A multi-dimensional dynamic permission checking network data security protection system

Abstract

This invention pertains to the field of cyberspace security technology, specifically a multi-dimensional dynamic permission verification network data security protection system. The system includes a data acquisition module, a feature engineering module, a risk assessment module, and a permission decision module. The data acquisition module accesses multi-domain data sources to generate single-access data features. The feature engineering module outputs a weighted core feature set through triple-combination weighting and Gaussian kernel nonlinear dimensionality reduction. The risk assessment module performs static cloud model quantization and time-series evolution prediction to obtain a comprehensive risk value and risk trend parameters. The permission decision module dynamically adjusts the permission integral benchmark using asymmetric evolutionary game theory, solves for the optimal strategy through a Markov decision model, and outputs fine-grained permission policies and protection action instructions. This invention enables dynamically adaptive permission control, effectively balancing data security protection strength and business availability, and is suitable for data security protection in multi-source heterogeneous access scenarios.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, specifically a network data security protection system with multi-dimensional dynamic permission verification. Background Technology

[0002] With the large-scale implementation of zero-trust security architecture and the continuous increase in cross-domain data sharing scenarios, dynamic permission verification has become a core link in network data security protection. Faced with complex security threats such as unauthorized access by internal personnel and gradual penetration by external attacks, the traditional permission control system based on static roles suffers from insufficient flexibility and lagging risk response.

[0003] Existing dynamic access control solutions generally suffer from deficiencies in risk assessment. Most solutions only quantify static risks based on current access characteristics, ignoring the temporal evolution of risks and failing to predict risk development trends. Some solutions introduce temporal prediction models, but lack specific detection mechanisms for sudden risk mutations, making it difficult to identify sudden high-risk access and gradual probing violations. Existing solutions mostly use fixed threshold access decay rules, failing to consider the strategic evolution of user groups from an offensive and defensive perspective. The control benchmark cannot dynamically and adaptively adjust with the group's violation status, making it easy for unauthorized users to bypass the protection mechanism through probing operations. At the same time, access control decisions are mostly based on single-objective threshold judgment modes, making it difficult to achieve a dynamic optimal balance among security risk control, business availability assurance, and system operation and maintenance costs. Therefore, a network data security protection system with multi-dimensional dynamic permission verification is needed to solve the above problems. Summary of the Invention

[0004] To address the technical problems raised in the background, this invention provides a network data security protection system with multi-dimensional dynamic permission verification.

[0005] The objective of this invention can be achieved through the following technical solutions: This invention provides a network data security protection system with multi-dimensional dynamic permission verification, including a data acquisition module, a feature engineering module, a risk assessment module, and a permission decision module; When the data acquisition module initiates an access request, it connects to the corresponding acquisition domain. The main domain collects keystroke and mouse trajectory features, which are then fused to generate identity confidence. The network and asset domains collect link attributes and data sensitivity features respectively. The threat intelligence domain analyzes the traffic and matches it against a tiered attack feature library, outputting attack matching degree and high-risk hit count, generating single access data features. The specific steps are as follows: When an access subject requests access, the network traffic probe interface of the execution terminal will be connected in real time to the access subject's identity domain, network space domain, object asset domain, and threat intelligence domain. Through the access subject's identity domain, the unique user ID, average key press interval, key press duration variance, and mouse trajectory entropy of the access subject will be collected in real time. The average key press interval, key press duration variance, and mouse trajectory entropy will be reverse normalized and weighted and fused to obtain the access subject's identity confidence index, which will be organized into subject identity features. Through the network space domain, the source IP address, network encryption protocol level, routing hop count, and average round-trip latency will be collected in real time and organized into network space features. Through the object asset domain, the data sensitivity classification, historical leakage event records, and historical unauthorized access counts will be collected in real time and integrated into data asset attribute features. The threat intelligence domain performs real-time protocol parsing on all traffic corresponding to access requests, extracting raw traffic features such as request header fields, payload byte sequences, and access behavior patterns. A pre-built tiered attack feature library is then loaded, divided into three rule levels: high-risk, medium-risk, and low-risk, based on the severity of the attack. The high-risk rule level includes attack features such as vulnerability exploitation, data breaching, and privilege escalation. An automaton multi-pattern matching algorithm is used to match the extracted raw traffic features with the tiered attack feature library feature by feature, outputting all matched features and their corresponding rule risk levels. The attack matching degree is obtained by dividing the total number of matched features by the total number of raw features extracted. The total number of rules corresponding to the high-risk rule level among all matched features is also counted. The attack matching degree and attack matching score are then integrated into intelligence data features. Using the moment when the access request first arrives at the execution terminal as the global reference time, an adaptive sliding alignment window is set, and the timestamps of each feature within the adaptive sliding alignment window are synchronized using piecewise linear interpolation to obtain time-aligned data features. For the feature data of each collection domain, the unique user ID carried by it is extracted, and the data features scattered in different domains are matched and mounted through the session association mapping table to obtain the single access data features.

[0006] The feature engineering module performs triple weighting and nonlinear feature dimensionality reduction on the features of a single access data session to obtain a weighted dimensionality-reduced core feature set. The specific steps are as follows: The operation sequence features are extracted from the single-access data features. These features are then segmented using a word segmentation algorithm, and word vectors are trained using a Word2Vec model to extract behavioral semantic embedding vectors. Feature cross terms are constructed using second- and third-order polynomial kernel functions to generate cross vectors. The access time entropy, access object entropy, operation interval entropy, and operation type distribution entropy of the single-access data features are calculated to obtain the information entropy vector. The first set of objective weights is calculated using an objective weighting method based on the feature standard deviation and the feature Pearson correlation coefficient. The calculation logic is as follows: ,in Let be the standard deviation of the j-th feature. Let be the Pearson correlation coefficient between any two features, j and k be the indices of different indicators, n be the number of features, and C be the first set of objective weights. The second set of objective weights is calculated based on the information entropy dispersion of the indicators using the entropy weight method. The calculation logic is as follows: Where e is the information entropy and rc is the second set of objective weights. Based on the principle of minimum variance, the two sets of objective weights are multiplied and normalized to obtain the comprehensive objective weights. The expert scores are extended to interval numbers and an interval judgment matrix is ​​constructed. The interval weight vector is solved by the interval eigenvalue method. When the consistency ratio is less than the preset threshold, the midpoint value of the interval weight is taken as the subjective weight. The objective function is to minimize the sum of the identification information based on both objective and subjective weights. An optimization model is constructed with the constraint that the sum of the weights is 1 and all weights are greater than 0. The calculation logic is as follows: ,in To take into account objective weights, Let J be the subjective weight, J be the total discriminative information loss function, In be the natural logarithm function, st be the constraint condition, and we be the final combined weight to be solved. The combined feature weights are obtained by solving the Lagrange multiplier method. The semantic embedding vector, the cross vector, and the cross vector are weighted to obtain the weighted feature matrix. A kernel matrix is ​​constructed by selecting the Gaussian radial basis function as the kernel function. After centering the kernel matrix, eigenvalue decomposition is performed. The eigenvalues ​​are sorted from largest to smallest and the cumulative contribution rate is calculated. The top k principal components with a cumulative contribution rate not lower than the preset contribution threshold are selected. The weighted feature matrix is ​​mapped to the kernel principal component space, and the weighted dimensionality-reduced core feature set is output.

[0007] The risk assessment module performs a three-level risk deduction based on the core feature set: static benchmark quantification, time-series evolution prediction, and abrupt change and anomaly early warning, to obtain a comprehensive risk value and risk trend parameters. The specific steps are as follows: The risk level is divided into five levels: low, lower, medium, higher and high. The risk value range [0,1] is divided into five continuous sub-intervals. The feature sample set corresponding to each risk level is obtained by filtering the historical access risk samples labeled in the database according to the level. Based on the feature sample set with risk level, the arithmetic mean of the feature sample set is calculated using an inverse cloud generator to obtain the expected value. Then, the arithmetic mean of the feature sample set is calculated again as the expected value. Finally, the first-order absolute central moment of the samples is calculated. The calculation logic is as follows: Where M is the total number of feature samples corresponding to this risk level, m is the feature sample number, XC is the feature value, and EX is the expectation of the cloud model. Given the first-order absolute central moment, the entropy of the cloud model is obtained by solving based on the first-order absolute central moment. The calculation logic is as follows: ,in Let π be the constant value of pi, and EN be the entropy of the cloud model. The hyperentropy is calculated by using the entropy of the cloud model. The calculation logic is as follows: HE represents the hyperentropy of the cloud model. The expected value, entropy, and hyperentropy corresponding to the five risk levels are integrated to obtain the cloud digital features. A forward cloud generator generates normally distributed random numbers with the expected value of the corresponding level's entropy and the standard deviation of the hyperentropy. These normally distributed random numbers are then embedded into the normal cloud certainty calculation formula to obtain the membership certainty. The calculation logic is as follows: , where exp is the natural exponential function; Based on the weighted sum of the membership certainty of each feature corresponding to each risk level, the comprehensive certainty vector of the current access request to the five risk levels is obtained. The comprehensive certainty vector is normalized, and the level center value of each risk level and the corresponding normalized certainty are weighted and summed to obtain the static benchmark risk value in the interval [0,1]. Extract the static baseline risk value of the user's historical continuous time period into the observation sequence, set a preset number of hidden risk states, and iteratively train the hidden Markov model using the Baum-Welch algorithm based on the expectation-maximization framework. After convergence, output the model's initial state probability vector, state transition probability matrix and observation probability matrix. Based on the trained Hidden Markov Model, the forward and backward probabilities are calculated separately using a forward-backward algorithm, and the posterior probabilities of each hidden risk state at the current time are obtained by jointly solving the algorithm. The calculation logic is as follows: Where h is the number of each hidden state, and H is the total number of hidden risks. and The forward and backward probabilities corresponding to the hidden states are combined to obtain the posterior probability vector of the state. The historical static risk value sequence within a preset time window is concatenated with the state posterior probability vector corresponding to each moment within the window according to the feature dimension to construct a multi-channel time-series input sequence. This sequence is then input into a two-layer long short-term memory network for time-series feature encoding, and outputs a hidden state sequence of corresponding length. The hidden state sequence is input into the fully connected layer to obtain the initial risk prediction sequence for several future steps. The residual sequence of historical prediction results and actual risk values ​​is calculated. The nonlinear evolution trend of the residuals is fitted by a grey Verhulst model to generate the residual prediction value for the corresponding step size. Its calculation logic is as follows: ,in The least squares estimate of the development coefficient. This is the least squares estimate of the gray action quantity. The initial value of the cumulative residual sequence is given. For time-exponential decay, the initial risk prediction sequence is superimposed and corrected to output the risk prediction value for several future steps; By performing a univariate linear fit on the risk prediction values ​​for several future steps, the slope of the risk trend is obtained. The sum of the differences between the prediction values ​​for each future step and the comprehensive risk value at the current moment is calculated to obtain the cumulative risk growth value.

[0008] The permission decision module performs evolutionary game baseline adjustment and Markov decision-making based on the static baseline risk value, risk trend slope, and cumulative risk growth value to obtain the optimal permission strategy and protective action instructions. The specific steps are as follows: An asymmetric evolutionary game model is constructed, with the two sides being the user group and the protection system group. The user-side strategy set consists of compliant access and illegal probing, while the system-side strategy set consists of lenient control and strict control. Both sides are bounded rational agents, and a stable equilibrium state is reached through iterative learning and evolution of group strategies. Set game payoff parameters and calculate the payoff matrices for each of the four strategy combinations: The base payoff for compliant user access, the additional payoff for attempted violations, the penalty for violations detected by strict system control, the operational costs of lenient system control, the operational costs of strict system control, and the data leakage loss resulting from user violations and lenient system control. Strategy combination 1 represents user compliance and lenient system control, with the user payoff being the base payoff and the system payoff being the lenient operational costs. Strategy combination 2 represents user compliance and strict system control, with the user payoff being the base payoff and the system payoff being the strict operational costs. Strategy combination 3 represents user violations and lenient system control, with the user payoff being the base payoff and the system payoff being the lenient operational costs. Additional benefits are added together. The system benefit is the difference between lenient operation and maintenance costs and data leakage losses. Strategy combination 4 involves user violations and strict system enforcement. User benefits are the base benefit plus additional benefits minus the penalties for strict enforcement. System benefits are the strict operation and maintenance costs. The proportion of group strategies is obtained based on the benefit matrix of each strategy combination. Specifically, the proportion of users choosing strategy combination 1 is x, the proportion choosing strategy combination 2 is 1-x, and the proportion choosing strategy combination 3 is y in the system group, and the proportion choosing strategy combination 4 is 1-y. Based on the group strategy proportions and the benefit matrix of each side, replication dynamic differential equations are constructed on the user side and the system side respectively. The calculation logic is as follows: , ,in For additional benefits, F is the penalty, LS is the data leakage loss, C1 and C2 are the operation and maintenance costs with loose control and strict control, respectively. The replication dynamic differential equations on the user side and the system side are set to 0, and all equilibrium points of the game are obtained by solving them. The stability of each equilibrium point is determined by the Jacobian matrix local stability analysis method, and the evolutionary stability strategy of the system is obtained. A permission point quantification system is constructed, encompassing access scope, operation type, access timeliness, data volume, operation frequency, and anonymization granularity. An initial total permission point is calculated by weighting according to preset dimension weights. Corresponding risk inflection points are dynamically matched based on the sensitivity level of the accessed data, and a piecewise adaptive S-shaped decay function is constructed. The permission decay coefficient is obtained by calculating the piecewise adaptive S-shaped decay function based on the current risk value prediction. A trend correction function is constructed based on the permission decay coefficient, the risk trend slope, and the cumulative risk growth value. Its calculation logic is as follows: ,in This represents the initial total privilege points. This is the privilege decay coefficient calculated based on the current static baseline risk value. The trend correction function performs a second trend correction on the initial total authority integral and outputs the adjusted authority integral HG. The equilibrium violation rate and equilibrium control intensity corresponding to the evolutionary stable strategy are extracted and set as the state space of the Markov decision model. The decision action is set as a combination of permission point adjustment level and protection execution action. The permission point adjustment level includes multi-level upgrade, maintenance, and multi-level downgrade. The protection execution action includes normal access, secondary authentication, permission downgrade, session blocking, and account freezing. All legal combinations constitute a finite discrete action space. The real-time calculated risk value, the current adjusted permission points, and the real-time violation rate of the group are used as observation vectors. The observation probability matrix is ​​constructed based on the risk assessment error distribution and the violation rate statistical error to obtain the Markov decision model. The Markov decision model is iteratively calculated based on the point value iteration algorithm, and the value function and policy function are updated until convergence to obtain the optimal decision strategy. The current observation vector is input, and the optimal permission point adjustment strategy and corresponding protection action instruction are output through the optimal strategy mapping.

[0009] Compared with the prior art, the beneficial effects of the present invention are: By using static cloud model quantification to achieve fuzzy and accurate risk assessment, by using time-series evolution prediction to uncover risk development patterns, by using residual correction algorithm to improve long-term prediction accuracy, and by outputting risk trend slope and cumulative growth value; by using mutation anomaly early warning to capture sudden high-risk behaviors, the system solves the lag defects of traditional static risk assessment, reduces risk underreporting and false alarm rates, and provides full-dimensional and dynamic risk data support for authorized decision-making. By using an asymmetric evolutionary game model to characterize the strategy evolution patterns of user groups and the protection system, the permission point decay benchmark can be dynamically adjusted according to the real-time violation situation, thereby improving the protection system's anti-circumvention capability and reducing violation attempts to bypass control. Based on a Markov decision model, the optimal strategy is solved, and fine-grained permission rules and differentiated protection actions are output. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. The following drawings are not drawn to scale according to the actual size, but are intended to illustrate the main idea of ​​the present invention.

[0011] Figure 1 This is a system connection module diagram of the present invention. Detailed Implementation

[0012] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are also within the scope of protection of the present invention.

[0013] Please refer to Figure 1 As shown, the present invention provides a network data security protection system with multi-dimensional dynamic permission verification, including a data acquisition module, a feature engineering module, a risk assessment module, and a permission decision module; When the data acquisition module initiates an access request, it connects to the corresponding acquisition domain. The main domain collects keystroke and mouse trajectory features, which are then fused to generate identity confidence. The network and asset domains collect link attributes and data sensitivity features respectively. The threat intelligence domain analyzes the traffic and matches it against a tiered attack feature library, outputting attack matching degree and high-risk hit count, generating single access data features. The specific steps are as follows: When an access subject requests access, the network traffic probe interface of the execution terminal will be connected in real time to the access subject's identity domain, network space domain, object asset domain, and threat intelligence domain. Through the access subject's identity domain, the unique user ID, average key press interval, key press duration variance, and mouse trajectory entropy of the access subject will be collected in real time. The average key press interval, key press duration variance, and mouse trajectory entropy will be reverse normalized and weighted and fused to obtain the access subject's identity confidence index, which will be organized into subject identity features. Through the network space domain, the source IP address, network encryption protocol level, routing hop count, and average round-trip latency will be collected in real time and organized into network space features. Through the object asset domain, the data sensitivity classification, historical leakage event records, and historical unauthorized access counts will be collected in real time and integrated into data asset attribute features. The threat intelligence domain performs real-time protocol parsing on all traffic corresponding to access requests, extracting raw traffic features such as request header fields, payload byte sequences, and access behavior patterns. A pre-built tiered attack feature library is then loaded, divided into three rule levels: high-risk, medium-risk, and low-risk, based on the severity of the attack. The high-risk rule level includes attack features such as vulnerability exploitation, data breaching, and privilege escalation. An automaton multi-pattern matching algorithm is used to match the extracted raw traffic features with the tiered attack feature library feature by feature, outputting all matched features and their corresponding rule risk levels. The attack matching degree is obtained by dividing the total number of matched features by the total number of raw features extracted. The total number of rules corresponding to the high-risk rule level among all matched features is also counted. The attack matching degree and attack matching score are then integrated into intelligence data features. Using the moment when the access request first arrives at the execution terminal as the global reference time, an adaptive sliding alignment window is set, and the timestamps of each feature within the adaptive sliding alignment window are synchronized using piecewise linear interpolation to obtain time-aligned data features. For the feature data of each collection domain, the unique user ID carried by it is extracted, and the data features scattered in different domains are matched and mounted through the session association mapping table to obtain the single access data features.

[0014] The feature engineering module performs triple weighting and nonlinear feature dimensionality reduction on the features of a single access data session to obtain a weighted dimensionality-reduced core feature set. The specific steps are as follows: The operation sequence features are extracted from the single-access data features. These features are then segmented using a word segmentation algorithm, and word vectors are trained using a Word2Vec model to extract behavioral semantic embedding vectors. Feature cross terms are constructed using second- and third-order polynomial kernel functions to generate cross vectors. The access time entropy, access object entropy, operation interval entropy, and operation type distribution entropy of the single-access data features are calculated to obtain the information entropy vector. The first set of objective weights is calculated using an objective weighting method based on the feature standard deviation and the feature Pearson correlation coefficient. The calculation logic is as follows: ,in Let be the standard deviation of the j-th feature. Let be the Pearson correlation coefficient between any two features, j and k be the indices of different indicators, n be the number of features, and C be the first set of objective weights. The second set of objective weights is calculated based on the information entropy dispersion of the indicators using the entropy weight method. The calculation logic is as follows: Where e is the information entropy and rc is the second set of objective weights. Based on the principle of minimum variance, the two sets of objective weights are multiplied and normalized to obtain the comprehensive objective weights. The expert scores are extended to interval numbers and an interval judgment matrix is ​​constructed. The interval weight vector is solved by the interval eigenvalue method. When the consistency ratio is less than the preset threshold, the midpoint value of the interval weight is taken as the subjective weight. The objective function is to minimize the sum of the identification information based on both objective and subjective weights. An optimization model is constructed with the constraint that the sum of the weights is 1 and all weights are greater than 0. The calculation logic is as follows: ,in To take into account objective weights, Let J be the subjective weight, J be the total discriminative information loss function, In be the natural logarithm function, st be the constraint condition, and we be the final combined weight to be solved. The combined feature weights are obtained by solving the Lagrange multiplier method. The semantic embedding vector, the cross vector, and the cross vector are weighted to obtain the weighted feature matrix. A kernel matrix is ​​constructed by selecting the Gaussian radial basis function as the kernel function. After centering the kernel matrix, eigenvalue decomposition is performed. The eigenvalues ​​are sorted from largest to smallest and the cumulative contribution rate is calculated. The top k principal components with a cumulative contribution rate not lower than the preset contribution threshold are selected. The weighted feature matrix is ​​mapped to the kernel principal component space, and the weighted dimensionality-reduced core feature set is output.

[0015] The risk assessment module performs a three-level risk deduction based on the core feature set: static benchmark quantification, time-series evolution prediction, and abrupt change and anomaly early warning, to obtain a comprehensive risk value and risk trend parameters. The specific steps are as follows: The risk level is divided into five levels: low, lower, medium, higher and high. The risk value range [0,1] is divided into five continuous sub-intervals. The feature sample set corresponding to each risk level is obtained by filtering the historical access risk samples labeled in the database according to the level. Based on the feature sample set with risk level, the arithmetic mean of the feature sample set is calculated using an inverse cloud generator to obtain the expected value. Then, the arithmetic mean of the feature sample set is calculated again as the expected value. Finally, the first-order absolute central moment of the samples is calculated. The calculation logic is as follows: Where M is the total number of feature samples corresponding to this risk level, m is the feature sample number, XC is the feature value, and EX is the expectation of the cloud model. Given the first-order absolute central moment, the entropy of the cloud model is obtained by solving based on the first-order absolute central moment. The calculation logic is as follows: ,in Let π be the constant value of pi, and EN be the entropy of the cloud model. The hyperentropy is calculated by using the entropy of the cloud model. The calculation logic is as follows: HE represents the hyperentropy of the cloud model. The expected value, entropy, and hyperentropy corresponding to the five risk levels are integrated to obtain the cloud digital features. A forward cloud generator generates normally distributed random numbers with the expected value of the corresponding level's entropy and the standard deviation of the hyperentropy. These normally distributed random numbers are then embedded into the normal cloud certainty calculation formula to obtain the membership certainty. The calculation logic is as follows: , where exp is the natural exponential function; Based on the weighted sum of the membership certainty of each feature corresponding to each risk level, the comprehensive certainty vector of the current access request to the five risk levels is obtained. The comprehensive certainty vector is normalized, and the level center value of each risk level and the corresponding normalized certainty are weighted and summed to obtain the static benchmark risk value in the interval [0,1]. Extract the static baseline risk value of the user's historical continuous time period into the observation sequence, set a preset number of hidden risk states, and iteratively train the hidden Markov model using the Baum-Welch algorithm based on the expectation-maximization framework. After convergence, output the model's initial state probability vector, state transition probability matrix and observation probability matrix. Based on the trained Hidden Markov Model, the forward and backward probabilities are calculated separately using a forward-backward algorithm, and the posterior probabilities of each hidden risk state at the current time are obtained by jointly solving the algorithm. The calculation logic is as follows: Where h is the number of each hidden state, and H is the total number of hidden risks. and The forward and backward probabilities corresponding to the hidden states are combined to obtain the posterior probability vector of the state. The historical static risk value sequence within a preset time window is concatenated with the state posterior probability vector corresponding to each moment within the window according to the feature dimension to construct a multi-channel time-series input sequence. This sequence is then input into a two-layer long short-term memory network for time-series feature encoding, and outputs a hidden state sequence of corresponding length. The hidden state sequence is input into the fully connected layer to obtain the initial risk prediction sequence for several future steps. The residual sequence of historical prediction results and actual risk values ​​is calculated. The nonlinear evolution trend of the residuals is fitted by a grey Verhulst model to generate the residual prediction value for the corresponding step size. Its calculation logic is as follows: ,in The least squares estimate of the development coefficient. This is the least squares estimate of the gray action quantity. The initial value of the cumulative residual sequence is given. For time-exponential decay, the initial risk prediction sequence is superimposed and corrected to output the risk prediction value for several future steps; By performing a univariate linear fit on the risk prediction values ​​for several future steps, the slope of the risk trend is obtained. The sum of the differences between the prediction values ​​for each future step and the comprehensive risk value at the current moment is calculated to obtain the cumulative risk growth value.

[0016] The permission decision module performs evolutionary game baseline adjustment and Markov decision-making based on the static baseline risk value, risk trend slope, and cumulative risk growth value to obtain the optimal permission strategy and protective action instructions. The specific steps are as follows: An asymmetric evolutionary game model is constructed, with the two sides being the user group and the protection system group. The user-side strategy set consists of compliant access and illegal probing, while the system-side strategy set consists of lenient control and strict control. Both sides are bounded rational agents, and a stable equilibrium state is reached through iterative learning and evolution of group strategies. Set game payoff parameters and calculate the payoff matrices for each of the four strategy combinations: The base payoff for compliant user access, the additional payoff for attempted violations, the penalty for violations detected by strict system control, the operational costs of lenient system control, the operational costs of strict system control, and the data leakage loss resulting from user violations and lenient system control. Strategy combination 1 represents user compliance and lenient system control, with the user payoff being the base payoff and the system payoff being the lenient operational costs. Strategy combination 2 represents user compliance and strict system control, with the user payoff being the base payoff and the system payoff being the strict operational costs. Strategy combination 3 represents user violations and lenient system control, with the user payoff being the base payoff and the system payoff being the lenient operational costs. Additional benefits are added together. The system benefit is the difference between lenient operation and maintenance costs and data leakage losses. Strategy combination 4 involves user violations and strict system enforcement. User benefits are the base benefit plus additional benefits minus the penalties for strict enforcement. System benefits are the strict operation and maintenance costs. The proportion of group strategies is obtained based on the benefit matrix of each strategy combination. Specifically, the proportion of users choosing strategy combination 1 is x, the proportion choosing strategy combination 2 is 1-x, and the proportion choosing strategy combination 3 is y in the system group, and the proportion choosing strategy combination 4 is 1-y. Based on the group strategy proportions and the benefit matrix of each side, replication dynamic differential equations are constructed on the user side and the system side respectively. The calculation logic is as follows: , ,in For additional benefits, F is the penalty, LS is the data leakage loss, C1 and C2 are the operation and maintenance costs with loose control and strict control, respectively. The replication dynamic differential equations on the user side and the system side are set to 0, and all equilibrium points of the game are obtained by solving them. The stability of each equilibrium point is determined by the Jacobian matrix local stability analysis method, and the evolutionary stability strategy of the system is obtained. A permission point quantification system is constructed, encompassing access scope, operation type, access timeliness, data volume, operation frequency, and anonymization granularity. An initial total permission point is calculated by weighting according to preset dimension weights. Corresponding risk inflection points are dynamically matched based on the sensitivity level of the accessed data, and a piecewise adaptive S-shaped decay function is constructed. The permission decay coefficient is obtained by calculating the piecewise adaptive S-shaped decay function based on the current risk value prediction. A trend correction function is constructed based on the permission decay coefficient, the risk trend slope, and the cumulative risk growth value. Its calculation logic is as follows: ,in This represents the initial total privilege points. This is the privilege decay coefficient calculated based on the current static baseline risk value. The trend correction function performs a second trend correction on the initial total authority integral and outputs the adjusted authority integral HG. The equilibrium violation rate and equilibrium control intensity corresponding to the evolutionary stable strategy are extracted and set as the state space of the Markov decision model. The decision action is set as a combination of permission point adjustment level and protection execution action. The permission point adjustment level includes multi-level upgrade, maintenance, and multi-level downgrade. The protection execution action includes normal access, secondary authentication, permission downgrade, session blocking, and account freezing. All legal combinations constitute a finite discrete action space. The real-time calculated risk value, the current adjusted permission points, and the real-time violation rate of the group are used as observation vectors. The observation probability matrix is ​​constructed based on the risk assessment error distribution and the violation rate statistical error to obtain the Markov decision model. The Markov decision model is iteratively calculated based on the point value iteration algorithm, and the value function and policy function are updated until convergence to obtain the optimal decision strategy. The current observation vector is input, and the optimal permission point adjustment strategy and corresponding protection action instruction are output through the optimal strategy mapping.

[0017] The above formulas all use dimensionless numerical calculations, which can be achieved through standardization, normalization, etc., and will not be elaborated here. The relevant expressions are obtained by collecting a large amount of network access logs and permission protection working condition data, and are obtained through simulation fitting, which closely reflects the actual network security protection operation status. The preset parameters in the formulas can be set by those skilled in the art according to the business system type, access scale and security level.

[0018] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented as a computer program product, which contains one or more computer-executable instructions. The instructions are loaded and run on a computing device to fully or partially implement the processes and functions described in this invention. The device includes an API gateway server, an identity authentication server, a database auditing device, an edge computing node, or a cloud security management platform. The instructions can be stored on a computer-readable storage medium or transmitted between devices via wired / wireless means. The readable storage medium includes industrial-grade storage media such as solid-state drives, USB flash drives, memory cards, hard disks, and optical discs.

[0019] The execution order of each process in this invention is based on functional and logical relationships, and is not limited by the number of the sequence. Those skilled in the art will understand that the modules and algorithm steps described in this invention can be implemented using electronic hardware or a combination of hardware and software, and appropriate implementation methods can be selected for specific application scenarios, all of which are within the scope of protection of this invention.

[0020] The methods and systems disclosed in this invention can also be implemented in other non-illustrative ways. The module division is only a logical functional division; other division methods can be used in practice. Multiple modules or components can be combined or integrated, and some features can be omitted. The coupling and connection between modules can be indirect, and can be electrical, communicative, or other forms.

[0021] The modules described as separate components may or may not be physically separated. The components shown as modules may be physical units or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the solution according to actual protection requirements.

[0022] When the functions of this invention are implemented as software functional units and sold or used as a product, they can be stored in a computer-readable storage medium. This software product includes several instructions for driving a security gateway, access control system, or security operation platform to execute all or part of the steps of this invention. The storage medium includes media capable of storing program code, such as solid-state drives, flash drives, portable hard drives, read-only memory, and random access memory.

[0023] The above description is merely a specific embodiment of the present invention, but the scope of protection is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this invention should be included within the scope of protection. Therefore, the scope of protection is determined by the claims.

Claims

1. A network data security protection system with multi-dimensional dynamic permission verification, comprising a data acquisition module, a feature engineering module, a risk assessment module, and a permission decision module; When the data acquisition module initiates an access request, it connects to the corresponding acquisition domain. The main domain collects keystroke and mouse trajectory features, merges them to generate identity confidence, the network and asset domains collect link attributes and data sensitivity features respectively, and the threat intelligence domain analyzes traffic and matches it with a graded attack feature library, outputs attack matching degree and high-risk hit count, and generates single access data features. The feature engineering module constructs cross vectors based on second- and third-order polynomial kernels, and then calculates information entropy to form an entropy vector. The model is built with the goal of minimizing the identification information. The combination weights are solved by the Lagrange multiplier method to complete feature weighting. Principal component analysis based on Gaussian kernel is used to screen principal components and output the core feature set. The risk assessment module obtains cloud characteristic parameters of each level based on the reverse cloud generator, generates membership certainty, calculates the static baseline risk value by combining weights, obtains preliminary predictions based on data, corrects the residuals using the grey Verhulst model, and fits the risk trend slope and cumulative growth value. The permission decision module establishes an asymmetric evolutionary game model of users and protection systems, derives the payoff matrix and replication dynamic equation, obtains the evolutionary stable strategy through Jacobi matrix analysis, builds a multi-dimensional permission integral system, imports the game equilibrium result into the Markov decision model, solves iteratively through point values, and outputs the optimal actions for permission adjustment and security protection.

2. The network data security protection system for multi-dimensional dynamic permission verification according to claim 1, characterized in that, The permission decision-making module performs evolutionary game benchmark adjustment based on the static benchmark risk value, risk trend slope, and cumulative risk growth value. The specific steps are as follows: An asymmetric evolutionary game model is constructed, game payoff parameters are set, and the payoff matrices for each of the four strategy combinations are calculated. Based on the payoff matrices for each strategy combination, the group strategy proportion is obtained. Based on the group strategy proportion and the payoff matrices for each player, replication dynamic differential equations are constructed for the user side and the system side, respectively. The calculation logic is as follows: , ,in For additional benefits, F is the penalty, LS is the data leakage loss, C1 and C2 are the operation and maintenance costs with loose control and strict control, respectively. The replication dynamic differential equations on the user side and the system side are set to 0, and all equilibrium points of the game are obtained by solving them. The stability of each equilibrium point is determined by the Jacobian matrix local stability analysis method, and the evolutionary stability strategy of the system is obtained. Construct a permission point quantification system that includes access scope, operation type, access time, data volume, operation frequency, and desensitization granularity. Calculate the initial total permission points by weighting according to preset dimension weights. Dynamically match the corresponding risk inflection point based on the sensitivity level of the accessed data and construct a piecewise adaptive S-shaped decay function. Calculate the permission decay coefficient based on the predicted value of the current risk value using the piecewise adaptive S-shaped decay function. A trend correction function is constructed based on the permission decay coefficient, risk trend slope, and risk cumulative growth value. The initial total permission score is then subjected to a second trend correction, and the adjusted permission score is output.

3. The network data security protection system for multi-dimensional dynamic permission verification according to claim 2, characterized in that, The access control decision module uses Markov decision-making to obtain the optimal access control policy and protection action instructions. The specific steps are as follows: The equilibrium violation rate and equilibrium control intensity corresponding to the evolutionary stable strategy are extracted and set as the state space of the Markov decision model. The decision action is set as a combination of permission point adjustment level and protection execution action. The permission point adjustment level includes multi-level upgrade, maintenance, and multi-level downgrade. The protection execution action includes normal access, secondary authentication, permission downgrade, session blocking, and account freezing. All legal combinations constitute a finite discrete action space. The real-time calculated risk value, the current adjusted permission points, and the real-time violation rate of the group are used as observation vectors. The observation probability matrix is ​​constructed based on the risk assessment error distribution and the violation rate statistical error to obtain the Markov decision model. The Markov decision model is iteratively calculated based on the point value iteration algorithm, and the value function and policy function are updated until convergence to obtain the optimal decision strategy. The current observation vector is input, and the optimal permission point adjustment strategy and corresponding protection action instruction are output through the optimal strategy mapping.

4. The network data security protection system for multi-dimensional dynamic permission verification according to claim 1, characterized in that, When the data acquisition module initiates an access request and connects to the corresponding acquisition domain, the specific steps are as follows: When an access subject requests access, the network traffic probe interface of the execution terminal will be connected in real time to the access subject's identity domain, network space domain, object asset domain, and threat intelligence domain. Through the access subject's identity domain, the unique user ID, average key press interval, key press duration variance, and mouse trajectory entropy of the access subject will be collected in real time. The average key press interval, key press duration variance, and mouse trajectory entropy will be reverse normalized and weighted and fused to obtain the access subject's identity confidence index, which will be organized into subject identity features. Through the network space domain, the source IP address, network encryption protocol level, routing hop count, and average round-trip latency will be collected in real time and organized into network space features. Through the object asset domain, the data sensitivity classification, historical leakage event records, and historical unauthorized access counts will be collected in real time and integrated into data asset attribute features.

5. A network data security protection system for multi-dimensional dynamic permission verification according to claim 4, characterized in that, The data acquisition module analyzes traffic in the threat intelligence domain and matches it against a tiered attack signature database, outputting attack matching degree and high-risk hit count, and generating single-access data features, specifically: The threat intelligence domain performs real-time protocol parsing on all traffic corresponding to access requests, extracts raw traffic features, and loads a pre-built hierarchical attack feature library. The feature library is divided into three rule levels according to the severity of the attack. The extracted raw traffic features and the hierarchical attack feature library are matched feature by feature using an automaton multi-pattern matching algorithm. All hit features and the risk level of the corresponding rule are output. The attack matching degree is obtained by dividing the total number of hit features by the total number of raw features extracted in this operation. The total number of rules corresponding to the high-risk rule level among all hit features is also counted. The attack matching degree and the attack matching degree are integrated into intelligence data features. Using the moment when the access request first arrives at the execution terminal as the global reference time, an adaptive sliding alignment window is set, and the timestamps of each feature within the adaptive sliding alignment window are synchronized using piecewise linear interpolation to obtain time-aligned data features. For the feature data of each collection domain, the unique user ID carried by it is extracted, and the data features scattered in different domains are matched and mounted through the session association mapping table to obtain the single access data features.

6. The network data security protection system for multi-dimensional dynamic permission verification according to claim 1, characterized in that, The feature engineering module performs a triple-weighting of single-access data features, and the specific steps are as follows: Operation sequence features are extracted from single-access data features. The operation sequence features are segmented using a word segmentation algorithm. Word vectors are then trained using a Word2Vec model to extract behavioral semantic embedding vectors. Feature cross terms are constructed using second-order and third-order polynomial kernel functions to generate cross vectors. The access time entropy, access object entropy, operation interval entropy, and operation type distribution entropy of single-access data features are calculated to obtain information entropy vectors. The first set of objective weights is calculated based on feature standard deviation and feature Pearson correlation coefficient using an objective weighting method. The second set of objective weights is calculated based on the dispersion of indicator information entropy using an entropy weighting method. The two sets of objective weights are multiplied and normalized based on the minimum variance principle to obtain the comprehensive objective weights. The expert scores are extended to interval numbers and an interval judgment matrix is ​​constructed. The interval weight vector is solved by the interval eigenvalue method. When the consistency ratio is less than the preset threshold, the midpoint value of the interval weight is taken as the subjective weight.

7. A network data security protection system for multi-dimensional dynamic permission verification according to claim 6, characterized in that, The feature engineering module performs dimensionality reduction on nonlinear features to obtain a weighted dimensionality-reduced core feature set. The specific process is as follows: The objective function is to minimize the sum of the identification information of the combined objective weight and subjective weight. An optimization model is constructed with the constraint that the sum of the weights is 1 and all weights are greater than 0. The combined feature weights are obtained by solving the Lagrange multiplier method. The semantic embedding vector, the cross vector, and the cross vector are weighted to obtain the weighted feature matrix. A kernel matrix is ​​constructed by selecting the Gaussian radial basis function as the kernel function. After centering the kernel matrix, eigenvalue decomposition is performed. The eigenvalues ​​are sorted from largest to smallest and the cumulative contribution rate is calculated. The top k principal components with a cumulative contribution rate not lower than the preset contribution threshold are selected. The weighted feature matrix is ​​mapped to the kernel principal component space, and the weighted dimensionality-reduced core feature set is output.

8. A network data security protection system for multi-dimensional dynamic permission verification according to claim 1, characterized in that, The risk assessment module obtains the membership certainty and static baseline risk value for each risk level, and the specific steps are as follows: The risk level is divided into five levels: low, lower, medium, higher and high. The risk value range [0,1] is divided into five continuous sub-intervals. The feature sample set corresponding to each risk level is obtained by filtering the historical access risk samples labeled in the database according to the level. Based on the feature sample set of risk levels, the arithmetic mean of the feature sample set is calculated using a reverse cloud generator to obtain the expected value. Then, the arithmetic mean of the feature sample set is calculated again as the expected value. The first-order absolute central moment of the sample is then calculated, and the entropy of the cloud model is obtained based on the first-order absolute central moment. The hyperentropy is then calculated using the entropy of the cloud model. The expected value, entropy, and hyperentropy corresponding to the five risk levels are integrated to obtain the cloud digital features. A normal random number is generated using a forward cloud generator with the entropy of the corresponding level as the expected value and the hyperentropy as the standard deviation. The normal random number is then embedded into the normal cloud determinism calculation formula to obtain the membership determinism.

9. Based on the combined feature weights, the membership certainty of each feature corresponding to each risk level is weighted and summed to obtain the comprehensive certainty vector of the current access request for the five risk levels. The comprehensive certainty vector is normalized, and the level center value of each risk level and the corresponding normalized certainty are weighted and summed to obtain the static benchmark risk value in the interval [0,1].

10. A network data security protection system for multi-dimensional dynamic permission verification according to claim 8, characterized in that, The risk assessment module outputs the risk trend slope and the cumulative risk growth value. The specific steps are as follows: Extract the static baseline risk value of the user's historical continuous time period into the observation sequence, set a preset number of hidden risk states, and iteratively train the hidden Markov model using the Baum-Welch algorithm based on the expectation-maximization framework. After convergence, output the model's initial state probability vector, state transition probability matrix and observation probability matrix. Based on the trained Hidden Markov Model, the forward probability and backward probability are calculated separately by the forward-backward algorithm, and the posterior probability of each hidden risk state at the current time is obtained by joint solution, and then integrated to obtain the state posterior probability vector. The historical static risk value sequence within a preset time window is concatenated with the state posterior probability vector corresponding to each moment within the window according to the feature dimension to construct a multi-channel time-series input sequence. This sequence is then input into a two-layer long short-term memory network for time-series feature encoding, and outputs a hidden state sequence of corresponding length. The hidden state sequence is input into the fully connected layer to obtain the initial risk prediction sequence for several future steps. The residual sequence of historical prediction results and actual risk values ​​is calculated. The nonlinear evolution trend of the residuals is fitted by the grey Verhulst model to generate the residual prediction value for the corresponding step size. The initial risk prediction sequence is superimposed and corrected to output the risk prediction value for several future steps. By performing a univariate linear fit on the risk prediction values ​​for several future steps, the slope of the risk trend is obtained. The sum of the differences between the prediction values ​​for each future step and the comprehensive risk value at the current moment is calculated to obtain the cumulative risk growth value.

Images