Multimodal-based data security posture insight and access control method and system

Abstract

This invention discloses a method and system for data security situation awareness and access control based on multimodal data, belonging to the fields of network security and data governance technology. The method includes: real-time capture of multimodal data and vectorization encoding of the captured multimodal data to obtain multimodal vectors; construction of a multimodal cross-attention network, inputting the multimodal vectors into the multimodal cross-attention network and mapping them to a unified semantic space; automatic learning of the correlation weights between different modalities through an attention mechanism to achieve multimodal feature fusion and situation awareness, generating a comprehensive situation feature vector; inputting the comprehensive situation feature vector into a classifier or anomaly detection model to output the current risk score in real time; and dynamically adjusting access policies based on the risk score through an access control gateway, and implementing corresponding security measures for access requests according to different risk levels.

Description

Technical Field

[0001] This invention relates to the fields of network security and data governance technology, and in particular to a method and system for data security situational awareness and access control based on multimodality. Background Technology

[0002] As digital transformation deepens, the security threats facing enterprise data assets are becoming increasingly complex. Existing data security protection systems typically include firewalls, intrusion detection systems (IDS), data loss prevention (DLP) systems, and identity authentication systems (IAM). Their security monitoring methods mostly rely on rule-based or unimodal data analysis methods. Specifically, these include log analysis that collects application logs through SIEM (Security Information and Event Management) systems and uses keyword matching or statistical anomaly detection to discover threats; traffic analysis that identifies malicious traffic by parsing the five-tuple or payload characteristics of network packets; and access control that mainly relies on static RBAC (role-based access control) models (where permissions typically remain unchanged during a session after successful user authentication).

[0003] However, these existing technologies have significant shortcomings in dealing with advanced persistent threats (APTs) or insider threats: On the one hand, log data (text), traffic data (sequences), and user behavior data (time-series / graph structures) are often isolated and processed separately in different systems. Single-modal data is not only easily bypassed, but also difficult to reconstruct the full picture of the attack, resulting in a high false positive rate and the formation of data silos. On the other hand, existing systems mostly focus on single-point alerts and lack quantitative assessment of the current overall security posture. For example, if a legitimate login behavior occurs in the context of a DDoS attack on the system and the account attempts to log in from a different location, its risk level should be increased, but this contextual relationship is often ignored by existing systems. In addition, traditional access control policies have static and rigid characteristics. Once the security posture changes (such as detecting a data breach risk), the system cannot dynamically shrink the permissions of authorized users within "milliseconds" (such as downgrading from "read and write" to "read only" or "blocking"), resulting in an excessively long risk exposure period and making it difficult to achieve timely and effective risk prevention and control. Summary of the Invention

[0004] The main objective of this invention is to provide a multimodal data security situational awareness and access control method.

[0005] Another objective of this invention is to propose a multimodal data security situational awareness and access control system.

[0006] The third objective of this invention is to provide a computer device.

[0007] The fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above objectives, a first aspect of the present invention proposes a multimodal data security posture insight and access control method, comprising:

[0009] Multimodal data is captured in real time, and the captured multimodal data is vectorized and encoded to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors; A multimodal cross-attention network is constructed, and the multimodal vectors are input into the multimodal cross-attention network and mapped to a unified semantic space; the association weights between different modalities are automatically learned through the attention mechanism to realize multimodal feature fusion and situational awareness, and generate a comprehensive situational feature vector. The comprehensive situation feature vector is input into a classifier or anomaly detection model, and the current risk score is output in real time. Access control gateways dynamically adjust access policies based on the risk scores and implement corresponding security measures for access requests according to different risk levels.

[0010] In one embodiment of the present invention, the real-time capture of multimodal data and the vectorization encoding of the captured multimodal data to obtain a multimodal vector include: For text modal data, a BERT pre-trained language model is used to transform text logs into high-dimensional semantic vectors; For sequence modal data, LSTM or Transformer encoders are used to transform traffic data and API sequence data into time-series feature vectors; For behavioral modality data, a graph neural network (GNN) is used to construct a user-asset-operation interaction graph, and node embedding vectors are extracted from the interaction graph.

[0011] In one embodiment of the present invention, the multimodal cross-attention network comprises a text encoder, a sequence encoder, an action encoder, and a feature fusion layer, specifically including: The text encoder uses an LSTM or Transformer encoder to encode the high-dimensional semantic vectors corresponding to the text modal data; The sequence encoder uses a Long Short-Term Memory (LSTM) network, a gated recurrent unit (GRU) or a recurrent neural network (RNN) to encode the temporal feature vectors corresponding to the sequence modal data. The behavior encoder uses a graph neural network (GNN) to encode the node embedding vectors corresponding to the behavior modality data. The feature fusion layer achieves multimodal feature fusion through a cross-attention mechanism, which is calculated as follows:

[0012] in, For querying the matrix, The key matrix, For value matrices, Let K be the transpose of matrix K. Let be the dimension of the key vector. Scaling factor The function is used to transform the input into a probability distribution.

[0013] In one embodiment of the present invention, the dynamic access control policy is defined as a 5-tuple. ,in Indicates the access subject, Indicates the object being visited. Indicates an access action. Indicates environmental attributes, This indicates the risk level corresponding to the risk score.

[0014] In one embodiment of the present invention, the step of implementing corresponding security measures for access requests based on different risk levels includes: When the risk score is lower than the first threshold, it is determined to be low risk and normal access is allowed; When the risk score is higher than the second threshold and lower than the third threshold, it is determined to be of medium risk, triggering secondary verification or data anonymization; When the risk score is higher than the third threshold, it is determined to be high risk. The access control gateway will first trigger the dynamic data masking policy, send an abnormal access alarm to the security administrator, and require the access subject to complete the two-factor authentication. If the access subject fails the two-factor authentication, the access connection will be blocked and the access subject's account will be frozen. The dynamic data masking includes real-time masking of sensitive fields in the database return results.

[0015] To achieve the above objectives, a second aspect of the present invention provides a multimodal data security situational awareness and access control system, comprising: A multimodal data acquisition and preprocessing module is used to capture multimodal data in real time and to vectorize the captured multimodal data to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors; The multimodal feature fusion and situational awareness module is used to construct a multimodal cross-attention network, input the multimodal vectors into the multimodal cross-attention network and map them to a unified semantic space; through the attention mechanism, it automatically learns the correlation weights between different modalities, realizes multimodal feature fusion and situational awareness, and generates a comprehensive situational feature vector; The dynamic strategy decision engine module is used to input the comprehensive situation feature vector into a classifier or anomaly detection model and output the current risk score in real time. The adaptive access control gateway module is used to dynamically adjust access policies based on the risk score through the access control gateway, and to implement corresponding security measures for access requests according to different risk levels.

[0016] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, for implementing a multimodal data security situational awareness and access control method as described in the first aspect embodiment.

[0017] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements a multimodal data security situational awareness and access control method as described in the first aspect embodiment.

[0018] The embodiments of the present invention have the following beneficial effects: This invention effectively compensates for the blind spots in single-modal data analysis by fusing multimodal data of text, traffic, and behavior. It can accurately identify hidden attack chains, thereby significantly reducing the false alarm rate and false negative rate in the security detection process and greatly improving detection accuracy. This invention directly transforms situational awareness results into specific actions through a decision engine, successfully realizing the core transformation from traditional "passive alarm" to "active defense". Dynamic access control based on risk scoring can quickly shrink user permissions the moment an attack occurs, minimizing the losses caused by data leakage and achieving a real-time dynamic defense effect. The access control of this invention is not limited to binary "allow / deny" judgments, but can also be combined with data anonymization and other technologies to achieve "degraded access". While effectively ensuring data security, it also fully considers business continuity, achieving a precise balance between security and business availability, and has outstanding practical value. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of a multimodal data security situation observation and access control method provided in this embodiment of the invention; Figure 2 This is a diagram of the multimodal cross-attention network structure provided in an embodiment of the present invention; Figure 3 A dynamic access control flowchart provided for embodiments of the present invention; Figure 4 A schematic diagram of the architecture of a multimodal data security situation insight and access control system provided in an embodiment of the present invention; Figure 5 This is a structural diagram of a multimodal data security situational awareness and access control system provided in an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] This invention aims to address the problems of low threat detection accuracy due to a single data modality and delayed response due to static access control in existing technologies. This invention provides a multimodal data security situational awareness and access control method and system, the core idea of ​​which is to construct a closed-loop system of "perception-decision-response". This invention achieves accurate situational awareness through multimodal data fusion technology and links it with an access control gateway to realize real-time dynamic permission adjustment based on risk.

[0023] The following description, with reference to the accompanying drawings, describes a data security situational awareness and access control method and system based on multimodal approaches, proposed according to embodiments of the present invention.

[0024] Example 1 This embodiment provides a multimodal data security posture insight and access control method. For example... Figure 1 As shown, the method includes the following steps: S1. Real-time capture of multimodal data and vectorization encoding of the captured multimodal data to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors.

[0025] Specifically, the multimodal data involved in this invention covers three categories: text modality, sequence modality, and behavioral modality (graph / time series). Among them, text modality includes application access logs and database operation SQL statements, sequence modality includes network traffic packet header sequences and API call sequences, and behavioral modality (graph / time series) covers user entity behavior (UEBA) features, such as login time, geographical location, access frequency and other key information.

[0026] In one embodiment of the present invention, user U (a finance department employee) attempts to access the "Employee Salary Table" in the core database through a new terminal device during non-working hours (Friday 23:00).

[0027] Further, step S1 includes: S11, for text modal data, uses the BERT pre-trained language model to transform text logs into high-dimensional semantic vectors.

[0028] In one embodiment of the present invention, the data acquisition probe captures the SQL query statement "SELECT" in the database audit log. The system uses a pre-trained BERT model to encode the SQL statement "FROM Salary_Table WHERE department = 'R&D'" and extracts its implicit semantic feature vector. The "Salary_Table" was identified as a highly sensitive asset.

[0029] S12, for sequence modal data, uses an LSTM or Transformer encoder to transform traffic data and API sequence data into time-series feature vectors.

[0030] In one embodiment of the invention, the gateway captures the API call sequence of user U over the past minute. LSTM model analysis reveals that the user made 50 consecutive calls to the "Export API" within a very short period. This high-frequency sequence is then transformed into a time-series feature vector. .

[0031] S13, For behavioral modality data, a graph neural network (GNN) is used to construct a user-asset-operation interaction graph, and node embedding vectors are extracted through the interaction graph.

[0032] In one embodiment of the present invention, the user behavior analysis module extracts current context features: time = "23:00" (offset from baseline), location = "unknown IP" (offset from baseline), and device fingerprint = "new device". These discrete features are mapped to behavioral feature vectors through graph embedding. .

[0033] S2, construct a multimodal cross-attention network, input the multimodal vector into the multimodal cross-attention network and map it to a unified semantic space; automatically learn the correlation weights between different modalities through the attention mechanism to realize multimodal feature fusion and situational awareness, and generate a comprehensive situational feature vector.

[0034] Specifically, when a "database export operation (text modality)" occurs, the system will automatically pay attention to "abnormal traffic peaks (sequence modality)" to enhance feature representation and suppress noise.

[0035] In one embodiment of the invention, the three vectors from step S1 are input into a multimodal cross-attention network. The attention mechanism automatically calculates the weights, and because "non-working time" and "high-sensitivity table queries" occur simultaneously, the model assigns weights accordingly. and Extremely high mutual attention weights. The fused situational feature vector effectively suppresses noise in a single dimension (e.g., if it is just a query of a salary table but during working hours, the weights will be low).

[0036] Furthermore, such as Figure 2 As shown, the multimodal cross-attention network consists of a text encoder, a sequence encoder, an action encoder, and a feature fusion layer, specifically including: The text encoder uses an LSTM or Transformer encoder to encode the high-dimensional semantic vectors corresponding to the text modal data.

[0037] The sequence encoder employs a Long Short-Term Memory (LSTM) network, a gated recurrent unit (GRU), or a recurrent neural network (RNN) to encode the temporal feature vectors corresponding to the sequence modal data.

[0038] The behavior encoder uses a graph neural network (GNN) to encode the node embedding vectors corresponding to the behavior modality data.

[0039] The feature fusion layer achieves multimodal feature fusion through a cross-attention mechanism, which is calculated as follows:

[0040] in, For querying the matrix, The key matrix, For value matrices, Let K be the transpose of matrix K. Let be the dimension of the key vector. Scaling factor The function is used to transform the input into a probability distribution.

[0041] S3, input the comprehensive situation feature vector into the classifier or anomaly detection model, and output the current risk score in real time.

[0042] Specifically, in this embodiment of the invention, the situation feature vector is input into a classifier (such as a fully connected layer + Softmax) or an anomaly detection model (such as Isolation Forest), and the current global security situation score (risk score) is output in real time (e.g., 0-100 points, with higher scores indicating greater risk). This embodiment not only outputs the overall score but also outputs individual risk indices for specific users and specific assets.

[0043] In this embodiment, the situational awareness module outputs a real-time security situation score (RiskScore) based on the fused vector. The judgment result is that the system's output score at this time is 85 points (high risk), which is much higher than the user's daily average risk baseline (15 points).

[0044] S4. The access control gateway dynamically adjusts the access policy based on the risk score and performs corresponding security measures on access requests according to different risk levels.

[0045] Specifically, such as Figure 3 As shown, an extended access control policy is defined. ,in This is based on real-time risk assessment. The access control gateway intercepts every data access request, verifying not only the subject and resource but also querying the risk score output in step S3 in real time. This control is session-level or even request-level, rather than just verifying at login.

[0046] In this embodiment of the invention, upon receiving a risk signal of 85 points, the access control gateway immediately triggers a "Dynamic Masking" strategy instead of directly blocking the data (to prevent misjudgment from affecting business operations). The gateway intercepts the original result set returned by the database and replaces the "salary amount" field in real time using a masking algorithm. Ultimately, the query result seen by user U on the terminal is "R&D Engineer: The sensitive data, including "USD", was not leaked. Simultaneously, the system sent a "high-risk abnormal access" alert to the security administrator and requested user U to perform two-factor authentication (MFA) to remove the restrictions.

[0047] Furthermore, the dynamic access control policy is defined as a 5-tuple. ,in Indicates the access subject, Indicates the object being visited. Indicates an access action. Indicates environmental attributes, This indicates the risk level corresponding to the risk score.

[0048] Furthermore, corresponding security measures are implemented for access requests based on different risk levels, specifically including: When the risk score is lower than the first threshold, it is determined to be low risk and normal access is allowed.

[0049] When the risk score is higher than the second threshold but lower than the third threshold, it is determined to be of medium risk, triggering secondary verification or data anonymization.

[0050] When the risk score is higher than the third threshold, it is determined to be high risk. The access control gateway will first trigger the dynamic data masking policy, send an abnormal access alarm to the security administrator, and require the access subject to complete the two-factor authentication. If the access subject fails the two-factor authentication, the access connection will be blocked and the access subject's account will be frozen. The dynamic data masking includes real-time masking of sensitive fields in the database return results.

[0051] Specifically, in this embodiment, a risk score below 30 is considered low risk, a risk score above 30 and below 70 is considered medium risk, and a risk score above 70 is considered high risk.

[0052] In summary, a specific application scenario of this embodiment is dynamic defense against abnormal data access to internal accounts. It demonstrates how, when an account of a finance personnel exhibits abnormal behavior, multimodal data fusion is used for situational awareness, and the entire process of automatically executing dynamic de-identification control is implemented. The security data fusion method based on a multimodal cross-attention mechanism of this invention can simultaneously process log text, network traffic sequences, and user behavior graph data to generate a unified situational feature vector. Furthermore, the real-time calculated security situational score can be introduced into the ABAC model to achieve dynamic adjustment of request-level permissions (such as dynamic de-identification and dynamic blocking).

[0053] Example 2 This invention also provides a multimodal data security situation awareness and access control system. This system includes a closed-loop system architecture encompassing data acquisition, multimodal fusion, situation quantification, and policy execution. Figure 4 and Figure 5 As shown, the system 10 specifically includes: The multimodal data acquisition and preprocessing module 100 is used to capture multimodal data in real time and to vectorize the captured multimodal data to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors; The multimodal feature fusion and situational awareness module 200 is used to construct a multimodal cross-attention network, input the multimodal vectors into the multimodal cross-attention network and map them to a unified semantic space; through the attention mechanism, it automatically learns the correlation weights between different modalities, realizes multimodal feature fusion and situational awareness, and generates a comprehensive situational feature vector; The dynamic strategy decision engine module 300 is used to input the comprehensive situation feature vector into a classifier or anomaly detection model and output the current risk score in real time. The adaptive access control gateway module 400 is used to dynamically adjust the access policy based on the risk score through the access control gateway, and to perform corresponding security measures on access requests according to different risk levels.

[0054] Example 3 To implement the methods of the above embodiments, the present invention also provides a computer device, which includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, so as to implement the various steps of the methods described above.

[0055] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0056] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0057] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0058] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A data security posture insight and access control method based on multimodal approaches, characterized in that, Includes the following steps: Multimodal data is captured in real time, and the captured multimodal data is vectorized and encoded to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors; A multimodal cross-attention network is constructed, and the multimodal vectors are input into the multimodal cross-attention network and mapped to a unified semantic space; the association weights between different modalities are automatically learned through the attention mechanism to realize multimodal feature fusion and situational awareness, and generate a comprehensive situational feature vector. The comprehensive situation feature vector is input into a classifier or anomaly detection model, and the current risk score is output in real time. Access control gateways dynamically adjust access policies based on the risk scores and implement corresponding security measures for access requests according to different risk levels.

2. The method according to claim 1, characterized in that, The real-time capture of multimodal data and the vectorization encoding of the captured multimodal data to obtain multimodal vectors include: For text modal data, a BERT pre-trained language model is used to transform text logs into high-dimensional semantic vectors; For sequence modal data, LSTM or Transformer encoders are used to transform traffic data and API sequence data into time-series feature vectors; For behavioral modality data, a graph neural network (GNN) is used to construct a user-asset-operation interaction graph, and node embedding vectors are extracted from the interaction graph.

3. The method according to claim 1, characterized in that, The multimodal cross-attention network consists of a text encoder, a sequence encoder, an action encoder, and a feature fusion layer, specifically including: The text encoder uses an LSTM or Transformer encoder to encode the high-dimensional semantic vectors corresponding to the text modal data; The sequence encoder uses a Long Short-Term Memory (LSTM) network, a gated recurrent unit (GRU) or a recurrent neural network (RNN) to encode the temporal feature vectors corresponding to the sequence modal data. The behavior encoder uses a graph neural network (GNN) to encode the node embedding vectors corresponding to the behavior modality data. The feature fusion layer achieves multimodal feature fusion through a cross-attention mechanism, which is calculated as follows: in, For querying the matrix, The key matrix, For value matrices, Let K be the transpose of matrix K. Let be the dimension of the key vector. Scaling factor The function is used to transform the input into a probability distribution.

4. The method according to claim 1, characterized in that, The dynamic access control policy is defined as a five-tuple. ,in Indicates the access subject, Indicates the object being visited. Indicates an access action. Indicates environmental attributes, This indicates the risk level corresponding to the risk score.

5. The method according to claim 1, characterized in that, The implementation of corresponding security measures for access requests based on different risk levels includes: When the risk score is lower than the first threshold, it is determined to be low risk and normal access is allowed; When the risk score is higher than the second threshold and lower than the third threshold, it is determined to be of medium risk, triggering secondary verification or data anonymization; When the risk score is higher than the third threshold, it is determined to be high risk. The access control gateway will first trigger the dynamic data masking policy, send an abnormal access alarm to the security administrator, and require the access subject to complete the two-factor authentication. If the access subject fails the two-factor authentication, the access connection will be blocked and the access subject's account will be frozen. The dynamic data masking includes real-time masking of sensitive fields in the database return results.

6. A multimodal data security situation awareness and access control system, characterized in that, include: A multimodal data acquisition and preprocessing module is used to capture multimodal data in real time and to vectorize the captured multimodal data to obtain multimodal vectors; wherein, the multimodal data includes text modal data, sequence modal data, and behavioral modal data, and the multimodal vectors include high-dimensional semantic vectors, temporal feature vectors, and node embedding vectors; The multimodal feature fusion and situational awareness module is used to construct a multimodal cross-attention network, input the multimodal vectors into the multimodal cross-attention network and map them to a unified semantic space; through the attention mechanism, it automatically learns the correlation weights between different modalities, realizes multimodal feature fusion and situational awareness, and generates a comprehensive situational feature vector; The dynamic strategy decision engine module is used to input the comprehensive situation feature vector into a classifier or anomaly detection model and output the current risk score in real time. The adaptive access control gateway module is used to dynamically adjust access policies based on the risk score through the access control gateway, and to implement corresponding security measures for access requests according to different risk levels.

7. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the multimodal data security situation insight and access control method as described in any one of claims 1-5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the multimodal data security situational awareness and access control method as described in any one of claims 1-5.

Images