trainable parameter warm-up process includes: loading model weights into memory; initializing the computation graph; preloading CPU / GPU computation tensors; performing an idle forward propagation to warm up the cache (ensuring real-time inference latency < 1 ms); loading multiple permission policy libraries, including: the unlogged-in policy library (baseline permissions) and the logged-in policy library (extended permissions, containing more resource mappings).

[0022] In this embodiment, the initialization phase transforms historical access permission data into a basic topology structure usable for graph neural networks. Specifically, the system first constructs an initial permission topology graph containing three types of nodes based on user identifiers, token identifiers, and resource identifiers appearing in historical audit records. Then, based on the frequency of historical abnormal access, risk alarms, or unauthorized events, the access relationships between nodes are mapped to directed edges with risk weights, where higher frequencies of abnormal behavior correspond to larger edge weights to reflect the potential risk level of the access link. After the graph structure is generated, permission policy libraries applicable to the logged-out and logged-in states are loaded respectively, so that policies can be quickly switched according to the session state of the token. At the same time, the system performs parameter preheating on the graph neural network model, including loading pre-trained weights, initializing the message passing layer, and activation functions, enabling the model to perform millisecond-level inference after receiving real-time topology data.

[0023] S3. Write the user identifier, token identifier, and resource identifier corresponding to this access into the topology update stream, and use a graph neural network to perform a risk score on the updated access path; when the risk score exceeds a preset threshold, send a session-level circuit breaker command to the session management module to interrupt subsequent requests in the session.

[0024] S2. Perform first-level cryptographic verification on the received access request to confirm the token's validity. After successful verification, parse the session state identifier carried in the token and atomically switch to the corresponding permission policy library at the current thread level based on this identifier. Further, in S2, S2.1: Use the Elliptic Curve Digital Signature Algorithm (ECDSA) as the token signing and verification mechanism. The token format includes a signature field: The signature verification process involves loading a pre-configured ECDSA public key from the internal cache. ;right of Calculate the hash value: Verify the signature using the public key: ,when Only when the next layer of verification is allowed; S2.2: Parse session state flags and atomically switch policy base: token A part contains a The session state identifier, with the 32nd bit defined as: 0: non-login state (baseline permissions); logged-in state (extended permissions); after token parsing, read: ,according to Value selection strategy library pointer: ; and perform atomic replacement using thread-local storage (TLS): In this embodiment, a two-layer token verification is performed upon receiving a user access request to simultaneously meet security and real-time requirements. First, the system uses asymmetric cryptography to verify the integrity and legitimate origin of the token. Specifically, the gateway uses a pre-configured ECDSA public key to perform a signature verification operation on the signature field in the token. Subsequent processing only continues if the signature verification is successful. After successful token verification, the session state identifier bit carried within the token is further parsed. This identifier bit distinguishes the session security level represented by the token, such as "not logged in" or "logged in." Based on this identifier bit, an atomic switch of the permission policy library is implemented directly in the current thread, enabling subsequent access permission verification to automatically reference the policy set corresponding to the token state. Since the switching operation is restricted to execution within the user-mode thread's local structure, the switching latency can be controlled within 0.1 ms.

[0025] S3. Write the user identifier, token identifier, and resource identifier corresponding to this access into the topology update stream, and use a graph neural network to perform a risk score on the updated access path; when the risk score exceeds a preset threshold, send a session-level circuit breaker command to the session management module to interrupt subsequent requests in the session; further, in S3, S3.1: The topology graph update stream writes triples generated based on the real-time received access requests: The triples are then written into the topology update stream; for each access action, the following update is performed in the permission graph: if the edge If the edge does not exist, create a new edge; if it exists, update the edge weight. The real-time weight update method for a given edge is as follows: ,in, The time decay coefficient, This indicates that the visit has been recorded; S3.2: GNN Risk Inference: Sample the local subgraph related to this visit, input it into the preheated GNN model to perform forward propagation, and the typical message passing formula is: The final risk score for the access path is: ,in, The range of values ​​is generally as follows: S3.3: Risk Threshold Determination and Session Circuit Breaker: Setting Security Thresholds: When the following conditions are met: The access link is then deemed abnormal, and a session circuit breaker is immediately triggered. The circuit breaker action includes: sending a session termination command to the session manager; and rejecting all subsequent requests for the session. The request writes the token to the "observation bucket," restricting access to read-only mode. The entire logic is completed within 1 ms, meeting the real-time requirements of high-concurrency zero-trust scenarios.

[0026] In this embodiment, after token verification is completed, real-time identification of access path risks is achieved through dynamic permission topology analysis. Specifically, the user identifier, token identifier, and resource identifier carried in the current access request are written into the topology graph update stream to update the node connection relationship of the permission topology. When a new access behavior is formed between a user or token and a resource, a corresponding access edge will be established in the topology graph and its risk weight will be updated. The updated topology graph is input into the preheated graph neural network model. The model performs forward propagation on the local subgraph containing the current access path to calculate the risk score of the access path. When the score is higher than a preset security threshold, it is determined that the session has a potential risk of unauthorized access or attack, and a circuit breaker command is immediately issued to the session management module, so that subsequent requests of the session are blocked in milliseconds. S4. The permission verification result is written to the log buffer configured by memory mapping, and the result is pushed to the event bus through a zero-copy mechanism, and the event bus asynchronously writes it to the audit database in batches. Further, in S4, S4.1: After performing permission verification, a structure is generated. ;based on Log buffer construction: Create a dedicated circular buffer for the log, allocate contiguous physical pages in kernel space, and then... Mapped to user space, enabling user space and kernel space to share a segment of physical memory: Completely avoid the following overheads: IO write; gRPC serialization; user space. Kernel-mode copy.

[0027] S4.2: The eBPF ring buffer pushes logs to the event bus: a. User space writes to the mmap region; b. The eBPF program listens for write pointer movement; c. The ring buffer pushes data to the event bus; d. The event bus batches writes to the audit library.

[0028] Performance analysis model: S4.3: The time cost of the traditional log path can be approximated as:

[0029] The zero-copy architecture of this technology is: ,in, (No cross-state copy) (The structure is written directly). (No gRPC) (Batch processing reduces the number of times) Actual test results: log write latency (35–50 ms), CPU saving of 40%+, and system throughput improvement of about 30%.

[0030] In this embodiment, a user-space accessible DMA pass-through buffer is created through memory mapping (mmap), allowing permission verification results to be directly written to the kernel shared area without undergoing multiple memory copies or serialization processes as in traditional logging schemes. Data written to the buffer is pushed to the event bus via an eBPF-based ring buffer mechanism. The event bus asynchronously consumes the logs and writes them to the audit database in batches, further reducing the number of database writes, increasing system throughput, reducing log write latency to 35–50 ms, and decreasing additional CPU usage by approximately 40%, significantly improving system performance under high concurrency environments.

[0031] S5. After a session is interrupted, the corresponding token is placed in a restricted access state, and its access path risk is periodically reassessed using a graph neural network; when the risk score is lower than a preset threshold, the circuit breaker restriction is lifted; further, S5.1: Session circuit breaker triggering and token bucketing: when the risk inference in S3 is obtained... Immediately trigger session circuit breaker and execute the following: block subsequent requests for the session and add the token to the "watch bucket"; the watch bucket is a restricted environment, and the token is forcibly bound to the least privilege policy within this range: S5.2: Observe each token in the bucket and set a periodic re-evaluation timer, for example, perform a re-evaluation every 30 seconds. During each re-evaluation, the system samples the latest access path of that token from the topology activity flow and constructs a local subgraph. And input the GNN to perform risk calculation: If we get: Then the risk is considered eliminated; S5.3: Automatic circuit breaker recovery mechanism: If N consecutive circuit breakers (e.g., 2) occur, the risk is considered eliminated. ~(3 assessments) Satisfy: Perform automatic recovery: a) Remove the token from the watch bucket; b) Restore the token to the normal policy library; c) Allow it to perform read and write operations; d) Record the recovery event to the audit log; S5.4: If the risk score continues to be higher than the threshold The system maintains the token in the watch bucket and performs the following actions: permission downgrade (such as further restricting the API scope), extending the watch period, increasing the monitoring weight of access frequency, and further reducing security risks.

[0032] In this embodiment, after detecting that the risk score of an access session exceeds a threshold and triggers a circuit breaker, the corresponding token is added to a controlled observation bucket. During the observation period, the system restricts the access capabilities of the token, allowing only read-only operations without side effects to ensure that potential attacks will not further impact system resources. The system recalculates the risk score of the access path corresponding to the token using a graph neural network model in a preheated state according to a preset evaluation cycle. If the risk score is consistently below the security threshold during continuous evaluations, the system considers that the access behavior of the token has returned to normal, and then automatically lifts the circuit breaker, removes it from the observation bucket, and restores its full permissions.

[0033] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for precise circuit breaking of system login permissions based on GNN risk assessment, characterized in that, Includes the following steps: S1. Construct an initial permission topology graph containing user nodes, token nodes, and resource nodes, and set risk weights for the edges in the graph based on historical abnormal access behavior. It loads multiple preset permission policy libraries and preheating graph neural network model parameters; S2, performs the first-level cryptographic verification of the token on the received access request to confirm the token's validity; After the signature verification is successful, the session state identifier carried in the token is parsed, and the corresponding permission policy library is atomically switched at the current thread level based on the identifier; S3, the user identifier, token identifier and resource identifier corresponding to this access are written into the topology update stream, and the risk score of the updated access path is performed using a graph neural network; When the risk score exceeds the preset threshold, a session-level circuit breaker command is sent to the session management module to interrupt subsequent requests in the session; S4, the permission verification result is written to the log buffer configured by memory mapping, and the result is pushed to the event bus through the zero-copy mechanism, and then asynchronously written to the audit database by the event bus in batches; S5. After a session is interrupted, the corresponding token is placed in a restricted access state, and its access path risk is periodically reassessed using a graph neural network; when the risk score is lower than a preset threshold, the circuit breaker restriction is lifted.

2. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 1, characterized in that, In step S1, an initial permission topology graph containing user nodes, token nodes, and resource nodes is constructed using user historical access records, and historical abnormal access behaviors are mapped to risk weights of edges in the graph.

3. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 2, characterized in that, In step S1, the initial input features of the graph neural network model are generated using the risk weights; at the same time, multiple permission policy libraries corresponding to the unlogged-in state and the logged-in state are loaded, and the graph neural network model is preheated with parameters to accelerate subsequent risk inference.

4. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 3, characterized in that, In step S2, after the gateway receives the access request, it uses a preset public key to verify the token using an elliptic curve digital signature algorithm to confirm that the token has not been tampered with.

5. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 4, characterized in that, In step S2, if the signature verification is successful, the predefined session state identifier in the token is parsed, and the current thread is atomically switched to the permission policy library corresponding to the session state based on the identifier, so as to realize real-time identification of token type and millisecond-level dynamic adjustment of permission boundaries.

6. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 5, characterized in that, In step S3, the user identifier, token identifier, and resource identifier corresponding to the current access request are written into the update stream of the permission topology graph to establish a new access path or adjust the weight of an existing edge in the permission topology graph.

7. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 6, characterized in that, In step S3, a risk score is performed on the updated access path based on the preheated graph neural network model. When the risk score exceeds a preset threshold, a session-level circuit breaker command is sent to the session management module to interrupt subsequent requests in the session.

8. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 7, characterized in that, In step S4, the permission verification result is encapsulated into structured log data, and the structured log data is written to a pre-allocated log buffer through memory mapping to avoid data copying between user mode and kernel mode; the eBPF-based ring buffer mechanism pushes the log data directly to the event bus, and the event bus asynchronously writes it to the audit database in batches.

9. The method for precise circuit breaking of system login permissions based on GNN risk assessment according to claim 8, characterized in that, In step S5, after an access session is determined to be abnormal and is circuit-broken, the token corresponding to the session is added to the restricted access observation bucket, so that it can only perform read-only operations during the observation period; and during the observation period, the risk score of the token access path is periodically recalculated using a graph neural network. When the risk score is lower than a preset threshold, the circuit-broken restriction on the token is automatically lifted and normal access is restored.

10. A system for precise circuit breaking of system login permissions based on GNN risk assessment, comprising the method for precise circuit breaking of system login permissions based on GNN risk assessment according to any one of claims 1-9, the system comprising: The permission topology construction module is used to build an initial permission topology graph consisting of user nodes, token nodes, and resource nodes when the system starts up. It associates the historical anomaly scores of the edges in the graph with the edge weights and loads the pre-warmed graph neural network model parameters and multiple RBAC policy libraries. The two-layer token verification module is used to perform the first layer of verification on the token based on the ECDSA public key to confirm the validity of the token when an access request is received. It also parses the session state bits in the token to distinguish the token type and switches the corresponding RBAC policy pointer atomically on the thread based on the parsing result. The Permission Topology Risk Analysis Module maps currently accessed users, tokens, and resources to the update flow of the permission topology graph. It uses a graph neural network to perform forward propagation to calculate risk scores on the expanded access paths. When the risk score exceeds a preset risk threshold, a session-level circuit breaker command is sent to the session manager. The Zero-Copy Audit Log Module writes the permission verification result structure directly to the kernel-mode DMA buffer via memory mapping. It then asynchronously consumes and batch-writes the logs to the audit database via an event bus based on the eBPF ring buffer, achieving low-latency audit log collection without kernel-mode or user-mode copying. The Session Circuit Breaker Recovery Module adds the corresponding token to a restricted access observation bucket after a session is deemed abnormal, restricting it to read-only operations. Within the observation period, it periodically recalculates the risk score of the token's access path using a graph neural network. When the risk score is below a preset threshold for multiple consecutive periods, the circuit breaker is automatically lifted, and normal access is restored.

Images