An artificial intelligence assisted zero trust detection method, device, equipment and medium

Abstract

This application relates to the field of network security technology and discloses an artificial intelligence-assisted zero-trust detection method, apparatus, device, and medium. The method includes: acquiring an access request from an accessing subject to a target access object, and collecting access context data corresponding to the access request; extracting features from the access context data to obtain access context features, including access time features, access space features, and an access session association graph; processing the access context features through an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators; determining whether there is an abnormal correlation between the terminal anomaly indicators and session anomaly indicators, and dynamically generating an access risk level based on the determination result; and matching and executing corresponding access control policies for the access request based on the access risk level. This application can improve the accuracy of identifying abnormal access risks in a zero-trust environment.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, specifically to an artificial intelligence-assisted zero-trust detection method, apparatus, device, and medium. Background Technology

[0002] With the continuous development of cloud computing, mobile office, microservices, and distributed application architectures, the access boundaries of enterprise information systems are gradually shifting from traditional fixed network boundaries to dynamic access environments that span terminals, networks, and services. Traditional security mechanisms based on network location, static identity authentication, or preset access permissions are insufficient to continuously reflect changes in the access subject, terminal environment, and network communication status. Zero-trust security architecture, based on continuous verification and dynamic authorization, continuously acquires contextual information such as identity, terminal, network, and behavior during the access process to dynamically assess the trustworthiness of access requests and implement corresponding access controls. It has been gradually applied in scenarios such as enterprise office networks, cloud platforms, and microservice architectures. However, existing zero-trust access control technologies still have certain limitations in practical applications. On the one hand, security information such as access time, login location, terminal status, and network session usually comes from different sources, and their data scale, change patterns, and anomaly manifestations vary significantly. If only a single indicator or a fixed combination of multiple indicators is used, local anomalies can easily be amplified or offset, making it difficult to accurately reflect the overall risk of an access request. On the other hand, the same user may have different access times, login locations, and communication paths in different business scenarios. Fixed rules or uniform thresholds are difficult to adapt to the behavioral differences between different users and target resources. In addition, network access usually involves multiple communication entities such as gateways, proxies, and application services. If abnormal communication only occurs in a local part of the access chain, existing technologies cannot determine whether the abnormality is substantially related to the current user and the current access behavior, which can easily lead to false alarms.

[0003] The information disclosed in this background section is intended only to enhance the understanding of the overall background of this application and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0004] The technical problem to be solved by this application is to overcome the defects of the prior art and provide an artificial intelligence-assisted zero-trust detection method, device, equipment and medium to improve the accuracy of identifying abnormal access risks in a zero-trust environment.

[0005] To solve the above-mentioned technical problems, this application provides the following technical solution:

[0006] On the one hand, this application provides an AI-assisted zero-trust detection method, comprising the following steps:

[0007] Obtain the access request from the access subject to the target access object, and collect the access context data corresponding to the access request;

[0008] Feature extraction is performed on the access context data to obtain the access context features of the access request, specifically including access time features, access space features, and access session association graph;

[0009] The access context features are processed by an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators.

[0010] Determine whether there is an abnormal correlation between the terminal abnormality indicator and the session abnormality indicator, and dynamically generate an access risk level for the access request based on the determination result;

[0011] Based on the access risk level, access requests are matched and corresponding access control policies are executed.

[0012] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the access context data includes the access time corresponding to the current access request, and the access time in the historical access records of the accessing subject to the target access object; the method for extracting the access time feature includes:

[0013] The access time corresponding to this access request is converted into a unified time representation value as the target access time; the access time in each historical access record is converted into a unified time representation value as the reference access time for each historical access record.

[0014] For any reference access time, calculate the first time difference and the second time difference of the target access time relative to the reference access time, and take the smaller value of the first time difference and the second time difference as the deviation of the target access time relative to the reference access time.

[0015] Set a kernel function; process the deviation of the target access time from each reference access time based on the kernel function to obtain the access probability density of the target access time;

[0016] The access time characteristics of this access request are calculated based on the access probability density.

[0017] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the access context data further includes the login location of the access subject corresponding to the current access request, and the historical login locations of the access subject.

[0018] The method for extracting the access spatial features includes: calculating the distance between the login location of the current access request and each historical login location, and taking the average as the spatial deviation of the current access request; and normalizing the spatial deviation as the access spatial feature of the current access request.

[0019] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the access context data further includes network session traffic data of the accessing subject;

[0020] The method for generating the access session association graph includes: extracting communication entity identification data and communication connection records based on the network session traffic data of the access subject;

[0021] Based on the communication entity identification data, nodes are added to the access session association graph; the nodes in the access session association graph include the node corresponding to the access subject, the node corresponding to the target access object, and intermediate nodes related to the network session of the access subject.

[0022] Based on the communication connection record, edges are added between nodes in the access session association graph to form a complete access session association graph; specifically, if communication occurs between any two nodes, an edge is added between the corresponding two nodes, and the added edge points from the data sender when the two nodes communicate to the receipt receiver.

[0023] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for processing the access context features to obtain terminal anomaly indicators includes:

[0024] The access time feature and access space feature are encoded into feature vectors respectively, and the feature vectors of the access time feature and the access space feature are concatenated and input into the trained anomaly detection model; the anomaly detection model outputs the probability that the current access request is an abnormal access request, which is used as the terminal anomaly index.

[0025] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for processing the access context features to obtain session anomaly indicators includes:

[0026] The node attributes of each node and the edge attributes of each edge in the access session association graph are encoded into feature vectors and concatenated to form a complete feature vector of the access session association graph. The complete feature vector of the access session association graph is then input into a graph neural network model. The graph neural network model calculates and outputs the graph-level feature vector of the access session association graph.

[0027] Filter reference access requests based on access request records; extract the graph-level feature vector of each reference access request as the reference feature vector for each reference access request.

[0028] The similarity between the graph-level feature vector of this access request and each reference feature vector is calculated, and the average value is used as the session anomaly indicator.

[0029] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for determining whether there is an abnormal correlation between the terminal anomaly indicator and the session anomaly indicator includes:

[0030] Calculate the first risk level of this access request based on the terminal anomaly indicators;

[0031] Mark the actual communication path of this access request in the access session association graph, and identify the abnormal edges associated with the actual communication path;

[0032] If the abnormal edge associated with the actual communication path is related to the access subject node, and the first risk level is greater than 0, then the terminal abnormality index and the session abnormality index are abnormally correlated.

[0033] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for calculating the first risk level includes:

[0034] Based on the anomaly detection model, the terminal anomaly index for each reference access request is calculated; the median of the terminal anomaly indexes for all reference access requests is extracted as the first reference anomaly index.

[0035] If the terminal anomaly index of the current access request is less than or equal to the first reference anomaly index, the first risk level is set to 0; otherwise, the first risk level is calculated based on the difference between the terminal anomaly index of the current access request and the first reference anomaly index.

[0036] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for identifying abnormal edges associated with the actual communication path includes marking the edges connecting any two actual communication nodes in the access session association graph as candidate detection edges.

[0037] Each candidate edge is checked to determine whether it is an abnormal edge associated with the actual communication path. Specifically, this includes:

[0038] Mark any candidate detection edge as a target detection edge; after removing the target detection edge from the access session association graph, recalculate the session anomaly index;

[0039] The difference between the session anomaly index after removing the target detection edge and the session anomaly index before removing the target detection edge is calculated and denoted as the anomaly representation value of the target detection edge.

[0040] If the anomaly representation value is greater than the preset anomaly representation threshold, then the target detection edge is an anomaly edge associated with the actual communication path.

[0041] The method for determining whether the abnormal edges associated with the actual communication path are related to the access subject node includes: marking all abnormal edges associated with the actual communication path as abnormal associated nodes; if the abnormal associated nodes include the access subject node, then the abnormal edges associated with the actual communication path are related to the access subject node.

[0042] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for dynamically generating an access risk level for the access request includes:

[0043] The second risk level of this access request is calculated based on the session anomaly index; the larger of the first risk level and the second risk level is taken as the access risk level.

[0044] If there is an abnormal correlation between terminal abnormality indicators and session abnormality indicators, the abnormal correlation strength is extracted, and the access risk level is strengthened and corrected based on the abnormal correlation strength.

[0045] The method for extracting the anomaly association strength includes: calculating the ratio of the total number of anomaly edges associated with the actual communication path to the total number of candidate detected edges, as the anomaly association strength.

[0046] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method for calculating the second risk level includes: calculating the session anomaly index for each reference access request based on the graph neural network model; and extracting the median of the session anomaly indices for all reference access requests as the second reference anomaly index.

[0047] If the session anomaly index of the current access request is greater than or equal to the second reference anomaly index, the second risk level is set to 0; otherwise, the second risk level is calculated based on the difference between the second reference anomaly index and the session anomaly index of the current access request.

[0048] As a preferred embodiment of the AI-assisted zero-trust detection method described in this application, the method includes: matching access requests with access control policies based on the access risk level and executing corresponding access control policies; specifically, it includes: setting a risk level threshold based on reference access records.

[0049] The access risk level is compared with the risk level threshold, and the access request is matched and the corresponding access control policy is executed based on the comparison result.

[0050] Secondly, this application provides an artificial intelligence-assisted zero-trust detection device, comprising a request monitoring module, a data processing module, an artificial intelligence module, a risk identification module, and an access control module; wherein:

[0051] The request monitoring module is used to obtain access requests from the access subject to the target access object and collect access context data;

[0052] The data processing module extracts features from the access context data to obtain the access context features of the access request;

[0053] The artificial intelligence module processes the access context features through an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators;

[0054] The risk identification module is used to determine whether there is an abnormal correlation between the terminal abnormality indicators and the session abnormality indicators, and dynamically generate the access risk level based on the determination result;

[0055] The access control module matches access requests with the access risk level and executes the corresponding access control policy.

[0056] Thirdly, the present invention provides an electronic device comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement an artificial intelligence-assisted zero-trust detection method as proposed in this application.

[0057] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements an artificial intelligence-assisted zero-trust detection method as proposed in this application.

[0058] Compared with the prior art, the beneficial effects achieved by this application are as follows:

[0059] This application achieves joint analysis of access request risk status by comprehensively utilizing multi-dimensional access context information such as access time, access space, and network session, and combining it with artificial intelligence models to extract terminal anomaly indicators and session anomaly indicators. Furthermore, it combines actual communication paths and anomaly edge correlations to determine whether different anomaly information has a substantial relationship, and dynamically generates access risk levels accordingly. This reduces the impact of single indicators or differences in the output scale of different models on risk assessment. Therefore, it can improve the accuracy and relevance of anomaly access identification in a zero-trust environment, making access control strategies more adaptable to the dynamic changes of different access subjects and access scenarios, and improving the reliability and granularity of access control. Attached Figure Description

[0060] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0061] Figure 1 A flowchart of an AI-assisted zero-trust detection method provided in this application;

[0062] Figure 2 This is a schematic diagram illustrating an application scenario for an AI-assisted zero-trust detection device provided in this application. Detailed Implementation

[0063] The technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments and specific features in the embodiments are detailed descriptions of the technical solution of this application, rather than limitations thereof. In the absence of conflict, the embodiments and technical features in the embodiments can be combined with each other.

[0064] This solution can be applied to zero-trust access control scenarios in enterprise office networks, cloud platforms, and microservice architectures. The access subjects are terminal clients used by office staff or automated microservice scripts. The target access objects include business application servers, databases, application programming interface services, and other protected network assets. The executor of this solution first listens for and intercepts access requests from the access subjects at the network access layer or application gateway. Then, it works with IAM (Identity and Access Management) components, UEM (Unified Terminal Management) components, network traffic analysis probes, and asset configuration management databases to comprehensively collect access context data corresponding to the access request. Furthermore, it performs feature extraction and dynamically generates access risk levels, thereby achieving continuous verification, dynamic trust assessment, and differentiated access control for each access request.

[0065] Example 1

[0066] This embodiment introduces an artificial intelligence-assisted zero-trust detection method, referring to... Figure 1 The method includes:

[0067] Obtain the access request from the access subject to the target access object, and collect the access context data corresponding to the access request;

[0068] Feature extraction is performed on the access context data to obtain the access context features of the access request, specifically including access time features, access space features, and access session association graph;

[0069] The access context data includes the access time corresponding to this access request, as well as the access time in the historical access records of the access subject to the target access object;

[0070] The method for extracting the access time feature includes:

[0071] Convert the access time corresponding to this access request into a unified time representation value, which will be used as the target access time;

[0072] The access time in each historical access record is converted into a unified time representation value, which serves as the reference access time for each historical access record;

[0073] In one alternative implementation, a minute value is used as a uniform time representation value; specifically, the access time of the day is converted into a minute value relative to the start time, with 0:00 of the day as the starting time; for example, if the access time is 8:30, the converted time representation value is 510, in minutes.

[0074] For any reference access time, calculate the first time difference and the second time difference of the target access time relative to the reference access time, and take the smaller value of the first time difference and the second time difference as the deviation of the target access time relative to the reference access time.

[0075] Specifically, for any historical access record with a reference access time, the difference between the target access time and the reference access time is calculated and its absolute value is taken as the first time difference; the difference between 1440 and the first time difference is calculated as the second time difference. Here, 1440 represents the maximum number of minutes in a day; the smaller value between the first time difference and the second time difference is taken as the deviation amount to prevent the deviation from exceeding 1440 minutes. For example, 23:50 on the previous day and 0:10 on the next day are actually only 20 minutes apart, not 1420 minutes.

[0076] Set a kernel function; process the deviation of the target access time from each reference access time based on the kernel function to obtain the access probability density of the target access time;

[0077] In one alternative implementation, a Gaussian kernel function is selected to handle the deviation, as shown in the following formula:

[0078] ;

[0079] In the formula, p represents the access probability density of the target access time; n represents the total number of samples of historical access records used, which can be set to 30; h represents the bandwidth of the Gaussian kernel function, which can be taken as 30 minutes to 60 minutes in this embodiment to adapt to the normal fluctuation of access time from half an hour to one hour and balance false alarms and false negatives. This represents the deviation of the target access time from the i-th reference access time.

[0080] In this embodiment, the access probability density p represents the relative probability of a user accessing the device at the time corresponding to the target access time within a day. The more concentrated the reference access times are around the target access time, the greater the access probability density p.

[0081] The access time characteristics of this access request are calculated based on the access probability density.

[0082] In an optional implementation, the access probability density is converted into access time features using a negative logarithmic form, as shown in the following formula:

[0083] ;

[0084] In the formula, A represents the access time characteristic. A very small positive number is set to prevent the logarithm from being impossible to calculate when the probability density is close to 0, for example... The greater the deviation of the target access time from the reference access time, the larger the access time characteristic A.

[0085] Preferably, the access time feature A is normalized before subsequent processing steps are performed. For example, the maximum and minimum values ​​of the access time feature in all historical access records are counted, and the access time feature of the current access request is normalized using Min-Max normalization (extreme value normalization).

[0086] It should be noted that existing access control systems or security audit platforms can mark historical access records as normal or abnormal based on authentication results, access policy enforcement results, and manual review results. This embodiment only selects historical access records marked as normal access to calculate the reference access time.

[0087] The access context data also includes the login location of the access subject corresponding to this access request, as well as the access subject's historical login locations;

[0088] The method for extracting the access spatial features includes: calculating the distance between the login location of the current access request and each historical login location, and taking the average as the spatial deviation of the current access request; and normalizing the spatial deviation as the access spatial feature of the current access request.

[0089] Specifically, the method for calculating the distance between any two login locations includes: converting the login locations into latitude and longitude coordinates, and using the Haversine formula to calculate the surface distance between the login locations. For example, the login locations are recorded as IP addresses, and the latitude and longitude coordinates of the corresponding streets, base stations, parks, or equipment rooms are extracted according to the actual situation and used in the calculation of the surface distance formula.

[0090] Optionally, the method for normalizing the spatial deviation includes: extracting the historical login locations of the accessing subject within a certain time range (e.g., the last 30 days), and extracting the maximum distance between any two historical login locations as the reference deviation; calculating the ratio of the spatial deviation to the reference deviation as the access spatial feature; if the normalized value is greater than 1, then the access spatial feature is truncated to 1.

[0091] The access context data also includes network session traffic data of the accessing entity;

[0092] The method for generating the access session association graph includes: extracting communication entity identification data and communication connection records based on the network session traffic data of the access subject;

[0093] Based on the communication entity identification data, nodes are added to the access session association graph; the nodes in the access session association graph include the node corresponding to the access subject, the node corresponding to the target access object, and intermediate nodes related to the network session of the access subject.

[0094] In this embodiment, the intermediate nodes include access gateway nodes, application gateway nodes, proxy forwarding nodes, and invoked application service nodes related to the network session of the accessing subject. The access gateway node receives the access request from the accessing subject; the application gateway node forwards the access request; the proxy forwarding node includes nodes corresponding to reverse proxies, load balancers, or service mesh proxies; and the application service node is the business service node that the access request passes through or invokes before reaching the target access object. The communication entity identification data includes the network address, device identifier, or service identifier corresponding to each node. The communication entity identification data can be used to determine the list of nodes and to mark and distinguish them. After adding a node, each node is numbered, and one of the network address, device identifier, or service identifier is recorded as a node attribute.

[0095] Based on the communication connection record, edges are added between nodes in the access session association graph to form a complete access session association graph; specifically, if communication occurs between any two nodes, an edge is added between the corresponding two nodes, and the added edge points from the data sender when the two nodes communicate to the receipt receiver.

[0096] In this embodiment, the edges in the access session association graph are used to represent the actual directed communication relationships and communication directions between nodes. The communication connection record includes at least the data sender identifier, data receiver identifier, communication time, protocol type, session identifier, and application programming interface call identifier for each communication recorded during inter-node communication; after adding the edges, each edge is numbered, and at least one of the communication time, access request identifier, and session identifier is recorded as an edge attribute.

[0097] Optionally, when an access request from a user is intercepted, the system traces back from the moment of interception to extract the user's network session traffic data, and continuously monitors new network session traffic data generated by the user after the moment of interception. The traceback duration can be set to 10 to 30 minutes to extract recent communication records before and after the current access request. This traceback can cover authentication, gateway forwarding, and recent service call relationships that are close to the current access request, avoiding excessive interference from irrelevant historical sessions.

[0098] The access context features are processed by an AI detection model to obtain terminal anomaly indicators and session anomaly indicators.

[0099] The method for processing the access context features to obtain terminal anomaly indicators includes:

[0100] The access time feature and access space feature are encoded into feature vectors respectively, and the feature vectors of the access time feature and the access space feature are concatenated and input into the trained anomaly detection model; the anomaly detection model outputs the probability that the current access request is an abnormal access request, which is used as the terminal anomaly index.

[0101] In one implementation, the anomaly detection model employs a multi-layer fully connected neural network. Access time features and access space features are each encoded as an 8-dimensional feature vector, which is then concatenated to form a 16-dimensional input vector. The anomaly detection model sequentially sets three hidden layers containing 32, 16, and 8 neurons respectively. Each hidden layer uses the ReLU activation function, and a Dropout layer with a dropout rate of 0.2 is set after the first two hidden layers. The output layer has one neuron and uses the Sigmoid activation function, outputting the probability that the current access request is an anomalous access request.

[0102] During anomaly detection model training, 10,000 already labeled access request records are selected. Each access request includes access time features, access space features, and a label indicating whether it is an anomalous access request. The labeling method is as follows: a normal access request is labeled as 0; if it is blocked by the access control system, confirmed by threat detection, or manually verified as an anomalous access request, it is labeled as 1. The training set, validation set, and test set are divided into an 8:1:1 ratio. The Adam optimization algorithm is used, with an initial learning rate of 0.001, a batch size of 64, and a maximum number of iterations of 100 rounds. Training is stopped early when the validation set loss does not decrease for 10 consecutive rounds, and the model parameters with the lowest validation set loss are retained. If the number of historical request records for the current target access object by the current access subject is insufficient, other access request records of the same type as the current access subject and the same type as the target access object can be selected to supplement the training. For example, the same access subject type indicates the same scope of authority or business function; the same target access asset type indicates the same asset category, business purpose, or access interface type.

[0103] The method for processing the access context features to obtain session anomaly indicators includes:

[0104] The node attributes of each node and the edge attributes of each edge in the access session association graph are encoded into feature vectors and concatenated to form a complete feature vector of the access session association graph. The complete feature vector of the access session association graph is then input into a graph neural network model. The graph neural network model calculates and outputs the graph-level feature vector of the access session association graph.

[0105] Filter reference access requests based on access request records; extract the graph-level feature vector of each reference access request as the reference feature vector for each reference access request.

[0106] The similarity between the graph-level feature vector of this access request and each reference feature vector is calculated, and the average value is used as the session anomaly indicator.

[0107] Optionally, the similarity between the graph-level feature vector of this access request and any reference feature vector is calculated based on cosine similarity, and when the cosine similarity is less than 0, the corresponding similarity is assigned a value of 0.

[0108] For the access request records used in training the anomaly detection model, access request records that have saved the network session traffic data of the access subject and are marked as normal access requests are selected as reference access requests. Referring to the method of generating access session association graphs described in this embodiment, an access session association graph is generated for each selected reference access request, and the graph-level feature vector of each access request record is extracted by the graph neural network model as the corresponding reference feature vector.

[0109] As an optional implementation, the graph neural network model includes an input layer, two graph information transfer layers, and a global pooling output layer. The input layer receives feature vectors of node attributes and edge attributes; the node attributes of any node are encoded as a 16-dimensional feature vector, and the edge attributes of any edge are encoded as an 8-dimensional feature vector. The first graph information transfer layer outputs a 32-dimensional node state vector, and the second graph information transfer layer outputs a 16-dimensional node state vector. Each layer uses the ReLU activation function. The global pooling output layer averages all node state vectors to obtain a 16-dimensional graph-level feature vector. In each graph information transfer layer, the features of the predecessor and successor nodes connected to each node are aggregated, and combined with the corresponding edge attributes and node attributes, the state vector of each node is updated. After two layers of information transfer, the state vector of each node simultaneously represents the node's own attributes and its contextual relationship in the access chain.

[0110] In this embodiment, the higher the terminal anomaly index, the higher the probability that the current access request is an abnormal access request; the higher the session anomaly index, the higher the probability that the current access request is a normal access request.

[0111] Determine whether there is an abnormal correlation between the terminal abnormality indicator and the session abnormality indicator, and dynamically generate an access risk level for the access request based on the determination result;

[0112] The methods for determining whether there is an abnormal correlation between the terminal anomaly indicators and the session anomaly indicators include:

[0113] Calculate the first risk level of this access request based on the terminal anomaly indicators;

[0114] Mark the actual communication path of this access request in the access session association graph, and identify the abnormal edges associated with the actual communication path;

[0115] If the abnormal edge associated with the actual communication path is related to the access subject node, and the first risk level is greater than 0, then the terminal abnormality index and the session abnormality index are abnormally correlated.

[0116] The method for calculating the first risk level includes:

[0117] Based on the anomaly detection model, the terminal anomaly index for each reference access request is calculated; the median of the terminal anomaly indexes for all reference access requests is extracted as the first reference anomaly index.

[0118] If the terminal anomaly index of the current access request is less than or equal to the first reference anomaly index, the first risk level is set to 0; otherwise, the first risk level is calculated based on the difference between the terminal anomaly index of the current access request and the first reference anomaly index.

[0119] In one optional implementation, when the terminal anomaly index of this access request is greater than the first reference anomaly index, the first risk level is calculated based on the following formula:

[0120] ;

[0121] in, Indicates the first level of risk. Let represent the first reference anomaly indicator, and m represent the terminal anomaly indicator for this access request. The first risk level calculated based on the above formula ranges from 0 to 1.

[0122] In this embodiment, the method for marking the actual communication path of the current access request in the access session association graph includes: generating a unique access request identifier for each access request, and constructing a session identifier using the source IP and source port of the access subject in the access request, the target IP and target port of the target access object, the transmission protocol, and the request time. Based on the network session traffic data, edges in the access session association graph that have the same access request identifier or session identifier as the current access request are extracted and designated as actual communication edges; nodes connected by any actual communication edge are marked as actual communication nodes. The actual communication path includes all actual communication edges and all actual communication nodes.

[0123] The method for identifying abnormal edges associated with the actual communication path includes: marking the edges connecting any two actual communication nodes in the access session association graph as candidate detection edges;

[0124] Each candidate edge is checked to determine whether it is an abnormal edge associated with the actual communication path. Specifically, this includes:

[0125] Mark any candidate detection edge as a target detection edge; after removing the target detection edge from the access session association graph, recalculate the session anomaly index;

[0126] The difference between the session anomaly index after removing the target detection edge and the session anomaly index before removing the target detection edge is calculated and denoted as the anomaly representation value of the target detection edge.

[0127] If the anomaly representation value is greater than the preset anomaly representation threshold, then the target detection edge is an anomaly edge associated with the actual communication path.

[0128] In this embodiment, removing the target detection edge from the access session association graph means that when recalculating the graph-level feature vector through the graph neural network model, the feature vector corresponding to the edge attribute of the input target detection edge is skipped, the graph-level feature vector is re-extracted, and then the session anomaly index is recalculated. Optionally, the anomaly representation threshold is set to 15% of the session anomaly index before removing the target detection edge; this means that if the session anomaly index increases by more than 15% after removing the target detection edge, it indicates that the communication record corresponding to the target detection edge is a key factor in suppressing the session anomaly index.

[0129] In this embodiment, the access subject node is the node corresponding to the access subject in the access session association graph. The number of candidate detection edges is greater than or equal to the number of actual communication edges; for example, there may be multiple edges between two actual communication nodes, and the remaining edges other than the actual communication edges should also be marked as candidate detection edges.

[0130] The method for determining whether the abnormal edges associated with the actual communication path are related to the access subject node includes: marking all abnormal edges associated with the actual communication path as abnormal associated nodes; if the abnormal associated nodes include the access subject node, then the abnormal edges associated with the actual communication path are related to the access subject node.

[0131] The method for dynamically generating access risk levels for the access request includes:

[0132] The second risk level of this access request is calculated based on the session anomaly index; the larger of the first risk level and the second risk level is taken as the access risk level.

[0133] If there is an abnormal correlation between terminal abnormality indicators and session abnormality indicators, the abnormal correlation strength is extracted, and the access risk level is strengthened and corrected based on the abnormal correlation strength.

[0134] The methods for calculating the second risk level include:

[0135] Based on the graph neural network model, the session anomaly index for each reference access request is calculated; the median of the session anomaly index for all reference access requests is extracted as the second reference anomaly index.

[0136] If the session anomaly index of the current access request is greater than or equal to the second reference anomaly index, the second risk level is set to 0; otherwise, the second risk level is calculated based on the difference between the second reference anomaly index and the session anomaly index of the current access request.

[0137] In one optional implementation, when the session anomaly index of the current access request is less than the second reference anomaly index, the second risk level is calculated based on the following formula:

[0138] ;

[0139] in, Indicates the second level of risk. This represents the second reference anomaly indicator, and n represents the session anomaly indicator for this access request.

[0140] Optionally, the mean vector of all reference feature vectors is calculated; for any reference access request, the similarity between its reference feature vector and the mean vector is calculated as an indicator of its session anomaly.

[0141] In this embodiment, the first risk level and the second risk level are calculated based on the terminal anomaly index and session anomaly index of this access request compared with the normal level of their respective anomaly indexes. Only the portion of the terminal anomaly index and session anomaly index that is higher than the normal level is retained, thereby eliminating the output scale and benchmark differences of different models and making the first risk level and the second risk level comparable.

[0142] The method for extracting the anomaly association strength includes: calculating the ratio of the total number of anomaly edges associated with the actual communication path to the total number of candidate detected edges, as the anomaly association strength.

[0143] In this embodiment, if the first risk level is greater than 0, it indicates that the accessing entity has a high risk of anomaly. If the abnormal edge associated with the actual communication path is related to the accessing entity's node, and further indicates that the accessing entity has been associated with abnormal communication records, the access request control for that accessing entity should be more stringent. In an optional implementation, the formula for strengthening and correcting the access risk level based on the abnormal association strength is as follows:

[0144] ;

[0145] In the formula, R represents the access risk level; L represents the strength of the abnormal association. This represents the larger of the first and second risk levels. This represents the smaller value between the first and second risk levels. The formula implies that the risk level is retained within the range of access risk levels. At the same time, superimposed The proportion that can be explained by the access subject.

[0146] Based on the access risk level, access requests are matched and corresponding access control policies are executed; specifically, this includes setting a risk level threshold based on reference access records;

[0147] The access risk level is compared with the risk level threshold, and the access request is matched and the corresponding access control policy is executed based on the comparison result.

[0148] In one optional implementation, the risk threshold includes a first risk threshold and a second risk threshold; the method for setting the first risk threshold and the second risk threshold based on the reference access record includes:

[0149] Calculate the access risk level of each reference access record as a reference normal risk level; sort the reference normal risk levels from smallest to largest, and take the 5th percentile as the first risk threshold, so that the access risk level of most normal access requests is less than the first risk threshold.

[0150] For the access request records used in training the anomaly detection model, the access request records that have saved the network session traffic data of the access subject and are marked as abnormal access requests are selected as reference abnormal requests; the access risk degree of each reference abnormal record is calculated as the reference abnormal risk degree; the reference abnormal risk degrees are sorted from smallest to largest, and the 95th percentile is taken as the second risk threshold, so that the access risk degree of most abnormal access requests is greater than the second risk threshold.

[0151] Further, optionally, based on the comparison result between the access risk level and the first risk threshold and the second risk threshold, a corresponding access control policy is matched and executed for the access request, specifically including:

[0152] If the access risk level of this access request is less than or equal to the first risk threshold, it is marked as a normal access request, and access to the target object is allowed. If the access risk level of this access request is greater than or equal to the second risk threshold, it is marked as an abnormal access request, and the access request is blocked. If the access risk level of this access request is greater than the first risk threshold but less than the second risk threshold, a secondary authentication request is sent to the access subject. A multi-factor authentication (MFA) secondary authentication request is sent to the access subject's terminal device via a mobile application, SMS gateway, or other preset authentication channel. During the period of sending the request and waiting for the access subject's response, the access control list is modified to perform a permission downgrade operation on this access request, for example, forcibly downgrading write permission to read-only permission. If the secondary authentication is successful, the permission is restored, and a full deep packet inspection is performed on the access subject to retain detailed access traces.

[0153] Example 2

[0154] This embodiment is the second embodiment of this application; based on the same inventive concept as Embodiment 1, this embodiment introduces an artificial intelligence-assisted zero-trust detection device, including a request monitoring module, a data processing module, an artificial intelligence module, a risk identification module, and an access control module; wherein:

[0155] The request monitoring module is used to obtain access requests from the access subject to the target access object and collect access context data. The request monitoring module is set at the network access layer or application gateway to listen for and intercept access requests from the access subject, and to work with the identity and access management component, terminal unified management component, network traffic analysis probe and asset configuration management database to collect access context data corresponding to the access request.

[0156] The data processing module extracts features from the access context data to obtain the access context features of the access request; the access context features include access time features, access space features, and access session association graph.

[0157] The artificial intelligence module processes the access context features through an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators. This module is configured with an anomaly detection model and a graph neural network model. The access time features and access space features are encoded and input into the trained anomaly detection model to obtain the probability that the current access request is an abnormal access request as the terminal anomaly indicator. The graph neural network model processes the access session association graph to obtain graph-level feature vectors, and combines them with the reference feature vectors of the reference access request to calculate the session anomaly indicator.

[0158] The risk identification module is used to determine whether there is an abnormal correlation between the terminal anomaly indicators and the session anomaly indicators, and dynamically generate an access risk level based on the determination result. Specifically, a first risk level is calculated based on the terminal anomaly indicators, and the actual communication path of this access request is marked in the access session association graph. Abnormal edges associated with the actual communication path are identified to determine whether the abnormal edges are related to the access subject node. A second risk level is calculated based on the session anomaly indicators, and an access risk level is generated based on the first risk level, the second risk level, and the strength of the abnormal correlation.

[0159] The access control module matches and executes corresponding access control policies for access requests based on the access risk level. The access control module sets a risk level threshold based on reference access records, compares the access risk level with the risk level threshold, and executes access control policies such as allowing access, blocking access, or requiring two-factor authentication based on the comparison result.

[0160] The specific functional implementation of each of the above modules refers to the relevant content in the AI-assisted zero-trust detection method described in Embodiment 1, and will not be repeated here.

[0161] The device described in this embodiment can be deployed in Figure 2 The network environment shown. (Refer to...) Figure 2The network environment includes a processor, communication bus, user interface, network interface, and memory. The network interface is mainly used for data communication with the network server; the user interface is mainly used for data interaction with the user; the memory includes: an operating system, used to manage and schedule hardware and software resources in the network environment; a network communication module, connected to the network interface, which receives and sends network communication data through the network interface; a user interface module, connected to the user interface, which receives user input information and outputs interactive information through the user interface; and a data storage module, used to store access context data, feature data, model processing results, and access control data, etc.

[0162] The memory also stores the AI-assisted zero-trust detection device described in this embodiment; the processor can call the AI-assisted zero-trust detection device stored in the memory and execute the zero-trust detection method based on the AI ​​trust evaluation algorithm provided in Embodiment 1 of the present invention.

[0163] Example 3

[0164] Based on the same inventive concept as other embodiments, this embodiment introduces an electronic device including a memory and a processor. The memory is used to store instructions, and the processor is used to execute the instructions, causing the computer device to perform an artificial intelligence-assisted zero-trust detection method as described in Embodiment 1.

[0165] Example 4

[0166] Based on the same inventive concept as other embodiments, this embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements an artificial intelligence-assisted zero-trust detection method as described in Embodiment 1.

[0167] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of protection of this application, and these forms are all within the protection scope of this application.

Claims

1. An AI-assisted zero-trust detection method, characterized in that: include: Obtain the access request from the access subject to the target access object, and collect the access context data corresponding to the access request; Feature extraction is performed on the access context data to obtain the access context features of the access request, specifically including access time features, access space features, and access session association graph; The access context features are processed by an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators. Determine whether there is an abnormal correlation between the terminal abnormality indicator and the session abnormality indicator, and dynamically generate an access risk level for the access request based on the determination result; Based on the access risk level, access requests are matched and corresponding access control policies are executed.

2. The AI-assisted zero-trust detection method as described in claim 1, characterized in that: The access context data includes the access time corresponding to this access request, as well as the access time in the historical access records of the access subject to the target access object; The method for extracting the access time feature includes: The access time corresponding to this access request is converted into a unified time representation value as the target access time; the access time in each historical access record is converted into a unified time representation value as the reference access time for each historical access record. For any reference access time, calculate the first time difference and the second time difference of the target access time relative to the reference access time, and take the smaller value of the first time difference and the second time difference as the deviation of the target access time relative to the reference access time. Set a kernel function; process the deviation of the target access time from each reference access time based on the kernel function to obtain the access probability density of the target access time; The access time characteristics of this access request are calculated based on the access probability density.

3. The AI-assisted zero-trust detection method as described in claim 2, characterized in that: The access context data also includes the login location of the access subject corresponding to this access request, as well as the access subject's historical login locations; The method for extracting the access spatial features includes: calculating the distance between the login location of the current access request and each historical login location, and taking the average as the spatial deviation of the current access request; The spatial deviation is normalized and used as the access spatial feature of this access request.

4. The AI-assisted zero-trust detection method as described in claim 3, characterized in that: The access context data also includes network session traffic data of the accessing entity; The method for generating the access session association graph includes: extracting communication entity identification data and communication connection records based on the network session traffic data of the access subject; Based on the communication entity identification data, nodes are added to the access session association graph; the nodes in the access session association graph include the node corresponding to the access subject, the node corresponding to the target access object, and intermediate nodes related to the network session of the access subject. Based on the communication connection record, edges are added between nodes in the access session association graph to form a complete access session association graph; specifically, if communication occurs between any two nodes, an edge is added between the corresponding two nodes, and the added edge points from the data sender when the two nodes communicate to the receipt receiver.

5. The AI-assisted zero-trust detection method as described in claim 4, characterized in that: The method for processing the access context features to obtain terminal anomaly indicators includes: The access time feature and access space feature are encoded into feature vectors respectively, and the feature vectors of the access time feature and the access space feature are concatenated and input into the trained anomaly detection model; the anomaly detection model outputs the probability that the current access request is an abnormal access request, which is used as the terminal anomaly index.

6. The AI-assisted zero-trust detection method as described in claim 5, characterized in that: The method for processing the access context features to obtain session anomaly indicators includes: The node attributes of each node and the edge attributes of each edge in the access session association graph are encoded into feature vectors and concatenated to form a complete feature vector of the access session association graph. The complete feature vector of the access session association graph is then input into a graph neural network model. The graph neural network model calculates and outputs the graph-level feature vector of the access session association graph. Filter reference access requests based on access request records; extract the graph-level feature vector of each reference access request as the reference feature vector for each reference access request. The similarity between the graph-level feature vector of this access request and each reference feature vector is calculated, and the average value is used as the session anomaly indicator.

7. The AI-assisted zero-trust detection method as described in claim 6, characterized in that: The methods for determining whether there is an abnormal correlation between the terminal anomaly indicators and the session anomaly indicators include: Calculate the first risk level of this access request based on the terminal anomaly indicators; Mark the actual communication path of this access request in the access session association graph, and identify the abnormal edges associated with the actual communication path; If the abnormal edge associated with the actual communication path is related to the access subject node, and the first risk level is greater than 0, then the terminal abnormality index and the session abnormality index are abnormally correlated.

8. The AI-assisted zero-trust detection method as described in claim 7, characterized in that: The method for calculating the first risk level includes: Based on the anomaly detection model, the terminal anomaly index for each reference access request is calculated; the median of the terminal anomaly indexes for all reference access requests is extracted as the first reference anomaly index. If the terminal anomaly index of the current access request is less than or equal to the first reference anomaly index, the first risk level is set to 0; otherwise, the first risk level is calculated based on the difference between the terminal anomaly index of the current access request and the first reference anomaly index.

9. The AI-assisted zero-trust detection method as described in claim 8, characterized in that: The method for identifying abnormal edges associated with the actual communication path includes: marking the edges connecting any two actual communication nodes in the access session association graph as candidate detection edges; Each candidate edge is checked to determine whether it is an abnormal edge associated with the actual communication path. Specifically, this includes: Mark any candidate detection edge as a target detection edge; after removing the target detection edge from the access session association graph, recalculate the session anomaly index; The difference between the session anomaly index after removing the target detection edge and the session anomaly index before removing the target detection edge is calculated and denoted as the anomaly representation value of the target detection edge. If the anomaly representation value is greater than the preset anomaly representation threshold, then the target detection edge is an anomaly edge associated with the actual communication path. The method for determining whether the abnormal edges associated with the actual communication path are related to the access subject node includes: marking all abnormal edges associated with the actual communication path as abnormal associated nodes; if the abnormal associated nodes include the access subject node, then the abnormal edges associated with the actual communication path are related to the access subject node.

10. The AI-assisted zero-trust detection method as described in claim 9, characterized in that: The method for dynamically generating access risk levels for the access request includes: The second risk level of this access request is calculated based on the session anomaly index; the larger of the first risk level and the second risk level is taken as the access risk level. If there is an abnormal correlation between terminal abnormality indicators and session abnormality indicators, the abnormal correlation strength is extracted, and the access risk level is strengthened and corrected based on the abnormal correlation strength. The method for extracting the anomaly association strength includes: calculating the ratio of the total number of anomaly edges associated with the actual communication path to the total number of candidate detected edges, as the anomaly association strength.

11. The AI-assisted zero-trust detection method as described in claim 10, characterized in that: The method for calculating the second risk level includes: calculating the session anomaly index for each reference access request based on the graph neural network model; and extracting the median of the session anomaly indexes for all reference access requests as the second reference anomaly index. If the session anomaly index of the current access request is greater than or equal to the second reference anomaly index, the second risk level is set to 0; otherwise, the second risk level is calculated based on the difference between the second reference anomaly index and the session anomaly index of the current access request.

12. The AI-assisted zero-trust detection method as described in claim 11, characterized in that: Based on the access risk level, access requests are matched and corresponding access control policies are executed. Specifically, this includes setting risk thresholds based on reference access records; The access risk level is compared with the risk level threshold, and the access request is matched and the corresponding access control policy is executed based on the comparison result.

13. An AI-assisted zero-trust detection device, used to implement an AI-assisted zero-trust detection method as described in any one of claims 1 to 12, characterized in that: It includes a request monitoring module, a data processing module, an artificial intelligence module, a risk identification module, and an access control module; among which: The request monitoring module is used to obtain access requests from the access subject to the target access object and collect access context data; The data processing module extracts features from the access context data to obtain the access context features of the access request; The artificial intelligence module processes the access context features through an artificial intelligence model to obtain terminal anomaly indicators and session anomaly indicators; The risk identification module is used to determine whether there is an abnormal correlation between the terminal abnormality indicators and the session abnormality indicators, and dynamically generate the access risk level based on the determination result; The access control module matches access requests with the access risk level and executes the corresponding access control policy.

14. An electronic device, characterized in that, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement an AI-assisted zero-trust detection method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements an artificial intelligence-assisted zero-trust detection method as described in any one of claims 1 to 12.

Images