Access data control method, apparatus, device, medium, and program product

Abstract

This disclosure provides an access data control method. It can be applied to the fields of artificial intelligence, big data, and the application of large models in information security and fintech. The method includes: inputting acquired text data into a pre-trained natural language model to output a first risk score and a first risk label; inputting acquired image data into a pre-trained visual neural network model to output a second risk score and a second risk label; acquiring behavioral data from the target access data, inputting the behavioral data into a pre-trained temporal neural network model to output a third risk score and a third risk label; generating a target risk score through weighted calculation, and selecting a target risk label through label filtering; and generating a target access control strategy based on the target risk score and target risk label to control the target access data. This disclosure also provides an access data control device, apparatus, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the fields of big data technology and artificial intelligence technology, specifically to the application of big data models in information security and fintech, and particularly to a method, apparatus, device, medium, and program product for accessing data control. Background Technology

[0002] With the rapid development of the data economy, enterprises, including banks, are increasingly demanding data security. Currently, cybersecurity threats are exhibiting unprecedented complexity and intelligence, making traditional static defense methods insufficient to counter attack methods such as visual spoofing, semantic obfuscation injection, and zero-day exploitation. Summary of the Invention

[0003] In view of the above problems, this disclosure provides an access data control method, apparatus, device, medium and program product.

[0004] According to a first aspect of this disclosure, an access data control method is provided, the method comprising: acquiring text data from target access data; inputting the text data into a pre-trained natural language model to output a first risk score and a first risk labels, wherein a is greater than 0 and a is an integer; acquiring image data from the target access data; inputting the image data into a pre-trained visual neural network model to output a second risk score and b second risk labels, wherein b is greater than 0 and b is an integer; acquiring behavioral data from the target access data; inputting the behavioral data into a pre-trained temporal neural network model to output a third risk score and c third risk labels, wherein c is greater than 0 and c is an integer; performing a weighted calculation on the first risk score, the second risk score, and the third risk score to generate a target risk score; selecting d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels, wherein d is greater than 0, d is less than the sum of a, b, and c, and d is an integer; and generating a target access control strategy based on the target risk score and the d target risk labels to control the target access data.

[0005] According to an embodiment of this disclosure, obtaining text data from target access data, inputting the text data into a pre-trained natural language model, and outputting a first risk score and a first risk labels includes: obtaining request method information, request path information, request header information, and identity credential information from the target access data as the text data; performing de-identification processing on the text data to generate de-identified text data; performing invalid character filtering processing on the de-identified text data to generate filtered text data; performing lightweight processing on the filtered text data to generate lightweight structured data; and inputting the lightweight structured data into a pre-trained natural language model to output a first risk score and a first risk labels.

[0006] According to an embodiment of this disclosure, obtaining image data from target access data, inputting the image data into a pre-trained visual neural network model, and outputting a second risk score and b second risk labels includes: obtaining webpage snapshots, CAPTCHA images, and user-uploaded images from the target access data as the image data; unifying the resolution of the image data to generate image data with uniform resolution; performing grayscale normalization processing on the image data with uniform resolution to generate normalized image data; and inputting the normalized image data into a pre-trained visual neural network model to output a second risk score and b second risk labels.

[0007] According to an embodiment of this disclosure, acquiring behavioral data from target access data, inputting the behavioral data into a pre-trained temporal neural network model, and outputting a third risk score and c third risk labels includes: acquiring access frequency data, fingerprint feature data, and geographical location information from the target access data as the behavioral data; performing time-series transformation on the behavioral data to generate time-series data; extracting features from the time-series data to generate time-series feature data; and inputting the time-series feature data into a pre-trained temporal neural network model to output a third risk score and c third risk labels.

[0008] According to an embodiment of this disclosure, a target risk score is generated by weighting the first risk score, the second risk score, and the third risk score. This includes: presetting a first weight for the first risk score, a second weight for the second risk score, and a third weight for the third risk score; calculating the product of the first risk score and the first weight to generate a first correlation value; calculating the product of the second risk score and the second weight to generate a second correlation value; calculating the product of the third risk score and the third weight to generate a third correlation value; and calculating the sum of the first correlation value, the second correlation value, and the third correlation value to generate the target risk score.

[0009] According to an embodiment of this disclosure, selecting d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels includes: obtaining a first association value; if the first association value is greater than a preset risk threshold, then selecting the a first risk labels as a first candidate labels; obtaining a second association value; if the second association value is greater than the preset risk threshold, then selecting the b second risk labels as b second candidate labels; obtaining a third association value; if the third association value is greater than the preset risk threshold, then selecting the c third risk labels as c third candidate labels; and combining the a first candidate labels, the b second candidate labels, and the c third candidate labels to generate d target risk labels.

[0010] According to an embodiment of this disclosure, a target access control policy is generated based on the target risk score and the d target risk labels, including: pre-setting e first access control policies, wherein each first access control policy corresponds to at least one of the first risk label, the second risk label, and the third risk label, wherein e is greater than 0, e is less than the sum of a, b, and c, and e is an integer; obtaining f second access control policies corresponding to the target risk label from the e first access control policies, wherein f is greater than 0, f is less than e, and f is an integer; pre-setting n risk score ranges, wherein each risk score range corresponds to a pre-set access handling action, wherein n is greater than 0, and n is an integer; obtaining the pre-set access handling action corresponding to the target risk score from the risk score ranges of the n policy levels, as the target access handling action; and merging the target access handling action and the f second access control policies to generate the target access control policy.

[0011] According to a second aspect of this disclosure, an access data control device is provided, comprising: a first acquisition module, configured to acquire text data from target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, wherein a is greater than 0 and a is an integer; a second acquisition module, configured to acquire image data from the target access data, input the image data into a pre-trained visual neural network model, and output a second risk score and b second risk labels, wherein b is greater than 0 and b is an integer; and a third acquisition module, configured to acquire behavioral data from the target access data, input the behavioral data into a pre-trained temporal neural network model. The network model outputs a third risk score and c third risk labels, where c is greater than 0 and is an integer; a first calculation module is used to perform weighted calculation on the first risk score, the second risk score, and the third risk score to generate a target risk score; a first filtering module is used to filter out d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels, where d is greater than 0, d is less than the sum of a, b, and c, and d is an integer; and a first generation module is used to generate a target access control policy based on the target risk score and the d target risk labels to control the target access data.

[0012] According to an embodiment of this disclosure, the first acquisition module includes: a fourth acquisition module, used to acquire request method information, request path information, request header information, and identity credential information from the target access data as the text data; a second generation module, used to perform desensitization processing on the text data to generate desensitized text data; a third generation module, used to perform invalid character filtering processing on the desensitized text data to generate filtered text data; a fourth generation module, used to perform lightweight processing on the filtered text data to generate lightweight structured data; and a fifth generation module, used to input the lightweight structured data into a pre-trained natural language model and output a first risk score and a first risk labels.

[0013] According to an embodiment of this disclosure, the second acquisition module includes: a fifth acquisition module, used to acquire a webpage snapshot, a verification code image, and a user-uploaded image from the target access data as the image data; a sixth generation module, used to unify the resolution of the image data to generate image data with a uniform resolution; a seventh generation module, used to perform grayscale normalization processing on the image data with a uniform resolution to generate normalized image data; and an eighth generation module, used to input the normalized image data into a pre-trained visual neural network model to output a second risk score and b second risk labels.

[0014] According to an embodiment of this disclosure, the third acquisition module includes: a sixth acquisition module, used to acquire access frequency data, fingerprint feature data, and geographical location information from the target access data as the behavioral data; a ninth generation module, used to perform time-series transformation on the behavioral data to generate time-series data; a tenth generation module, used to extract features from the time-series data to generate time-series feature data; and an eleventh generation module, used to input the time-series feature data into a pre-trained time-series neural network model to output a third risk score and c third risk labels.

[0015] According to an embodiment of this disclosure, the first calculation module includes: a first preset module, configured to preset a first weight of the first risk score, a second weight of the second risk score, and a third weight of the third risk score; a second calculation module, configured to calculate the product of the first risk score and the first weight to generate a first correlation value; a third calculation module, configured to calculate the product of the second risk score and the second weight to generate a second correlation value; a fourth calculation module, configured to calculate the product of the third risk score and the third weight to generate a third correlation value; and a fifth calculation module, configured to calculate the sum of the first correlation value, the second correlation value, and the third correlation value to generate a target risk score.

[0016] According to an embodiment of this disclosure, the first screening module includes: a seventh acquisition module, configured to acquire the first association value, and if the first association value is greater than the preset risk threshold, then the a first risk tags are selected as a first candidate tags; an eighth acquisition module, configured to acquire the second association value, and if the second association value is greater than the preset risk threshold, then the b second risk tags are selected as b second candidate tags; a ninth acquisition module, configured to acquire the third association value, and if the third association value is greater than the preset risk threshold, then the c third risk tags are selected as c third candidate tags; and a twelfth generation module, configured to combine the a first candidate tags, the b second candidate tags, and the c third candidate tags to generate d target risk tags.

[0017] According to an embodiment of this disclosure, the first generation module includes: a second preset module, configured to preset e first access control policies, wherein each first access control policy corresponds to at least one of the first risk label, the second risk label, and the third risk label, wherein e is greater than 0, e is less than the sum of a, b, and c, and e is an integer; a tenth acquisition module, configured to acquire f second access control policies corresponding to the target risk label from the e first access control policies, wherein f is greater than 0, f is less than e, and f is an integer; a third preset module, configured to preset n risk scoring ranges, wherein each risk scoring range corresponds to a preset access handling action, wherein n is greater than 0, and n is an integer; an eleventh acquisition module, configured to acquire a preset access handling action corresponding to the target risk score from the risk scoring ranges of the n policy levels, as the target access handling action; and a thirteenth generation module, configured to merge the target access handling action and the f second access control policies to generate a target access control policy.

[0018] According to a third aspect of this disclosure, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the aforementioned access data control method.

[0019] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided that stores executable instructions or a computer program thereon, which, when executed by a processor, cause the processor to perform the aforementioned data access control method.

[0020] According to a fifth aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the above-described data access control method.

[0021] This disclosure utilizes multimodal deep analysis integrating text, images, and behavior to generate risk scores and specific risk labels using a large model. This further generates refined access control policies, enabling comprehensive risk detection of target access data and providing accurate and highly interpretable risk labels. It also enhances the flexibility, accuracy, and reliability of access data control, significantly improving system security, increasing operational efficiency, and conserving computer resources. Furthermore, it addresses the technical challenges of traditional static defenses against visual spoofing attacks, semantic obfuscation injection, and zero-day exploits. Attached Figure Description

[0022] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0023] Figure 1 This diagram illustrates an application scenario of the access data control method and apparatus according to embodiments of the present disclosure.

[0024] Figure 2 A flowchart illustrating an access data control method according to an embodiment of the present disclosure is shown schematically.

[0025] Figure 3 A flowchart illustrating the processing of text data in an access data control method according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 4 A flowchart illustrating the processing of image data in an access data control method according to an embodiment of the present disclosure is shown schematically.

[0027] Figure 5 A flowchart illustrating the processing of behavioral data in an access data control method according to an embodiment of the present disclosure is shown schematically.

[0028] Figure 6 A flowchart illustrating the generation of a target risk score in an access data control method according to an embodiment of the present disclosure is shown schematically.

[0029] Figure 7 A flowchart illustrating the generation of a target risk label in an access data control method according to an embodiment of the present disclosure is shown.

[0030] Figure 8 A flowchart illustrating the generation of a target access control policy in an access data control method according to an embodiment of the present disclosure is shown in the illustration.

[0031] Figure 9 A schematic diagram of an access data control system according to an embodiment of the present disclosure is shown.

[0032] Figure 10 A schematic block diagram of an access data control device according to an embodiment of the present disclosure is shown; and

[0033] Figure 11 A block diagram of an electronic device suitable for implementing an access data control method according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0034] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0037] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0038] The accompanying drawings show some block diagrams and / or flowcharts. It should be understood that some blocks or combinations thereof in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts.

[0039] This disclosure provides an access data control method, comprising: acquiring text data from target access data; inputting the text data into a pre-trained natural language model to output a first risk score and a first risk labels, wherein a is greater than 0 and a is an integer; acquiring image data from the target access data; inputting the image data into a pre-trained visual neural network model to output a second risk score and b second risk labels, wherein b is greater than 0 and b is an integer; acquiring behavioral data from the target access data; inputting the behavioral data into a pre-trained temporal neural network model to output a third risk score and c third risk labels, wherein c is greater than 0 and c is an integer; performing a weighted calculation on the first risk score, the second risk score, and the third risk score to generate a target risk score; and selecting d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels, wherein d is greater than 0, d is less than the sum of a, b, and c, and d is an integer. Based on the target risk score and the d target risk tags, a target access control policy is generated to control the target access data.

[0040] According to embodiments of this disclosure, by integrating multimodal deep analysis of text, images, and behavior, a large model is used to generate risk scores and specific risk labels, further generating refined access control policies. This enables comprehensive risk detection of target access data and provides accurate and highly interpretable risk labels, while improving the flexibility, accuracy, and reliability of access data control. This significantly enhances system security capabilities, improves operational efficiency, and saves computer resources. It solves the technical problems that traditional static defenses struggle to address, such as visual spoofing domain name attacks, semantic obfuscation injection, and zero-day vulnerability exploits.

[0041] Figure 1 The diagram illustrates an application scenario of the access data control method and apparatus according to embodiments of the present disclosure. It should be noted that... Figure 1 The examples shown are merely examples of scenarios in which the embodiments of this disclosure can be applied, to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0042] like Figure 1 As shown, application scenario 100 according to this embodiment may include an application scenario for access data control. Network 104 is used as a medium to provide a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0043] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0044] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0045] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0046] It should be noted that the access data control method provided in this embodiment can generally be executed by server 105. Correspondingly, the access data control device provided in this embodiment can generally be located in server 105. The access data control method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the access data control device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0047] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0048] The following will be based on Figure 1 The described scene, through Figures 2-9 The access data control method of the disclosed embodiments is described in detail. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this disclosure, and the implementation of this disclosure is not limited in any way. Rather, the implementation of this disclosure can be applied to any applicable scenario.

[0049] Figure 2 A flowchart illustrating an access data control method according to an embodiment of the present disclosure is shown schematically.

[0050] like Figure 2 As shown, the method 200 includes steps S201 to S206.

[0051] Step S201: Obtain text data from the target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, where a is greater than 0 and a is an integer.

[0052] Figure 3 A flowchart illustrating the processing of text data in an access data control method according to an embodiment of the present disclosure is shown.

[0053] like Figure 3 As shown, the method 300 includes steps S301 to S305.

[0054] Step S301: Obtain the request method information, request path information, request header information, and identity credential information from the target access data as the text data.

[0055] For example, the client-initiated Hypertext Transfer Protocol (HTTP) requests and server-generated system log information can be obtained from the target access data, and request method information, request path information, request header information, and identity credential information can be extracted as the text data.

[0056] Step S302: De-identify the text data to generate de-identified text data.

[0057] Step S303: Perform invalid character filtering on the desensitized text data to generate filtered text data.

[0058] Step S304: The filtered text data is processed to generate lightweight structured data.

[0059] Step S305: Input the lightweight structure data into a pre-trained natural language model and output a first risk score and a first risk labels.

[0060] For example, a pre-trained language model can be used to perform deep semantic modeling on text fields such as request method information, request path information, request header information, and identity credential information in the pre-processed access request. Attack features can be extracted by embedding vectors, and the attack intent label can be output by the attack type classification header network as the first risk label. The first risk label can include database attacks using security vulnerabilities, cross-client cheating attacks, and command execution attacks. At the same time, an attack confidence score between 0 and 1 is generated as the first risk score.

[0061] By employing techniques such as desensitization, filtering, and lightweight processing to purify the original text into high-quality model input data, the accuracy and reliability of the first risk score and a first risk label output by the natural language model can be improved.

[0062] Return to reference Figure 2 In step S202, image data from the target access data is obtained, and the image data is input into a pre-trained visual neural network model to output a second risk score and b second risk labels, where b is greater than 0 and b is an integer.

[0063] Figure 4 A flowchart illustrating the processing of image data in an access data control method according to an embodiment of the present disclosure is shown.

[0064] like Figure 4 As shown, the method 400 includes steps S401 to S404.

[0065] Step S401: Obtain the webpage snapshot, verification code image, and user-uploaded image from the target access data as the image data.

[0066] Step S402: The image data is unified in resolution to generate image data with uniform resolution.

[0067] Step S403: Perform grayscale normalization processing on the uniform resolution image data to generate normalized image data.

[0068] Step S404: Input the normalized image data into a pre-trained visual neural network model to output a second risk score and b second risk labels.

[0069] For example, a pre-trained visual neural network model can be used to perform visual semantic analysis on webpage snapshots, CAPTCHA images, and user-uploaded images involved in the access. The model outputs an attack intent label as a second risk label, which includes: image spoofing, visual deception, CAPTCHA bypass, etc. At the same time, the similarity difference measure between the label and the legitimate template image is calculated, and a visual spoofing score between 0 and 1 is generated as the first risk score.

[0070] The technique of processing raw image data into standardized model input data through resolution unification and grayscale normalization can be used to prevent visual content-based threats such as visual spoofing, CAPTCHA attacks, and phishing pages. This improves the accuracy and reliability of the second risk score and b second risk labels output by the visual neural network model.

[0071] Return to reference Figure 2 In step S203, behavioral data from the target access data is obtained, and the behavioral data is input into a pre-trained temporal neural network model to output a third risk score and c third risk labels, where c is greater than 0 and c is an integer.

[0072] Figure 5 A flowchart illustrating the processing of behavioral data in an access data control method according to an embodiment of the present disclosure is shown.

[0073] like Figure 5 As shown, the method 500 includes steps S501 to S504.

[0074] Step S501: Obtain the access frequency data, fingerprint feature data, and geographical location information from the target access data as the behavioral data.

[0075] Step S502: Perform time-series transformation on the behavioral data to generate time-series data.

[0076] Step S503 involves extracting features from the time series data to generate time series feature data.

[0077] Step S504: Input the time series feature data into a pre-trained time-series neural network model to output a third risk score and c third risk labels.

[0078] For example, behavioral data such as access frequency data, fingerprint feature data, and geographical location information are obtained from the target access data. A temporal neural network model is used to understand the long-term dependencies and contextual relationships in the behavioral sequence through a self-attention mechanism, and an attack intent label is output as a third risk label. The third risk label includes: automated script attacks, account sharing, etc. At the same time, a difference analysis is performed in combination with historical baseline behavior, and the deviation of the behavior trajectory in the range of 0 to 1 is output as a third risk score. The behavior trajectory deviation is used to measure the degree of deviation between user behavior and the legitimate model.

[0079] Behavioral data reflects users' interaction paths and operating habits within a system, serving as crucial evidence for identifying abnormal behaviors such as "non-human operations," "account sharing," and "automated attacks." By transforming raw behavioral data into time-series feature data through time-series data conversion and feature extraction, the accuracy and reliability of the third risk score and c third risk labels output by the time-series neural network model can be improved.

[0080] Return to reference Figure 2 In step S204, the first risk score, the second risk score, and the third risk score are weighted and calculated to generate a target risk score.

[0081] Figure 6 A flowchart illustrating the generation of a target risk score in an access data control method according to an embodiment of the present disclosure is shown.

[0082] like Figure 6 As shown, the method 600 includes steps S601 to S605.

[0083] Step S601: Preset the first weight of the first risk score, the second weight of the second risk score, and the third weight of the third risk score.

[0084] For example, weights can be preset based on historical feedback data, which may include labeled mis-blocking or missed events, user-reported misjudgment feedback, and data on the difference between model output and actual attack results. Weight parameters can be automatically updated and adjusted.

[0085] Step S602: Calculate the product of the first risk score and the first weight to generate the first association value.

[0086] Step S603: Calculate the product of the second risk score and the second weight to generate the second association value.

[0087] Step S604: Calculate the product of the third risk score and the third weight to generate the third association value.

[0088] Step S605: Calculate the sum of the first correlation value, the second correlation value, and the third correlation value to generate a target risk score.

[0089] For example, the formula for generating the target risk score can be: Target Risk Score = First Risk Score * First Weight + Second Risk Score * Second Weight + Second Risk Score * Second Weight.

[0090] By presetting a first weight, a second weight, and a third weight, a technical method for calculating and generating a target risk score is used to achieve the technical effect of generating a precise and accurate target risk score.

[0091] Return to reference Figure 2 In step S205, d target risk labels are selected from the a first risk labels, the b second risk labels and the c third risk labels, where d is greater than 0, less than the sum of a, b and c, and d is an integer.

[0092] Figure 7 The flowchart illustrating the generation of a target risk label in an access data control method according to an embodiment of the present disclosure is shown.

[0093] like Figure 7 As shown, the method 700 includes steps S701 to S704.

[0094] Step S701: Obtain the first association value. If the first association value is greater than the preset risk threshold, then the a first risk labels are used as a first candidate labels.

[0095] For example, if the first association value is less than or equal to a preset risk threshold, then there is no first candidate label.

[0096] Step S702: Obtain the second association value. If the second association value is greater than the preset risk threshold, then the b second risk labels are used as b second candidate labels.

[0097] For example, if the second association value is less than or equal to a preset risk threshold, then there is no second candidate label.

[0098] Step S703: Obtain the third association value. If the third association value is greater than the preset risk threshold, then the c third risk labels are used as c third candidate labels.

[0099] For example, if the third association value is less than or equal to the preset risk threshold, then there is no third candidate label.

[0100] Step S704: Combine the a first candidate labels, the b second candidate labels, and the c third candidate labels to generate d target risk labels.

[0101] For example, if *a* first-candidate labels exist, *b* second-candidate labels exist, and *c* third-candidate labels exist, then *d* target risk labels are generated, where *d* = *a* + *b* + *c*. If *a* first-candidate labels exist, *b* second-candidate labels exist, and *c* third-candidate labels do not exist, then *d* target risk labels are generated, where *d* = *a* + *c*. If *a* first-candidate labels do not exist, *b* second-candidate labels exist, and *c* third-candidate labels exist, then *d* target risk labels are generated, where *d* = *b*. If *a* first-candidate labels exist, *b* second-candidate labels exist, and *c* third-candidate labels do not exist, then *d* target risk labels are generated, where *d* = *b*. If a first candidate label does not exist, b second candidate labels do not exist, and c third candidate labels exist, then d target risk labels are generated, where d = c.

[0102] By filtering risk labels using preset risk thresholds, the technical means of generating target risk labels can achieve the technical effect of ensuring the reliability and robustness of the generated target risk labels.

[0103] Return to reference Figure 2 In step S206, a target access control policy is generated based on the target risk score and the d target risk tags to control the target access data.

[0104] Figure 8 A flowchart illustrating the generation of a target access control policy in an access data control method according to an embodiment of the present disclosure is shown.

[0105] like Figure 8 As shown, the method 800 includes steps S801 to S805.

[0106] Step S801: Preset e first access control policies, wherein each first access control policy corresponds to at least one of the first risk label, the second risk label, and the third risk label, wherein e is greater than 0, e is less than the sum of a, b, and c, and e is an integer.

[0107] For example, the first risk label includes: database attacks exploiting security vulnerabilities, cross-client cheating attacks, and command execution attacks; the second risk label includes: image spoofing, visual deception, and CAPTCHA bypass; the third risk label includes: automated script attacks and account sharing. The preset first access control policies include: a first preset protection policy to protect against database attacks exploiting security vulnerabilities; a second preset protection policy to protect against cross-client cheating attacks; a third preset protection policy to protect against command execution attacks; a fourth preset protection policy to protect against image spoofing; a fifth preset protection policy to protect against visual deception; a sixth preset protection policy to protect against CAPTCHA bypass; a seventh preset protection policy to protect against automated script attacks; and an eighth preset protection policy to protect against account sharing.

[0108] Step S802: Obtain f second access control policies corresponding to the target risk label from the e first access control policies, wherein f is greater than 0, f is less than e, and f is an integer.

[0109] Step S803: Preset n risk scoring ranges, where each risk scoring range corresponds to a preset access handling action, where n is greater than 0 and n is an integer.

[0110] For example, as shown in Table 1, four risk scoring ranges can be set. Each risk scoring range corresponds to a preset access handling action. Among them, "Allow" means normal access; "Verify" means a verification code must be triggered for access to be granted; "Block" means the request must be frozen and placed in the review queue; and "Ban" means the terminal must be disconnected and the account must be banned or added to the blacklist.

[0111] Table 1

[0112] Risk scoring range Strategy Level Access handling actions [0,0.3) Level 1 Release [0.3,0.6) Level 2 verify [0.6,0.8) Level 3 Block [0.8,1] Level 4 Ban

[0113] Step S804: Obtain the preset access handling action corresponding to the target risk score from the risk score range of the n strategy levels, and use it as the target access handling action.

[0114] Step S805: The target access handling action and the f second access control policies are merged to generate a target access control policy.

[0115] For example, when the target access action is blocking, and the second access control policy includes a third preset protection policy against command execution attacks, the target access control policy can simultaneously implement the blocking action and activate the third preset protection policy against command execution attacks. When the target access action is banning, and the second access control policy includes a seventh preset protection policy against automated script attacks and a first preset protection policy against database attacks exploiting security vulnerabilities, the target access control policy can simultaneously implement the ban and activate both the seventh preset protection policy against automated script attacks and the first preset protection policy against database attacks exploiting security vulnerabilities.

[0116] Furthermore, target access control policies can achieve multi-level response linkage from the network layer, application layer, to the physical layer. A policy control center can uniformly schedule these actions and confirm callback results to ensure execution. For example, at the network layer, abnormal traffic can be quickly blocked through firewalls / proxy devices, performing IP blocking, rate limiting, and firewall interception operations. At the application layer, abnormal account activity can be controlled or restricted at the system login session level, performing operations such as account freezing and CAPTCHA verification. At the physical layer, terminal-level blocking can be performed through linked terminal detection and response, executing operations such as terminal locking and disconnection.

[0117] By using target risk scoring and target risk labeling to generate target access control policies, the technical effects of improving the accuracy and reliability of target access control policies, enhancing security protection capabilities, improving operational efficiency, and saving computer resources are achieved.

[0118] Figure 9 A schematic diagram of an access data control system according to an embodiment of the present disclosure is shown.

[0119] like Figure 9 As shown, the system 900 includes: a multimodal data acquisition and preprocessing module 901, a large model analysis and threat scoring module 902, a dynamic access control policy generation module 903, a collaborative response execution module 904, and a feedback optimization module 905.

[0120] The multimodal data acquisition and preprocessing module 901 serves as the system's data entry point, enabling comprehensive and multi-dimensional real-time acquisition and processing of user access behavior and environmental information. This provides rich raw data support for subsequent threat assessment using large-scale models. This module operates in three dimensions: text data, image data, and behavioral data. It utilizes reverse proxy intermediate servers, application server logs, interface gateways, front-end tracking points, distribution logs, and back-end request tracing to collect multi-dimensional data in real time, covering different aspects of user interaction. The multimodal data acquisition and preprocessing module 901 includes: a text data acquisition unit, an image data acquisition unit, and a behavioral data acquisition unit. The text data acquisition unit collects text data, declassifies sensitive information, filters invalid characters, and generates lightweight structured data. The image data acquisition unit collects image data and performs processing such as resolution unification and grayscale normalization. The behavioral data acquisition unit collects behavioral data, transforms discrete operation events into time-series data, and extracts statistical features.

[0121] The large model analysis and threat scoring module 902 is the core intelligent processing unit of the entire system. Based on the mainstream pre-trained architecture in the large model system, including natural language model, visual model and temporal modeling model, this module is responsible for deep semantic understanding and access intent modeling of multimodal input data (text, image and behavior), and outputs a quantitative comprehensive threat score, providing a direct basis for the access control policy generation module.

[0122] The dynamic access control policy generation module 903 relies on the multimodal semantic understanding and intent reasoning capabilities of the large model in the preceding module. Based on the comprehensive scoring results and semantic tags output by the large model, it dynamically generates access control policies to ensure that the system can make differentiated, intelligent and structured access control decisions for different access intentions and risk levels.

[0123] The collaborative response execution module 904 performs operations such as access control, policy linkage, and response logging, enabling unified access management across multiple platforms, dimensions, and scenarios. This module receives structured control commands from the policy generation module in real time via event middleware or interfaces, parses policy fields to extract target object information, determines the policy level and corresponding blocking, verification, and isolation actions, and identifies large model tags and scoring explanations as important components of the response log. After parsing, the commands enter the response scheduling queue, awaiting execution. Based on the policy level and control action type, the system implements multi-level response linkage from the network layer, application layer, to the physical layer. The policy control center uniformly schedules these actions and confirms callback results to ensure execution.

[0124] The feedback optimization module 905 inputs the strategy execution results and manually reviewed data into the model, triggering a self-learning process. Data feedback sources include administrator-annotated false blocking / missed events, user-reported misjudgment feedback, and data on the difference between model output and actual attack results, automatically updating and adjusting weight parameters.

[0125] This system constructs a multimodal threat perception framework based on text, image, and behavior, dynamically generates access control policies in real time based on attack intent, and achieves hierarchical collaborative response at the network, application, and physical layers. At the same time, it utilizes the adaptive learning mechanism of a large model to continuously optimize protection rules, improves the ability to identify new threats without relying on manually preset rules, and builds an intelligent access control and protection system of "threat perception - intent reasoning - policy generation - collaborative response - continuous optimization".

[0126] Figure 10 A schematic block diagram of an access data control device according to an embodiment of the present disclosure is shown.

[0127] like Figure 10 As shown, the device 1000 includes: a first acquisition module 1001, a second acquisition module 1002, a third acquisition module 1003, a first calculation module 1004, a filtering module 1005, and a first generation module 1006.

[0128] The first acquisition module 1001 is used to acquire text data from the target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, where a is greater than 0 and a is an integer. In one embodiment, the first acquisition module 1001 can be used to perform step S201 described above.

[0129] The first acquisition module 1001 includes: a fourth acquisition module, a second generation module, a third generation module, a fourth generation module, and a fifth generation module. The fourth acquisition module is used to acquire request method information, request path information, request header information, and identity credential information from the target access data as the text data. In one embodiment, the fourth acquisition module can be used to execute step S301 described above, which will not be repeated here. The second generation module is used to perform desensitization processing on the text data to generate desensitized text data. In one embodiment, the second generation module can be used to execute step S302 described above, which will not be repeated here. The third generation module is used to perform invalid character filtering processing on the desensitized text data to generate filtered text data. In one embodiment, the third generation module can be used to execute step S303 described above, which will not be repeated here. The fourth generation module is used to perform lightweight processing on the filtered text data to generate lightweight structured data. In one embodiment, the fourth generation module can be used to execute step S304 described above, which will not be repeated here. The fifth generation module is used to input the lightweight structured data into a pre-trained natural language model and output a first risk score and a first risk labels. In one embodiment, the fifth generation module can be used to perform step S305 described above, which will not be repeated here.

[0130] The second acquisition module 1002 is used to acquire image data from the target access data, input the image data into a pre-trained visual neural network model, and output a second risk score and b second risk labels, where b is greater than 0 and b is an integer. In one embodiment, the second acquisition module 1002 can be used to perform step S202 described above.

[0131] The second acquisition module 1002 includes a fifth acquisition module, a sixth generation module, a seventh generation module, and an eighth generation module. The fifth acquisition module is used to acquire webpage snapshots, verification code images, and user-uploaded images from the target access data as the image data. In one embodiment, the fifth acquisition module can be used to execute step S401 described above, which will not be repeated here. The sixth generation module is used to unify the resolution of the image data to generate image data with a uniform resolution. In one embodiment, the sixth generation module can be used to execute step S402 described above, which will not be repeated here. The seventh generation module is used to perform grayscale normalization processing on the image data with the uniform resolution to generate normalized image data. In one embodiment, the seventh generation module can be used to execute step S403 described above, which will not be repeated here. The eighth generation module is used to input the normalized image data into a pre-trained visual neural network model and output a second risk score and b second risk labels. In one embodiment, the eighth generation module can be used to execute step S404 described above, which will not be repeated here.

[0132] The third acquisition module 1003 is used to acquire behavioral data from the target access data, input the behavioral data into a pre-trained temporal neural network model, and output a third risk score and c third risk labels, where c is greater than 0 and c is an integer. In one embodiment, the third acquisition module 1003 can be used to perform step S203 described above.

[0133] The third acquisition module 1003 includes: a sixth acquisition module, a ninth generation module, a tenth generation module, and an eleventh generation module. The sixth acquisition module is used to acquire access frequency data, fingerprint feature data, and geographical location information from the target access data as the behavioral data. In one embodiment, the sixth acquisition module can be used to execute step S501 described above, which will not be repeated here. The ninth generation module is used to perform time-series transformation on the behavioral data to generate time-series data. In one embodiment, the ninth generation module can be used to execute step S502 described above, which will not be repeated here. The tenth generation module is used to extract features from the time-series data to generate time-series feature data. In one embodiment, the tenth generation module can be used to execute step S503 described above, which will not be repeated here. The eleventh generation module is used to input the time-series feature data into a pre-trained time-series neural network model and output a third risk score and c third risk labels. In one embodiment, the eleventh generation module can be used to execute step S504 described above, which will not be repeated here.

[0134] The first calculation module 1004 is used to perform a weighted calculation on the first risk score, the second risk score, and the third risk score to generate a target risk score. In one embodiment, the first calculation module 1004 can be used to perform step S204 described above.

[0135] The first calculation module 1004 includes: a first preset module, a second calculation module, a third calculation module, a fourth calculation module, and a fifth calculation module. The first preset module is used to preset a first weight for the first risk score, a second weight for the second risk score, and a third weight for the third risk score. In one embodiment, the first preset module can be used to execute step S601 described above, which will not be repeated here. The second calculation module is used to calculate the product of the first risk score and the first weight to generate a first correlation value. In one embodiment, the second calculation module can be used to execute step S602 described above, which will not be repeated here. The third calculation module is used to calculate the product of the second risk score and the second weight to generate a second correlation value. In one embodiment, the third calculation module can be used to execute step S603 described above, which will not be repeated here. The fourth calculation module is used to calculate the product of the third risk score and the third weight to generate a third correlation value. In one embodiment, the fourth calculation module can be used to execute step S604 described above, which will not be repeated here. The fifth calculation module is used to calculate the sum of the first correlation value, the second correlation value, and the third correlation value to generate a target risk score. In one embodiment, the fifth calculation module can be used to perform step S605 as described above, which will not be repeated here.

[0136] The filtering module 1005 is used to filter out d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels, wherein d is greater than 0, d is less than the sum of a, b, and c, and d is an integer. In one embodiment, the filtering module 1005 can be used to perform step S205 described above.

[0137] The filtering module 1005 includes: a seventh acquisition module, an eighth acquisition module, a ninth acquisition module, and a twelfth generation module. The seventh acquisition module is used to acquire the first association value. If the first association value is greater than the preset risk threshold, then the *a* first risk tags are selected as *a* first candidate tags. In one embodiment, the seventh acquisition module can be used to execute step S701 described above, which will not be repeated here. The eighth acquisition module is used to acquire the second association value. If the second association value is greater than the preset risk threshold, then the *b* second risk tags are selected as *b* second candidate tags. In one embodiment, the eighth acquisition module can be used to execute step S702 described above, which will not be repeated here. The ninth acquisition module is used to acquire the third association value. If the third association value is greater than the preset risk threshold, then the *c* third risk tags are selected as *c* third candidate tags. In one embodiment, the ninth acquisition module can be used to execute step S703 described above, which will not be repeated here. The twelfth generation module is used to combine the a first candidate tags, the b second candidate tags, and the c third candidate tags to generate d target risk tags. In one embodiment, the twelfth generation module can be used to execute step S704 described above, which will not be repeated here.

[0138] The first generation module 1006 is used to generate a target access control policy based on the target risk score and the d target risk tags, so as to control the target access data. In one embodiment, the first generation module 1006 can be used to execute step S206 described above.

[0139] The first generation module 1006 includes: a second preset module, a tenth acquisition module, a third preset module, an eleventh acquisition module, and a thirteenth generation module. The second preset module is used to preset e first access control policies, wherein each first access control policy corresponds to at least one of the first risk label, the second risk label, and the third risk label, wherein e is greater than 0, e is less than the sum of a, b, and c, and e is an integer. In one embodiment, the second preset module can be used to execute step S801 described above, which will not be repeated here. The tenth acquisition module is used to acquire f second access control policies corresponding to the target risk label from the e first access control policies, wherein f is greater than 0, f is less than e, and f is an integer. In one embodiment, the tenth acquisition module can be used to execute step S802 described above, which will not be repeated here. The third preset module is used to preset n risk scoring ranges, wherein each risk scoring range corresponds to a preset access handling action, wherein n is greater than 0, and n is an integer. In one embodiment, the third preset module can be used to execute step S803 described above, which will not be repeated here. The eleventh acquisition module is used to acquire a preset access handling action corresponding to the target risk score from the risk score range of the n policy levels, as the target access handling action. In one embodiment, the eleventh acquisition module can be used to execute step S804 described above, which will not be repeated here. The thirteenth generation module is used to merge the target access handling action and the f second access control policies to generate a target access control policy. In one embodiment, the thirteenth generation module can be used to execute step S805 described above, which will not be repeated here.

[0140] According to embodiments of this disclosure, any multiple modules among the first acquisition module 1001, second acquisition module 1002, third acquisition module 1003, first calculation module 1004, filtering module 1005, and first generation module 1006 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first acquisition module 1001, second acquisition module 1002, third acquisition module 1003, first calculation module 1004, filtering module 1005, and first generation module 1006 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the first acquisition module 1001, the second acquisition module 1002, the third acquisition module 1003, the first calculation module 1004, the filtering module 1005, and the first generation module 1006 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0141] Figure 11 A block diagram of an electronic device suitable for implementing an access data control method according to an embodiment of the present disclosure is shown schematically.

[0142] like Figure 11 As shown, an electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage portion 1108 into a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0143] RAM 1103 stores various programs and data required for the operation of electronic device 1100. Processor 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Processor 1101 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1102 and / or RAM 1103. It should be noted that the programs may also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0144] According to embodiments of this disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to a bus 1104. The electronic device 1100 may also include one or more of the following components connected to the I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1110 as needed so that computer programs read from it can be installed into the storage section 1108 as needed.

[0145] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0146] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1102 and / or RAM 1103 and / or one or more memories other than ROM 1102 and RAM 1103 described above.

[0147] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the access data control method provided in the embodiments of this disclosure.

[0148] When the computer program is executed by the processor 1101, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0149] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1109, and / or installed from the removable medium 1111. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0150] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by processor 1101, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0151] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0152] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0153] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0154] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for controlling access to data, characterized in that, The method includes: Obtain text data from the target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, where a is greater than 0 and a is an integer; Obtain image data from the target access data, input the image data into a pre-trained visual neural network model, and output a second risk score and b second risk labels, where b is greater than 0 and b is an integer; Obtain behavioral data from the target access data, input the behavioral data into a pre-trained temporal neural network model, and output a third risk score and c third risk labels, where c is greater than 0 and c is an integer; The first risk score, the second risk score, and the third risk score are weighted and calculated to generate a target risk score. From the a first risk labels, the b second risk labels, and the c third risk labels, d target risk labels are selected, where d is greater than 0, less than the sum of a, b, and c, and d is an integer; and Based on the target risk score and the d target risk tags, a target access control policy is generated to control the target access data.

2. The method according to claim 1, characterized in that, Obtain text data from the target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, including: The request method information, request path information, request header information, and identity credential information in the target access data are obtained as the text data; The text data is then de-identified to generate de-identified text data. The desensitized text data is filtered for invalid characters to generate filtered text data. The filtered text data is then processed to generate lightweight structured data; and The lightweight structure data is input into a pre-trained natural language model, which outputs a first risk score and a first risk labels.

3. The method according to claim 1, characterized in that, Obtain image data from the target access data, input the image data into a pre-trained visual neural network model, and output a second risk score and b second risk labels, including: The webpage snapshot, CAPTCHA image, and user-uploaded image in the target access data are obtained as the image data; The image data is then standardized in resolution to generate image data with uniform resolution. The uniform resolution image data is subjected to grayscale normalization to generate normalized image data; and The normalized image data is input into a pre-trained visual neural network model, which outputs a second risk score and b second risk labels.

4. The method according to claim 1, characterized in that, Obtain behavioral data from the target access data, input the behavioral data into a pre-trained temporal neural network model, and output a third risk score and c third risk labels, including: The access frequency data, fingerprint feature data, and geographic location information in the target access data are obtained as the behavioral data; The behavioral data is then transformed into time-series data. Feature extraction will be performed on the time series data to generate time series feature data; and The time series feature data is input into a pre-trained time-series neural network model, which outputs a third risk score and c third risk labels.

5. The method according to claim 1, characterized in that, The target risk score is generated by weighting the first risk score, the second risk score, and the third risk score, including: A first weight is preset for the first risk score, a second weight is preset for the second risk score, and a third weight is preset for the third risk score; Calculate the product of the first risk score and the first weight to generate the first association value; Calculate the product of the second risk score and the second weight to generate the second correlation value; Calculate the product of the third risk score and the third weight to generate a third correlation value; and Calculate the sum of the first correlation value, the second correlation value, and the third correlation value to generate a target risk score.

6. The method according to claim 5, characterized in that, From the a first risk labels, the b second risk labels, and the c third risk labels, d target risk labels are selected; including: Obtain the first association value; if the first association value is greater than the preset risk threshold, then use the a first risk labels as a first candidate labels. Obtain the second association value; if the second association value is greater than the preset risk threshold, then use the b second risk labels as b second candidate labels. Obtain the third association value; if the third association value is greater than the preset risk threshold, then use the c third risk labels as c third candidate labels; and The a first candidate labels, the b second candidate labels, and the c third candidate labels are combined to generate d target risk labels.

7. The method according to any one of claims 1 to 6, characterized in that, Based on the target risk score and the d target risk labels, a target access control policy is generated, including: There are e preset first access control policies, wherein each first access control policy corresponds to at least one of the first risk label, the second risk label, and the third risk label, wherein e is greater than 0, e is less than the sum of a, b, and c, and e is an integer; Obtain f second access control policies corresponding to the target risk label from the e first access control policies, where f is greater than 0, f is less than e, and f is an integer; There are n preset risk scoring ranges, where each risk scoring range corresponds to a preset access handling action, and n is greater than 0 and is an integer; From the risk score range of the n strategy levels, obtain the preset access handling action corresponding to the target risk score, and use it as the target access handling action; and The target access handling action and the f second access control policies are combined to generate the target access control policy.

8. A data access control device, characterized in that, The device includes: The first acquisition module is used to acquire text data in the target access data, input the text data into a pre-trained natural language model, and output a first risk score and a first risk labels, where a is greater than 0 and a is an integer; The second acquisition module is used to acquire image data from the target access data, input the image data into a pre-trained visual neural network model, and output a second risk score and b second risk labels, where b is greater than 0 and b is an integer; The third acquisition module is used to acquire behavioral data from the target access data, input the behavioral data into a pre-trained temporal neural network model, and output a third risk score and c third risk labels, where c is greater than 0 and c is an integer; The first calculation module is used to perform a weighted calculation on the first risk score, the second risk score and the third risk score to generate a target risk score. The first filtering module is used to filter out d target risk labels from the a first risk labels, the b second risk labels, and the c third risk labels, wherein d is greater than 0, d is less than the sum of a, b, and c, and d is an integer; and The first generation module is used to generate a target access control policy based on the target risk score and the d target risk tags, so as to control the target access data.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images