A dynamic access control method and system based on continuous behavior authentication

Abstract

The embodiment of the specification discloses a dynamic access control method and system based on continuous behavior authentication, relates to the technical field of access control, and is used for solving the problem that the existing lacks access that can be dynamically adjusted in real time according to user behavior risks. The method comprises the following steps: acquiring a historical behavior feature set of a user to construct a user behavior baseline model; after the user obtains initial access authorization, collecting real-time behavior feature flow of a current session of the user to respectively map the real-time behavior feature flow to a biological feature space and an environmental feature space, and calculating and obtaining a first deviation value and a second deviation value; acquiring multi-dimensional context information of the current session to construct a dynamic weight vector based on the multi-dimensional context information, perform risk measurement on the first deviation and the second deviation, and obtain a real-time risk score of the current session; and performing a step-by-step access authorization decision according to the risk score and a preset multi-level threshold value.

Description

Technical Field

[0001] This specification relates to the field of access control technology, and in particular to a dynamic access control method and system based on continuous behavior authentication. Background Technology

[0002] As enterprises deepen their digital transformation, access control security in scenarios such as web applications, mobile applications, cloud services, API gateways, and zero-trust network access is receiving increasing attention. To ensure access control security, continuous evaluation of each access request is necessary, rather than relying solely on single-time authentication during login. Against this backdrop, how to achieve continuous access control throughout the entire user session lifecycle has become a key technical challenge in the field of cybersecurity.

[0003] Current access control systems primarily employ role-based access control (RBAC), which authenticates users upon login, grants them fixed permissions upon successful authentication, and maintains the user's trusted identity during subsequent sessions. Some systems, building upon this, introduce rule-based anomaly detection mechanisms, using preset static rules to identify and block abnormal behavior. However, with the increasing sophistication of cyberattacks and the growing number of internal threats, existing methods lack the ability to dynamically adjust permissions in real time. They cannot respond and adjust permissions accordingly and are difficult to update based on user behavior patterns. Consequently, the baseline model gradually deviates from the user's current actual behavior patterns over time, leading to a gradual increase in false positive rates.

[0004] Therefore, there is a need for an access method that can dynamically adjust in real time according to user behavior risks. Summary of the Invention

[0005] To address the aforementioned technical problems, one or more embodiments of this specification provide a dynamic access control method and system based on continuous behavior authentication.

[0006] One or more embodiments of this specification employ the following technical solutions: This specification provides one or more embodiments of a dynamic access control method based on continuous behavior authentication, the method comprising: Obtain the user's historical behavior feature set, and construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline; After the user obtains initial access authorization, the real-time behavioral feature stream of the current session is collected, and the real-time behavioral feature stream is mapped to the biometric feature space and compared with the biometric feature sub-baseline to calculate the first deviation value. The feature stream is then mapped to the environmental feature space and compared with the environmental feature sub-baseline to calculate the second deviation value. The sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session is obtained, and the deviation coupling factor is determined according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value; A dynamic weight vector is constructed based on the sensitivity of the current business scenario and the deviation coupling factor. Based on the dynamic weight vector, the first deviation value and the second deviation value are used to measure the risk and determine the real-time risk score of the current session. Based on the real-time risk score and preset multi-level thresholds, a tiered access authorization decision is executed; wherein the tiered access authorization decision includes at least two different levels of access control actions.

[0007] Optionally, in one or more embodiments of this specification, obtaining the user's historical behavior feature set specifically includes: Obtain the session identifier and business scenario tag of the current session, and query the corresponding historical behavior records based on the session identifier; Based on the business scenario tags, the historical behavior records are filtered to obtain a subset of historical behavior features that are semantically associated with the business scenario; Based on a preset time window, historical behavior features extracted from the subset of historical behavior features are obtained, wherein the preset time window includes: a short-term window and a long-term window; When the amount of long-term historical behavioral features within the long-term window is lower than a preset threshold, one or more business scenarios to be migrated are determined based on the semantic similarity between the current business scenario and other business scenarios, and their historical behavior records are used as supplementary data. Based on the supplementary data, the historical behavioral features are supplemented and fused to generate a set of historical behavioral features for the user.

[0008] Optionally, in one or more embodiments of this specification, constructing a user behavior baseline model based on the historical behavior feature set specifically includes: Based on the timestamps corresponding to each historical behavior feature in the historical behavior feature set, the historical behavior feature time series is obtained by sorting them. Based on the temporal position of each historical behavioral feature in the time series of historical behavioral features, the temporal dimension weight of each historical behavioral feature is determined; wherein, the temporal dimension weight is negatively correlated with the time difference between each historical behavioral feature and the current time. Based on historical behavioral features with the aforementioned time dimension weights, biometric sub-baselines and environmental sub-baselines are constructed respectively, and the biometric sub-baselines and environmental sub-baselines are combined to generate a user behavior baseline model.

[0009] Optionally, in one or more embodiments of this specification, based on historical behavioral features with the aforementioned time dimension weights, biometric sub-baselines and environmental sub-baselines are constructed respectively, and the biometric sub-baselines and environmental sub-baselines are combined to generate a user behavior baseline model, specifically including: Obtain the first feature vector of each of the historical biological behavioral features in the historical behavioral features with the time dimension weight, and obtain the second feature vector of each of the historical environmental context features in the historical behavioral features with the time dimension weight; The first feature vector and the second feature vector are multiplied by their corresponding time dimension weights to obtain the weighted biological feature vector and the weighted environmental feature vector, respectively. The biofeature sub-baseline is determined based on the weighted mean vector and weighted covariance matrix of each weighted biofeature vector, and the environmental feature sub-baseline is determined based on the weighted mean vector and weighted covariance matrix of each weighted environmental feature vector. The biometric sub-baseline and the environmental sub-baseline are correlated to generate a user behavior baseline model.

[0010] Optionally, in one or more embodiments of this specification, after the user obtains initial access authorization, the real-time behavioral feature stream of the user's current session is collected, specifically including: After the user obtains initial access authorization, the sliding time window is initialized starting from the current moment; Based on a preset sliding step size, the sliding time window is pushed forward to extract user interaction signals within the current sliding time window coverage area through the client probe; Based on the interaction signals and the current session identifier, a real-time data stream is generated; The real-time data stream is parsed to obtain real-time operational behavior data and real-time environmental state data. Real-time biological behavior features and real-time environmental context features are extracted respectively to generate a real-time behavior feature stream.

[0011] Optionally, in one or more embodiments of this specification, the real-time behavioral feature stream is mapped to a biometric space and compared with the biometric sub-baseline to calculate a first deviation value, and then mapped to an environmental feature space and compared with the environmental sub-baseline to calculate a second deviation value, specifically including: Obtain the feature type label corresponding to each real-time behavior feature in the real-time behavior feature stream, and split the real-time behavior feature stream into a real-time biological behavior feature stream and a real-time environmental context feature stream according to the feature type label; The real-time biological behavior feature stream is mapped to the biological feature space, and the biological feature sub-baseline is obtained; based on the biological feature sub-baseline, the first deviation between the current real-time biological behavior feature and the biological feature sub-baseline is calculated, and used as the first deviation value; The real-time environmental context feature stream is mapped to the environmental feature space, and the environmental feature sub-baseline is obtained; based on the environmental feature sub-baseline, the second deviation between the current real-time environmental context feature and the environmental feature sub-baseline is calculated as the second deviation value.

[0012] Optionally, in one or more embodiments of this specification, obtaining the current business scenario sensitivity corresponding to the multi-dimensional context information of the current session, and determining the deviation coupling factor based on the numerical relationship between the first deviation value and the second deviation value, specifically includes: Obtain multi-dimensional context information of the current session, which includes at least: the sensitivity level of the resource requested by the current access request, the security status score of the current terminal environment, and the time deviation between the current operation time and the user's historical active period; The sensitivity of the current business scenario is determined by querying a preset sensitivity mapping table based on the sensitivity level; wherein, the sensitivity mapping table includes the correspondence between different resource sensitivity levels and scenario sensitivity. The first deviation and the second deviation are used as feature dimensions and mapped to a two-dimensional risk space to construct a real-time risk vector; The deviation coupling factor is determined based on the preset region in which the real-time risk vector is located in the two-dimensional risk space; wherein the two-dimensional risk space is divided into a single-dimensional abnormal region and a collaborative abnormal region, the deviation coupling factor is greater than 1 when the real-time risk vector is located in the collaborative abnormal region, and the deviation coupling factor is equal to 1 when the real-time risk vector is located in the single-dimensional abnormal region.

[0013] Optionally, in one or more embodiments of this specification, a dynamic weight vector is constructed based on the current business scenario sensitivity and the deviation coupling factor. Based on this dynamic weight vector, risk measurement is performed on the first deviation value and the second deviation value to determine the real-time risk score of the current session. Specifically, this includes: Based on the sensitivity of the current business scenario, a first basic weight corresponding to the first deviation and a second basic weight corresponding to the second deviation are determined; wherein, the first basic weight is positively correlated with the sensitivity of the current business scenario, and the second basic weight is negatively correlated with the sensitivity of the current business scenario; The first basic weight and the second basic weight are corrected according to the deviation coupling factor to obtain the first fusion weight and the second fusion weight, and the dynamic weight vector is constructed according to the first fusion weight and the second fusion weight. Based on the dynamic weight vector, the coordinate axis weights of the two-dimensional risk space where the real-time risk vector is located are determined, and the risk baseline vector and risk boundary in the two-dimensional risk space are dynamically generated according to the multi-dimensional context information of the current session; wherein, the risk baseline vector and the risk boundary are adaptively adjusted as the multi-dimensional context information changes; Based on the coordinate axis weights, the geometric distance between the weighted real-time risk vector and the risk baseline vector is determined, and the real-time risk score of the current session is determined according to the relative positional relationship between the geometric distance and the risk boundary.

[0014] Optionally, in one or more embodiments of this specification, a tiered access authorization decision is performed based on the real-time risk score and preset multi-level thresholds, specifically including: Obtain the risk score sequence of the current session within a preset historical time period, and calculate the risk change trend based on the risk score sequence; the risk change trend is used to indicate whether the risk of the current session is in an upward, stable, or downward state. Based on the risk change trend, the preset benchmark threshold is dynamically adjusted to generate a dynamic threshold that matches the current risk evolution state. The real-time risk score of the current session is compared with the dynamic threshold, and the corresponding access control action is executed according to the comparison result. The access control action includes at least the access maintenance action, the access reduction action, and the session termination action.

[0015] This specification provides one or more embodiments of a dynamic access control system based on continuous behavior authentication, the system comprising: A construction module is used to obtain the user's historical behavior feature set, and to construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline; The mapping module, after the user obtains initial access authorization, collects the real-time behavioral feature stream of the current session, maps the real-time behavioral feature stream to the biometric feature space and compares it with the biometric feature sub-baseline to calculate the first deviation value, and maps it to the environmental feature space and compares it with the environmental feature sub-baseline to calculate the second deviation value. The determination module is used to obtain the sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session, and determine the deviation coupling factor according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value; The scoring module is used to construct a dynamic weight vector based on the sensitivity of the current business scenario and the deviation coupling factor, to perform weighted fusion of the first deviation value and the second deviation value based on the dynamic weight vector, and to map the fusion result to the real-time risk score of the current session. The execution module is used to perform tiered access authorization decisions based on the risk score and preset multi-level thresholds; wherein the tiered access authorization decisions include at least two different levels of access control actions.

[0016] The above-described at least one technical solution used in the embodiments of this specification can achieve the following beneficial effects: By continuously collecting real-time behavioral feature streams during user sessions and determining the first and second deviations of these streams based on a user behavior baseline model, continuous monitoring of user identity and environment credibility is achieved. The outputs of these two deviations help accurately distinguish anomaly sources, avoiding increased false alarm rates caused by interference between the two types of features. By acquiring multi-dimensional contextual information of the current session to determine the sensitivity of the current business scenario, and determining the deviation coupling factor based on the numerical relationship between the first and second deviation values, a dynamic weight vector is constructed by dynamically allocating the relative confidence levels of the two deviations. This allows the risk score to adaptively adjust according to the sensitivity of the business scenario and the degree of anomaly in conjunction with the deviation, improving scenario adaptability and facilitating risk assessment for various scenarios. Furthermore, by executing tiered access authorization decisions based on the risk score and pre-set multi-level thresholds, security is ensured while maintaining user experience continuity and system stability, transforming permission granting from static granting to continuous dynamic adjustment. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A flowchart illustrating a dynamic access control method based on continuous behavior authentication provided in an embodiment of this specification; Figure 2This is a schematic diagram of a dynamic access control system based on continuous behavior authentication, provided as an embodiment of this specification. Detailed Implementation

[0018] This specification provides a dynamic access control method and system based on continuous behavior authentication.

[0019] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0020] like Figure 1 As shown in the diagram, this specification provides a structural schematic of a dynamic access control method based on continuous behavior authentication. Figure 1 It can be seen that the methods include: S101: Obtain the user's historical behavior feature set, and construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline.

[0021] The historical behavior feature set includes multiple historical behavior features, which can be categorized into historical biological behavior features and historical environmental context features based on their corresponding feature type labels. Historical biological behavior features represent the individual user's operational habits, including but not limited to keystroke dynamics features such as the time interval between adjacent keys and keystroke duration; mouse operation features such as movement speed, movement trajectory curvature, and click frequency; and touch interaction features such as swipe speed, touch pressure, and gesture trajectory. It is understood that these historical biological behavior features exhibit individual user differences and can be used to distinguish the identities of different users.

[0022] Historical context features are used to reflect the characteristics of the external environment conditions in which a user accesses the site, including but not limited to terminal device fingerprints, network status, geographical location, and access time pattern features.

[0023] Specifically, in one or more embodiments of this specification, obtaining the user's historical behavior feature set includes: The system retrieves the session identifier and business scenario tag for the current session. The session identifier uniquely identifies the current user session, while the business scenario tag identifies the type of business being accessed, such as financial transfer or document retrieval. After retrieving the session identifier, since it is associated with the user's identity identifier, the system can use the user's identity identifier as an index to query all historical behavior records for that user from the historical behavior database. This historical behavior database uses the user's identity identifier as the primary key and stores the user's historical operation records across all business scenarios. Each record includes fields such as operation timestamp, operation type, operation object, terminal device fingerprint, network environment information, and geographical location information.

[0024] Based on the business scenario tags, historical behavior records are filtered to obtain a subset of historical behavior features semantically associated with the business scenario. For example, in one feasible approach, a relationship graph between scenarios and semantic features is pre-constructed. This graph records the mapping relationships between different business scenario tags and behavioral feature dimensions, as well as the semantic hierarchy relationships between business scenarios. Semantic association filtering includes: locating the corresponding set of feature dimensions in the relationship graph based on the current business scenario tag; retaining only records from historical behavior records belonging to the set of feature dimensions; and filtering out behavioral record dimensions irrelevant to the current business scenario to reduce data dimensionality and minimize interference from irrelevant data on subsequent baseline modeling.

[0025] In one or more feasible methods, the semantic association filtering further includes cleaning data with missing fields or abnormal format in historical behavior records to remove records with data integrity below a preset integrity threshold.

[0026] Furthermore, in one or more feasible methods, the semantic association filtering further includes: obtaining the superior scene label that has a semantic inheritance relationship with the current business scene label or the subordinate scene label that has a semantic derivation relationship in the association graph, thereby including the feature dimension set corresponding to the superior scene label or the subordinate scene label into the filtering scope.

[0027] Based on a preset time window, historical behavioral features are extracted from a subset of historical behavioral features. This preset time window includes a short-term window and a long-term window. The short-term window is a dynamic time window measured in units of the number of successful sessions, used to extract short-term historical behavioral data within the most recent preset number of successful sessions preceding the current session. A successful session refers to the complete session period from when the user completes authentication and obtains access authorization until the session ends. The data from the short-term window is used to capture the user's recent operational habits and temporary behavioral changes, such as temporary device changes or network environment switching.

[0028] The aforementioned long-term window is a semantically driven time window that uses business scenario tags as matching conditions. It is used to extract historical records of similar operations that semantically match the business scenario tags. It is not limited by time range and continues until the amount of data extracted reaches a preset abundance threshold. The data in this long-term window is used to construct a baseline of the user's inherent behavioral patterns in this type of operation scenario.

[0029] It should be noted that in the embodiments of this specification, the short-term window and the long-term window constitute an asymmetric double-ring time window structure, that is, the short-term window uses the number of sessions as the window unit, and the long-term window uses scene semantic matching as the extraction condition; the short-term window focuses on time proximity, and the long-term window focuses on scene semantic consistency; the amount of data in the short-term window is relatively fixed, and the amount of data in the long-term window depends on the abundance of historical data.

[0030] In new business scenarios, users may lack sufficient historical behavioral data to build a reliable baseline model. The challenge in this scenario is to quickly construct a usable and reliable temporary baseline model to support real-time risk assessment of the current session, while preserving individual differences and avoiding business disruptions. Since the same user's behavioral patterns are transferable across different scenarios, a data volume of long-term historical behavioral features within a long-term window falling below a preset threshold indicates insufficient historical behavioral data for the user in the current business scenario. In this case, based on the semantic similarity between the current business scenario and other business scenarios, one or more business scenarios to be migrated are identified, and their historical behavioral records are used as supplementary data. The semantic similarity is calculated based on the hierarchical distance of scenario function tags and the overlap of resource access types. When the semantic similarity exceeds a preset migration threshold, the historical behavioral records of the candidate business scenarios are used as supplementary data, and confidence decay correction is applied to the supplementary data. The decay magnitude of this confidence decay correction is negatively correlated with semantic similarity; that is, the higher the semantic similarity, the higher the reliability of the supplementary data and the smaller the decay magnitude, and vice versa. In one or more embodiments, the confidence decay correction includes: applying a scaling factor related to semantic similarity to the feature vector of the supplementary data, the scaling factor being equal to 1 when the semantic similarity is 1, approaching 0 when the semantic similarity approaches a preset migration threshold, and the scaling factor having a non-linear decay relationship with the semantic similarity, so as to accelerate decay when the semantic similarity is close to the migration threshold and avoid the low confidence supplementary data causing significant interference to the baseline.

[0031] Based on supplementary data, the historical behavioral features are further fused to generate a user's historical behavioral feature set. Specifically, in one feasible approach, the fusion includes: merging short-term historical behavioral features, long-term historical behavioral features, and historical behavioral features belonging to user operation behavior patterns from the supplementary data into a biological behavioral feature group; and merging historical behavioral features belonging to terminal and network environment conditions into an environmental context feature group. After fusion, the biological behavioral feature group constitutes the historical biological behavioral feature component of the historical behavioral feature set, and the environmental context feature group constitutes the historical environmental context feature component of the historical behavioral feature set.

[0032] In one feasible approach, the fusion process further includes consistency verification of historical behavioral characteristics of the same feature dimension across the three data sources. When the values ​​of the same feature dimension conflict across multiple data sources, the value from the source with the highest data volume percentage is used as the value for that feature dimension. If the source with the highest data volume percentage cannot be uniquely determined, conflict resolution is performed in the order of priority: short-term window data > long-term window data > supplementary data.

[0033] In one or more embodiments, the fusion process further includes normalizing the fused feature set to map feature data from different sources or with different dimensions to a unified numerical range, thereby eliminating dimensional differences between features and facilitating statistical calculations in the subsequent baseline modeling process.

[0034] In one or more embodiments, the fused feature set is further timestamped to ensure that each historical behavioral feature is arranged in the order in which the operation occurred, forming a sequence of behavioral features with temporal relationships.

[0035] Furthermore, in one or more embodiments, if the user is a newly registered user and the historical behavior record is empty, this step is skipped, and the subsequent baseline initialization process is entered, using the default baseline parameters or group baseline parameters instead.

[0036] By incorporating business scenario tags for semantic association filtering, historical behavioral noise irrelevant to the current scenario is filtered out, reducing the computational overhead of subsequent baseline modeling. Furthermore, the structure of short-term and long-term windows simultaneously captures both the immediate trends and long-term stable patterns of user behavior, providing a hierarchical data foundation for building a baseline model that reflects both short-term habits and long-term preferences. Through cross-scenario semantic similarity transfer, the cold-start problem in data-sparse scenarios is solved, expanding its applicability across different business scenarios and providing reliable data assurance for the accurate construction of the baseline model.

[0037] In real-world business scenarios, user behavior patterns naturally evolve over time. For example, users may master keyboard shortcuts, increasing their operation speed, or switch to a touchpad instead of a mouse, resulting in shorter keystroke intervals and changes in mouse trajectory. However, a static baseline model collects behavioral data only once upon a user's first login, establishing a fixed baseline for continuous use. This static baseline cannot track this evolution, leading to a gradual increase in false alarm rates. Reconstructing the baseline by recollecting data at fixed intervals, on the other hand, cannot adapt to the varying evolution speeds of different users due to the fixed time window. Therefore, to reflect the current state while preserving inherent patterns, this embodiment of the specification weights the historical behavioral feature set according to the time dimension to construct a behavioral baseline model.

[0038] Specifically, in one or more embodiments of this specification, a weighted processing of the historical behavior feature set based on the time dimension is performed to construct a user behavior baseline model, which specifically includes the following steps: In the embodiments of this specification, each historical behavior feature in the historical behavior feature set includes a collection timestamp field, recording the time when the corresponding operation occurred. Then, by sorting the historical behavior features according to their timestamps, all historical behavior features are arranged in chronological order, forming a time series of historical behavior features with a temporal relationship. It can be understood that this time series is used to subsequently assign time dimension weights to each historical behavior feature, thereby ensuring that recent historical behavior features and long-term historical behavior features have a comparable time benchmark in terms of weight allocation.

[0039] Based on the temporal position of each historical behavioral feature within the historical behavioral feature time series, the temporal dimension weight of each historical behavioral feature is determined. The temporal dimension weight is negatively correlated with the time difference between each historical behavioral feature and the current time. Specifically, in one feasible approach, the temporal dimension weight is calculated using a preset time decay function. This time decay function takes the time difference between the timestamp of the historical behavioral feature and the current time as input and outputs the corresponding weight value. The time decay function is a monotonically non-increasing function, ensuring that more recent historical behaviors contribute more to the baseline model than more distant historical behaviors. This time decay function can be determined based on specific user behavior patterns, including but not limited to exponential decay functions or power-law decay functions. In the exponential decay function, the weight decreases exponentially with increasing time difference, suitable for scenarios where user behavior patterns change rapidly; in the power-law decay function, the weight decreases power-lawly with increasing time difference, suitable for scenarios where user behavior patterns change slowly.

[0040] Furthermore, in one feasible approach, the aforementioned time dimension weights also include a preservation factor. That is, for historical behavioral characteristics within a preset stable period of user behavior patterns, a preservation factor is applied on top of the time decay to slow down their decay rate over time. During the stable period, which is a time interval where user behavior patterns do not change significantly, when users are in a stable behavioral period, long-term historical behavioral characteristics still have high reference value and should not be excessively decayed to maintain the stability and continuity of the baseline.

[0041] In one or more embodiments of this specification, the weight allocation further includes: for historical behavioral features that have repeated timestamps or similar timestamps in the historical behavioral feature set, a timestamp aggregation strategy is adopted to merge multiple historical behavioral features belonging to the same time window into a weighted behavioral feature, so as to eliminate the data skew caused by high-frequency sampling and make the weight allocation more balanced.

[0042] Based on historical behavioral features weighted by a time dimension, biometric sub-baselines and environmental sub-baselines are constructed separately. These sub-baselines are then combined to generate a user behavior baseline model. Specifically: The user's historical behavior feature set generated based on step S101 above contains multiple historical behavior features. Each historical behavior feature is labeled with a feature type tag during collection, indicating whether it belongs to the biological behavior feature category or the environmental context feature category. Simultaneously, each historical behavior feature has been assigned a time dimension weight in the preceding processing. Now, based on the feature type tag, all samples in the historical behavior features with time dimension weights are divided into two groups: samples belonging to the biological behavior feature category are grouped into the biological behavior feature group, and samples belonging to the environmental context feature category are grouped into the environmental context feature group. Corresponding feature vectors are then extracted from the two groups of samples respectively; that is, for each historical biological behavior feature in the biological behavior feature group, its biological behavior feature dimension is extracted into a numerical representation, forming the corresponding first feature vector. It should be noted that this first feature vector is a fixed-dimensional numerical vector, and the vector dimension is determined by a preset biological behavior feature dimension template. The number of dimensions is determined according to the actual type of biological behavior feature collected. For each historical environmental context feature in the environmental context feature group, its environmental context feature dimension is extracted into a numerical representation to form a corresponding second feature vector. This second feature vector is a fixed-dimensional numerical vector, and the vector dimension is determined by a preset environmental context feature dimension template. The number of dimensions is determined according to the actual type of environmental context features collected.

[0043] The first and second feature vectors are multiplied by their corresponding time dimension weights to obtain a weighted biometric feature vector and a weighted environmental feature vector, respectively. That is, each first feature vector generates a weighted biometric feature vector, and all weighted biometric feature vectors form a weighted biometric feature vector sequence. Similarly, each second feature vector generates a weighted historical environmental feature vector, and these weighted historical environmental feature vectors form a weighted environmental feature vector sequence. Through this weighting process, recent historical behavioral features receive a higher contribution in subsequent statistical aggregation, while older historical behavioral feature samples receive a lower contribution, thus enabling the final baseline model to reflect the temporal evolution of user behavior patterns. Further, in a feasible embodiment, when the time dimension weights are normalized (i.e., the sum of the weights of all historical behavioral features is 1), the weighted feature vectors directly participate in the calculation of the subsequent weighted mean vector and weighted covariance matrix. However, when the time dimension weights are not normalized, in subsequent weighted statistical calculations, each weighted feature vector participates in the aggregation calculation according to its proportion in the total weight sum.

[0044] Weighted statistical processing is performed on each weighted biometric vector, specifically by obtaining the weighted mean vector and weighted covariance matrix of the biometric behavioral feature dimension. These weighted mean vectors and covariance matrices are then used as parameters for the biometric sub-baseline. Similarly, the environmental feature sub-baseline is determined based on the weighted mean vector and weighted covariance matrix of each weighted environmental feature vector. Through this weighted statistical processing, the biometric sub-baseline represents the central position and fluctuation range of the user's biometric behavioral features under normal conditions, expressed by the weighted mean vector and weighted covariance matrix. Similarly, the environmental feature sub-baseline describes the central position and fluctuation range of the user's environmental context features under normal conditions.

[0045] A correlation is established between the biometric sub-baseline and the environmental sub-baseline to generate a user behavior baseline model. In one feasible approach, a user identity identifier can be obtained, and then, using the user identity identifier as an index key, the parameter sets of the biometric sub-baseline and the parameter sets of the environmental sub-baseline can be correlated to obtain the user behavior baseline model. In other words, the user behavior baseline model includes both biometric and environmental sub-baselines.

[0046] In one or more embodiments, after generating the user behavior baseline model, the method further includes: binding the user behavior baseline model to a user identity identifier, and associating the user identity identifier with a current session identifier, so that real-time behavior monitoring of the current session directly calls the baseline model. Simultaneously, the baseline model is stored in a distributed cache to support users quickly loading the same baseline model when switching between devices.

[0047] By splitting historical behavioral features into first and second feature vectors according to feature type, vectorized representations of biological and environmental features are achieved. Furthermore, by multiplying each feature vector by its corresponding time dimension weight, recent behaviors receive a higher contribution in subsequent statistical aggregation, while longer-term behaviors receive a lower contribution, enabling the baseline model to adaptively track user behavior evolution. By storing the two sub-baselines in association, subsequent deviation calculations can compare the two channels separately, achieving independent quantification of user behavior anomalies and environmental state anomalies. Moreover, the mathematical parameterization of the mean vector and covariance matrix enables efficient loading and rapid calculation of the baseline.

[0048] S102: After the user obtains initial access authorization, the real-time behavioral feature stream of the current session is collected, and the real-time behavioral feature stream is mapped to the biometric feature space and compared with the biometric feature sub-baseline to calculate the first deviation value. The stream is then mapped to the environmental feature space and compared with the environmental feature sub-baseline to calculate the second deviation value.

[0049] Because user behavior and environment are constantly changing during a real-world session, a single authentication process cannot capture these dynamic changes. Therefore, attackers may exploit the session window to perform malicious operations after successful authentication. To achieve dual-channel real-time awareness of continuous user identity verification and continuous environmental trust monitoring throughout the entire session lifecycle, and to provide fine-grained anomaly detection for dynamic permission adjustments, this embodiment of the specification collects the real-time behavioral feature stream of the user's current session after the user obtains initial access authorization. This enables continuous access control during the user session, mapping the real-time behavioral feature stream to both the biometric space and the environmental feature space, and calculating a first deviation value and a second deviation value.

[0050] Specifically, in one or more embodiments of this specification, after a user obtains initial access authorization, the real-time behavioral feature stream of the user's current session is collected, specifically including: After the user obtains initial access authorization, a sliding time window for collecting real-time behavioral data is initialized starting from the current moment. This sliding time window includes a window length parameter and a sliding step parameter. The window length determines the time span of a single data collection, and the sliding step determines the time interval between two adjacent data collections. The window length and sliding step can be dynamically configured according to the business scenario of the current session; specific limitations are not specified here. In one feasible embodiment, the window length of the sliding time window remains unchanged during the current session, and the sliding step is less than or equal to the window length to ensure overlap between adjacent sliding time windows and prevent the loss of behavioral data at window boundaries.

[0051] In one or more embodiments of this specification, different window lengths and sliding step sizes are configured for different business scenarios. For highly sensitive operation scenarios, a shorter window length, such as 1 minute, and a smaller sliding step size, such as 10 seconds, are used to collect more granular behavioral data. For regular operation scenarios, a longer window length, such as 3 minutes, and a larger sliding step size, such as 20 seconds, are used. Therefore, no specific limits are imposed on their specific values ​​here.

[0052] Based on a preset sliding step size, the sliding time window moves forward, and after each slide, the current sliding time window covers a specific time interval. Then, a client probe deployed on the user terminal extracts the user's interaction signals within the time interval covered by the current sliding time window. It should also be noted that during the forward movement of the sliding time window, the time intervals covered by adjacent windows overlap, and the interaction signals within this overlap appear in both adjacent windows. Therefore, in subsequent steps, the consistency of the same interaction signal in the overlapping portion across adjacent windows can be identified and utilized to verify the signal's validity, improving the reliability of feature extraction.

[0053] Based on the interaction signals and the current session identifier, a real-time data stream is generated. This involves arranging all interaction signals with attached session identifiers and timestamps within the current sliding time window in timestamp order to form the corresponding real-time raw data stream for that time window. As the sliding time window moves forward, new real-time data stream segments are continuously generated, thus forming a continuous real-time data stream.

[0054] The real-time raw data stream is parsed. Specifically, the server identifies and separates signal data belonging to user operation behavior and signal data belonging to terminal environment status from the real-time raw data stream according to preset data format specifications. This generates corresponding real-time operation behavior data and real-time environment status data. Real-time biological behavior features and real-time environmental context features are then extracted to generate a real-time behavior feature stream. In one feasible approach, real-time biological behavior features can be extracted from the real-time operation behavior data according to a preset biometric dimension template. This biometric dimension template defines the types of biological behavior features to be extracted and the calculation method for each feature. After extraction, the feature values ​​of each dimension are combined into a fixed-dimensional real-time biological behavior feature. Similarly, according to a preset environmental feature dimension template, which also defines the types of environmental features to be extracted and the calculation method for each feature, real-time environmental context feature values ​​are extracted from the real-time environmental status data and combined into a fixed-dimensional real-time environmental context feature. Then, the extracted real-time biological behavior features and real-time environmental context features are aligned according to the collection timestamp, and each feature is labeled with a feature type to generate a structured real-time behavior feature stream, which serves as input data for subsequent deviation calculations.

[0055] Specifically, in one or more embodiments of this specification, the real-time behavioral feature stream is mapped to a biometric space and compared with a biometric sub-baseline to calculate a first deviation value, and then mapped to an environmental feature space and compared with the environmental sub-baseline to calculate a second deviation value, specifically including: The feature type labels corresponding to each real-time behavioral feature in the real-time behavioral feature stream are obtained. Based on the feature type labels, the real-time behavioral feature stream is split into a real-time biological behavioral feature stream and a real-time environmental context feature stream. The real-time biological behavioral feature stream is mapped to a biological feature space, and the biological feature sub-baseline is obtained. The biological feature space is a multi-dimensional space constructed using the dimensions of the biological behavioral features as coordinate axes. Therefore, the biological feature space and the space where the biological feature sub-baseline is located have the same dimensional definition, allowing the deviation between the real-time biological behavioral features and the biological feature sub-baseline to be calculated in the same space. Therefore, based on the biological feature sub-baseline, the first deviation between the current real-time biological behavioral feature and the biological feature sub-baseline can be calculated as the first deviation value. Similarly, the real-time environmental context feature stream is mapped to an environmental feature space, and the environmental feature sub-baseline is obtained. This environmental feature space is a multi-dimensional space constructed using the dimensions of the environmental context features as coordinate axes. Therefore, this environmental feature space and the space where the environmental feature sub-baseline is located have the same dimensional definition. Based on the environmental feature sub-baseline, the second deviation between the current real-time environmental context feature and the environmental feature sub-baseline is calculated as the second deviation value.

[0056] In this process, after a user gains access authorization, continuous monitoring of the user session's entire lifecycle is achieved by continuously collecting real-time behavioral feature streams throughout the session. A sliding time window mechanism segments the continuous behavioral data stream into discrete time segments for collection, ensuring the continuity and consistency of real-time data acquisition. The overlapping design of adjacent windows also avoids the loss of behavioral data at window boundaries. By mapping real-time biological behavioral features and real-time environmental context features to their respective feature spaces, deviation calculations are performed in two independent mathematical spaces, and the correlation between features is considered while calculating the two deviations separately. This provides a quantitative input with clear physical meaning for subsequent risk scoring, thereby supporting differentiated access control.

[0057] S103: Obtain the current business scenario sensitivity corresponding to the multi-dimensional context information of the current session, and determine the deviation coupling factor according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value.

[0058] The sensitivity of the current business scenario is determined based on multi-dimensional contextual information of the current session, indicating the stringency of risk assessment within the business scenario in which the current access request is located. In other words, a higher sensitivity indicates stricter system requirements for reviewing access behavior in that scenario and a lower tolerance for deviations. Conversely, a lower sensitivity indicates relatively more lenient system requirements for reviewing access behavior in that scenario.

[0059] The deviation coupling factor is a quantitative factor used to indicate whether there is a coordinated anomaly between the first deviation value and the second deviation value. When both the first and second deviation values ​​increase simultaneously, it indicates that both user behavior and environmental conditions are abnormal, possibly indicating a coordinated attack, such as an attacker stealing credentials and operating on an unfamiliar device. In this case, the deviation coupling factor is greater than 1, which amplifies the risk score. However, when only one deviation increases, it indicates that there is only a single-dimensional anomaly, such as the user operating on an unfamiliar device. In this case, the deviation coupling factor equals 1, and the risk score is executed according to the normal logic.

[0060] Specifically, in one feasible embodiment of this specification, the sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session is obtained, and the deviation coupling factor is determined according to the numerical relationship between the first deviation value and the second deviation value, specifically including: Obtain multi-dimensional context information of the current session. The multi-dimensional context information includes at least: the sensitivity level of the resource requested by the current access request, the security status score of the current terminal environment, and the time deviation between the current operation time and the user's historical active period.

[0061] In one feasible embodiment, the identification information of the target resource is extracted from the current access request. Based on the resource identifier, a preset resource sensitivity level mapping table is queried to determine the sensitivity level of the currently requested resource. The resource sensitivity level mapping table is pre-configured and records the sensitivity levels corresponding to different resource identifiers, such as low sensitivity, medium sensitivity, and high sensitivity. A security status score for the current terminal device is obtained by communicating with the security monitoring module on the user terminal. This security status score is calculated based on factors such as the terminal device's operating system patch level, antivirus software running status, presence of known vulnerabilities, and whether the device is jailbroken or rooted. A higher security status score indicates a more trustworthy terminal environment. Access timestamps of each historical behavior feature sample are extracted from the user's historical behavior feature set. The distribution of user access time within historical periods is statistically analyzed to determine the user's historical active periods. The current operation time is compared with the historical active periods to calculate the time deviation. The larger the time deviation, the greater the deviation between the current operation time and the user's historical active periods.

[0062] The sensitivity of the current business scenario is determined by querying a preset sensitivity mapping table based on the sensitivity level. This sensitivity mapping table records the correspondence between different resource sensitivity levels and scenario sensitivity. In one or more embodiments of this specification, the sensitivity mapping table is stored in the system configuration database and supports dynamic updates. When business security policies are adjusted, the administrator can update the correspondence in the sensitivity mapping table. The sensitivity mapping table is constructed by configuring corresponding scenario sensitivity values ​​for different resource sensitivity levels according to the business security policy.

[0063] The first deviation and the second deviation are used as feature dimensions and mapped to a two-dimensional risk space to construct a real-time risk vector. That is, in this illustrative embodiment, the first deviation is used as the first dimension coordinate and the second deviation is used as the second dimension coordinate to construct a real-time risk vector in a two-dimensional risk space.

[0064] In this embodiment, the two-dimensional risk space is pre-divided into single-dimensional anomaly regions and collaborative anomaly regions. A single-dimensional anomaly region is a region with only one high deviation value and another low deviation value, located near the horizontal or vertical axis. A collaborative anomaly region is a region with both high deviation values, located far from both coordinate axes. Based on the endpoint coordinates of the real-time risk vector, a preset region in the two-dimensional risk space is determined, and a deviation coupling factor is determined based on this preset region. Specifically, when the endpoint of the real-time risk vector is located in a collaborative anomaly region, both the first and second deviation values ​​are at high levels, indicating simultaneous anomalies in user behavior and environmental state, thus a collaborative anomaly exists. In this case, the deviation coupling factor is set to an amplification factor greater than 1 to amplify the risk score in subsequent risk scoring calculations, enabling the system to respond more quickly to collaborative anomaly scenarios. Conversely, when the endpoint of the real-time risk vector is located in a single-dimensional anomaly region (i.e., only one high deviation value and another low deviation value), and only a single-dimensional anomaly exists, it is determined that no collaborative anomaly exists. The deviation coupling factor is set to 1, and the risk score is calculated according to conventional logic.

[0065] In one or more embodiments of this specification, the boundary between single-dimensional anomaly regions and collaborative anomaly regions in the two-dimensional risk space is determined based on statistical analysis of historical security event data. Specifically, security event data occurring within a historical period is collected, and the distribution characteristics of the two deviations in collaborative anomaly events (i.e., security events where the first and second deviations increase simultaneously) are statistically analyzed. The boundary of the collaborative anomaly region is determined based on the distribution characteristics, ensuring that the real-time risk vector in the collaborative anomaly event is located within the collaborative anomaly region.

[0066] In one or more embodiments of this specification, the boundary between the collaborative anomaly region and the single-dimensional anomaly region is a monotonically decreasing curve. This curve divides the two-dimensional risk space into three regions: the region closer to the horizontal axis is the first single-dimensional anomaly region, the region closer to the vertical axis is the second single-dimensional anomaly region, and the region farther away from both coordinate axes is the collaborative anomaly region.

[0067] By obtaining resource sensitivity levels from multi-dimensional context information and querying a sensitivity mapping table, the sensitivity of the current business scenario is determined, eliminating the need for complex calculations to assess the rigor of review for that scenario. A real-time risk vector is constructed by mapping the first and second deviations to a two-dimensional risk space, and the deviation coupling factor is determined based on the preset region where the real-time risk vector is located, thus distinguishing between single-dimensional anomalies and coordinated anomalies. By dividing the two-dimensional risk space into single-dimensional and coordinated anomaly regions, and determining the boundary between them based on historical security event data statistics, the region division is automatically generated driven by historical data, rather than relying on subjective experience, improving the accuracy of coordinated anomaly detection. This process can identify coordinated attack patterns that cannot be detected by single-dimensional deviation calculations alone, effectively reducing the risk of missed detections in complex attack scenarios.

[0068] S104: Construct a dynamic weight vector based on the current business scenario sensitivity and the deviation coupling factor, and measure the risk of the first deviation value and the second deviation value based on the dynamic weight vector to determine the real-time risk score of the current session.

[0069] Specifically, in one feasible embodiment of this specification, a dynamic weight vector is constructed based on the sensitivity of the current business scenario and the deviation coupling factor. The first deviation value and the second deviation value are then weighted and fused based on the dynamic weight vector, and the fusion result is mapped to a real-time risk score for the current session. This specifically includes: Based on the current business scenario sensitivity, a first basic weight corresponding to the first deviation and a second basic weight corresponding to the second deviation are determined. The first basic weight is positively correlated with the current business scenario sensitivity, and the second basic weight is negatively correlated with the current business scenario sensitivity. In one or more embodiments of this specification, a mapping table between scenario sensitivity and basic weights is pre-constructed. This mapping table records the values ​​of the first and second basic weights corresponding to different scenario sensitivities. For example, in a certain scenario, when the scenario sensitivity is high, the first basic weight is 0.7 and the second basic weight is 0.3; when the scenario sensitivity is medium, the first basic weight is 0.5 and the second basic weight is 0.5; when the scenario sensitivity is low, the first basic weight is 0.3 and the second basic weight is 0.7. Therefore, by querying this mapping table based on the determined current business scenario sensitivity, the corresponding first and second basic weights are obtained.

[0070] The first and second basic weights are corrected based on the deviation coupling factor to obtain the first and second fusion weights, and the dynamic weight vector is constructed based on the first and second fusion weights. When the deviation coupling factor equals 1, it indicates that there is no collaborative anomaly, so no correction is made to the basic weights; the first fusion weight equals the first basic weight, and the second fusion weight equals the second basic weight. When the deviation coupling factor is greater than 1, it indicates that there is a collaborative anomaly, and the basic weights need to be corrected. Specifically, the first and second basic weights are compared; the larger one is multiplied by the deviation coupling factor to obtain the corrected weight, and the smaller one is divided by the deviation coupling factor to obtain the corrected weight. The two corrected weights are then normalized so that their sum is 1, resulting in the first and second fusion weights. Through this correction, when a collaborative anomaly exists, the dynamic weight vector is further biased towards the feature dimension with a higher deviation, enabling the risk score to respond more quickly to collaborative anomaly scenarios. Then, the obtained first and second fusion weights constitute the dynamic weight vector.

[0071] Based on a dynamic weight vector, the coordinate axis weights of the real-time risk vector in the two-dimensional risk space are determined, and a risk baseline vector and risk boundary in the two-dimensional risk space are dynamically generated according to the multi-dimensional context information of the current session. The risk baseline vector and the risk boundary are adaptively adjusted as the multi-dimensional context information changes.

[0072] In one feasible embodiment, the dynamic weight vector includes a first fusion weight and a second fusion weight, which serve as the coordinate axis weights for the first and second deviation axes in the two-dimensional risk space, respectively. The coordinate axis weights are used to adjust the contribution of each dimension's deviation in subsequent geometric distance calculations; the larger the weight of a dimension, the greater its contribution to the geometric distance calculation.

[0073] The risk baseline vector is a vector pointing from the origin to a baseline coordinate point in a two-dimensional risk space, representing the expected or acceptable risk baseline position in the current scenario. The first dimension of the risk baseline vector is determined based on resource sensitivity level and time deviation; the higher the resource sensitivity level or the greater the time deviation, the closer the first dimension is to the origin. The second dimension of the risk baseline vector is determined based on the terminal environment's security status score and time deviation; the lower the security status score or the greater the time deviation, the closer the second dimension is to the origin. The risk boundary is a boundary line dividing the two-dimensional risk space into low-risk and medium-to-high-risk areas. The shape and position of the risk boundary adaptively adjust to changes in multi-dimensional contextual information. When the resource sensitivity level increases, the risk boundary contracts inward along the first deviation axis. When the terminal environment's security status score decreases, the risk boundary contracts inward along the second deviation axis. When the time deviation increases, the risk boundary contracts inward simultaneously along both coordinate axes. Based on the coordinate axis weights, the geometric distance between the weighted real-time risk vector and the risk baseline vector is determined, and the real-time risk score of the current session is determined based on the relative positional relationship between the geometric distance and the risk boundary.

[0074] In one feasible embodiment, the geometric distance between the real-time risk vector and the risk baseline vector is calculated based on the weighted Euclidean distance:

[0075] in, As the first fusion weight, As the second fusion weight, This is the first deviation value. This is the second deviation value. The first dimension of the risk baseline vector is the coordinate. This represents the second dimension of the risk baseline vector. Through the weighted Euclidean distance calculation described above, dimensions with larger weights contribute more to the geometric distance calculation.

[0076] The system further determines the relative positional relationship between the endpoint coordinates of the real-time risk vector and the risk boundary. When the endpoint is located inside the risk boundary, the current access is determined to be in a low-risk area, and the corresponding risk score is lower than the first threshold. When the endpoint is located on the risk boundary or outside the boundary but inside the preset termination boundary, the current access is determined to be in a medium-risk area, and the corresponding risk score is between the first threshold and the second threshold. When the endpoint is located outside the preset termination boundary, the current access is determined to be in a high-risk area, and the corresponding risk score is higher than the second threshold.

[0077] In one or more embodiments of this specification, the risk score is calculated as follows: The geometric distance is mapped to the [0,1] interval to obtain a normalized geometric distance. The normalized geometric distance is then corrected based on relative positional relationships. When the endpoint of the real-time risk vector is inside the risk boundary, an attenuation coefficient is applied to the normalized geometric distance. When the endpoint is outside the risk boundary, an amplification coefficient is applied to the normalized geometric distance. The corrected geometric distance is then used as the real-time risk score.

[0078] In this embodiment, dynamic weight vectors and geometric metrics are unified under the distance calculation framework. The dynamic weight vectors determine the coordinate axis weights, and multi-dimensional contextual information determines the position of the risk benchmark vector and the risk boundary. These factors work together from different perspectives to affect the final risk score, enabling the risk score to be adaptively adjusted according to changes in business scenario sensitivity, deviation, collaborative anomaly degree, and contextual information.

[0079] S105: Based on the real-time risk score and preset multi-level thresholds, execute a tiered access authorization decision; wherein the tiered access authorization decision includes at least two different levels of access control actions.

[0080] After the real-time risk score is calculated, it needs to be translated into specific access control actions to dynamically adjust user permissions. However, since a single risk score can fluctuate instantaneously, making decisions based directly on a single score can lead to frequent permission oscillations, affecting user experience and system stability. Therefore, in this embodiment, a tiered access authorization decision is executed based on the real-time risk score and preset multi-level thresholds. This tiered access authorization decision includes at least two different levels of permission control actions.

[0081] Specifically, in one or more embodiments of this specification, a tiered access authorization decision is executed based on the real-time risk score and preset multi-level thresholds, including: The system acquires a risk score sequence for the current session within a preset historical time period and calculates a risk change trend based on the risk score sequence. This risk change trend indicates whether the risk of the current session is in an upward, stable, or downward state; that is, step S104 continuously outputs the real-time risk score of the current session at each sampling time. When the system executes an authorization decision at the current time, it acquires the risk score values ​​within the preset historical time period to form a risk score sequence. In one feasible approach, the risk change trend is calculated by: calculating the linear regression slope of the risk score sequence; when the slope is greater than a preset upward threshold, the risk is determined to be in an upward state. When the slope is less than a preset downward threshold, the risk is determined to be in a downward state; otherwise, the risk is determined to be in a stable state. In another feasible approach, the risk change trend is calculated by comparing the difference between the latest risk score and the previous risk score; when the difference is consistently greater than a preset directional threshold, it is determined to be in an upward or downward state; when the difference fluctuates within the preset directional threshold range, it is determined to be in a stable state.

[0082] Based on risk change trends, preset benchmark thresholds are dynamically adjusted to generate dynamic thresholds that match the current risk evolution state. These benchmark thresholds can be based on fixed first and second benchmark thresholds pre-configured by operators according to safety requirements, or differentiated based on individual user historical behavioral characteristics, or by collecting all risk score data generated within historical operating cycles, plotting risk score distribution curves, and then using specific quantiles of the risk scores as benchmark thresholds based on these distribution curves. Specifically, benchmark thresholds for classifying different risk levels are pre-configured, including a first benchmark threshold to distinguish between low and medium risk, and a second benchmark threshold to distinguish between medium and high risk. The dynamic threshold is generated as follows: when the risk change trend is upward, the first benchmark threshold is multiplied by a first contraction coefficient to obtain the first dynamic threshold, and the second benchmark threshold is multiplied by a second contraction coefficient to obtain the second dynamic threshold, where both the first and second contraction coefficients are less than 1. Because the contraction coefficient is less than 1, the dynamic threshold is lower than the benchmark threshold, making it easier to trigger permission reduction actions under a medium-risk upward trend, allowing for early intervention when the risk continues to rise.

[0083] When the risk trend is downward, a first dynamic threshold is obtained by multiplying a first baseline threshold by a first expansion coefficient, and a second dynamic threshold is obtained by multiplying a second baseline threshold by a second expansion coefficient, where both the first and second expansion coefficients are greater than 1. Because the expansion coefficient is greater than 1, the dynamic threshold is higher than the baseline threshold, making it less likely to trigger a reduction in authority when the risk declines, thus avoiding overreaction. When the risk trend is stable, the first dynamic threshold equals the first baseline threshold, and the second dynamic threshold equals the second baseline threshold. In one or more embodiments of this specification, the contraction coefficient and expansion coefficient are positively correlated with the absolute value of the slope of the risk scoring sequence and can be determined based on statistical analysis of historical risk events; no specific limitations are imposed here.

[0084] The system compares the real-time risk score of the current session with a dynamic threshold and executes corresponding access control actions based on the comparison result. These actions include at least access maintenance, access reduction, and session termination. For example, when the real-time risk score is lower than the first dynamic threshold, the system determines the current access is in a low-risk state and performs an access maintenance action. When the real-time risk score is between the first and second dynamic thresholds, the system determines the current access is in a medium-risk state and performs an access reduction action. When the real-time risk score exceeds the second dynamic threshold, the system determines the current access is in a high-risk state and terminates the session. Through this tiered authorization decision, the system executes differentiated access control actions based on different risk levels, achieving a progressive response strategy from low to high risk.

[0085] Furthermore, when users switch between different end-device devices, existing technical solutions require users to re-collect historical behavior data and rebuild baseline models on the new device, resulting in duplicate authentication that impacts user experience. Additionally, there is a lack of consistent and continuous behavior monitoring capabilities across different devices. In one or more embodiments of this specification, the method further includes: The system acquires a set of endpoint device identifiers for the target user and associates multiple endpoint device identifiers for the same user with the same user identity identifier. The endpoint device identifier is used to uniquely identify the user's terminal device. When a user authenticates and accesses multiple endpoint devices, such as office computers, personal laptops, smartphones, and tablets, using the same user identity identifier, the endpoint device identifiers for each device are collected separately.

[0086] To determine whether a user has established a user behavior baseline model on the first terminal device, in this embodiment, when a user initiates an access request through the second terminal device, the system first queries whether a corresponding user behavior baseline model exists on the second terminal device based on its terminal device identifier. If not, it further queries whether the user has established a user behavior baseline model on other terminal devices, using the user's identity identifier as an index, to determine whether the user has established a user behavior baseline model on the first terminal device. If so, the user behavior baseline model is synchronized to the user's second terminal device. During the real-time behavior feature stream acquisition process on the second-side device, the user behavior baseline model synchronized to the second-side device is invoked to calculate the deviation of the real-time behavior feature stream on the second-side device. In this process, by invoking the user behavior baseline model synchronized to the second-side device, the real-time behavior monitoring on the second-side device does not need to re-collect historical behavior data and rebuild the baseline model, and can directly reuse the behavior baseline model already established for the user on the first-side device.

[0087] By associating multiple device identifiers of the same user with the same user identity identifier, unified identification of the user's identity is achieved across different terminal devices, providing an identity association foundation for the cross-device reuse of the behavior baseline model. Furthermore, by determining whether a user behavior baseline model has already been established on the first device, and synchronizing the baseline model to the second device upon confirmation, the user does not need to re-collect historical behavioral features and rebuild the baseline model on the second device. This avoids the impact of duplicate authentication and data collection on user experience, while also reducing the computational overhead of repeatedly building the baseline. By enabling the second device to call the synchronized baseline model for deviation calculation, consistency in behavior monitoring of the same user across different devices is achieved, eliminating the fragmentation problem of security policies caused by differences in security policies between different devices. This makes it difficult for attackers to bypass protection by exploiting cross-device security policy differences.

[0088] like Figure 2 As shown in one or more embodiments of this specification, a schematic diagram of a dynamic access control system based on continuous behavior authentication is provided. The system includes: The construction module 201 is used to obtain the user's historical behavior feature set, so as to construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline; The mapping module 202, after the user obtains initial access authorization, collects the real-time behavioral feature stream of the current session, maps the real-time behavioral feature stream to the biometric feature space and compares it with the biometric feature sub-baseline to calculate a first deviation value, and maps it to the environmental feature space and compares it with the environmental feature sub-baseline to calculate a second deviation value. The determination module 203 is used to obtain the sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session, and determine the deviation coupling factor according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value; The scoring module 204 is used to construct a dynamic weight vector based on the current business scenario sensitivity and the deviation coupling factor, so as to measure the risk of the first deviation value and the second deviation value based on the dynamic weight vector and determine the real-time risk score of the current session. The execution module 205 is used to perform a tiered access authorization decision based on the risk score and preset multi-level thresholds; wherein the tiered access authorization decision includes at least two different levels of access control actions.

[0089] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0090] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0091] The above description is merely one or more embodiments of this specification and is not intended to limit this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of this specification.

Claims

1. A dynamic access control method based on continuous behavior authentication, characterized in that, The method includes: Obtain the user's historical behavior feature set, and construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline; After the user obtains initial access authorization, the real-time behavioral feature stream of the current session is collected, and the real-time behavioral feature stream is mapped to the biometric feature space and compared with the biometric feature sub-baseline to calculate the first deviation value. The feature stream is then mapped to the environmental feature space and compared with the environmental feature sub-baseline to calculate the second deviation value. The sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session is obtained, and the deviation coupling factor is determined according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value; A dynamic weight vector is constructed based on the sensitivity of the current business scenario and the deviation coupling factor. Based on the dynamic weight vector, the first deviation value and the second deviation value are used to measure the risk and determine the real-time risk score of the current session. Based on the real-time risk score and preset multi-level thresholds, a tiered access authorization decision is executed; wherein the tiered access authorization decision includes at least two different levels of access control actions.

2. The dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, Obtain the user's historical behavior feature set, specifically including: Obtain the session identifier and business scenario tag of the current session, and query the corresponding historical behavior records based on the session identifier; Based on the business scenario tags, the historical behavior records are filtered to obtain a subset of historical behavior features that are semantically associated with the business scenario; Based on a preset time window, historical behavior features extracted from the subset of historical behavior features are obtained, wherein the preset time window includes: a short-term window and a long-term window; When the amount of long-term historical behavioral features within the long-term window is lower than a preset threshold, one or more business scenarios to be migrated are determined based on the semantic similarity between the current business scenario and other business scenarios, and their historical behavior records are used as supplementary data. Based on the supplementary data, the historical behavioral features are supplemented and fused to generate a set of historical behavioral features for the user.

3. The dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, Based on the aforementioned historical behavior feature set, a user behavior baseline model is constructed, specifically including: Based on the timestamps corresponding to each historical behavior feature in the historical behavior feature set, the historical behavior feature time series is obtained by sorting them. Based on the temporal position of each historical behavioral feature in the time series of historical behavioral features, the temporal dimension weight of each historical behavioral feature is determined; wherein, the temporal dimension weight is negatively correlated with the time difference between each historical behavioral feature and the current time. Based on historical behavioral features with the aforementioned time dimension weights, biometric sub-baselines and environmental sub-baselines are constructed respectively, and the biometric sub-baselines and environmental sub-baselines are combined to generate a user behavior baseline model.

4. The dynamic access control method based on continuous behavior authentication according to claim 3, characterized in that, Based on historical behavioral features weighted by the time dimension, biometric sub-baselines and environmental sub-baselines are constructed respectively. These biometric and environmental sub-baselines are then combined to generate a user behavior baseline model, specifically including: Obtain the first feature vector of each historical biological behavior feature in the historical behavior features with the time dimension weight, and obtain the second feature vector of each historical environmental context feature in the historical behavior features with the time dimension weight. The first feature vector and the second feature vector are multiplied by their corresponding time dimension weights to obtain the weighted biological feature vector and the weighted environmental feature vector, respectively. The biofeature sub-baseline is determined based on the weighted mean vector and weighted covariance matrix of each weighted biofeature vector, and the environmental feature sub-baseline is determined based on the weighted mean vector and weighted covariance matrix of each weighted environmental feature vector. The biometric sub-baseline and the environmental sub-baseline are correlated to generate a user behavior baseline model.

5. The dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, After a user obtains initial access authorization, the real-time behavioral feature stream of the user's current session is collected, specifically including: After the user obtains initial access authorization, the sliding time window is initialized starting from the current moment; Based on a preset sliding step size, the sliding time window is pushed forward to extract user interaction signals within the current sliding time window coverage area through the client probe; Based on the interaction signals and the current session identifier, a real-time data stream is generated; The real-time data stream is parsed to obtain real-time operational behavior data and real-time environmental state data. Real-time biological behavior features and real-time environmental context features are extracted respectively to generate a real-time behavior feature stream.

6. The dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, The real-time behavioral feature stream is mapped to the biometric feature space and compared with the biometric feature sub-baseline to calculate a first deviation value. Then, it is mapped to the environmental feature space and compared with the environmental feature sub-baseline to calculate a second deviation value. Specifically, this includes: Obtain the feature type label corresponding to each real-time behavior feature in the real-time behavior feature stream, and split the real-time behavior feature stream into a real-time biological behavior feature stream and a real-time environmental context feature stream according to the feature type label; The real-time biological behavior feature stream is mapped to the biological feature space, and the biological feature sub-baseline is obtained; based on the biological feature sub-baseline, the first deviation between the current real-time biological behavior feature and the biological feature sub-baseline is calculated, and used as the first deviation value; The real-time environmental context feature stream is mapped to the environmental feature space, and the environmental feature sub-baseline is obtained; based on the environmental feature sub-baseline, the second deviation between the current real-time environmental context feature and the environmental feature sub-baseline is calculated as the second deviation value.

7. The dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, Obtain the current business scenario sensitivity corresponding to the multi-dimensional context information of the current session, and determine the deviation coupling factor based on the numerical relationship between the first deviation value and the second deviation value, specifically including: Obtain multi-dimensional context information of the current session, which includes at least: the sensitivity level of the resource requested by the current access request, the security status score of the current terminal environment, and the time deviation between the current operation time and the user's historical active period; The sensitivity of the current business scenario is determined by querying a preset sensitivity mapping table based on the sensitivity level; wherein, the sensitivity mapping table includes the correspondence between different resource sensitivity levels and scenario sensitivity. The first deviation and the second deviation are used as feature dimensions and mapped to a two-dimensional risk space to construct a real-time risk vector; The deviation coupling factor is determined based on the preset region in which the real-time risk vector is located in the two-dimensional risk space; wherein the two-dimensional risk space is divided into a single-dimensional abnormal region and a collaborative abnormal region, the deviation coupling factor is greater than 1 when the real-time risk vector is located in the collaborative abnormal region, and the deviation coupling factor is equal to 1 when the real-time risk vector is located in the single-dimensional abnormal region.

8. A dynamic access control method based on continuous behavior authentication according to claim 7, characterized in that, A dynamic weight vector is constructed based on the current business scenario sensitivity and the deviation coupling factor. Based on this dynamic weight vector, risk is measured on the first deviation value and the second deviation value to determine the real-time risk score for the current session. Specifically, this includes: Based on the sensitivity of the current business scenario, a first basic weight corresponding to the first deviation and a second basic weight corresponding to the second deviation are determined; wherein, the first basic weight is positively correlated with the sensitivity of the current business scenario, and the second basic weight is negatively correlated with the sensitivity of the current business scenario; The first basic weight and the second basic weight are corrected according to the deviation coupling factor to obtain the first fusion weight and the second fusion weight, and the dynamic weight vector is constructed according to the first fusion weight and the second fusion weight. Based on the dynamic weight vector, the coordinate axis weights of the two-dimensional risk space where the real-time risk vector is located are determined, and the risk baseline vector and risk boundary in the two-dimensional risk space are dynamically generated according to the multi-dimensional context information of the current session; wherein, the risk baseline vector and the risk boundary are adaptively adjusted as the multi-dimensional context information changes; Based on the coordinate axis weights, the geometric distance between the weighted real-time risk vector and the risk baseline vector is determined, and the real-time risk score of the current session is determined according to the relative positional relationship between the geometric distance and the risk boundary.

9. A dynamic access control method based on continuous behavior authentication according to claim 1, characterized in that, Based on the real-time risk score and preset multi-level thresholds, a tiered access authorization decision is executed, specifically including: Obtain the risk score sequence of the current session within a preset historical time period, and calculate the risk change trend based on the risk score sequence; the risk change trend is used to indicate whether the risk of the current session is in an upward, stable, or downward state. Based on the risk change trend, the preset benchmark threshold is dynamically adjusted to generate a dynamic threshold that matches the current risk evolution state. The real-time risk score of the current session is compared with the dynamic threshold, and the corresponding access control action is executed according to the comparison result. The access control action includes at least the access maintenance action, the access reduction action, and the session termination action.

10. A dynamic access control system based on continuous behavior authentication, the system comprising: A construction module is used to obtain the user's historical behavior feature set, and to construct a user behavior baseline model based on the historical behavior feature set; wherein, the user behavior baseline model includes: a biometric sub-baseline and an environmental feature sub-baseline; The mapping module, after the user obtains initial access authorization, collects the real-time behavioral feature stream of the current session, maps the real-time behavioral feature stream to the biometric feature space and compares it with the biometric feature sub-baseline to calculate the first deviation value, and maps it to the environmental feature space and compares it with the environmental feature sub-baseline to calculate the second deviation value. The determination module is used to obtain the sensitivity of the current business scenario corresponding to the multi-dimensional context information of the current session, and determine the deviation coupling factor according to the numerical relationship between the first deviation value and the second deviation value; wherein, the deviation coupling factor is used to indicate whether there is a coordination anomaly between the first deviation value and the second deviation value; The scoring module is used to construct a dynamic weight vector based on the sensitivity of the current business scenario and the deviation coupling factor, and to perform risk measurement on the first deviation value and the second deviation value based on the dynamic weight vector to determine the real-time risk score of the current session. The execution module is used to perform tiered access authorization decisions based on the risk score and preset multi-level thresholds; wherein the tiered access authorization decisions include at least two different levels of access control actions.

Images