An AI big data-based business permission management method and system

Abstract

The application belongs to the technical field of enterprise management, and particularly relates to a business permission management method and system based on AI big data. The method comprises the following steps: when it is determined based on the permission log that the access state is a normal access state, performing dynamic adjustment of the permission; when it is determined based on the permission log that the access state is an abnormal access state, preventing the user from accessing and recording the abnormal event; and in a subsequent access period, in response to an obtained user access request, performing access control. When it is determined that the access state is an abnormal access state, the time difference value between the actual access termination time and the access end time corresponding to the current access period is calculated to determine the type of the stop access behavior; at the same time, the permitted time fluctuation range is set based on the adjusted access permission end time, the access request initiated too early in the subsequent access period is monitored and identified, and the change from passive response to active defense is realized.

Description

Technical Field

[0001] This invention belongs to the field of enterprise management technology, specifically relating to a business access control method and system based on AI big data. Background Technology

[0002] With the digital transformation of enterprises, various information systems have become the hubs carrying business processes and data. In this context, a business access control system can ensure the security of enterprise data assets and prevent unauthorized access and information leakage. Therefore, building an access control system is of great value to the healthy development of modern enterprises.

[0003] Existing access control models, such as Role-Based Access Control (RBAC), have static and coarse-grained authorization logic, making them ill-suited to the complex business scenarios of modern enterprises. For example, temporary project teams or cross-departmental collaborations lead to overly broad permission configurations; conversely, to mitigate potential risks, permission configurations can be overly strict, thus impacting work efficiency. Furthermore, current technologies can only determine whether a user possesses a certain permission, but cannot combine contextual information such as time, access frequency, and operation sequence to determine the legitimacy of permission usage. This makes it difficult for the system to identify abnormal operations performed using legitimate identities, such as malicious access after account theft or unauthorized actions by internal personnel, resulting in frequent false positives and false negatives and hindering the timely detection of security threats.

[0004] In view of this, the present invention proposes a business access control method and system based on AI big data. Summary of the Invention

[0005] The purpose of this invention is to provide a business access management method and system based on AI big data, so as to solve the problem that the analysis of user access behavior in the existing technology is not comprehensive and is prone to misjudgment.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: a business permission management method based on AI big data, comprising: when the access status is determined to be a normal access status based on the permission log, performing dynamic permission adjustment; When the access status is determined to be abnormal based on the permission log, the user access is blocked and the abnormal event is recorded; and in subsequent access cycles, access control is executed in response to the obtained user access requests. The dynamic adjustment of execution permissions includes: determining the access frequency within a preset unit of time based on the permission log; and adjusting the access permission duration based on the comparison between the access frequency and the preset access requirement threshold to obtain the adjusted access permission end time. And based on the adjusted access permission end time, set the allowable time fluctuation range in subsequent access cycles, including the lower limit time.

[0007] Preferably, the access control includes: if the start time of a user's access request is earlier than the lower limit of the allowable time fluctuation range, the user's access request is identified as an abnormal access behavior, and an abnormal response handling mechanism is initiated. And if the user's access request starts no earlier than the lower limit time, the user's access request is approved.

[0008] Preferably, adjusting the access permission duration based on the comparison between the access frequency and the preset access requirement threshold includes: if the access frequency is greater than the preset access requirement threshold, calculating the adjusted access permission end time based on the permission adjustment parameters; Additionally, if the access frequency is not greater than the preset access requirement threshold, the access end time corresponding to the current access cycle will be used as the adjusted access permission end time.

[0009] Preferably, the method further includes: mapping the access frequency to permission adjustment parameters according to preset parameter adjustment rules.

[0010] Preferably, the abnormal response handling mechanism includes: issuing a security warning, suspending access permissions, and transferring the case to the administrator for handling.

[0011] A business access control system based on AI and big data includes: The access status monitoring module is used to determine whether the access status is normal or abnormal based on the permission log, and to obtain user access requests and their start times in subsequent access cycles. The permission duration adjustment module is used to dynamically adjust permissions when the access status monitoring module determines a normal access status. The dynamic permission adjustment includes: determining the access frequency within a preset unit time based on the permission log; adjusting the access duration based on the comparison result of the access frequency and a preset access requirement threshold to obtain the adjusted access duration end time; and setting the allowable time fluctuation range in subsequent access cycles based on the adjusted access duration end time, wherein the allowable time fluctuation range includes a lower limit time. The access control module is used to detect abnormal access statuses in response to the access status monitoring module and prevent users from accessing the system. In addition, in response to the access status monitoring module obtaining user access requests in subsequent access cycles, access control is executed.

[0012] Preferably, the permission duration adjustment module is used to calculate the adjusted access permission end time based on the permission adjustment parameters when the access frequency exceeds the preset access requirement threshold.

[0013] Preferably, the permission duration adjustment module is also used to: map the access frequency to permission adjustment parameters according to preset parameter adjustment rules.

[0014] Preferably, the abnormal response handling mechanism includes: issuing a security warning, suspending access permissions, and transferring the case to the administrator for handling.

[0015] Preferably, the access control includes: if the start time of a user access request is earlier than the lower limit time, identifying the user access request as an abnormal access behavior and initiating an abnormal response handling mechanism; and if the start time of a user access request is not earlier than the lower limit time, approving the user access request. Beneficial effects

[0016] 1. This invention determines the frequency of a user's access within a preset unit of time and compares it with a preset access demand threshold. Then, it calculates the adjusted access permission end time based on permission adjustment parameters. The effective duration of access permissions is adjusted according to the user's actual usage intensity to avoid the rigidity caused by fixed authorization duration. For high-frequency users, the authorization is automatically extended to avoid cumbersome repeated application processes. For low-frequency users, the authorization is ensured to expire in a timely manner, thus ensuring system security.

[0017] 2. When the access status is determined to be an abnormal access status, the present invention calculates the time difference between the actual access termination time and the access end time corresponding to the current access cycle to determine the type of access cessation behavior; at the same time, it sets an allowable time fluctuation range based on the adjusted access permission end time, monitors and identifies access requests initiated too early in subsequent access cycles, and realizes the transformation from passive response to active defense.

[0018] 3. By distinguishing between proactive and reactive access cessation behaviors, this invention provides deeper event tracing information for security auditing; by anticipating and monitoring future access behaviors, it can detect access attempts that do not conform to normal behavior patterns in advance, block potential unauthorized access, and improve the security of the business access management system. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method provided by the present invention; Figure 2 This is a system module diagram provided by the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example 1

[0021] Please see Figure 1 As shown, this embodiment provides a business access control method based on artificial intelligence and big data, used in scenarios where precise access control and anomaly detection are required when a large number of users access an enterprise-level system. The method specifically includes the following steps: S1. Historical Access Period Identification and Trusted Permission Settings: Acquire and aggregate historical user access data, including various access permissions and their corresponding start and end times; identify concentrated and common access behavior patterns within the organization from massive amounts of data, and establish behavioral baselines; That is, by statistical analysis, we can identify the regular working window with high-density concurrent access within a specific time period, and define this window as the historical access period to which the access permission belongs. Then, we can verify the regularity of individual access behavior through group behavior data.

[0022] Specifically, obtain the historical access permissions of all users and their corresponding access start times, record the historical access permissions of all users, sort them in a global timeline according to the access start time, and construct a macro-time sequence view of all access events within the entire organization; Then, for a specific user's access permission, the overlap ratio between that access permission and other access permissions in the sorted order is calculated in time. The access start time of that user's access permission is determined as the reference baseline time point, and a time window of a preset length is constructed around this point. The window start time and window end time are used to define the scope of localized analysis, in order to assess whether there is intensive access behavior originating from other users in the network at the same time that the user initiates access.

[0023] Within the time window, retrieve all access permission records belonging to other users and extract their access start and end times; then calculate the time overlap with the user's access permissions, sum up the durations of all other access segments within the time window that intersect with the user's access permissions, and calculate the time overlap ratio by dividing the summed time overlap by the total duration of the time window. If the time overlap ratio is greater than or equal to the preset overlap ratio threshold, such as 60% according to the business security level, it indicates that the user's access behavior is highly consistent with the behavior of a large number of other users in time, which is the normal working mode. Therefore, it is determined that the user's access permission belongs to a historical access period, and it is added to the preset trusted permission set as the core benchmark for subsequent permission management and anomaly judgment.

[0024] S2. Initial Access Permission and Status Determination: In the permission granting process, the permission log associated with the user is retrieved to determine whether the user has the permission for first-time access; the permission log is a historical archive that records the user's interactions with the system and the acquisition of permission credentials. If at least one of the following is found in the license log: execution operation record, confirmation operation record, or authorization operation record, then the user is determined to have initial access permission. The basis for this judgment is that these operations all represent that the user has been verified in some form of identity or intent in the past; if the operation record can be a log of the user successfully calling a specific system function, it indicates that the user has implicit permission to use the function. Confirmation operation logs can serve as interactive credentials for users to agree to the terms of service or security prompts, and are direct evidence of users' voluntary confirmation of operations; while authorization operation logs are event entries that explicitly grant permissions to the user by the system administrator or automation policies, and are the most explicit form of permission.

[0025] Based on the verification results of the permission log, the user's access status is further determined. If the user has the permission to access for the first time and their current access behavior conforms to a set of established security policies, then their access status is determined to be a normal access status. For example, the established security policies may include a set of rules for verifying the frequency of requests within a preset unit of time, the geographical location of the access source, or the logic of the operation sequence. Conversely, if a user's behavior does not conform to the established security policy, such as making frequent requests in a short period of time or accessing a path that does not conform to the normal business process, their access status will be determined as an abnormal access status.

[0026] S3. Analysis of Access Requirements and Stopping Methods: If the user's access status is determined to be normal access status in the aforementioned steps, a deep analysis of their access behavior will be conducted; the actual access termination time of the user's current access will be obtained, and the time difference between the actual access termination time and the system's preset access end time will be calculated. Based on the time difference and the preset allowable offset time, such as five minutes, the user's type of access termination behavior will be determined. If the actual access termination time is earlier than the access end time, and the time difference is less than or equal to the preset allowable offset time, then the access stop behavior type will be determined as the active access type. This usually indicates that the user has exited the system normally after completing the task. Conversely, if the actual access termination time is later than the access end time, or if the actual access termination time is earlier than the access end time but the time difference is greater than the preset allowable offset time, the access stop behavior type will be determined as passive access type. This situation may be caused by non-subjective reasons such as session timeout, network interruption, or the user forgetting to actively log out.

[0027] Then, based on the permission logs, the frequency of user access is counted within a preset unit of time, such as the past thirty days; according to a set of preset parameter adjustment rules, the access frequency is mapped to permission adjustment parameters, and the original access frequency is transformed into a quantitative indicator that can be used for permission adjustment.

[0028] The preset parameter adjustment rules can be specifically represented as a hierarchical mapping structure, such as a lookup table stored in the system; this structure predefines the correspondence between different access frequency ranges and specific permission adjustment parameter values: For example, if the access frequency is low, less than five times per month, it is mapped to the permission adjustment parameter 1.0, which means that the access will not be extended. Medium frequency, such as five to twenty times per month, is mapped to 1.1, indicating a moderate extension; High frequency, such as more than 20 times per month, is mapped to 1.2, indicating a significant extension.

[0029] S4. Permission Adjustment and Access Cycle Monitoring: The access frequency determined in the preceding steps is compared with the preset access demand threshold. The preset access demand threshold is preferably 10 times. If the access frequency is greater than the preset access demand threshold, it is determined that the user has a high work demand and the access permission duration needs to be adjusted to improve the work experience. In this case, the adjusted access permission end time is calculated based on the permission adjustment parameters determined in the preceding steps. Multiply the original access duration (the difference between the access end time and the access start time) by the access adjustment parameter to obtain the new access duration; then add the new duration to the access start time to obtain the adjusted access end time. If the access frequency is not greater than the preset access requirement threshold, it is determined that there is no need to adjust the access permission duration; in this case, the original access end time is directly used as the adjusted access permission end time, and the adjusted access permission end time is used as the benchmark. Set an allowable time fluctuation range to handle normal fluctuations in user behavior and provide early warnings of anomalies; this range includes a lower limit time; in subsequent access cycles, obtain the user's access requests and their request start time; if the request start time is earlier than the lower limit time of the allowable time fluctuation range, then this user access request is identified as abnormal access behavior. Such premature access may indicate abnormal operational intent or automated script behavior, therefore the system will trigger the exception response handling mechanism: If the request start time is not earlier than the lower limit time, it is considered a normal access request, and the user's access is approved. For abnormal status handling, if the user's access status is determined to be abnormal in step S2, the user's access is directly blocked and the abnormal event is recorded. If the user's access request is determined to be abnormal access behavior in the current step, a tiered abnormal response handling mechanism is initiated.

[0030] The mechanism first executes the first response step, which includes pushing a security warning message to the user interface and immediately suspending access permissions to prevent the potential risk from escalating. If the abnormal behavior of the same user occurs more than the preset frequency threshold, such as 3 times, within a preset statistical period, such as 24 hours, or if the type of abnormal behavior is judged as a high-risk event according to the preset security risk level table, the system will raise the response level to the second response step. This step involves automatically generating a work order and transferring it to the administrator for processing, where a security administrator with higher privileges will conduct a manual review and make a decision. Example 2

[0031] Please see Figure 2 As shown, this embodiment provides a business access control system based on artificial intelligence and big data. In its specific implementation, this system can be deployed on an enterprise's internal server, cloud platform, or as a functional component of a specific business application, such as an ERP system, CRM system, or financial transaction platform. The system specifically includes the following modules: The access status monitoring module is configured to continuously monitor and preliminarily characterize user access activities. In the specific execution process, this module accesses and parses the permission logs of one or more business systems, which record structured data of user interaction with the system, including but not limited to user identity, request time, accessed resources, and operation results.

[0032] This module analyzes permission logs based on preset rules to determine the current user's access status; if the logs show that the user has made multiple incorrect password attempts, attempted unauthorized access, or logged in from an abnormal geographical location within a short period of time, the access status is determined to be an abnormal access status. Conversely, if a user's access behavior matches their historical pattern and all accesses are successfully authorized, then their access status is determined to be normal.

[0033] In addition, during subsequent access cycles, this module is also responsible for capturing new user access requests initiated by users in real time and extracting the start time of the request access for subsequent modules to perform timeliness verification.

[0034] The permission duration adjustment module is activated after the access status monitoring module determines that the access status is normal, and performs dynamic adjustment of permissions to achieve intelligent management of the access duration of legitimate users.

[0035] Based on permission logs, this module counts the access frequency of a specific user within a preset time unit, such as the past 24 hours or a working day; then it compares the access frequency with a preset access demand threshold, which represents the boundary between ordinary users and high-frequency users.

[0036] If the comparison results show that the access frequency is greater than the preset access demand threshold, it indicates that the user has a high access demand for the system; adjust the access permission duration to improve the user experience; this module will map the current access frequency to the permission adjustment parameter according to a preset parameter adjustment rule; This rule can be a function or a lookup table. The core idea is that the higher the access frequency, the larger the permission adjustment parameter. Then, the module uses this permission adjustment parameter to calculate the end time of the adjusted access permissions, thereby appropriately extending the user's session validity period.

[0037] If the comparison results show that the access frequency is not greater than the preset access requirement threshold, it indicates that the user is a regular or low-frequency user and their current access duration is sufficient. In this case, the module will directly use the access end time corresponding to the current access cycle as the adjusted access end time, that is, it will not extend the access duration.

[0038] After determining the end time of the adjusted access permissions, the module will set an allowable time fluctuation range for the user's subsequent access cycles based on this time and the user's historical access time patterns. The range defines the expected time interval for the user to initiate the next access. The key parameter is the lower limit time, which sets the earliest allowed access time to prevent premature access that deviates significantly from the user's normal behavior pattern.

[0039] The access control module is the ultimate executor of permission policies, responsible for adjudicating and processing all user access requests. Its main functions include: When the access status monitoring module determines that the access status is abnormal in the initial stage, the access control module will respond immediately; it will perform operations to block the user's access, such as disconnecting the current connection or temporarily locking the account, and simultaneously record the abnormal event for access auditing. In subsequent access cycles, when the access status monitoring module captures a new user access request, it executes the core access control logic, obtains the start time of the user's request access, and compares it with the lower limit of the allowable time fluctuation range set by the permission duration adjustment module.

[0040] If the access request starts earlier than the lower limit time, the access behavior is identified as abnormal access behavior; at this time, the module will activate the abnormal response handling mechanism, specifically as follows: Issue security alerts to users or system administrators, such as via email or SMS; immediately suspend the user's access permissions and require them to re-authenticate; and mark the incident and forward it to the administrator for in-depth analysis and decision-making by human intervention.

[0041] If the request to access the resource does not start earlier than the lower limit time, the module will approve the user's access request, allowing the user to access the requested resource normally.

[0042] Through the collaborative work of the above access modules, the system in this embodiment dynamically adjusts the duration of access permissions based on the actual user needs, improving the system's flexibility and user-friendliness; and by establishing refined access control based on time behavior patterns, it enhances the ability to detect and block abnormal behavior.

Claims

1. A business access control method based on AI big data, characterized in that, include: When the access status is determined to be normal based on the permission log, the permissions are dynamically adjusted. When the access status is determined to be abnormal based on the permission log, the user access is blocked and the abnormal event is logged. And in subsequent access cycles, respond to the obtained user access requests and execute access control; The dynamic adjustment of execution permissions includes: determining the access frequency within a preset unit of time based on the permission log; and adjusting the access permission duration based on the comparison between the access frequency and the preset access requirement threshold to obtain the adjusted access permission end time. And based on the adjusted access permission end time, set the allowable time fluctuation range in subsequent access cycles, including the lower limit time.

2. The business access control method based on AI big data according to claim 1, characterized in that, Enforcing access control includes: if the start time of a user's access request is earlier than the lower limit of the allowed time fluctuation range, the user's access request is identified as an abnormal access behavior, and an abnormal response handling mechanism is initiated. And if the user's access request starts no earlier than the lower limit time, the user's access request is approved.

3. The business access control method based on AI big data according to claim 1, characterized in that, Based on the comparison between access frequency and preset access requirement thresholds, the duration of access permissions is adjusted as follows: If the access frequency is greater than the preset access requirement threshold, the adjusted access permission end time is calculated based on the permission adjustment parameters; and if the access frequency is not greater than the preset access requirement threshold, the access end time corresponding to the current access period is used as the adjusted access permission end time.

4. The business access control method based on AI big data according to claim 3, characterized in that, The method also includes mapping access frequency to permission adjustment parameters according to preset parameter adjustment rules.

5. The business access control method based on AI big data according to claim 1, characterized in that, The exception handling mechanism includes: Issue security warnings, suspend access permissions, or refer the matter to the administrator.

6. A business access control system based on AI big data, characterized in that, include: The access status monitoring module is used to determine whether the access status is normal or abnormal based on the permission log, and to obtain user access requests and their start times in subsequent access cycles. The permission duration adjustment module is used to dynamically adjust permissions after the access status monitoring module determines a normal access status. The dynamic permission adjustment includes: determining the access frequency within a preset unit time based on the permission log; adjusting the access duration according to the comparison result between the access frequency and a preset access requirement threshold to obtain the adjusted access duration end time; and setting the allowable time fluctuation range in subsequent access cycles based on the adjusted access duration end time, wherein the allowable time fluctuation range includes a lower limit time. The access control module is used to detect abnormal access statuses in response to the access status monitoring module and prevent users from accessing the system. In addition, in response to the access status monitoring module obtaining user access requests in subsequent access cycles, access control is executed.

7. A business access control system based on AI big data according to claim 6, characterized in that, The permission duration adjustment module is used to calculate the adjusted access permission end time based on the permission adjustment parameters when the access frequency exceeds the preset access requirement threshold.

8. A business access control system based on AI big data according to claim 7, characterized in that, The permission duration adjustment module is also used to map access frequency to permission adjustment parameters according to preset parameter adjustment rules.

9. A business access control system based on AI big data according to claim 6, characterized in that, The exception handling mechanism includes: Issue security warnings, suspend access permissions, or refer the matter to the administrator.

10. A business access control system based on AI big data according to claim 6, characterized in that, Enforcing access control includes: if the start time of a user's access request is earlier than the lower limit time, the user's access request will be identified as an abnormal access behavior and an abnormal response handling mechanism will be initiated. Additionally, if the user's access request starts no earlier than the lower limit time, the user's access request is approved.

Images