Network security access control method and device, computer device and medium

Abstract

The application relates to a network security access control method and device, computer equipment and a medium. The method comprises the following steps: determining a theoretical security baseline of a controlled module at a current access time based on state data of the controlled module at the current access time; determining a state deviation amount at the current access time based on the state data of the controlled module and the theoretical security baseline; determining an access control strategy of the controlled module based on the state deviation amount, so that the controlled module responds to the access control strategy to obtain a response result; evaluating the security effect of the access control strategy based on the response result to obtain an effect evaluation result; determining a strategy update amount based on the effect evaluation result and the state deviation amount; updating the access control strategy based on the strategy update amount to obtain an updated access control strategy; and controlling the access of the controlled module at a next access time based on the updated access control strategy. The method can improve the accuracy of network security access control.

Description

Technical Field

[0001] This application relates to the field of network security and access control technology, and in particular to network security access control methods, devices, computer equipment and media. Background Technology

[0002] As enterprises deepen their digital transformation, the cybersecurity threats faced by information systems are becoming increasingly complex and diverse. Traditional cybersecurity devices (such as firewalls, intrusion detection systems, and identity authentication systems) generally adopt black-and-white access control policies based on predefined static rules, that is, pre-setting conditions for allowing or denying access, and strictly executing decisions according to the preset rules during actual operation.

[0003] However, the pre-set allow or deny conditions are usually based on experience. Setting conditions based on experience is prone to misjudgment, which in turn affects the accuracy of network security access control.

[0004] Therefore, how to implement secure access control for network devices to improve the accuracy of network security access control is a problem that needs to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide a network security access control method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] In a first aspect, this application provides a network security access control method, which is applied to a processing module in a single device terminal, the processing module being communicatively connected to a controlled module, comprising:

[0007] Based on the status data of the controlled module at the current access time, the theoretical security baseline of the controlled module at the current access time is determined;

[0008] Based on the state data of the controlled module and the theoretical security baseline, the state deviation at the current access time is determined;

[0009] Based on the state deviation, the access control policy of the controlled module is determined so that the controlled module responds to the access control policy at the current access time and obtains a response result;

[0010] Based on the response results, the security effectiveness of the access control policy is evaluated to obtain the effectiveness evaluation results;

[0011] Based on the effect evaluation results and the state deviation, the policy update amount is determined;

[0012] Based on the policy update amount, the access control policy is updated to obtain the updated access control policy;

[0013] The access of the controlled module at the next access time is controlled based on the updated access control policy.

[0014] In one embodiment, the status data includes the current operating data of the controlled module in multiple dimensions, and the theoretical safety baseline includes safety baselines in multiple dimensions;

[0015] The determination of the state deviation at the current access time based on the state data of the controlled module and the theoretical security baseline includes:

[0016] For each dimension, determine the feature deviation amount corresponding to each dimension based on the current operating data and the safety baseline;

[0017] Based on the historical operating data of the controlled module in each dimension, the deviation contribution rate of each dimension is determined;

[0018] Based on the policy update amount and the deviation contribution rate of each dimension, the dimension weight of the corresponding dimension at the previous access time is adjusted to obtain the dimension weight of each dimension at the current access time.

[0019] Based on the feature deviation amount corresponding to each dimension and the dimension weight of each dimension at the current access time, the state deviation amount at the current access time is determined.

[0020] In one embodiment, determining the state deviation at the current access time based on the feature deviation corresponding to each of the dimensions and the dimension weight of each of the dimensions at the current access time includes:

[0021] Based on the state data of the controlled module and the theoretical safety baseline, the initial comprehensive deviation is determined;

[0022] Based on the initial comprehensive deviation and the preset deviation threshold, the target comprehensive deviation is determined;

[0023] The total dimension deviation is determined based on the feature deviation amount corresponding to each dimension and the dimension weight of each dimension at the current access time.

[0024] Based on the target comprehensive deviation and the total dimension deviation, the state deviation at the current access time is determined.

[0025] In one embodiment, determining the theoretical security baseline of the controlled module at the current access time based on the state data of the controlled module at the current access time includes:

[0026] The state data of the controlled module at the current access time is input into the trained baseline learning model to obtain the theoretical security baseline of the controlled module at the current access time.

[0027] The trained baseline learning model is obtained by training a model combining a long short-term memory network and an autoencoder based on the state data of the controlled module at historical access times.

[0028] In one embodiment, determining the access control policy of the controlled module based on the state deviation includes:

[0029] The initial deviation level is determined based on the state deviation amount;

[0030] Based on the access time factor, access address factor, access resource factor, and user access reputation factor corresponding to the status data at the current access time, a level adjustment factor is determined;

[0031] Based on the level adjustment factor, the initial deviation level is adjusted to obtain the target deviation level;

[0032] Based on the target deviation level, the access control policy for the controlled module is determined.

[0033] In one embodiment, determining the policy update amount based on the effect evaluation result and the state deviation includes:

[0034] Based on the state deviation amount and the deviation threshold, the degree of deviation abnormality is determined;

[0035] Based on the degree of deviation anomaly, the amount of state deviation, and the effect evaluation results, the policy update amount is determined.

[0036] In one embodiment, updating the access control policy based on the policy update amount to obtain an updated access control policy includes:

[0037] Based on the policy update amount, the activity weight of the access control policy in the rule base is updated to obtain the updated rule base;

[0038] From the updated rule base, the rule that matches the status data of the controlled module at the next access time is determined as the updated access control policy.

[0039] Secondly, this application also provides a network security access control device, comprising:

[0040] The security baseline determination module is used to determine the theoretical security baseline of the controlled module at the current access time based on the status data of the controlled module at the current access time.

[0041] The deviation determination module is used to determine the state deviation at the current access time based on the state data of the controlled module and the theoretical safety baseline.

[0042] The control strategy determination module is used to determine the access control strategy of the controlled module based on the state deviation amount, so that the controlled module responds to the access control strategy at the current access time and obtains a response result;

[0043] The effectiveness evaluation module is used to evaluate the security effectiveness of the access control policy based on the response results and obtain the effectiveness evaluation results.

[0044] The update amount determination module is used to determine the policy update amount based on the effect evaluation results and the state deviation amount;

[0045] The policy update module is used to update the access control policy based on the policy update amount to obtain an updated access control policy.

[0046] The access control module is used to control the access of the controlled module at the next access time based on the updated access control policy.

[0047] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps in any of the embodiments of the first aspect described above.

[0048] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps in any of the embodiments of the first aspect described above.

[0049] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method steps in any of the embodiments of the first aspect described above.

[0050] In the above implementation process, the state data of the controlled module at the current access time determines the theoretical security baseline. This effectively solves the problem that traditional access control relies on manually preset fixed thresholds or rules, which cannot adapt to normal changes in device load and user habits over time, leading to baseline aging and alarm proliferation. This facilitates improved accuracy of network security access control. Based on the state data and the theoretical security baseline, the state deviation at the current access time is determined, and the access control policy for the controlled module is determined based on the state deviation, enabling adaptive adjustment of the access control policy. Then, based on the response results, the security effect of the access control policy is evaluated, and the policy update amount is determined based on the effect evaluation results and the state deviation. This achieves coupling between the effect evaluation results and the state deviation, making the policy update amount subject to dual constraints of decision quality and deviation degree, significantly improving the stability and accuracy of access control policy evolution. Finally, based on the policy update amount, the access control policy is updated, and the access of the controlled module at the next access time is controlled according to the updated access control policy. This realizes a closed-loop process from determining the access control policy to obtaining the response result, then to effect evaluation, policy update, and access control at the next time. This ensures that each access control policy adjustment forms an adaptive correction negative feedback closed loop, fundamentally guaranteeing the convergence and reliability of network security access control in long-term operation, and effectively improving the accuracy of network security access control. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram of an application environment for a network security access control method provided in an embodiment of this application;

[0053] Figure 2 This is a flowchart illustrating a network security access control method provided in an embodiment of this application;

[0054] Figure 3 This is a flowchart illustrating another network security access control method provided in an embodiment of this application;

[0055] Figure 4 This is a schematic diagram of the structure of a network security access control device provided in an embodiment of this application;

[0056] Figure 5 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0059] As enterprises deepen their digital transformation, the cybersecurity threats faced by information systems are becoming increasingly complex and diverse. Traditional cybersecurity devices (such as firewalls, intrusion detection systems, and identity authentication systems) generally adopt a "black and white" access control policy based on predefined static rules, that is, pre-setting conditions for allowing or denying access, and strictly executing decisions according to the preset rules during actual operation.

[0060] RBAC (Role-Based Access Control) is currently the most widely adopted access control model. It manages access behavior by assigning predefined roles to users and configuring corresponding permissions for those roles. However, in large organizations or complex business environments, the RBAC model faces the dilemma of "role explosion." For example, the number of roles grows exponentially to encode various dynamic constraints, leading to a sharp increase in management complexity.

[0061] While ABAC (Attribute-Based Access Control) introduces real-time evaluation of user attributes, resource attributes, and environment attributes, improving the granularity and flexibility of control, it still essentially relies on manually pre-written policy rules.

[0062] The Zero Trust Architecture (ZTA) has brought a new approach to access control. The Zero Trust model follows three principles: continuous authentication, least privilege, and dynamic policy. It emphasizes that identity and context verification must be performed for each access, rather than one-time authorization.

[0063] In recent years, the industry has made some progress in dynamic access control. For example, some solutions collect user behavior data in real time and construct time-series feature vectors, dynamically calculate users' behavioral credit scores based on time-series models, and then map the credit scores to permission levels for real-time authentication. Other solutions combine initial strong authentication using software-defined boundaries (SDP) with continuous monitoring based on user behavior baselines, identifying abnormal risks and triggering permission adjustments by comparing current operations with the behavioral baseline in real time. However, while these methods have made breakthroughs in dynamic evaluation, they generally lack a systematic feedback evaluation and self-optimization mechanism for the effectiveness of control decisions. They have not yet formed a complete closed-loop control system and cannot adaptively adjust according to user behavior habits and environmental changes, thus affecting the accuracy of network security access control.

[0064] The network security access control method provided in this application embodiment can be applied to, for example, Figure 1 The application environment shown. Figure 1 This is a schematic diagram of an application environment for a network security access control method provided in an embodiment of this application, such as... Figure 1 As shown, this network security access control method can be applied to... Figure 1 In the single-device terminal 100, the processing module 101 is communicatively connected to the controlled module 102. The single-device terminal 100 can be a computer terminal or an IoT terminal; the IoT terminal can be a smart speaker, smart TV, smart air conditioner, smart vehicle device, projection device, etc. The controlled module 102 can be a device unit in the single-device terminal 100 used to receive user network access, such as a display unit or input unit. The processing module 101 can be a local decision engine of the single-device terminal 100, which can be a server.

[0065] In one exemplary embodiment, Figure 2 This is a flowchart illustrating a network security access control method provided in an embodiment of this application, applied to... Figure 1 Taking the processing module 101 in the middle as an example, the explanation is as follows: Figure 2 As shown, the method may include steps 201 to 207. Wherein:

[0066] Step 201: Based on the status data of the controlled module at the current access time, determine the theoretical security baseline of the controlled module at the current access time.

[0067] For example, during a user's access to a single device terminal, the controlled module can collect status data in real time. For instance, data can be collected at preset time windows (such as every 30 seconds) or by triggering events.

[0068] Specifically, the status acquisition unit in the controlled module can read the local configuration file to obtain the following acquisition control parameters: acquisition period (unit: seconds), user behavior data acquisition (Boolean value), device status data acquisition (Boolean value), system resource data acquisition (Boolean value), network environment data acquisition (Boolean value), a list of specific feature fields to be acquired, and the maximum number of entries in the local data buffer, and initialize the acquisition control parameters. After initialization, user behavior data, device status data, system resource access data, and network environment data can be acquired, and all acquired data will be used as the status data of the controlled module at the current access time. That is, the status data can include user behavior data, device status data, system resource access data, and network environment data.

[0069] As an example, user behavior data can be collected by calling the operating system API (Application Programming Interface) or kernel hook interface to collect the following user behavior-related fields: the unique identifier of the currently logged-in user; the timestamp of this login; the UNIX time format; the IP address from which this login originated; the login method, with values ​​such as LOCAL, SSH, RDP, etc.; the sequence of commands executed by the user in the past collection period, retaining a maximum of the most recent 50 commands, each record containing the command text and execution time; a list of file access records, each record containing the file path, access type (values ​​are READ, WRITE, EXECUTE, DELETE), and access timestamp; and a list of process startup records, each record containing the process name, process ID, parent process ID, and startup timestamp.

[0070] Device status data can be collected by reading the proc file system in Linux, the performance counter interface (Windows environment), or general system APIs. The following device status fields can be collected: CPU (Central Processing Unit) overall utilization (floating-point, range 0-100); memory utilization (floating-point, range 0-100); disk read bytes in the current collection period; disk write bytes in the current collection period; total number of currently active TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) connections; network received bytes in the current collection period; network sent bytes in the current collection period; a list of currently running process names and process IDs, with a maximum of 200 entries; a list of ports currently listening, each entry including port number and protocol type; the continuous running time of the controlled module since its last startup, in seconds; and the currently installed patch version number of the operating system.

[0071] System resource access data can be collected through the system audit interface or kernel monitoring points, including the following system resource-related fields: the frequency of access to preset sensitive directories (such as / etc / , / root / , system registry entries, etc.) within this collection period; a summary of system call sequences within this collection period, represented using n-gram hash dimensionality reduction to reduce transmission and storage overhead; a list of registry modification records (Windows environment only); and a list of kernel module loading or unloading records.

[0072] Network environment data is collected through network interface queries, including the following network environment fields: the IP address currently used by this device; the MAC address of this device's network card; a list of DNS query records initiated during this collection period; and a list of target IPs and ports for outbound connections during this collection period, with a maximum of 100 duplicate records retained.

[0073] All state data collected at the current access time is encapsulated into a unified data structure. For example, it is encapsulated into a SecurityStateRecord data structure to obtain the state data of the controlled module at the current access time.

[0074] Furthermore, the status acquisition unit sends the acquired status data to the local IPC socket to the processing module, enabling the processing module to obtain the status data of the controlled module at the current access time.

[0075] Then, the processing module determines the theoretical security baseline of the controlled module at the current access time based on the state data of the controlled module at the current access time. As an example, the state data at the current access time can be input into a trained baseline learning model, so that the baseline learning model outputs the theoretical security baseline of the controlled module at the current access time.

[0076] It should be noted that the theoretical security baseline is the minimum security standard or theoretical reference point for the normal behavior of a system, device, or network in its security configuration and operating state.

[0077] Step 202: Based on the state data of the controlled module and the theoretical security baseline, determine the state deviation at the current access time.

[0078] Furthermore, the processing module compares the state data of the controlled module at the current access time with the determined theoretical safety baseline to obtain the state deviation at the current access time. As an example, the state data at the current access time and the determined theoretical safety baseline can be vectorized separately, and the difference between the two vectorized data can be used to determine the state deviation at the current access time.

[0079] Step 203: Based on the state deviation, determine the access control policy of the controlled module so that the controlled module responds to the access control policy at the current access time and obtains the response result.

[0080] For example, the processing module can determine the access control policy corresponding to the state data at the current access time from a preset deviation-policy mapping table based on the determined state deviation amount.

[0081] Then, the processing module transmits the determined access control policy to the controlled module, enabling the controlled module to execute the access control policy at the current access time and obtain a response result. The controlled module then feeds back the response result to the processing module, allowing the processing module to obtain the response result of the controlled module executing the access control policy at the current access time.

[0082] Specifically, after receiving the access control policy from the processing module, the controlled module starts a countdown timer, with the observation window duration T_observe defaulting to 300 seconds (5 minutes). During T_observe, the controlled module continuously collects the following types of data:

[0083] Subsequent status data: used to calculate the trend of security status changes after the access control policy is implemented; Abnormal event reporting: to determine whether similar high-deviation alarms are still being triggered within the observation window; False alarm feedback interface: to receive appeals from users or administrators regarding the wrongful interception of normal operations; System resource monitoring data: to obtain the CPU and memory overhead caused by the newly added access control rules through the system monitoring interface. Based on the collected data, security effectiveness indicators, business impact indicators, and system resource overhead indicators are determined; that is, the response results can include security effectiveness indicators, business impact indicators, and system resource overhead indicators.

[0084] Safety performance indicators may include changes in deviation, abnormal behavior containment rate, and alarm clearance rate. Changes in deviation are:

[0085]

[0086] in, This refers to the change in deviation. The deviation amount collected last time before the execution of the access control policy at the current access time (i.e., the state deviation amount corresponding to the current access time). ), This represents the deviation measured at the end of the observation window. ΔS > 0 indicates an improvement in the safety status.

[0087] Abnormal behavior containment rate: If no similar high deviation alarms (Level≥MEDIUM and alarm source points to the same user or device) are generated in the observation window, the containment rate = 1.0; otherwise, the containment rate = 0.

[0088] Alarm clearance rate: Check whether the alarm events associated with the access control at the current access time have been cleared before the end of the observation window. If they have been cleared, the value is 1.0; otherwise, the value is 0.

[0089] Business impact metrics can include false blocking rate and response latency increment. False blocking rate: This is calculated from user feedback channels and system logs, tracking the number of normal business operations incorrectly blocked within the observation window. The formula for calculating the false blocking rate is:

[0090]

[0091] If the total number of business operations is 0, then the false interception rate is 0.

[0092] Response latency increment: Query the average response time of similar normal business requests before and after the execution of the access control policy at the current access time, and calculate the difference between the two. Normalize the difference to the [0,1] interval to characterize the impact of access control on normal business performance.

[0093] System resource overhead metrics can include average CPU usage increment ΔCPU and average memory usage increment ΔMem. Specifically, the list of currently active access control rules can be obtained through the monitoring interface, and the average CPU usage increment ΔCPU and average memory usage increment ΔMem resulting from these rules can be calculated. After normalizing ΔCPU and ΔMem by dividing them by their preset upper limits, the average value is taken to obtain the normalized resource overhead value, which ranges from [0, 1].

[0094] Step 204: Based on the response results, evaluate the security effectiveness of the access control policy and obtain the effectiveness evaluation results.

[0095] Furthermore, the processing module evaluates the security effectiveness of the access control policy based on the received response results, and obtains the effectiveness evaluation results.

[0096] Specifically, preset weights can be used to combine three types of indicators—security effectiveness indicators, business impact indicators, and system resource consumption indicators—into a single effectiveness evaluation result E.

[0097]

[0098] in, The change in deviation The value is obtained after normalization; This represents the weight of safety effectiveness, indicating that safety improvements are the most important factor in the evaluation; the default configuration is 0.6. To minimize business disruptions, we encourage reducing false blocking; the default configuration is 0.3. This represents the resource overhead weight, indicating that system overhead is a minor but not negligible factor, with a default configuration of 0.1. The theoretical range of E is [-1, 1]. E > 0 indicates that the overall effect of the access control policy is positive, making it an effective decision; E < 0 indicates that the access control policy has a negative impact (such as excessively high false positive rates or excessive resource overhead), making it an ineffective decision; E ≈ 0 indicates that the access control policy has little effect.

[0099] As an example, =min(1.0,max(0.0,ΔΔS)) restricts the change in deviation to the interval [0,1].

[0100] In addition, information related to the effectiveness evaluation results can be encapsulated into a FeedbackSignal data structure, and this record can be persistently stored in the effectiveness evaluation log table effectiveness_log for subsequent offline analysis and auditing.

[0101] Information related to the effectiveness evaluation results may include: the associated access control policy ID, the timestamp of the evaluation completion, the effectiveness evaluation result E, with a value range of [-1, 1], the state deviation before the access control policy was executed, the deviation at the end of the observation window, security effect sub-indicators, business impact sub-indicators, and resource overhead sub-indicators.

[0102] Step 205: Determine the policy update amount based on the effect evaluation results and the state deviation.

[0103] Furthermore, the policy update amount can be determined by coupling the effect evaluation result with the state deviation. As an example, the product of the effect evaluation result and the state deviation can be used to determine the policy update amount.

[0104] Step 206: Update the access control policy based on the policy update amount to obtain the updated access control policy.

[0105] Step 207: Control the access of the controlled module at the next access time based on the updated access control policy.

[0106] Furthermore, the processing module can compare the policy update amount with a preset policy update threshold. Specifically, the policy update threshold can include a strengthening threshold and a weakening threshold. If the policy update amount is greater than the strengthening threshold, the access control policy is strengthened, resulting in an updated access control policy; if the policy update amount is less than the weakening threshold, the access control policy is weakened, resulting in an updated access control policy; if the policy update amount is between the strengthening and weakening thresholds, the access control policy remains unchanged, meaning the updated access control policy is the access control policy corresponding to the current access time.

[0107] Furthermore, the processing module sends the updated access control policy to the controlled module. When the user accesses the single device terminal at the next access time, the controlled module executes the updated access control policy.

[0108] In the above implementation process, the state data of the controlled module at the current access time determines the theoretical security baseline. This effectively solves the problem that traditional access control relies on manually preset fixed thresholds or rules, which cannot adapt to normal changes in device load and user habits over time, leading to baseline aging and alarm proliferation. This facilitates improved accuracy of network security access control. Based on the state data and the theoretical security baseline, the state deviation at the current access time is determined, and the access control policy for the controlled module is determined based on the state deviation, enabling adaptive adjustment of the access control policy. Then, based on the response results, the security effect of the access control policy is evaluated, and the policy update amount is determined based on the effect evaluation results and the state deviation. This achieves coupling between the effect evaluation results and the state deviation, making the policy update amount subject to dual constraints of decision quality and deviation degree, significantly improving the stability and accuracy of access control policy evolution. Finally, based on the policy update amount, the access control policy is updated, and the access of the controlled module at the next access time is controlled according to the updated access control policy. This realizes a closed-loop process from determining the access control policy to obtaining the response result, then to effect evaluation, policy update and control at the next time. This ensures that each access control policy adjustment forms a self-correcting negative feedback loop, fundamentally guaranteeing the convergence and reliability of network security access control in long-term operation, and effectively improving the accuracy of network security access control.

[0109] In one embodiment, the status data includes the current operating data of the controlled module in multiple dimensions, and the theoretical safety baseline includes safety baselines in multiple dimensions.

[0110] Based on the state data of the controlled modules and the theoretical security baseline, the state deviation at the current access time is determined, including: for each dimension, determining the feature deviation corresponding to each dimension based on the current operating data and the security baseline; determining the deviation contribution rate of each dimension based on the historical operating data of the controlled modules in each dimension; adjusting the dimension weights of the corresponding dimensions in the previous access time based on the policy update amount and the deviation contribution rate of each dimension, and determining the dimension weights of each dimension at the current access time; and determining the state deviation at the current access time based on the feature deviations corresponding to each dimension and the dimension weights of each dimension at the current access time.

[0111] For example, status data may include user behavior data, device status data, system resource access data, and network environment data. Correspondingly, status data may include operational data of the controlled module in the four dimensions of user behavior, device status, system resource access, and network environment. Correspondingly, the theoretical security baseline may include the security baselines corresponding to the four dimensions of user behavior, device status, system resource access, and network environment.

[0112] As an example, if any one of the four dimensions—user behavior, device status, system resource access, and network environment—is... The current running data is Dimension The corresponding security baseline is Then the dimension The corresponding characteristic deviation is :

[0113]

[0114] in, For dimension The corresponding characteristic deviation; Dimension indexes are provided for four dimensions: user behavior, device status, system resource access, and network environment. For dimension Current running data; For dimension The corresponding security baseline.

[0115] Furthermore, based on the historical operational data of the controlled module in each dimension, the deviation contribution rate of each dimension can be determined. Specifically, based on the historical operational data of each dimension, the characteristic deviation of each dimension is determined in the Kth effective access (effect evaluation result E greater than 0) most recent access time. The frequency of occurrence is used to obtain the bias contribution rate for each dimension. As an example, the contribution rate of deviation. It can be determined by the following expression:

[0116]

[0117] in, For dimension The deviation contribution rate; K is the total number of effective visits closest to the current access time. Effective visits refer to visits with an effect evaluation result E greater than 0. K defaults to 20. In the most recent K valid visits, the th The number of times the operational data of each dimension acted as a major contributor to deviation was determined by the following criteria: Weighted bias components of the operational data in each dimension It has the highest proportion among all dimensions, that is argmax j ( ); In the most recent K valid visits, the th The number of times that the operational data of each dimension are the main contributors to the bias and are invalid visits (invalid visits refer to visits where the effect evaluation result E is less than 0).

[0118] Furthermore, the dimension of the current access time can be determined according to the following expression. Dimension weights :

[0119]

[0120] in, Dimension of the current access time Dimensional weights; Dimension of the previous access time Dimensional weights; This is the learning rate for the weights, with a default value of 0.05. This refers to the amount of time required for strategy updates. For dimension The contribution rate of the deviation.

[0121] Furthermore, the dimension weights of all dimensions at the current access time can be determined using the above expression for determining dimension weights, and the initial state deviation at the current access time can be determined using the following expression:

[0122]

[0123] in, This represents the initial state deviation at the current access time. Total number of dimensions; the initial dimension weights of each dimension are equal, and the sum of all initial dimension weights is 1, which ensures that the running data of each dimension is processed equally in the absence of prior knowledge.

[0124] Furthermore, to prevent oversensitivity caused by extreme values, the initial state deviation is normalized using the Sigmoid normalization function to obtain the state deviation at the current access time:

[0125]

[0126] in, This represents the state deviation at the current access time. The scaling factor is 1.0 by default; e is the natural constant (approximately 2.71828). The mathematical properties of this function are: as the independent variable approaches negative infinity, the function value approaches -1; as the independent variable approaches positive infinity, the function value approaches 1. Because... The values ​​are non-negative (each δ_i is a square value with positive weights), the actual input is always on the positive half-axis, and the output is mapped to the interval [0, 1]. When When the value is small, the function grows approximately linearly, maintaining sensitivity to subtle anomalies; when... When the value is large, the function gradually saturates and approaches 1, preventing individual extreme outliers from amplifying the deviation indefinitely.

[0127] In the above implementation process, based on the historical operational data of the controlled module in each dimension, the deviation contribution rate of each dimension is determined, effectively quantifying the information in the historical access process. Then, based on the policy update amount and the deviation contribution rate of each dimension, the dimension weights of the corresponding dimensions at the previous access time are adjusted to obtain the dimension weights of each dimension at the current access time. Thus, the quantified deviation contribution rate and policy update amount are used together as the basis for weight adjustment, ensuring that the trend of dimension weight changes reflects the actual interpretability of the operational data of each dimension to the security status over a period of time, effectively improving the sensitivity and stability of adaptive access control policy adjustment. Finally, based on the feature deviation amount corresponding to the dimension and the dimension weights of each dimension at the current access time, the state deviation amount at the current access time is determined, effectively eliminating the lag of static weights and facilitating further improvement in the accuracy of access control policy adjustment.

[0128] In one embodiment, determining the state deviation at the current access time based on the feature deviations corresponding to each dimension and the dimension weights of each dimension at the current access time may include: determining an initial comprehensive deviation based on the state data of the controlled module and the theoretical security baseline; determining a target comprehensive deviation based on the initial comprehensive deviation and a preset deviation threshold; determining a total dimension deviation based on the feature deviations corresponding to each dimension and the dimension weights of each dimension at the current access time; and determining the state deviation at the current access time based on the target comprehensive deviation and the total dimension deviation.

[0129] As an example, the processing module maintains a sliding window buffer of length W, which stores the state data transmitted by the controlled module in the previous W-1 iterations. If the state data at the current access time is the state data of the Wth iteration, then the state data at the current access time is appended to the end of the buffer to make up a state data of length W. The W state data is then vectorized to form a state vector sequence. .

[0130] The state vector sequence is input into the trained baseline learning model, which performs forward inference to obtain a reconstructed vector sequence. The vector corresponding to the last time step in the reconstructed vector sequence is then used as the input. This is determined as the theoretical security baseline for the current access time.

[0131] Furthermore, the initial integration deviation can be determined by the square of the norm of the controlled module's state data and the theoretical safety baseline. As an example, the initial integration deviation can be determined using the following expression:

[0132]

[0133] in, This represents the initial overall deviation at the current access time. It is a sequence of state vectors formed based on the state data at the current access time; This is the theoretical security baseline at the current access time.

[0134] The maximum error of the baseline learning model during training is defined as the preset bias threshold. Furthermore, the target overall deviation can be determined using the following expression:

[0135]

[0136] in, The overall deviation from the target; The preset deviation threshold is determined by the maximum error of the baseline learning model during training. Within the interval [0, 1], The larger the value, the greater the deviation of the current state from the baseline of normal behavior.

[0137] The state deviation at the current access time mentioned above This serves as the total dimensional deviation. Further, based on the target comprehensive deviation and the total dimensional deviation, the state deviation at the current access time is determined. Specifically, the weighted average of the target comprehensive deviation and the total dimensional deviation can be used as the state deviation at the current access time.

[0138] In the above implementation process, to reduce the model inference error of determining the theoretical safety baseline through the baseline learning model, the deviation between the state data of the controlled module and the theoretical safety baseline is determined as the initial comprehensive deviation. Based on the initial comprehensive deviation and a preset deviation threshold, the target comprehensive deviation is determined, effectively determining the degree of deviation between the current state and the normal behavior baseline. Furthermore, based on the feature deviations corresponding to each dimension and the dimensional weights of each dimension at the current access time, the total dimensional deviation is determined. The target comprehensive deviation and the total dimensional deviation are then merged into the final state deviation. By determining the state deviation at the current access time through multiple dimensions, the possibility of inaccurate state deviation due to model inference errors is reduced, effectively improving the accuracy of the state deviation at the current access time.

[0139] In one embodiment, determining the theoretical security baseline of the controlled module at the current access time based on the state data of the controlled module at the current access time may include the following steps: inputting the state data of the controlled module at the current access time into a trained baseline learning model to obtain the theoretical security baseline of the controlled module at the current access time; the trained baseline learning model is obtained by training a model combining a long short-term memory network and an autoencoder based on the state data of the controlled module at historical access times.

[0140] For example, the theoretical security baseline of the controlled module at the current access time can be inferred through a trained baseline learning model.

[0141] Specifically, the baseline learning model adopts an architecture that combines a long short-term memory network with an autoencoder, namely a long short-term memory autoencoder (LSTM-Autoencoder), to capture the time series corresponding to security state data in multiple dimensions.

[0142] During initial deployment, the baseline learning model sets an initial learning period T_init, which is configurable and defaults to 14 days. During T_init, the controlled module sends historical access status data to the baseline learning unit in the processing module. The baseline learning unit stores all received records completely in the historical state database table (historical_state) without any filtering or discarding. The 14-day initial learning period is designed to cover at least two weeks of user behavior, including different usage patterns on weekdays and weekends, ensuring that the baseline learning model can fully learn various variations of normal behavior.

[0143] After the initial learning cycle ends, the baseline learning unit performs data cleaning and feature engineering on all historical state data records accumulated during T_init, specifically including the following sub-steps:

[0144] Outlier removal: For continuous features, first check if they exceed the range of physical meaning (e.g., less than 0 or greater than 100), and directly remove obvious outliers; then calculate the mean of each feature. and standard deviation Remove values ​​that deviate from the mean by more than 3 standard deviations (i.e., exceed the standard deviation). The sampling points (within a certain range) typically correspond to occasional extreme states and are not suitable as part of a baseline for normal behavior.

[0145] Missing value imputation: For cases where individual fields are occasionally missing, forward imputation is used, meaning the missing value is filled with the most recent valid sample value of that field on this device. If a field has never had a valid value in the entire dataset, it is filled with the global mean of the dataset for that field.

[0146] Feature extraction and vectorization: Each historical state data record is converted into a one-dimensional numerical feature vector X=[x_1,x_2,...,x_n], where n is the total dimension of the state data. The conversion rules for each type of field are as follows:

[0147] Continuous features (such as usage rate, number of bytes, etc.) are directly taken as numerical values ​​and then mapped to the [0, 1] interval using the min-max normalization method; discrete features (such as command sequences) are converted into numerical vectors using TF-IDF or n-gram frequency vectorization methods; textual features (such as process lists) are encoded into sparse vector representations using the bag-of-words model.

[0148] Time series sample construction: After vectorizing the features of a single record, time series training samples are constructed using a sliding window approach. The sliding window length W defaults to 10 sampling points, and the sliding step size is 1. Specifically, for time point t, when constructing samples, the feature vector sequence { As a training sample, the input and output of this sample are both vector sequences of length W. The training goal of the Autoencoder is to reconstruct an output that is close to the original sequence from the input sequence.

[0149] The LSTM-Autoencoder is used as the baseline model. Its network structure includes an encoder and a decoder, and the training process is as follows:

[0150] Encoder section: A single-layer Long Short-Term Memory (LSTM) network, with input dimension n equal to the feature vector dimension and hidden state dimension m set to n / 2 (rounded down when n is odd). The encoder LSTM reads the input sequence { In the last time step, the hidden state vector h is output, which is the compressed representation of the entire input sequence.

[0151] Decoder section: A single-layer LSTM network, with the hidden state dimension also being m. The decoder uses the hidden state vector h output by the encoder as the initial hidden state and reconstructs the output sequence step by step. The decoder's output at each time step is mapped from m dimensions back to n dimensions through a fully connected layer.

[0152] Model training: Using all constructed training samples, with mean squared error as the loss function:

[0153]

[0154] The Adam optimizer was used for training, with an initial learning rate of 0.001 and 100 training epochs. The validation set loss was monitored during training, and training was terminated early when the validation set loss stopped decreasing for 10 consecutive epochs to prevent overfitting.

[0155] Normalized baseline calculation: After training is complete, input all samples from the training set into the model one by one, and calculate the reconstruction error for each sample. Statistically analyze the distribution of reconstruction errors for all training samples, and denote the maximum value as . This serves as the benchmark parameter for the normalized deviation in subsequent operation phases.

[0156] Model persistence: This involves storing the weights, optimizer states, and other parameters of the trained LSTM-Autoencoder model. Serialize and store them together in the baseline model (baseline_model) table for easy use later.

[0157] After the baseline model is trained and persisted, a well-trained baseline learning model is obtained.

[0158] Furthermore, the state data of the controlled module at the current access time is input into the trained baseline learning model to obtain the theoretical security baseline of the controlled module at the current access time.

[0159] As another example, after the baseline model is trained and persisted, a baseline version number is generated. The version number format is v{YYYYMMDD}_{serial number}. The metadata of the baseline learning model (including creation timestamp, feature dimension n, training data volume, start and end times of the initial learning cycle, etc.) is written to the baseline version table.

[0160] After the baseline learning model enters the formal operation phase, the baseline learning module continues to receive real-time state data. It maintains a fixed-length sliding time window as the training data source for incremental learning, with a default window length of 30 days. The data within the window is taken from the `historical_state` table and managed according to the collection timestamp: whenever new data enters the window, the window's starting position slides forward, and data exceeding the window boundary (i.e., more than 30 days earlier than the current time) is automatically removed from the training range.

[0161] For example, the incremental learning process is triggered at 2:00 AM every day. The reason for choosing the early morning time is that the system load is usually low during this period, and executing model training will not affect normal business operations.

[0162] After the incremental learning process is started, perform the following operations:

[0163] Read all state data within the current 30-day sliding window from the historical_state table, and perform data cleaning, feature extraction, and time series sample construction on this data.

[0164] Using the weights of the currently active LSTM-Autoencoder model as initial weights, fine-tuning training is performed on newly constructed training samples. The learning rate for fine-tuning training is set to 0.0001 (lower than the initial training learning rate), and the number of training epochs is set to 20 to prevent catastrophic forgetting.

[0165] After fine-tuning, the maximum reconstruction error e_max_new of the new model on this training set is recalculated.

[0166] Calculate the mean reconstruction error on the same validation set (10% of the data randomly selected from the most recent 7 days within the window) on both the new and old models. If the mean reconstruction error of the new model is lower than that of the old model, the new model is considered to fit the normal behavior pattern better. A new baseline version number is generated, the old record in the baseline_model table is replaced with the new model parameters, the baseline version table is updated, and the baseline learning model optimization process is repeated.

[0167] In the above implementation process, a model combining a long short-term memory network and an autoencoder is used as the network architecture of the baseline learning model. The baseline learning model is trained based on the state data of the controlled module at historical access times. This allows the model to dynamically track the temporal trajectory of the controlled module's behavior during training and to establish complete normal behavior without any abnormal labels. This achieves a unity of temporal modeling capability and nonlinear representation capability. The trained baseline learning model is then used to determine the theoretical safety baseline at the current access time, effectively improving the accuracy of the theoretical safety baseline determination.

[0168] In one embodiment, determining the access control policy of the controlled module based on the state deviation may include: determining an initial deviation level based on the state deviation; determining a level adjustment factor based on the access time factor, access address factor, access resource factor, and user access reputation factor corresponding to the state data at the current access time; adjusting the initial deviation level based on the level adjustment factor to obtain a target deviation level; and determining the access control policy of the controlled module based on the target deviation level.

[0169] For example, three level thresholds can be preset: , as well as Furthermore, the state deviation is compared with the three level thresholds to determine the initial level corresponding to the state deviation.

[0170] Specifically, if the state deviation ΔS < 0.3, the initial deviation level is low, indicating that the current safety status is basically consistent with the normal baseline, with only normal random fluctuations; if the state deviation ΔS is in the range of 0.3 ≤ ΔS < 0.6, the initial deviation level is medium, indicating that the current status has a slight anomaly, which needs attention but does not yet pose a direct threat.

[0171] If the range of the state deviation ΔS is 0.6≤ΔS<0.8, and the initial deviation level is high (HIGH), it indicates that there is a significant anomaly and stricter control measures need to be taken.

[0172] If the state deviation ΔS ≥ 0.8, the initial deviation level is critical, indicating that there is a high-risk abnormal behavior and immediate blocking measures are required.

[0173] After determining the initial deviation level, a deviation report can be generated. This deviation report can only include the timestamp of the deviation calculation completion, the device's unique identifier, the state deviation amount ΔS (value range [0, 1]), the deviation level (value range LOW / MEDIUM / HIGH / CRITICAL), a list of deviation values ​​δ_i for subsequent interpretive analysis, and the baseline version number used in this calculation.

[0174] Furthermore, the status deviation amount ΔS, deviation level Level, and device identifier can be extracted from the deviation report, and a snapshot of the context factors corresponding to the status data at the current access time can be read from the context cache. Specifically, the context factors include access time factor, access address factor, access resource factor, and user access reputation factor.

[0175] Access Time Factor : Read the current access time and determine if it falls within the preset normal working hours (default is 9:00 to 18:00, Monday to Friday). If the current access time is not within the normal working hours, then =0.2; if it is during normal working hours, then =0. The physical meaning of the access time factor is: operations occurring outside of working hours are more suspicious and control actions should be escalated accordingly.

[0176] Access address factor The current login source IP address's geographic location is compared with the historical frequently used geographic locations list corresponding to the device_id. The historical frequently used geographic locations list is extracted from the baseline learning module and contains the most frequently occurring login IP address ranges for this device over the past 30 days. If the current IP address does not match any of the frequently used locations, then... =0.3; otherwise α_L=0.

[0177] Access Resource Factor Check if the target resource of the current access request belongs to the preset list of highly sensitive resources (including core databases, system configuration files, encryption key storage paths, etc.). If the target resource is in the list, then α_R = 0.4; otherwise, α_R = 0.

[0178] User access reputation factor α_H: Reads the historical reputation score H_score of the current user or device from the reputation database. The reputation score is updated by the effectiveness evaluation module after each decision feedback, and its value ranges from [0, 1], where 1 represents complete trust. Calculation In other words, the lower the reputation, the larger the factor value, and the stronger the impetus for upgrading control actions.

[0179] Furthermore, the grade adjustment factor is determined by the following expression:

[0180]

[0181] in, This is the level adjustment factor.

[0182] Furthermore, the initial deviation level is adjusted according to the level adjustment factor to obtain the target deviation level. Specifically, if... If the deviation is ≥0.8 and the current level is not CRITICAL, then the initial deviation level will be increased by one level, for example, from LOW to MEDIUM, from MEDIUM to HIGH, and from HIGH to CRITICAL; If the deviation is less than 0.2 and the current level is higher than LOW, the initial deviation level will be reduced by one level. Otherwise, the level will remain unchanged.

[0183] Furthermore, based on the target deviation level, the access control policy for the controlled module can be determined from the level policy mapping table. This finalizes the access control policy for this application.

[0184] As an example, Table 1 is a level policy mapping table provided in an embodiment of this application. The level policy mapping table includes access control policies corresponding to each deviation level, as well as corresponding descriptions.

[0185] Table 1

[0186] Deviation level Access control policy illustrate LOW ACTION_ALLOW Allow it completely, without any restrictions, and only record it in the regular audit log. MEDIUM ACTION_RESTRICT Restrict access to sensitive resources and increase the detail level of audit logs. HIGH ACTION_ISOLATE Isolate the current user session or device process to a restricted network area or sandbox environment. CRITICAL ACTION_BLOCK Immediately block the current access request, forcibly terminate the suspicious process, and lock the user account.

[0187] It should be noted that this level policy mapping table can be a pre-configured backup policy mechanism within a single device terminal. Regardless of whether the current access control policy exists in the existing rule base, it can determine the corresponding access control policy from the level policy mapping table based on the state deviation level, thereby ensuring that it has the ability to respond instantly in any abnormal scenario.

[0188] Furthermore, specific control parameters (ControlParameters) can be generated based on the final determined access control policy.

[0189] Specifically, if the access control policy is ACTION_RESTRICT.

[0190] Generate file system access restriction rules: remount sensitive directories such as / etc / , / root / , / var / spool / cron / in read-only mode, or call the file system filter driver to block write operations;

[0191] Generate process permission restriction rules: For all processes under the current user session, limit their resource limits such as CPU time, memory lock, and number of open files through the prctl system call or setrlimit;

[0192] Elevate the logging level of the system audit subsystem to verbose mode to record all system calls and file access behaviors.

[0193] If the access control policy is ACTION_ISOLATE.

[0194] Generate network isolation rules: Configure outbound traffic filtering policies on the local machine using iptables or nftables to only allow traffic to the preset management IP range and block outbound connections to all other addresses;

[0195] Create process sandbox rules: Move the current user process tree into a separate cgroup control group, limit its CPU usage limit and memory usage limit, and prevent abnormal processes from consuming too many system resources.

[0196] If the access control policy is ACTION_BLOCK:

[0197] Immediately terminate all processes associated with the current access session and send a SIGKILL signal to the corresponding process ID;

[0198] Lock the current user account to prevent it from creating new login sessions;

[0199] Add a persistent blocking rule to the local firewall rules targeting this user ID or source IP to deny any subsequent access requests.

[0200] Finally, a decision record can be generated, which may include: a unique identifier for the access control policy, in UUID v4 format; a timestamp for the generation of the access control policy; a unique identifier for the controlled entity; the current state deviation amount ΔS; the target deviation level; the access control policy corresponding to the initial deviation level; the access control policy corresponding to the target deviation level; specific control parameters; and context factor records.

[0201] Furthermore, the controlled unit executes the corresponding access control policy.

[0202] Specifically, taking the Linux operating system as an example, the specific execution methods of various control actions are as follows:

[0203] Read-only file system mounting: Execute commands such as `mount -o remount` or `ro / etc` to remount the target sensitive directory as read-only. For scenarios that support fine-grained control, directory-level write protection can also be implemented through the Linux security module interface.

[0204] Network isolation: Add outbound filtering rules using iptables commands:

[0205] Discard all outbound traffic from this user;

[0206] Allow outbound connections only to permitted management IP addresses.

[0207] Process resource limit: Write the limit value to the parameter file of the corresponding user process control group in the file system.

[0208] Process termination: parse the PID of the target process, call the kill() system call to send a SIGKILL signal to forcibly terminate the process.

[0209] After each control action is executed, check the return value of the call or the exit code of the command-line tool. If the return value is 0 or the exit code is 0, the execution was successful; if it is non-zero, the execution failed. For actions that fail, first record the error code and error description, and then try to re-execute using alternative methods.

[0210] Finally, execution status feedback information can be generated, which may include the corresponding access control ID; the timestamp of execution completion; whether all executions were successful; if it failed, the first error code is recorded; and a list of the actual effective rule identifiers.

[0211] Write the successfully applied access control policy to a persistent storage file. This file can be in a structured format (such as JSON or YAML), and each rule should include a rule ID, matching conditions, action type, parameters, and an effective timestamp. Simultaneously, register the automatic loading logic for this rule file in the startup script or service configuration to ensure that previously effective access control policies are automatically restored after the controlled unit restarts.

[0212] In the above implementation process, the initial deviation level is determined based on the state deviation amount, and the level adjustment factor is determined based on the access time factor, access address factor, access resource factor, and user access reputation factor. The level adjustment factor is used to adjust the initial deviation level to obtain the target deviation level. This realizes the integration of four types of access context factors into the level adjustment factor, so that the determined target deviation level can dynamically reflect the differentiated risks of the same technical deviation in different scenarios, improving the accuracy of deviation level determination. Finally, the access control policy is determined based on the accurate deviation level, which improves the accuracy of access control policy determination.

[0213] In one embodiment, determining the policy update amount based on the effect evaluation results and the state deviation amount may include: determining the degree of deviation anomaly based on the state deviation amount and the deviation threshold; and determining the policy update amount based on the degree of deviation anomaly, the deviation amount, and the effect evaluation results.

[0214] For example, a deviation threshold is preset. The difference between the state deviation and the deviation threshold is used to determine the degree of deviation anomaly. Furthermore, based on the degree of deviation anomaly, the state deviation, and the effect evaluation results, the policy update amount is determined.

[0215] As an example, the policy update amount can be determined using the following expression:

[0216]

[0217] in, For strategy update volume, For the effect evaluation results; The global learning rate controls the maximum step size for each policy update. It is read from the configuration file and has a default value of 0.1. A larger global learning rate allows rules to change faster but may be unstable, while a smaller global learning rate makes rule evolution smoother but slower. The deviation amount before the access control policy is executed, with a value range of [0, 1], is also the state deviation amount ΔS at the current access time; The degree of deviation anomaly; Sigmoid(·): S-shaped activation function, specifically Sigmoid(x) = 1 / (1 + e^{-x}), with an output range of (0, 1); β is the steepness coefficient, controlling the sensitivity of the Sigmoid function, with a default value of 10. The larger the β, the steeper the change of the function near the threshold, and the more obvious the gating effect; deviation threshold. The default value is 0.5. When When the value is significantly lower than θ, the Sigmoid output approaches 0, suppressing the adjustment; when When the value is significantly higher than θ, the Sigmoid output approaches 1, and the adjustment is relaxed.

[0218] In the above implementation process, the policy update amount is determined by multiple factors, including the degree of deviation anomaly, the amount of state deviation, and the effect evaluation results. This effectively improves the accuracy of the policy update amount determination and reduces the error caused by determining the policy update amount by a single factor.

[0219] In one embodiment, updating the access control policy based on the policy update amount to obtain an updated access control policy may include: updating the activity weight of the access control policy in the rule base based on the policy update amount to obtain an updated rule base; and determining the rules that match the state data of the controlled module at the next access time from the updated rule base as the updated access control policy.

[0220] For example, the processing module can compare the policy update amount with a preset policy update threshold. The policy update threshold may include a strengthening threshold and a weakening threshold.

[0221] As an example, the reinforcement threshold τ_high = 0.15; the weakening threshold τ_low = -0.10. If Adjustment > 0.15: enter the reinforcement rule process; if -0.10 ≤ Adjustment ≤ 0.15: enter the maintenance rule process; if Adjustment < -0.10: enter the weakening / reversal rule process.

[0222] Specifically, the rule process is strengthened by searching the rule base for existing rules that match the current access control policy. If a matching rule is found, the access control policy's active weight in the rule base is increased.

[0223]

[0224] This represents the activity weight of the access control policy in the rule base. The maximum activity weight is 1.0, indicating that the access control policy has the highest credibility. Increasing the activity weight gives the access control policy a higher priority in subsequent matching.

[0225] If no matching rule is found, it indicates that the control mode corresponding to the access control policy is valid, but the corresponding rule is currently lacking in the rule base. In this case, the access control policy is converted into a candidate rule, written into the rule base, and set to observation mode (status='shadow').

[0226] Maintaining the rule flow: When the policy update adjustment falls within the neutral range [-0.10, 0.15], no modifications are made to the rule base; only a record of "Evaluation complete, no rule changes" is written to the log. This avoids frequent rule fluctuations caused by minor fluctuations in feedback signals.

[0227] Weakening / Revoking Rule Process:

[0228] Search the rule base for an existing rule corresponding to this access control policy and reduce its weight:

[0229]

[0230] Note that Adjustment is negative at this point, so weight + Adjustment will decrease.

[0231] If the updated weight > 0, only the weight field is updated, and the rule remains active.

[0232] If the updated weight is less than or equal to 0, the status field of the rule will be changed from 'active' to 'disabled', indicating that the rule has been revoked and will no longer participate in subsequent access control decision matching. Revoked rules are not physically deleted but are retained in the rule base as historical records for rollback or recovery if necessary.

[0233] In addition, new rules can be generated: the automatic generation process for new rules is triggered when the following conditions are met simultaneously:

[0234] The current state deviation ΔS > 0.8; this high deviation state has lasted for more than 600 seconds (20 consecutive data collections, at 30-second intervals); there are no active rules in the current rule base that match this abnormal pattern.

[0235] The new rule generation sub-process is as follows:

[0236] Extract the original records of all state data during the period of high deviation from the historical_state table; use feature importance analysis to compare the distribution differences of each feature component of this batch of abnormal records with the normal baseline data, and find the feature combination with the largest contribution to the deviation (usually the top 5 features).

[0237] Based on these significant anomalies and their value ranges, a new access control rule is generated, including matching conditions (the combination of feature thresholds that trigger the rule) and a restriction action (defaulting to ACTION_ISOLATE). The new rule is written to the base table, and its status is set to 'shadow' (observation mode), with a default observation period of 24 hours. During the observation period, the rule is loaded into the rule engine for matching, but no control action is actually executed; only the number of hits is counted and the effect evaluation results after each hit are recorded.

[0238] After the observation period ends, the mean validity score E_avg of all feedback signals corresponding to the rule is calculated. If E_avg > 0, the rule status is changed from 'shadow' to 'active', and it is officially added to the active rule set; if E_avg ≤ 0, the rule status is changed to 'disabled', and the new rule is discarded.

[0239] Furthermore, at the next access time, the processing module determines the access control policy that matches the status data of the next access time from the updated rule base, thereby realizing adaptive cyclic control of network security access.

[0240] In the above implementation process, the active weight of the current access control policy in the rule base is updated by updating the policy update amount, thereby realizing the adjustment of the priority of the access control policy in the rule base. This makes it easier to match the access control policy according to the updated priority in the next access process, thus improving the flexibility of access control policy adjustment.

[0241] Figure 3 This is a flowchart illustrating another network security access control method provided in an embodiment of this application. This method can be applied to network security access control systems, such as... Figure 3 As shown, the network security access control system includes a status acquisition module, a baseline learning module, a deviation calculation module, a dynamic decision-making module, an execution control module, an effect evaluation module, and a rule update module.

[0242] Status acquisition module: Deployed in the controlled unit, it is responsible for collecting multi-dimensional safety status data in real time. The multi-dimensional safety status data includes historical status data and real-time status data, and encapsulates the data into a unified structure and sends it to the baseline learning module and the deviation calculation module.

[0243] Baseline learning module: Deployed on the local decision engine, it learns the baseline of normal behavior based on the LSTM-Autoencoder model and provides the baseline parameters to the deviation calculation module. It should be noted that the baseline learning model in this embodiment can also be an isolation forest algorithm for anomaly detection, constructing a decision tree through random partitioning and defining the state deviation as the anomaly score; a variational autoencoder (VAE) replaces the autoencoder to increase probabilistic modeling capabilities; simple moving average and EWMA (Exponentially Weighted Moving Average) methods are suitable for scenarios with extremely limited computing resources.

[0244] Deviation Calculation Module: Deployed in the local decision engine, it compares the current state with the baseline, calculates the state deviation ΔS, determines the deviation level, and outputs it to the dynamic decision module.

[0245] Dynamic Decision Module: Deployed on the local decision engine, this module dynamically generates access control decisions based on deviation and context factors, and then distributes them to the execution control module. The dynamic decision module can be a fuzzy logic controller: using state deviation and context factors as fuzzy variables, it infers decision actions through a fuzzy rule base; or a reinforcement learning model, such as Q-Learning or DQN (Deep Q-Network): using a safe state as the state space, access control actions as the action space, and performance evaluation results as the reward signal, it trains a reinforcement learning agent to make decisions.

[0246] Execution control module: Deployed in the controlled unit, it translates decisions into specific control actions at the operating system level and executes them, and feeds back the execution results to the effect evaluation module.

[0247] Effectiveness evaluation module: Deployed on the local decision engine, it quantifies the effectiveness of the decision after the observation window ends and generates a feedback signal R to be sent to the rule update module.

[0248] The rule update module, deployed locally within the decision engine, mathematically couples the feedback signal R with the state deviation ΔS to calculate rule adjustments. It then performs strengthening, weakening, revocation, or addition operations on the rule base and pushes the updated feature weights back to the deviation calculation module, forming a complete closed loop. The rule update module can employ Bayesian optimization, treating rule parameter adjustment as a black-box optimization problem and modeling the rule effect function using a Gaussian process; or it can use an evolutionary algorithm (genetic algorithm), treating the rule base as a population and iteratively optimizing the rules through selection, crossover, and mutation operations.

[0249] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0250] Based on the same inventive concept, this application also provides a network security access control device for implementing the network security access control method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more network security access control device embodiments provided below can be found in the limitations of the network security access control method described above, and will not be repeated here.

[0251] In one exemplary embodiment, Figure 4 This is a schematic diagram of a network security access control device provided in an embodiment of this application. The device is applied to a processing module in a single-device terminal, and the processing module is communicatively connected to the controlled module, such as... Figure 4 As shown, the device includes:

[0252] The security baseline determination module 401 is used to determine the theoretical security baseline of the controlled module at the current access time based on the status data of the controlled module at the current access time.

[0253] The deviation determination module 402 is used to determine the state deviation at the current access time based on the state data of the controlled module and the theoretical safety baseline.

[0254] The control strategy determination module 403 is used to determine the access control strategy of the controlled module based on the state deviation amount, so that the controlled module responds to the access control strategy at the current access time and obtains the response result;

[0255] The effectiveness evaluation module 404 is used to evaluate the security effectiveness of the access control policy based on the response results and obtain the effectiveness evaluation results.

[0256] The update amount determination module 405 is used to determine the policy update amount based on the effect evaluation results and the state deviation amount;

[0257] The policy update module 406 is used to update the access control policy based on the policy update amount to obtain the updated access control policy.

[0258] Access control module 407 is used to control the access of the controlled module at the next access time based on the updated access control policy.

[0259] In one embodiment, the status data includes the current operating data of the controlled module in multiple dimensions, and the theoretical safety baseline includes safety baselines in multiple dimensions; the deviation determination module 402 is specifically used for:

[0260] For each dimension, determine the corresponding feature deviation between the current operating data and the safety baseline;

[0261] Based on the historical operational data of the controlled module in each dimension, determine the deviation contribution rate of each dimension;

[0262] Based on the policy update amount and the deviation contribution rate of each dimension, the dimension weights of the corresponding dimensions at the previous access time are adjusted to obtain the dimension weights of each dimension at the current access time.

[0263] Based on the feature deviations corresponding to each dimension and the dimension weights of each dimension at the current access time, the state deviation at the current access time is determined.

[0264] In one embodiment, the deviation determination module 402 is specifically used for:

[0265] Based on the state data of the controlled module and the theoretical safety baseline, the initial comprehensive deviation is determined;

[0266] The target comprehensive deviation is determined based on the initial comprehensive deviation and the preset deviation threshold.

[0267] The total dimension deviation is determined based on the feature deviation of each dimension and the dimension weight of each dimension at the current access time.

[0268] Based on the target comprehensive deviation and the total dimension deviation, the state deviation at the current access time is determined.

[0269] In one embodiment, the safety baseline determination module 401 is specifically used for:

[0270] Input the state data of the controlled module at the current access time into the trained baseline learning model to obtain the theoretical security baseline of the controlled module at the current access time;

[0271] The trained baseline learning model is obtained by training a model combining a long short-term memory network and an autoencoder based on the state data of the controlled module at historical access times.

[0272] In one embodiment, the control strategy determination module 403 is specifically used for:

[0273] Determine the initial deviation level based on the state deviation amount;

[0274] Based on the access time factor, access address factor, access resource factor, and user access reputation factor corresponding to the status data at the current access time, determine the level adjustment factor;

[0275] The initial deviation level is adjusted based on the level adjustment factor to obtain the target deviation level;

[0276] Based on the target deviation level, determine the access control policy for the controlled module.

[0277] In one embodiment, the update amount determination module 405 is specifically used for:

[0278] The degree of deviation abnormality is determined based on the state deviation amount and the deviation threshold;

[0279] The policy update amount is determined based on the degree of deviation anomaly, the amount of state deviation, and the effect evaluation results.

[0280] In one embodiment, the policy update module 406 is specifically used for:

[0281] Based on the policy update volume, the active weight of the access control policy in the rule base is updated to obtain the updated rule base;

[0282] From the updated rule base, the rules that match the status data of the controlled module at the next access time will be determined as the updated access control policies.

[0283] Each module in the aforementioned network security access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0284] In one exemplary embodiment, a computer device is provided, which may be a server. Figure 5 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application, such as... Figure 5As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores the status data of the controlled modules. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a network security access control method.

[0285] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0286] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method steps of any of the above embodiments.

[0287] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the method steps of any of the above embodiments.

[0288] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0289] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0290] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0291] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network security access control method, characterized in that, The method is applied to a processing module in a single-device terminal, the processing module being communicatively connected to a controlled module, and the method includes: Based on the status data of the controlled module at the current access time, the theoretical security baseline of the controlled module at the current access time is determined; Based on the state data of the controlled module and the theoretical security baseline, the state deviation at the current access time is determined; Based on the state deviation, the access control policy of the controlled module is determined so that the controlled module responds to the access control policy at the current access time and obtains a response result; Based on the response results, the security effectiveness of the access control policy is evaluated to obtain the effectiveness evaluation results; Based on the effect evaluation results and the state deviation, the policy update amount is determined; Based on the policy update amount, the access control policy is updated to obtain the updated access control policy; The access of the controlled module at the next access time is controlled based on the updated access control policy.

2. The method according to claim 1, characterized in that, The status data includes the current operating data of the controlled module in multiple dimensions, and the theoretical safety baseline includes safety baselines in multiple dimensions. The determination of the state deviation at the current access time based on the state data of the controlled module and the theoretical security baseline includes: For each dimension, determine the feature deviation amount corresponding to each dimension based on the current operating data and the safety baseline; Based on the historical operating data of the controlled module in each dimension, the deviation contribution rate of each dimension is determined; Based on the policy update amount and the deviation contribution rate of each dimension, the dimension weight of the corresponding dimension at the previous access time is adjusted to obtain the dimension weight of each dimension at the current access time. Based on the feature deviation amount corresponding to each dimension and the dimension weight of each dimension at the current access time, the state deviation amount at the current access time is determined.

3. The method according to claim 2, characterized in that, The determination of the state deviation at the current access time based on the feature deviation corresponding to each of the dimensions and the dimension weight of each of the dimensions at the current access time includes: Based on the state data of the controlled module and the theoretical safety baseline, the initial comprehensive deviation is determined; Based on the initial comprehensive deviation and the preset deviation threshold, the target comprehensive deviation is determined; The total dimension deviation is determined based on the feature deviation amount corresponding to each dimension and the dimension weight of each dimension at the current access time. Based on the target comprehensive deviation and the total dimension deviation, the state deviation at the current access time is determined.

4. The method according to claim 1, characterized in that, The step of determining the theoretical security baseline of the controlled module at the current access time based on the status data of the controlled module at the current access time includes: The state data of the controlled module at the current access time is input into the trained baseline learning model to obtain the theoretical security baseline of the controlled module at the current access time. The trained baseline learning model is obtained by training a model combining a long short-term memory network and an autoencoder based on the state data of the controlled module at historical access times.

5. The method according to claim 1, characterized in that, The step of determining the access control policy for the controlled module based on the state deviation includes: The initial deviation level is determined based on the state deviation amount; Based on the access time factor, access address factor, access resource factor, and user access reputation factor corresponding to the status data at the current access time, a level adjustment factor is determined. Based on the level adjustment factor, the initial deviation level is adjusted to obtain the target deviation level; Based on the target deviation level, the access control policy for the controlled module is determined.

6. The method according to claim 1, characterized in that, The determination of the policy update amount based on the effect evaluation results and the state deviation includes: Based on the state deviation amount and the deviation threshold, the degree of deviation abnormality is determined; Based on the degree of deviation anomaly, the amount of state deviation, and the effect evaluation results, the policy update amount is determined.

7. The method according to any one of claims 1 to 6, characterized in that, The step of updating the access control policy based on the policy update amount to obtain an updated access control policy includes: Based on the policy update amount, the activity weight of the access control policy in the rule base is updated to obtain the updated rule base; From the updated rule base, the rule that matches the status data of the controlled module at the next access time is determined as the updated access control policy.

8. A network security access control device, characterized in that, A processing module for use in a single-device terminal, the processing module being communicatively connected to a controlled module, the device comprising: The security baseline determination module is used to determine the theoretical security baseline of the controlled module at the current access time based on the status data of the controlled module at the current access time. The deviation determination module is used to determine the state deviation at the current access time based on the state data of the controlled module and the theoretical safety baseline. The control strategy determination module is used to determine the access control strategy of the controlled module based on the state deviation amount, so that the controlled module responds to the access control strategy at the current access time and obtains a response result; The effectiveness evaluation module is used to evaluate the security effectiveness of the access control policy based on the response results and obtain the effectiveness evaluation results. The update amount determination module is used to determine the policy update amount based on the effect evaluation results and the state deviation amount; The policy update module is used to update the access control policy based on the policy update amount to obtain an updated access control policy. The access control module is used to control the access of the controlled module at the next access time based on the updated access control policy.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images