WO2018103595A1 - 一种授权策略推荐方法及装置、服务器、存储介质 - Google Patents

一种授权策略推荐方法及装置、服务器、存储介质 Download PDF

Info

Publication number
WO2018103595A1
WO2018103595A1 PCT/CN2017/114290 CN2017114290W WO2018103595A1 WO 2018103595 A1 WO2018103595 A1 WO 2018103595A1 CN 2017114290 W CN2017114290 W CN 2017114290W WO 2018103595 A1 WO2018103595 A1 WO 2018103595A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization policy
data
account
policy
authorization
Prior art date
Application number
PCT/CN2017/114290
Other languages
English (en)
French (fr)
Inventor
袁哲
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018103595A1 publication Critical patent/WO2018103595A1/zh
Priority to US16/296,167 priority Critical patent/US10686843B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00—Computing arrangements using knowledge-based models
    • G06N5/02—Knowledge representation; Symbolic representation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to an authorization policy recommendation method, an authorization policy recommendation device, a server, and a storage medium.
  • Cloud services are models of the addition, use, and delivery of Internet-based related services, often involving the provision of dynamically scalable and often virtualized resources over the Internet.
  • the user of the cloud service can help the user to securely control the access rights of the user to the resource by granting the user permission, which specifically includes which users can access the resource, the resources they can access and the way of access, and the like.
  • the server of the cloud service can judge whether to allow the specific access behavior of the user for a specific resource according to the granted permission, and the user can access the specific resource of the user only when the authentication allows.
  • the authentication service provider will provide a number of built-in policies (ie, built-in policy sets) based on historical experience, and then guide the user through the template to select the built-in policy set of different application programming interfaces (APIs) of each service, built-in strategies.
  • the collection is sorted alphabetically or by the authentication service provider to provide policy weights and sorted by weighting factors.
  • the service provider uses the preset policy as a recommended candidate set, and then uses the recommended scenario as a guiding template, and the recommended content is arranged in alphabetical order of the complete set or by manually defined weighting factors. To recommend to the user.
  • the technical problem to be solved by the embodiments of the present invention is to provide an authorization policy recommendation method, an authorization policy recommendation device, a server, and a storage medium, which can improve the diversity of the recommendation method and the accuracy of the recommendation.
  • An embodiment of the present invention provides a method for recommending an authorization policy, including:
  • An embodiment of the present invention further provides an authorization policy recommendation method, where the method is performed by a server, where the server includes one or more first processors and a first storage medium, and one or more programs, where The one or more programs are stored in a first storage medium, the program including one or more units each corresponding to a set of instructions, the one or more first processors being configured to execute instructions
  • the method includes:
  • An embodiment of the present invention provides an authorization policy recommendation apparatus, including:
  • a data acquisition part configured to obtain cloud service-based account data, provided authorization policy data, and service data
  • a feature extraction part configured to extract an account feature, an authorization policy feature, and a service feature according to the account data, the provided authorization policy data, and the service data; according to the account data, the provided authorization policy data, and the service data Relationship generation combination feature;
  • a model training generating part configured to perform model training according to the account feature, the authorization policy feature, the service feature, and the combination feature, and generate a policy prediction recommendation model
  • the prediction recommendation part is configured to predict the recommendation model based on the policy, perform prediction recommendation according to the current account information of the cloud service context scenario, filter out the authorization policy, and recommend the selected authorization policy to the current account.
  • Embodiments of the present invention provide a computer readable storage medium, which is applied to an authorization policy recommendation device, and stores a machine instruction, when the machine instruction is executed by one or more second processors, the second process The device performs the above authorization policy recommendation method.
  • An embodiment of the present invention provides an authorization policy recommendation apparatus, including:
  • a second storage medium configured to store executable instructions
  • a second processor configured to execute executable instructions stored in the second storage medium,
  • the executable instructions are configured to perform the authorization policy recommendation method described above.
  • An embodiment of the present invention provides a server, including:
  • a first storage medium configured to store executable instructions
  • the first processor is configured to execute executable instructions stored in the first storage medium, the executable instructions being configured to perform the authorization policy recommendation method described above.
  • the embodiment of the present invention further provides a computer readable storage medium, which is applied to a server, and stores a machine instruction, when the machine instruction is executed by one or more first processors, the first processor executes The above authorization policy recommendation method.
  • the embodiment of the present invention implements the cloud service-based account data, the provided authorization policy data, and the service data, and then extracts the account characteristics, the authorization policy features, the service features, and the combination characteristics of the three, and predicts the recommendation according to the feature generation strategy.
  • the model finally predicts the recommendation model based on the strategy, performs prediction recommendation based on the current account context information of the cloud service, and filters out the recommended authorization policy, and solves the problem in the prior art that is built according to the historical experience of the cloud service provider operator.
  • the forecasting strategy can not truly reflect the user's needs, the recommendation method is too single, the recommended accuracy rate is affected by the technical problem, and different strategies are recommended according to the characteristics of the account, which greatly improves the accuracy and diversity of the recommendation, making the strategy more widely used;
  • the prediction recommendation can be continuously improved and optimized, so that the recommended authorization strategy is continuously optimized, and the current account is combined with the current account.
  • the context of the scene information Service forecast recommendation can continue to improve further guide the user authorization policy, reduce operating costs and more efficiently promote the use of authentication systems.
  • FIG. 1 is a schematic diagram of a principle of recommendation of a related art authorization policy
  • FIG. 2 is a schematic diagram of a scenario structure of an authorization policy recommendation according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a method for recommending an authorization policy according to an embodiment of the present invention
  • 4-1 is a schematic diagram of the principle of sample training provided by an embodiment of the present invention.
  • 4-2 is a schematic flowchart of a method for recommending an authorization policy according to still another embodiment of the present invention.
  • FIG. 5 is a schematic flowchart diagram of another embodiment of an authorization policy recommendation method according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of an authorization policy recommendation apparatus according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a model training generation module according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram 1 of another embodiment of an authorization policy recommendation apparatus according to an embodiment of the present disclosure.
  • FIG. 9 is a second schematic structural diagram of another embodiment of an authorization policy recommendation apparatus according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a server according to an embodiment of the present invention.
  • Figure 2 is the hair A schematic diagram of a scenario architecture recommended by an authorization policy disclosed in the embodiment.
  • a user such as an enterprise or a unit
  • the user can register a cloud service account with a server that provides a cloud service through the terminal, and apply for some machine resources to some users (such as the corresponding enterprise). Or the employee of the organization), the user can step through the authorization policy according to the authorization policy guide provided or recommended by the system, to allow which users can access the machine resources, which machine resources can be accessed, how to access, and so on.
  • An embodiment of the present invention provides a method for recommending an authorization policy, which can automatically recommend a suitable authorization policy for the user.
  • FIG. 3 is a schematic flowchart of a method for recommending an authorization policy according to an embodiment of the present invention, which may include the following steps:
  • Step S300 acquiring cloud service-based account data, provided authorization policy data, and service data;
  • the cloud service-based account data in the embodiment of the present invention may include recommended object information data, such as personal attribute data of the user, including an account category, and an account domain (Internet, finance, home appliances, etc.) , login time, number of account logins, geographic data, etc.
  • the authorization policy data provided by the cloud service may include some preset policies manually operated by the cloud service provider, and some user policies customized by the authentication use account.
  • the policy content includes information such as authorized users, APIs, and resources that can be operated.
  • the cloud service-based service data may include some attribute data of each cloud service, and data obtained by continuous operation, including a list of APIs included in the service, information on the number of users used by the service, and the like.
  • the cloud service account after a period of operation, the cloud service account generates a number of custom policies for the inventory authorization policy in the cloud product authentication system, and the cloud service provider also sets a number of preset policies.
  • the cloud service system of the embodiment of the present invention may acquire or request acquisition of account data, authorization policy data, and service data in other respective cloud services from its own database.
  • Step S302 extracting account characteristics, authorization policy features, and service features according to the account data, the provided authorization policy data, and the service data; and generating a combination feature according to the relationship between the account data, the provided authorization policy data, and the service data;
  • embodiments of the invention may be divided into two categories of features, including basic features and combined features.
  • the basic feature may include an account feature, an authorization policy feature, and a service feature extracted from the account data, the provided authorization policy data, and the service data;
  • the combination feature may include account data, provided authorization policy data, and service data.
  • the combined features generated by the relationship.
  • the account characteristics in the embodiment of the present invention may include account domain, account creation time, number of logins, login duration, recent login time, registered area, number of sub accounts, roles, and the like, and the like. limit.
  • the authorization policy feature in the embodiment of the present invention may include an API list of the authorization policy, the number of authorized users, the number of resources, the number of users used by the authorization policy, the frequency of the authorization policy, the creation time, the number of similar policies, and the like. No restrictions.
  • the service feature in the embodiment of the present invention may include the number of APIs of the cloud service, the number of API groups, the number of users of the cloud service, the API and the API, and the distribution of the users (region, time), etc., which are not limited in the embodiment of the present invention. .
  • the combined features in the embodiment of the present invention may include a user policy combination feature, a user service combination feature, a service policy combination feature, and the like, which are not limited in the embodiment of the present invention.
  • the user policy combination feature may include the number of policies owned by the user, the user's policy distribution, the API distribution of the user authorization, the user's current policy usage frequency, the authentication pass rate, and the like;
  • the user service combination feature may include the cloud service owned by the user. The number and list, the number of users' cloud service resources and the frequency of use, etc.;
  • the service policy combination characteristics may include the number of policies to which the service belongs, and the number of policies to which the API belongs.
  • Step S304 Perform model training according to account characteristics, authorization policy features, service features, and combination features, and generate a policy prediction recommendation model
  • the model training in the embodiment of the present invention may include some computing frameworks for the cloud service, and then use the account feature, the authorization policy feature, the service feature, and the combined feature to perform training and optimize the computing framework. Parameters to derive strategic prediction recommendations model.
  • the schematic diagram of the sample training provided by the embodiment of the present invention may select a positive sample according to an account feature, an authorization policy feature, a service feature, and a combination feature. Negative samples; then based on the positive and negative samples, model training is performed using a preset machine learning algorithm to generate a strategy prediction recommendation model.
  • the sample selection stage combines the user (ie account), the relationship between the strategy and the service, and the historical behavior of the user to select positive and negative samples, and then performs model training based on the characteristics of the positive and negative samples to generate a policy prediction. Recommended model.
  • a sample constructed based on an existing relationship between a user, a policy, and a service may be defined as a positive sample, and a certain type of user and policy and service category that have never been associated may be artificially constructed.
  • the sample which can be defined as a negative sample, can also be defined as a negative sample for users, policies, and services that were previously associated with the relationship.
  • Step S306 Based on the policy prediction recommendation model, perform prediction recommendation according to the current account context information of the cloud service, filter out the authorization policy, and recommend the selected authorization policy to the current account.
  • the context scenario information in the embodiment of the present invention may include interface information of the current account in the cloud service console or phase information of the authorization policy setting wizard; because the setup wizard is step-by-step, press The service and API are recommended in stages.
  • the policy set is different at each stage. According to the interface information of the current account in the cloud service console or the stage information of the authorization policy setting wizard, the matching degree can be selected from the policy candidate set.
  • the authorization policy of the first preset threshold may include interface information of the current account in the cloud service console or phase information of the authorization policy setting wizard; because the setup wizard is step-by-step, press The service and API are recommended in stages.
  • the policy set is different at each stage. According to the interface information of the current account in the cloud service console or the stage information of the authorization policy setting wizard, the matching degree can be selected from the policy candidate set.
  • the authorization policy of the first preset threshold is the interface information of the current account in the cloud service console or phase information of the authorization policy setting wizard.
  • the first preset threshold in the embodiment of the present invention may be set by a technician or a developer or a user according to their own needs, or may be set according to experience or experimental data, which is not limited by the present invention.
  • the first preset threshold may be 98%.
  • the embodiment of the present invention implements the cloud service-based account data, the provided authorization policy data, and the service data, and then extracts the account characteristics, the authorization policy features, the service features, and the combination characteristics of the three, and predicts the recommendation according to the feature generation strategy.
  • the model finally predicts the recommendation model based on the policy, and performs prediction recommendation according to the current account in the context scenario information of the cloud service, and filters out the recommended authorization policy, and solves the historical experience in the prior art due to the operation personnel according to the cloud service provider.
  • the recommended method is too single, the recommended accuracy is affected by the technical problems, and recommend different strategies according to the characteristics of the account, greatly improving the accuracy and diversity of the recommendations, making the strategy more use widely.
  • an embodiment of the present invention provides a policy prediction recommendation model based on introducing machine learning technology, and all feature dimensions are considered for each click classification and then comprehensively judged.
  • the strategy prediction recommendation model In the initial stage of forming the strategy prediction recommendation model, it is still necessary to manually select as many dimensions as possible for the machine learning model training. According to the distinguishing degree of the training results, which features are selected, there is basically no problem of manual intervention selection parameters.
  • Machine learning can learn the appropriate parameters by itself; because the meaning of the feature is more intuitive than the meaningless parameter, the distribution of the feature is easier to understand; firstly, the account data and authorization strategy based on the machine learning model.
  • Data, service data, and policy prediction recommendations involve comprehensive consideration of multi-dimensional features and improve the accuracy of policy prediction recommendations.
  • the model itself has the function of evolutionary learning. Even if account data, authorization policy data, and service data are updated or deleted, by simply re-training the model (sometimes requiring fine-tuning of features), it is possible to identify updated account data, update authorization policy data, and update service data.
  • the policy prediction recommendation model is adjusted to ensure the accuracy of the authorization policy recommendation.
  • step S304 of the method may include: steps S3041-S3043. as follows:
  • Step S3041 Obtain a positive sample and a negative sample from the historical account data, the authorization policy data, and the service data according to a preset configuration ratio, where the positive sample and the negative sample are used to represent the correspondence between the authorization policy and the matching degree;
  • This ratio is the configuration ratio.
  • the terminal configures the training data (the existing historical account characteristics)
  • the authorization policy feature and the service feature and the combination feature, and the corresponding matching degree are also required to be set according to the configuration ratio.
  • the terminal needs to extract the features of the positive sample and the features of the negative sample.
  • the feature extraction of the positive sample and the negative sample is obtained, and the account feature, the authorization strategy feature, the service feature, and the combined feature are obtained, and the feature is used to perform the model. Training.
  • Step S3042 invoking the set training model to process a positive sample or a negative sample to obtain a first training result
  • Step S3043 Continuously detecting the training model until the first training result satisfies the model training condition, and the first training model that satisfies the model training condition as the strategy prediction recommendation model, and the model training condition is used to represent the first training model according to the first training model.
  • the resulting data output is used to determine the match, the closest match to the true match.
  • the input of the training model includes the features of the above different dimensions, and after multiple trials, if the feature does not have a favorable influence or a fault on the training result, to reduce the weight of the feature, if the feature has a beneficial effect on the training result, the weight of the feature is increased. If the weight of a parameter is reduced to zero, then the feature will have no effect in the training model.
  • the characteristics of the above different dimensions can finally have a positive impact on the training result. It is a long-term feature.
  • the above-mentioned formation process of the click-through rate prediction model generally includes: inputting the characteristics of the positive or negative samples into the first training. a model, obtaining a first training result from the first model; wherein the first model constructed is a feature, and each feature has a corresponding weight; and the first training result is continuously monitored until the preset condition is met, then the first The model serves as a strategy prediction recommendation model.
  • the preset condition in the embodiment of the present invention may be that the accuracy of the matching degree reaches a first preset threshold, the first preset threshold may be 90%, and the determination of the first preset threshold may be set, the present invention
  • the embodiment is not limited, but the higher the first preset threshold is set, the more accurate the policy prediction recommendation model that reaches the first preset threshold or the preset condition is.
  • the embodiment of the present invention adopts an estimated matching degree method based on a policy prediction recommendation model, and performs matching of an authorization policy based on current user behavior when an account feature, an authorization policy feature, a service feature, and a combined feature are performed.
  • the estimation of the degree makes full use of account data, authorization strategy data and service data, and combines the multi-channel historical data to obtain the strategy prediction recommendation model, which can effectively obtain the indicators reflecting the trustworthiness of the authorization strategy and realize the estimation of the authorization strategy;
  • the embodiment of the present invention introduces various characteristics of different dimensions to train the training model, and determines the final verified feature according to the training result, thereby improving the accuracy of the authorization strategy recommendation.
  • a significant feature of the policy prediction recommendation model adopted by the embodiment of the present invention is that the model can self-evolve, and the feature weight is automatically adjusted according to the transformation of the user's click behavior, thereby avoiding rule-based manual frequent intervention adjustment parameters.
  • the account data, the authorization policy data, and the service data existing in the present invention are used as the main data source, and the feature construction process is simple, compared with the existing use of various complicated behavior data. It is easy to perform complex construction and processing of features without using various complicated coding, clustering and filtering methods, which greatly reduces the workload of data processing and makes the strategy prediction recommendation model simple and usable.
  • the authorization policy recommendation provided by the present invention as shown in FIG. A schematic flowchart of another embodiment of the method may include the following steps:
  • Step S500 Acquire cloud service-based account data, provided authorization policy data, and service data;
  • Step S502 extracting an account feature, an authorization policy feature, and a service feature according to the account data, the provided authorization policy data, and the service data, and generating a combination feature according to the relationship between the account data, the provided authorization policy data, and the service data;
  • Step S504 Perform model training according to account characteristics, authorization policy features, service features, and combination features, and generate a policy prediction recommendation model
  • Step S506 Based on the policy prediction recommendation model, perform prediction recommendation according to the current account context information of the cloud service, filter out the authorization policy, and recommend the selected authorization policy to the current account;
  • the steps S500 to S506 may refer to the steps S300 to S306 in the foregoing embodiment of FIG. 3, and details are not described herein again.
  • Step S508 Acquire the cloud service-based update account data, the provided update authorization policy data, and the update service data, and perform an iterative optimization policy prediction recommendation model according to the update account data, the update authorization policy data, and the update service data.
  • the cloud service system can be updated based on continuous updating of basic data such as cloud service-based account data, provided authorization policy data, and service data, and positive samples and negative samples.
  • the cloud service updates the account data, the provided update authorization policy data, and the updated service data, and the updated positive and negative samples; then re-extracts the account characteristics, the authorization policy features, and the service features, and regenerates the combined features, according to the updated
  • the iterative optimization of the data predicts the recommendation model, thereby continuously improving and optimizing the prediction recommendation, so that the recommended authorization strategy is continuously optimized.
  • Step S510 Acquire a click distribution information of the cloud service-based account for the recommended authorization policy
  • the cloud service system can also continuously obtain an account for pushing The click distribution information of the recommended authorization policy, that is, the historical behavior information of the user for the recommended authorization policy. For example, an authorization policy frequently used by a user, some services frequently accessed by users in a user, an authorization policy for setting, a subsequent authentication pass rate, and the like.
  • Step S512 According to the click distribution information, reduce the weight of the authorization policy whose click amount is smaller than the second preset threshold and the order is greater than the third preset threshold, or increase the click amount that is greater than the fourth preset threshold and the order is less than the fifth preset threshold. The weight of the authorization policy.
  • the authorization policy selected in step S506 of the embodiment of the present invention may include multiple authorization policies; then the authorization policy recommended to the current account may include: when predicting multiple authorization policies, The plurality of authorization policies are recommended to the current account according to the weighting order; then the cloud service system in the embodiment of the present invention can predict the model by Click-Through-Rate (CTR) similar to the search engine according to the click distribution information.
  • CTR Click-Through-Rate
  • the prediction recommendation can be continuously improved and optimized, so that the recommended authorization policy is continuously optimized, and an authorization policy more suitable for the current user is recommended.
  • the embodiment of the present invention implements the cloud service-based account data, the provided authorization policy data, and the service data, and then extracts the account characteristics, the authorization policy features, the service features, and the combination characteristics of the three, and predicts the recommendation according to the feature generation strategy.
  • the model finally predicts the recommendation model based on the policy, and performs prediction recommendation according to the current account in the context scenario information of the cloud service, and filters out the recommended authorization policy, and solves the historical experience in the prior art due to the operation personnel according to the cloud service provider.
  • the recommended method is too single, the recommended accuracy is affected by the technical problems, and recommend different strategies according to the characteristics of the account, greatly improving the accuracy and diversity of the recommendations, making the strategy more use Extensive; in addition, through the continuous accumulation of operational data and the historical behavior of collecting user feedback, not only the number It is more abundant, and can continuously improve and optimize the prediction recommendation, so that the recommended authorization policy is continuously optimized, and the current account is predicted and recommended in the context information of the cloud service, which can further guide the user to continuously improve the authorization strategy and effectively reduce Operating costs can more effectively promote the use of authentication systems.
  • an authorization policy recommendation method provided by all the foregoing embodiments is performed by a server, where the server includes one or more first processors and a first storage medium, and one or more The above program, wherein one or more programs are stored in a first storage medium, the program comprising one or more units each corresponding to a set of instructions, the one or more first processors being configured to execute the instructions.
  • the detailed implementation process of the authorization policy recommendation method performed by the server is consistent with the description of all the embodiments described above.
  • the present invention further provides an authorization policy recommendation device, which is described in detail below with reference to the accompanying drawings:
  • FIG. 6 is a schematic structural diagram of an authorization policy recommendation apparatus according to an embodiment of the present invention.
  • the authorization policy recommendation apparatus 60 may include: a data acquisition section 600, a feature extraction section 602, a model training generation section 604, and a prediction recommendation section 606, wherein ,
  • the data acquisition part 600 is configured to acquire cloud service-based account data, provided authorization policy data, and service data;
  • the feature extraction part 602 is configured to extract an account feature, an authorization policy feature, and a service feature according to the account data, the provided authorization policy data, and the service data, according to the account data, the provided authorization policy data, and the service data. Relationship generation feature;
  • the model training generating part 604 is configured to perform model training according to the account feature, the authorization policy feature, the service feature, and the combination feature, and generate a policy prediction recommendation model;
  • the prediction recommendation part 606 is configured to predict the recommendation model based on the policy, perform prediction recommendation on the context information of the cloud service according to the current account, filter out the authorization policy, and recommend the selected authorization policy to the current account.
  • the model training provided by the embodiment of the present invention as shown in FIG. 7 A schematic diagram of the structure of the training part, the model training generating part 604 may include a screening unit 6040 and a generating unit 6042, wherein
  • the screening unit 6040 is configured to: screen positive and negative samples according to the account feature, the authorization policy feature, the service feature, and the combination feature;
  • the generating unit 6042 is configured to perform model training by using a preset machine learning algorithm based on the positive sample and the negative sample to generate the policy prediction recommendation model.
  • the context scenario information of the embodiment of the present invention includes interface information of the current account in the cloud service console or phase information of the authorization policy setting wizard;
  • the prediction recommendation part 606 is specifically configured to: when the context information includes the interface information of the current account in the cloud service console or the stage information of the authorization policy setting wizard, according to the current account interface in the cloud service console
  • the information or the phase information of the authorization policy setting wizard is used to filter the authorization policy whose matching degree reaches the first preset threshold from the policy candidate set, and recommend the filtered authorization policy to the current account.
  • the authorization policy recommendation apparatus 60 includes a data acquisition section 600, a feature extraction section 602, and a model.
  • the training generating portion 604 and the prediction recommending portion 606 may further include: an information acquiring portion 6010 and a weight adjusting portion 6012, wherein
  • the data acquisition part 600 is further configured to: after the prediction recommendation part 606 recommends the filtered authorization policy to the current account, acquire cloud service-based update account data, provided update authorization policy data, and update service data, according to the update.
  • the account data, the update authorization policy data, and the update service data iteratively optimize the policy prediction recommendation model.
  • the prediction recommendation part 606 is specifically configured to: when predicting multiple authorization policies, recommend the multiple authorization policies to the current account according to weight ranking;
  • the information obtaining part 6010 is configured to: in the order of the multiple authorization policies After ranking the recommended current account, obtaining the click distribution information of the cloud service-based account for the recommended authorization policy;
  • the weight adjustment part 6012 is configured to reduce the weight of the authorization policy whose click amount is smaller than the second preset threshold and the order is greater than the third preset threshold according to the click distribution information, or increase the click amount by more than the fourth preset threshold.
  • the weight of the authorization policy that is less than the fifth preset threshold is sorted.
  • FIG. 9 is a schematic structural diagram of another embodiment of an authorization policy recommendation apparatus provided by the present invention.
  • the authorization policy recommendation device 90 may include: at least one second processor 901, such as a CPU, at least one network interface 904, a user interface 903, a second storage medium 905, at least one communication bus 902, display Screen 906 and imaging portion 907.
  • the communication bus 902 is configured to implement connection communication between these components.
  • the user interface 903 may include a touch screen or the like.
  • the network interface 904 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface).
  • the second storage medium 905 may be a high speed RAM memory, or may be a non-volatile memory such as at least one disk storage, and the second storage medium 905 includes a flash in the embodiment of the present invention.
  • the second storage medium 905 can also optionally be at least one storage system located away from the foregoing second processor 901. As shown in FIG. 9, an operating system, a network communication portion, a user interface portion, and an authorization policy recommendation program may be included in the second storage medium 905 as a computer storage medium.
  • the second processor 901 can be configured to invoke the authorization policy recommendation program stored in the second storage medium 905, and perform the following operations:
  • the authorization policy feature the service feature, and the combination Feature, model training, and generate a strategy prediction recommendation model
  • the second processor 901 performs model training according to the account feature, the authorization policy feature, the service feature, and the combination feature, and generates a policy prediction recommendation model, which may include:
  • a preset machine learning algorithm is used to perform model training, and a strategy prediction recommendation model is generated.
  • the context scenario information includes interface information of the current account in the cloud service console or phase information of the authorization policy setting wizard; the second processor 901 is in the cloud service according to the current account.
  • the context scenario information is used for prediction recommendation, and the authorization policy is filtered out, which may include:
  • the authorization policy whose matching degree reaches the first preset threshold is filtered out from the policy candidate set according to the interface information of the current account in the cloud service console or the stage information of the authorization policy setting wizard.
  • the second processor 901 may further perform:
  • the current processor recommending the authorization policy by the second processor 901 includes: when predicting multiple authorization policies, recommending the multiple authorization policies to the current account according to weight ranking;
  • the second processor 901 may further perform:
  • the authorization policy recommendation device 60 or the authorization policy recommendation device 90 in the embodiment of the present invention includes, but is not limited to, an electronic device such as a personal computer.
  • the authorization policy recommendation device 60 or the authorization policy recommendation device 90 is generally a server of the cloud server. It is to be understood that the functions of the modules in the authorization policy recommendation device 60 or the authorization policy recommendation device 90 may be corresponding to the specific implementation manners of any of the embodiments in the foregoing method embodiments, and are not described herein again.
  • an embodiment of the present invention provides a server 100, including:
  • the first storage medium 1001 is configured to store executable instructions
  • the first processor 1002 is configured to execute executable instructions stored in a storage medium, the executable instructions being configured to perform the authorization policy recommendation method described above.
  • bus system 1003 the various components in the server are coupled together by the bus system 1003. It will be appreciated that the bus system 1003 is used to implement connection communication between these components.
  • the bus system 1003 includes a power bus, a control bus, and a status signal bus in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1003 in FIG.
  • the embodiment of the present invention implements the cloud service-based account data, the provided authorization policy data, and the service data, and then extracts the account characteristics, the authorization policy feature, the service feature, and the combination characteristics of the three, respectively, and predicts the recommendation according to the feature generation strategy. a model, and finally predicting a recommendation model based on the policy, and predicting the context scenario information of the cloud service according to the current account It is recommended to filter out the recommended authorization strategy and solve the technical problems in the prior art that the prediction method cannot accurately reflect the user's needs according to the historical experience of the cloud service provider operators. The recommendation method is too single and the recommended accuracy rate is affected.
  • the embodiment of the present invention may further provide a computer storage medium, which is applied to a server and stores a machine instruction.
  • the machine instruction is executed by one or more first processors, the first The processor executes the authorization policy recommendation method corresponding to the server.
  • the embodiment of the present invention may further provide another computer storage medium, which is applied to an authorization policy recommendation device, and stores a machine instruction, when the machine instruction is executed by one or more second processors, the second process The device performs the authorization policy recommendation method corresponding to the authorization policy recommendation device.
  • the computer readable storage medium may be a magnetic random access memory (FRAM), a read only memory (ROM), a programmable read only memory (PROM), or a programmable read only memory (PROM). Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash Memory, Magnetic Surface Memory Memory such as a compact disc or a compact disc read-only memory (CD-ROM).
  • FRAM magnetic random access memory
  • ROM read only memory
  • PROM programmable read only memory
  • PROM programmable read only memory
  • PROM programmable read only memory
  • PROM programmable read only memory
  • EPROM Erasable Programmable Read-Only Memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • Flash Memory Magnetic Surface Memory Memory such as a compact disc or a compact disc read-only memory (CD-ROM).
  • the disclosed method and intelligence can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
  • the units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one second processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit;
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the authorization policy recommendation device can recommend different policies according to the characteristics of the account, the accuracy and diversity of the recommendation are greatly improved, and the strategy is more widely used.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Evolutionary Computation (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • Medical Informatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Computational Linguistics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明公开了一种授权策略推荐方法，包括：获取基于云服务的账户数据、提供的授权策略数据以及服务数据；根据账户数据、提供的授权策略数据以及服务数据分别提取出账户特征、授权策略特征以及服务特征；根据账户数据、提供的授权策略数据以及服务数据相互之间的关系生成组合特征；根据账户特征、授权策略特征、服务特征以及组合特征，进行模型训练，生成策略预测推荐模型；基于策略预测推荐模型，根据当前账户在云服务的上下文场景信息进行预测推荐，筛选出当前授权策略，并向当前账户推荐当前授权策略。本发明还公开了一种授权策略推荐装置、服务器和存储介质，能够提高推荐方法的多样性，及推荐的准确度。

Description

一种授权策略推荐方法及装置、服务器、存储介质
相关申请的交叉引用
本申请基于申请号为201611124782.5、申请日为2016年12月08日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本发明涉及计算机技术领域，尤其涉及授权策略推荐方法以及授权策略推荐装置、服务器、存储介质。
背景技术
云服务是基于互联网的相关服务的增加、使用和交付模式，通常涉及通过互联网来提供动态易扩展且经常是虚拟化的资源。云服务的使用者可以通过授予给用户权限，帮助其安全的控制用户对其资源的访问权限，该访问权限具体包括哪些用户可以访问资源，以及他们可以访问的资源及访问的方式，等等。那么，云服务的服务器可以根据授予的权限来判断是否允许用户针对特定资源发生的具体访问行为，只有在鉴权允许的情况下，用户才能访问使用者的特定资源。
目前，鉴权服务提供商会根据历史经验来提供若干内置策略(即内置策略集合)，然后通过模版引导用户选择各个服务的不同应用程序编程接口(Application Programming Interface，API)的内置策略集合，内置策略集合按字母排序或者由鉴权服务提供商提供策略权重并按权重因子排序。如图1示出的目前授权策略推荐的原理示意图，服务提供商将预设策略作为推荐候选集，然后以推荐场景为引导模板，推荐内容按全集的字母序排列或者按人工定义的权重因子排序，以推荐给使用者。
当前，根据云服务提供商运营人员的历史经验来构建预测策略，并不能真实反映用户需求，推荐方法过于单一，推荐的准确率受到影响。
发明内容
本发明实施例所要解决的技术问题在于，提供一种授权策略推荐方法以及授权策略推荐装置、服务器、存储介质，能够提高推荐方法的多样性，及推荐的准确度。
为了解决上述技术问题，本发明实施例的技术方案可以如下实现：
本发明实施例提供了一种授权策略推荐方法，包括：
获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
本发明实施例还提供了一种授权策略推荐方法，所述方法由服务器执行，所述服务器包括有一个或多个第一处理器及第一存储介质，以及一个或多个以上的程序，其中，所述一个或一个以上的程序存储于第一存储介质中，所述程序包括一个或一个以上的每一个对应一组指令的单元，所述一个或多个第一处理器被配置为执行指令；所述方法包括：
获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；
根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
本发明实施例提供了一种授权策略推荐装置，包括：
数据获取部分，配置为获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
特征提取部分，配置为根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
模型训练生成部分，配置为根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
预测推荐部分，配置为基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
本发明实施例提供了一种计算机可读存储介质，应用于授权策略推荐装置中，存储有机器指令，当所述机器指令被一个或多个第二处理器执行的时候，所述第二处理器执行上述的授权策略推荐方法。
本发明实施例提供了一种授权策略推荐装置，包括：
第二存储介质，配置为存储可执行指令；
第二处理器，配置为执行第二存储介质中存储的可执行指令，所述 可执行指令配置为执行上述的授权策略推荐方法。
本发明实施例提供了一种服务器，包括：
第一存储介质，配置为存储可执行指令；
第一处理器，配置为执行第一存储介质中存储的可执行指令，所述可执行指令配置为执行上述授权策略推荐方法。
本发明实施例还提供了一种计算机可读存储介质，应用于服务器中，存储有机器指令，当所述机器指令被一个或多个第一处理器执行的时候，所述第一处理器执行上述的授权策略推荐方法。
实施本发明实施例，通过获取基于云服务的账户数据、提供的授权策略数据以及服务数据，然后对应提取出账户特征、授权策略特征、服务特征以及三者的组合特征，根据特征生成策略预测推荐模型，最终基于该策略预测推荐模型，根据当前账户在云服务的上下文场景信息进行预测推荐，筛选出推荐的授权策略，解决了现有技术中由于根据云服务提供商运营人员的历史经验来构建预测策略不能真实反映用户需求，推荐方法过于单一，推荐的准确率受到影响的技术问题，并且根据账户的特点而推荐不同的策略，大大提高了推荐的精度和多样性，使得策略使用更加广泛；另外通过运营数据的持续积累以及搜集用户反馈的历史行为，不但使得数据更加丰富，而且可以不断地改进和优化预测推荐，使得推荐的授权策略持续优化，同时结合当前账户在所述云服务的上下文场景信息进行预测推荐，可以进一步引导用户持续完善授权策略，有效降低运营成本，可以更高效地推广鉴权系统的使用。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员 来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是相关技术授权策略推荐的原理示意图；
图2是本发明实施例提供的一种授权策略推荐的场景架构示意图；
图3是本发明实施例提供的授权策略推荐方法的流程示意图；
图4-1是本发明实施例提供的样本训练的原理示意图；
图4-2是本发明实施例提供的又一实施例的授权策略推荐方法的流程示意图；
图5是本发明实施例提供的授权策略推荐方法的另一实施例的流程示意图；
图6是本发明实施例提供的授权策略推荐装置的结构示意图；
图7是本发明实施例提供的模型训练生成模块的结构示意图；
图8是本发明实施例提供的授权策略推荐装置的另一实施例的结构示意图一；
图9是本发明实施例提供的授权策略推荐装置的另一实施例的结构示意图二；
图10为本发明实施例提供的一种服务器的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
为了更好理解本发明实施例公开的一种授权策略推荐方法及相关装置，下面先对本发明实施例适用的场景架构进行描述。请参阅图2，图2是本发 明实施例公开的一种授权策略推荐的场景架构示意图。如图2所示，例如某使用者(如某企业或单位等)通过终端可以向提供云服务的服务器注册了一个云服务的账号，申请了一些机器资源给某些用户(如对应的该企业或单位的员工)访问，使用者可以按照系统提供或推荐的授权策略向导来一步步地设置授权策略，以允许哪些用户可以访问机器资源，可以访问哪些机器资源以及访问的方式等等。本发明实施例就是提供了一种授权策略推荐方法，可以自动针对该使用者推荐出合适的授权策略。
基于图2所示的应用场景，请参阅图3，图3是本发明实施例提供的授权策略推荐方法的流程示意图，可以包括以下步骤：
步骤S300：获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
本发明可选实施例中，本发明实施例中的基于云服务的账户数据可以包括被推荐对象信息数据，例如用户的个人属性数据，包括账户类别，账户所属领域(互联网、金融、家电等)，登陆时间，账户登陆次数，地域等数据。基于云服务提供的授权策略数据可以包括云服务提供商人工运营的一些预设策略，以及鉴权使用账户自定义的一些用户策略。策略内容包括授权用户、API及可以操作的资源等信息。基于云服务的服务数据可以包括各个云服务的一些属性数据，以及持续运营得到的数据，包括服务包括的API列表、服务使用用户数等信息。
可理解的是，云产品的鉴权体系中的存量授权策略，经过一段时间的运营之后，云服务账户会生成不少自定义策略，同时云服务提供商也会设置不少预设策略。本发明实施例的云服务系统可以从自己的数据库中获取或者请求获取其它各个云服务中的账户数据、授权策略数据以及服务数据。
步骤S302：根据账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
在本发明的可选实施例中，本发明实施例可以分成两类特征，包括基础特征和组合特征。其中，基础特征可以包括从账户数据、提供的授权策略数据以及服务数据对应提取出的账户特征、授权策略特征以及服务特征；组合特征可以包括账户数据、提供的授权策略数据以及服务数据之间的关系生成的组合特征。
其中，本发明实施例中的账户特征可以包括账户所属领域、账户创建时间、登陆次数、登陆时长、最近登陆时间、注册地域、子账户数目、角色等各类别账户信息等，本发明实施例不作限制。
本发明实施例中的授权策略特征可以包括授权策略的API列表、授权用户个数、资源数目、授权策略使用的用户数、授权策略使用的频率、创建时间、相似策略数等，本发明实施例不作限制。
本发明实施例中的服务特征可以包括云服务的API数、API组数、云服务、API及API组合的使用用户数、各类用户分布情况(地域、时间)等，本发明实施例不作限制。
本发明实施例中的组合特征可以包括用户策略组合特征、用户服务组合特征、服务策略组合特征等，本发明实施例不作限制。其中，用户策略组合特征可以包括用户拥有的策略数、用户的策略分布、用户授权的API分布、用户对当前策略使用频率、鉴权通过率等；用户服务组合特征可以包括用户所拥有的云服务数目及列表，用户的云服务资源数目及使用频率等；服务策略组合特征可以包括服务所属的策略个数、API所属的策略个数等。
步骤S304：根据账户特征、授权策略特征、服务特征以及组合特征，进行模型训练，生成策略预测推荐模型；
在本发明的可选实施例中，本发明实施例中的模型训练可以包括针对云服务的一些计算框架，然后使用账户特征、授权策略特征、服务特征以及组合特征，进行训练，优化计算框架中的参数，从而得出策略预测推荐 模型。
在本发明可选的实施例中，如图4-1示出的本发明实施例提供的样本训练的原理示意图，可以根据账户特征、授权策略特征、服务特征以及组合特征，筛选出正样本和负样本；然后基于该正样本和负样本，采用预设的机器学习算法进行模型训练，生成策略预测推荐模型。其中，样本选取阶段，会结合用户(即账户)、策略及服务的关联关系，以及用户的历史行为来选择正样本和负样本，然后基于正样本和负样本的特征进行模型训练，生成策略预测推荐模型。
需要说明的是，本发明实施例中基于已经存在的用户、策略、服务的关系构造的样本，可以被定义为正样本，对于从未产生过关联的某类别用户与策略、服务类别，人工构造的样本，可以被定义为负样本；对于之前是存在关联关系，后面被解除关系的用户、策略和服务，也可以被定义为负样本。
步骤S306：基于策略预测推荐模型，根据当前账户在云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
在本发明的可选实施例中，本发明实施例中的上下文场景信息可以包括当前账户在云服务控制台的界面信息或者处于授权策略设置向导的阶段信息；因为设置向导是分步骤的，按服务、API分阶段推荐，在每个阶段的策略集合是不同的，那么根据当前账户在云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，可以从策略候选集中筛选出匹配度达到第一预设阈值的授权策略。
需要说明的是，本发明实施例中的第一预设阈值可以是技术人员或开发者或使用者根据自身需求进行设置，或者根据经验或实验数据来进行设置，本发明不作限定。这里第一预设阈值越高，表征筛选出的授权策略的准确度越高，因此，在本发明实施例中的第一预设阈值可以设置的较高一 些，例如，第一预设阈值可以为98％。
实施本发明实施例，通过获取基于云服务的账户数据、提供的授权策略数据以及服务数据，然后对应提取出账户特征、授权策略特征、服务特征以及三者的组合特征，根据特征生成策略预测推荐模型，最终基于该策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出推荐的授权策略，解决了现有技术中由于根据云服务提供商运营人员的历史经验来构建预测策略不能真实反映用户需求，推荐方法过于单一，推荐的准确率受到影响的技术问题，并且根据账户的特点而推荐不同的策略，大大提高了推荐的精度和多样性，使得策略使用更加广泛。
基于上面实施例中的描述，本发明实施例提供一种基于引入机器学习技术而形成一种策略预测推荐模型，对每一次点击分类都会考虑所有特征维度然后综合进行判断。在形成策略预测推荐模型的初期，仍然需要人工挑选尽可能多维度的特征供机器学习模型训练，根据特征对训练结果的区分度决定选用哪些特征擦描述，这里基本不存在人工干预选择参数的问题，机器学习可以自己学习出合适的参数来；由于特征含义相比没有意义的参数看来更为直观，结合特征的分布，解释起来也比较容易理解；首先基于机器学习模型的账户数据、授权策略数据、服务数据，策略预测推荐涉及到多维度特征的综合考虑，提高了策略预测推荐的准确性。另外由于模型自身具有进化学习的功能。即使账户数据、授权策略数据、服务数据发生更新或删减，通过简单的重新进行模型训练(有时候需要对特征进行微调)，即可以识别的更新账户数据、更新授权策略数据、更新服务数据并进行策略预测推荐模型的调整，保证授权策略推荐的准确性。
机器学习技术在点击率预测中的应用可以自由的分享和传播，因为机器学习策略预测推荐全面且可以自我进化，不针对特定某种数据，因此，甚至对同一装置的不同数据一样可以公开基于机器学习模型的策略预测推荐的做法。
如图4-2示出的本发明实施例提供的一种授权策略推荐方法的流程图，该方法的步骤S304的实现过程可以包括：步骤S3041-S3043。如下：
步骤S3041、按照预设的配置比例，从历史账户数据、授权策略数据和服务数据中，获取正样本和负样本，正样本和负样本用于表征授权策略与匹配度的对应关系；
这里，在实际操作的过程中，匹配度高和匹配度低会存在一定的比例，这个比例即为配置比例，在形成策略预测推荐模型时，终端对训练数据的配置(已有的历史账户特征、授权策略特征和服务特征以及组合特征，对应的匹配度)也需要按照该配置比例进行设置。
这里，终端需要提取正样本的特征和负样本的特征，本发明实施例中对正样本和负样本的特征提取，得到了账户特征、授权策略特征、服务特征以及组合特征，利用这些特征进行模型的训练。
可以理解的是，本发明实施例中的正样本和负样本涉及的数据越完整，后续的策略预测推荐的匹配度是越准确的。
步骤S3042、调用设置的训练模型处理正样本或负样本，得到第一训练结果；
步骤S3043、持续检测训练模型，直至第一训练结果满足模型训练条件，并将第一训练结果满足模型训练条件的第一训练模型作为策略预测推荐模型，模型训练条件用于表征根据第一训练模型得到的数据输出结果运用于确定匹配度时，最接近真实的匹配度。
本发明实施例中，不管采用何种训练模型，在开始训练之时，该训练模型的输入包括上述不同维度的特征，经过多次试验如果该特征不对训练结果产生有利影响或者分错的时候，就降低该特征的权重，如果该特征对训练结果产生有利影响时候，就提高该特征的权重，如果一个参数的权重降低为0，那么在训练模型中该特征将不起任何作用了。经过本发明实施例的最终试验，上述不同的维度的特征最终对训练结果能够产生积极影响的 是长期特征。下面假设不同维度的特征只包括长期特征(即已经将其他的不符的特征都剔除掉了)，那么上述的点击率预测模型的形成过程大致包括：将正样本或负样本的特征输入第一训练模型，从第一模型获得第一训练结果；其中进行构造的第一模型以一个特征，且每一个特征具有对应的权值；持续监测第一训练结果直至满足预设条件时，则将第一模型作为策略预测推荐模型。
可选的，本发明实施例中的预设条件可以为匹配度的准确率达到第一预设阈值，该第一预设阈值可以为90％，第一预设阈值的确定可设置，本发明实施例不作限制，但是，第一预设阈值设置的越高，达到该第一预设阈值或预设条件的策略预测推荐模型就越精确。
从以上流程可以看出，1)本发明实施例采用了基于策略预测推荐模型的预估匹配度方式，当账户特征、授权策略特征、服务特征以及组合特征进行基于当前用户行为的授权策略的匹配度的预估，充分利用了账户数据、授权策略数据和服务数据，结合多渠道的历史数据得到策略预测推荐模型，能够有效得到反映授权策略可信赖程度的指标，实现对授权策略的预估；2)本发明实施例引入了各种不同维度的特征来对训练模型进行训练，根据训练结果确定最终核实的特征，如此提升了授权策略推荐的准确性。3)本发明实施例采用的策略预测推荐模型的一个显著特点是模型可以自我进化，根据用户的点击的行为的变换自动进行特征权值的调整，避免基于规则的人工频繁介入调整参数。
可以理解的是，在本发明实施例中，相比现有的使用各种复杂的行为数据，本发明使用当中存在的账户数据、授权策略数据以及服务数据作为主要数据源，特征构造过程都简单易行，不需要使用各种复杂的编码、聚类、筛选手段对特征进行复杂的构造和处理，大大降低了数据处理的工作量，使得策略预测推荐模型简单可用。
在本发明的可选实施例中，如图5示出的本发明提供的授权策略推荐 方法的另一实施例的流程示意图，可以包括如下步骤：
步骤S500：获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
步骤S502：根据账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
步骤S504：根据账户特征、授权策略特征、服务特征以及组合特征，进行模型训练，生成策略预测推荐模型；
步骤S506：基于策略预测推荐模型，根据当前账户在云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略；
在本发明的可选实施例中，步骤S500至步骤S506可以对应参考上述图3实施例中的步骤S300至步骤S306，这里不再赘述。
步骤S508：获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据更新账户数据、更新授权策略数据以及更新服务数据迭代优化策略预测推荐模型。
在本发明的可选实施例中，云服务系统可以通过不断地对基于云服务的账户数据、提供的授权策略数据以及服务数据等基础数据以及正样本和负样本进行更新，这样就可以获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，以及更新后的正样本和负样本了；然后重新提取账户特征、授权策略特征以及服务特征，重新生成组合特征，根据更新的数据迭代优化该策略预测推荐模型，从而实现了不断地改进和优化预测推荐，使得推荐的授权策略持续优化。
步骤S510：获取基于云服务的账户针对推荐的授权策略的点击分布信息；
在本发明的可选实施例中，云服务系统还可以不断地获取账户针对推 荐的授权策略的点击分布信息，即用户针对推荐的授权策略的历史行为信息。例如某使用者经常使用的授权策略、某使用者中的用户经常访问的一些服务、以及针对设置的授权策略，后续的鉴权通过率的大小等等。
步骤S512：根据点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
在本发明的可选实施例中，本发明实施例步骤S506中筛选出的授权策略可以包括多个授权策略；那么向当前账户推荐的授权策略可以包括：当预测得到多个授权策略时，将多个授权策略按照权重排序推荐给当前账户；那么本发明实施例中的云服务系统可以根据该点击分布信息，通过类似于搜索引擎的点击通过率(Click-Through-Rate，CTR)预估模型，对于排序靠前(即排序大于第三预设阈值)，但用户点击量偏少(即点击量小于第二预设阈值)的授权策略，需要进行打压，降低其权重，使得其排序往后调整。对于排序靠后(即排序小于第五预设阈值)，但用户点击量偏高(即点击量大于第四预设阈值)的授权策略，要进行提权，增加其权重，使得其排序往前调整。从而可以不断地改进和优化预测推荐，使得推荐的授权策略持续优化，推荐出更加适合当前使用者的授权策略。
实施本发明实施例，通过获取基于云服务的账户数据、提供的授权策略数据以及服务数据，然后对应提取出账户特征、授权策略特征、服务特征以及三者的组合特征，根据特征生成策略预测推荐模型，最终基于该策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出推荐的授权策略，解决了现有技术中由于根据云服务提供商运营人员的历史经验来构建预测策略不能真实反映用户需求，推荐方法过于单一，推荐的准确率受到影响的技术问题，并且根据账户的特点而推荐不同的策略，大大提高了推荐的精度和多样性，使得策略使用更加广泛；另外通过运营数据的持续积累以及搜集用户反馈的历史行为，不但使得数 据更加丰富，而且可以不断地改进和优化预测推荐，使得推荐的授权策略持续优化，同时结合当前账户在所述云服务的上下文场景信息进行预测推荐，可以进一步引导用户持续完善授权策略，有效降低运营成本，可以更高效地推广鉴权系统的使用。
在本发明的可选的实施例中，上述全部实施例提供的一种授权策略推荐方法由服务器执行，该服务器包括有一个或多个第一处理器及第一存储介质，以及一个或多个以上的程序，其中，一个或一个以上的程序存储于第一存储介质中，程序包括一个或一个以上的每一个对应一组指令的单元，一个或多个第一处理器被配置为执行指令。详细的服务器执行的授权策略推荐方法的实施过程与上述全部实施例的描述一致。
为了便于更好地实施本发明实施例的上述方案，本发明还对应提供了一种授权策略推荐装置，下面结合附图来进行详细说明：
如图6示出的本发明实施例提供的授权策略推荐装置的结构示意图，授权策略推荐装置60可以包括：数据获取部分600、特征提取部分602、模型训练生成部分604和预测推荐部分606，其中，
数据获取部分600，配置为获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
特征提取部分602，配置为根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
模型训练生成部分604，配置为根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
预测推荐部分606，配置为基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
在本发明的可选实施例中，如图7示出的本发明实施例提供的模型训 练生成部分的结构示意图，模型训练生成部分604可以包括筛选单元6040和生成单元6042，其中，
筛选单元6040，配置为根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，筛选出正样本和负样本；
生成单元6042，配置为基于所述正样本和所述负样本，采用预设的机器学习算法进行模型训练，生成所述策略预测推荐模型。
在本发明的可选实施例中，本发明实施例的上下文场景信息包括当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息；
预测推荐部分，606具体配置为当所述上下文场景信息包括当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息时，根据当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，从策略候选集中筛选出匹配度达到第一预设阈值的授权策略，并向当前账户推荐筛选出的授权策略。
在本发明的可选实施例中，如图8示出的本发明提供的授权策略推荐装置的另一实施例的结构示意图，授权策略推荐装置60包括数据获取部分600、特征提取部分602、模型训练生成部分604和预测推荐部分606外，还可以包括：信息获取部分6010和权重调整部分6012，其中，
所述数据获取部分600，还配置为在预测推荐部分606向当前账户推荐筛选出的授权策略之后，获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据所述更新账户数据、所述更新授权策略数据以及所述更新服务数据迭代优化所述策略预测推荐模型。
在本发明的可选实施例中，所述预测推荐部分606，具体配置为当预测得到多个授权策略时，将所述多个授权策略按照权重排序推荐给所述当前账户；
所述信息获取部分6010，配置为在所述将所述多个授权策略按照顺序 排列推荐给所述当前账户之后，获取基于云服务的账户针对推荐的授权策略的点击分布信息；
所述权重调整部分6012，配置为根据所述点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
请参阅图9，图9是本发明提供的授权策略推荐装置的另一实施例的结构示意图。其中，如图9所示，授权策略推荐装置90可以包括：至少一个第二处理器901，例如CPU，至少一个网络接口904，用户接口903，第二存储介质905，至少一个通信总线902、显示屏906以及摄像部分907。其中，通信总线902配置为实现这些组件之间的连接通信。其中，用户接口903可以包括触摸屏等等。网络接口904可选的可以包括标准的有线接口、无线接口(如WI-FI接口)。第二存储介质905可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器，第二存储介质905包括本发明实施例中的flash。第二存储介质905可选的还可以是至少一个位于远离前述第二处理器901的存储系统。如图9所示，作为一种计算机存储介质的第二存储介质905中可以包括操作系统、网络通信部分、用户接口部分以及授权策略推荐程序。
在图9所示的授权策略推荐装置90中，第二处理器901可以用于调用第二存储介质905中存储的授权策略推荐程序，并执行以下操作：
通过网络接口904或用户接口903获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合 特征，进行模型训练，生成策略预测推荐模型；
基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
在本发明的可选实施例中，第二处理器901根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型，可以包括：
根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，筛选出正样本和负样本；
基于所述正样本和所述负样本，采用预设的机器学习算法进行模型训练，生成策略预测推荐模型。
在本发明的可选实施例中，上下文场景信息包括当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息；第二处理器901根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，可以包括：
根据当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，从策略候选集中筛选出匹配度达到第一预设阈值的授权策略。
在本发明的可选实施例中，第二处理器901向当前账户推荐筛选出的授权策略之后，还可以执行：
获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据所述更新账户数据、所述更新授权策略数据以及所述更新服务数据迭代优化所述策略预测推荐模型。
在本发明的可选实施例中，第二处理器901当前账户推荐所述授权策略包括：当预测得到多个授权策略时，将所述多个授权策略按照权重排序推荐给当前账户；
第二处理器901将所述多个授权策略按照顺序排列推荐给所述当前账户之后，还可以执行：
通过网络接口904或用户接口903获取基于云服务的账户针对推荐的授权策略的点击分布信息；
根据所述点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
需要说明的是，本发明实施例中的授权策略推荐装置60或授权策略推荐装置90包括但不限于个人计算机等电子设备。授权策略推荐装置60或授权策略推荐装置90一般为云服务端的服务器。可理解的是，授权策略推荐装置60或授权策略推荐装置90中各模块的功能可对应参考上述各方法实施例中图1至图5任意实施例的具体实现方式，这里不再赘述。
示例性的，如图10所示，本发明实施例提供了一种服务器100，包括：
第一存储介质1001，配置为存储可执行指令；
第一处理器1002，配置为执行存储介质中存储的可执行指令，所述可执行指令配置为执行上述的授权策略推荐方法。
当然，实际应用时，如图10所示，服务器中的各个组件通过总线系统1003耦合在一起。可理解，总线系统1003用于实现这些组件之间的连接通信。总线系统1003除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图10中将各种总线都标为总线系统1003。
实施本发明实施例，通过获取基于云服务的账户数据、提供的授权策略数据以及服务数据，然后分别提取出账户特征、授权策略特征、服务特征以及三者的组合特征，根据特征生成策略预测推荐模型，最终基于该策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测 推荐，筛选出推荐的授权策略，解决了现有技术中由于根据云服务提供商运营人员的历史经验来构建预测策略不能真实反映用户需求，推荐方法过于单一，推荐的准确率受到影响的技术问题，并且根据账户的特点而推荐不同的策略，大大提高了推荐的精度，使得策略使用更加广泛；另外通过运营数据的持续积累以及搜集用户反馈的历史行为，不但使得数据更加丰富，而且可以不断地改进和优化预测推荐，使得推荐的授权策略持续优化，同时结合当前账户在所述云服务的上下文场景信息进行预测推荐，可以进一步引导用户持续完善授权策略，有效降低运营成本，可以更高效地推广鉴权系统的使用。
需要说明的是，本发明实施例还可以提供一种计算机存储介质，应用于服务器中，存储有机器指令，当所述机器指令被一个或多个第一处理器执行的时候，所述第一处理器执行上述服务器对应的授权策略推荐方法。
本发明实施例还可以提供另一种计算机存储介质，应用于授权策略推荐装置中，存储有机器指令，当所述机器指令被一个或多个第二处理器执行的时候，所述第二处理器执行上述授权策略推荐装置对应的授权策略推荐方法。
其中，计算机可读存储介质可以是磁性随机存取存储器(ferromagnetic random access memory，FRAM)、只读存储器(Read Only Memory，ROM)、可编程只读存储器(Programmable Read-Only Memory，PROM)、可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM)、电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、快闪存储器(Flash Memory)、磁表面存储器、光盘、或只读光盘(Compact Disc Read-Only Memory，CD-ROM)等存储器。
本发明实施例所记载的技术方案之间，在不冲突的情况下，可以任意组合。
在本发明所提供的几个实施例中，应该理解到，所揭露的方法和智能 设备，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个第二处理单元中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。
工业实用性
在本发明实施例中，由于授权策略推荐装置可以根据账户的特点而推荐不同的策略，大大提高了推荐的精度和多样性，使得策略使用更加广泛。

Claims (22)

  1. 一种授权策略推荐方法，包括：
    获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
    根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；
    根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
    根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
    基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
  2. 如权利要求1所述的方法，其中，所述根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型，包括：
    根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，筛选出正样本和负样本；
    基于所述正样本和所述负样本，采用预设的机器学习算法进行模型训练，生成所述策略预测推荐模型。
  3. 如权利要求1所述的方法，其中，所述根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，包括：
    当所述上下文场景信息包括当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息时，根据当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，从策略候选集中筛选出匹配度达到第一预设阈值的授权策略。
  4. 如权利要求1所述的方法，其中，所述向当前账户推荐筛选出的授权策略之后，所述方法还包括：
    获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据所述更新账户数据、所述更新授权策略数据以及所述更新服务数据迭代优化所述策略预测推荐模型。
  5. 如权利要求1所述的方法，其中，所述向当前账户推荐筛选出的授权策略，包括：
    当预测得到多个授权策略时，将所述多个授权策略按照权重排序推荐给所述当前账户；
  6. 如权利要求5所述的方法，其中，所述将所述多个授权策略按照顺序排列推荐给所述当前账户之后，所述方法还包括：
    获取基于云服务的账户针对推荐的授权策略的点击分布信息；
    根据所述点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
  7. 一种授权策略推荐方法，所述方法由服务器执行，所述服务器包括有一个或多个第一处理器及第一存储介质，以及一个或多个以上的程序，其中，所述一个或一个以上的程序存储于第一存储介质中，所述程序包括一个或一个以上的每一个对应一组指令的单元，所述一个或多个第一处理器被配置为执行指令；所述方法包括：
    获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
    根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；
    根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
    根据所述账户特征、所述授权策略特征、所述服务特征以及所述组 合特征，进行模型训练，生成策略预测推荐模型；
    基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
  8. 如权利要求7所述的方法，其中，所述根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型，包括：
    根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，筛选出正样本和负样本；
    基于所述正样本和所述负样本，采用预设的机器学习算法进行模型训练，生成所述策略预测推荐模型。
  9. 如权利要求7所述的方法，其中，所述根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，包括：
    当所述上下文场景信息包括当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息时，根据当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，从策略候选集中筛选出匹配度达到第一预设阈值的授权策略。
  10. 如权利要求7所述的方法，其中，所述向当前账户推荐筛选出的授权策略之后，所述方法还包括：
    获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据所述更新账户数据、所述更新授权策略数据以及所述更新服务数据迭代优化所述策略预测推荐模型。
  11. 如权利要求7所述的方法，其中，所述向当前账户推荐筛选出的授权策略，包括：
    当预测得到多个授权策略时，将所述多个授权策略按照权重排序推荐给所述当前账户；
  12. 如权利要求11所述的方法，其中，所述将所述多个授权策略按照顺序排列推荐给所述当前账户之后，所述方法还包括：
    获取基于云服务的账户针对推荐的授权策略的点击分布信息；
    根据所述点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
  13. 一种授权策略推荐装置，包括：
    数据获取部分，配置为获取基于云服务的账户数据、提供的授权策略数据以及服务数据；
    特征提取部分，配置为根据所述账户数据、提供的授权策略数据以及服务数据对应提取出账户特征、授权策略特征以及服务特征；根据所述账户数据、提供的授权策略数据以及服务数据之间的关系生成组合特征；
    模型训练生成部分，配置为根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，进行模型训练，生成策略预测推荐模型；
    预测推荐部分，配置为基于所述策略预测推荐模型，根据当前账户在所述云服务的上下文场景信息进行预测推荐，筛选出授权策略，并向当前账户推荐筛选出的授权策略。
  14. 如权利要求13所述的装置，其中，所述模型训练生成部分包括：
    筛选单元，配置为根据所述账户特征、所述授权策略特征、所述服务特征以及所述组合特征，筛选出正样本和负样本；
    生成单元，配置为基于所述正样本和所述负样本，采用预设的机器学习算法进行模型训练，生成所述策略预测推荐模型。
  15. 如权利要求13所述的装置，其中，
    所述预测推荐部分，具体配置为当所述上下文场景信息包括当前账 户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息时，根据当前账户在所述云服务控制台的界面信息或者处于授权策略设置向导的阶段信息，从策略候选集中筛选出匹配度达到第一预设阈值的授权策略，并向当前账户推荐筛选出的授权策略。
  16. 如权利要求13所述的装置，其中，所述装置还包括：
    所述数据获取部分，还配置为在所述预测推荐模块向当前账户推荐筛选出的授权策略之后，获取基于云服务的更新账户数据、提供的更新授权策略数据以及更新服务数据，根据所述更新账户数据、所述更新授权策略数据以及所述更新服务数据迭代优化所述策略预测推荐模型。
  17. 如权利要求13所述的装置，其中，所述装置还包括：
    所述预测推荐部分，具体配置为当预测得到多个授权策略时，将所述多个授权策略按照权重排序推荐给所述当前账户；
  18. 如权利要求17所述的装置，其中，所述装置还包括：
    信息获取部分，配置为在所述将所述多个授权策略按照顺序排列推荐给所述当前账户之后，获取基于云服务的账户针对推荐的授权策略的点击分布信息；
    权重调整部分，配置为根据所述点击分布信息，降低点击量小于第二预设阈值且排序大于第三预设阈值的授权策略的权重，或者增加点击量大于第四预设阈值且排序小于第五预设阈值的授权策略的权重。
  19. 一种计算机可读存储介质，应用于授权策略推荐装置中，存储有机器指令，当所述机器指令被一个或多个第二处理器执行的时候，所述第二处理器执行所述的权利要求1至6任一项所述的授权策略推荐方法。
  20. 一种授权策略推荐装置，包括：
    第二存储介质，配置为存储可执行指令；
    第二处理器，配置为执行第二存储介质中存储的可执行指令，所述 可执行指令配置为执行上述的权利要求1至6任一项所述的授权策略推荐方法。
  21. 一种服务器，包括：
    第一存储介质，配置为存储可执行指令；
    第一处理器，配置为执行第一存储介质中存储的可执行指令，所述可执行指令配置为执行上述的权利要求7至12任一项所述的授权策略推荐方法。
  22. 一种计算机可读存储介质，应用于服务器中，存储有机器指令，当所述机器指令被一个或多个第一处理器执行的时候，所述第一处理器执行所述的权利要求7至12任一项所述的授权策略推荐方法。
PCT/CN2017/114290 2016-12-08 2017-12-01 一种授权策略推荐方法及装置、服务器、存储介质 WO2018103595A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/296,167 US10686843B2 (en) 2016-12-08 2019-03-07 Authorization policy recommendation method and apparatus, server, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611124782.5A CN106685933B (zh) 2016-12-08 2016-12-08 一种授权策略推荐及装置
CN201611124782.5 2016-12-08

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/296,167 Continuation US10686843B2 (en) 2016-12-08 2019-03-07 Authorization policy recommendation method and apparatus, server, and storage medium

Publications (1)

Publication Number Publication Date
WO2018103595A1 true WO2018103595A1 (zh) 2018-06-14

Family

ID=58867750

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/114290 WO2018103595A1 (zh) 2016-12-08 2017-12-01 一种授权策略推荐方法及装置、服务器、存储介质

Country Status (3)

Country Link
US (1) US10686843B2 (zh)
CN (1) CN106685933B (zh)
WO (1) WO2018103595A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3617918A1 (en) * 2018-08-28 2020-03-04 Cobalt Iron, Inc. Dynamic authorization control system and method
CN111861690A (zh) * 2020-07-23 2020-10-30 金蝶软件（中国）有限公司 账务数据核对方法及账务数据核对装置
US10999290B2 (en) 2018-08-28 2021-05-04 Cobalt Iron, Inc. Dynamic authorization control system and method
CN113301067A (zh) * 2020-04-01 2021-08-24 阿里巴巴集团控股有限公司 机器学习应用的云配置推荐方法以及装置
CN114363671A (zh) * 2021-12-31 2022-04-15 北京达佳互联信息技术有限公司 多媒体资源推送方法、模型训练方法、装置、存储介质

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106685933B (zh) * 2016-12-08 2020-06-19 腾讯科技（深圳）有限公司 一种授权策略推荐及装置
CN106992994B (zh) * 2017-05-24 2020-07-03 腾讯科技（深圳）有限公司 一种云服务的自动化监控方法和系统
CN107491992B (zh) * 2017-08-25 2020-12-25 哈尔滨工业大学（威海） 一种基于云计算的智能服务推荐方法
CN110378716A (zh) * 2018-04-13 2019-10-25 北京三快在线科技有限公司 优惠策略生成方法、装置、电子设备及计算机可读介质
CN111797864A (zh) * 2019-04-09 2020-10-20 Oppo广东移动通信有限公司 特征处理方法、装置、存储介质及电子设备
CN111797423A (zh) * 2019-04-09 2020-10-20 Oppo广东移动通信有限公司 模型训练方法、数据授权方法、装置、存储介质及设备
US11645659B2 (en) * 2019-07-31 2023-05-09 Nutanix, Inc. Facilitating customers to define policies for their clouds
CN112445699A (zh) * 2019-09-05 2021-03-05 北京达佳互联信息技术有限公司 策略匹配方法、装置、电子设备及存储介质
CN111274560B (zh) * 2020-01-14 2022-11-18 支付宝(杭州)信息技术有限公司 身份认证方式推荐方法、装置及设备
US11475654B1 (en) 2020-04-29 2022-10-18 Wells Fargo Bank, N.A. Technology control evaluation program
CN113836389B (zh) * 2020-06-23 2024-03-26 北京达佳互联信息技术有限公司 内容推荐方法及装置
CN111950770A (zh) * 2020-07-20 2020-11-17 上海淇馥信息技术有限公司 一种管理资源返还辅助策略的方法、装置和电子设备
CN111881358B (zh) * 2020-07-31 2021-08-03 北京达佳互联信息技术有限公司 一种对象推荐系统、方法、装置、电子设备和存储介质
CN112000888B (zh) * 2020-08-24 2024-02-02 北京达佳互联信息技术有限公司 信息推送方法、装置、服务器及存储介质
CN111966908A (zh) * 2020-08-25 2020-11-20 贝壳技术有限公司 推荐系统和方法、电子设备和计算机可读存储介质
CN114745143A (zh) * 2020-12-23 2022-07-12 息象(北京)科技发展有限公司 一种访问控制策略自动生成方法及装置
CN113139463B (zh) * 2021-04-23 2022-05-13 北京百度网讯科技有限公司 用于训练模型的方法、装置、设备、介质和程序产品
CN113285940B (zh) * 2021-05-17 2023-09-19 深圳Tcl新技术有限公司 一种设备连接方法及装置
CN113343082A (zh) * 2021-05-25 2021-09-03 北京字节跳动网络技术有限公司 可热字段预测模型生成方法、装置、存储介质及设备
CN114093475A (zh) * 2021-11-11 2022-02-25 山东思码科技有限公司 一种基于结构化授权标准的临床医疗授权方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105074720A (zh) * 2013-02-27 2015-11-18 微软技术许可有限责任公司 基于云的环境中的自主策略管理
JP2016066186A (ja) * 2014-09-24 2016-04-28 株式会社日立ソリューションズ アカウント管理方法、アカウント管理サーバ、及びアカウント管理システム
CN105871854A (zh) * 2016-04-11 2016-08-17 浙江工业大学 基于动态授权机制的自适应云访问控制方法
CN106685933A (zh) * 2016-12-08 2017-05-17 腾讯科技（深圳）有限公司 一种授权策略推荐及装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7809650B2 (en) * 2003-07-01 2010-10-05 Visa U.S.A. Inc. Method and system for providing risk information in connection with transaction processing
US8380880B2 (en) * 2007-02-02 2013-02-19 The Mathworks, Inc. Scalable architecture
EP2588968A4 (en) 2010-06-30 2016-03-23 Hewlett Packard Development Co SYSTEM AND METHOD FOR A SERVICE RECOMMENDATION SERVICE
US8495683B2 (en) * 2010-10-21 2013-07-23 Right Brain Interface Nv Method and apparatus for content presentation in a tandem user interface
US8694540B1 (en) * 2011-09-01 2014-04-08 Google Inc. Predictive analytical model selection
CN102307205B (zh) * 2011-09-29 2014-04-23 北京理工大学 由信誉评估上升到信任管理的跨域访问控制策略生成方法
US10607219B2 (en) * 2012-06-11 2020-03-31 Visa International Service Association Systems and methods to provide privacy protection for activities related to transactions
CN105493093A (zh) * 2013-09-27 2016-04-13 英特尔公司 用于促进对资源的动态的基于上下文访问控制的机制
CN104883376B (zh) * 2014-02-28 2018-09-21 华为技术有限公司 应用程序推荐方法及终端
US9600670B2 (en) * 2014-12-23 2017-03-21 Intel Corporation Provisioning location-based security policy
US10152544B1 (en) * 2015-08-31 2018-12-11 Facebook, Inc. Viral content propagation analyzer in a social networking system
CN106131004A (zh) * 2016-07-04 2016-11-16 福州大学 一种用于云计算安全强度评估的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105074720A (zh) * 2013-02-27 2015-11-18 微软技术许可有限责任公司 基于云的环境中的自主策略管理
JP2016066186A (ja) * 2014-09-24 2016-04-28 株式会社日立ソリューションズ アカウント管理方法、アカウント管理サーバ、及びアカウント管理システム
CN105871854A (zh) * 2016-04-11 2016-08-17 浙江工业大学 基于动态授权机制的自适应云访问控制方法
CN106685933A (zh) * 2016-12-08 2017-05-17 腾讯科技（深圳）有限公司 一种授权策略推荐及装置

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3617918A1 (en) * 2018-08-28 2020-03-04 Cobalt Iron, Inc. Dynamic authorization control system and method
US10999290B2 (en) 2018-08-28 2021-05-04 Cobalt Iron, Inc. Dynamic authorization control system and method
US11310237B2 (en) 2018-08-28 2022-04-19 Cobalt Iron, Inc. Dynamic authorization control system and method
US11632374B2 (en) 2018-08-28 2023-04-18 Cobalt Iron, Inc. Dynamic authorization control system and method
US11902285B2 (en) 2018-08-28 2024-02-13 Cobalt Iron, Inc. Dynamic authorization control system and method
CN113301067A (zh) * 2020-04-01 2021-08-24 阿里巴巴集团控股有限公司 机器学习应用的云配置推荐方法以及装置
CN111861690A (zh) * 2020-07-23 2020-10-30 金蝶软件（中国）有限公司 账务数据核对方法及账务数据核对装置
CN111861690B (zh) * 2020-07-23 2024-04-26 金蝶软件（中国）有限公司 账务数据核对方法及账务数据核对装置
CN114363671A (zh) * 2021-12-31 2022-04-15 北京达佳互联信息技术有限公司 多媒体资源推送方法、模型训练方法、装置、存储介质
CN114363671B (zh) * 2021-12-31 2024-03-19 北京达佳互联信息技术有限公司 多媒体资源推送方法、模型训练方法、装置、存储介质

Also Published As

Publication number Publication date
CN106685933A (zh) 2017-05-17
US10686843B2 (en) 2020-06-16
US20190207985A1 (en) 2019-07-04
CN106685933B (zh) 2020-06-19

Similar Documents

Publication Publication Date Title
WO2018103595A1 (zh) 一种授权策略推荐方法及装置、服务器、存储介质
WO2020011068A1 (zh) 用于执行机器学习过程的方法和系统
Qi et al. Weighted principal component analysis-based service selection method for multimedia services in cloud
US20190362222A1 (en) Generating new machine learning models based on combinations of historical feature-extraction rules and historical machine-learning models
TW202018533A (zh) 資料處理模型構建方法、裝置、伺服器和用戶端
US11735292B2 (en) Intelligent personalized chemical synthesis planning
CN107305611B (zh) 恶意账号对应的模型建立方法和装置、恶意账号识别的方法和装置
WO2019196534A1 (zh) 验证码的人机识别方法及装置
WO2023124029A1 (zh) 深度学习模型的训练方法、内容推荐方法和装置
US20200151629A1 (en) Discovery and generation of organizational key performance indicators utilizing glossary repositories
CN106844550B (zh) 一种虚拟化平台操作推荐方法及装置
Jayapriya et al. Cloud service recommendation based on a correlated QoS ranking prediction
US20190180193A1 (en) Accurate and interpretable rules for user segmentation
CN114205690A (zh) 流量预测、模型训练方法及装置、电子设备、存储介质
CN112017042A (zh) 基于tweedie分布的资源配额确定方法、装置和电子设备
WO2023055426A1 (en) Techniques for input classification and responses using generative neural networks
CN109558248A (zh) 一种用于确定面向海洋模式计算的资源分配参数的方法及系统
CN112669084A (zh) 策略确定方法、设备及计算机可读存储介质
US10884713B2 (en) Transformations of a user-interface modality of an application
CN109376981B (zh) 数据处理方式的确定方法、装置、服务器和数据处理方法
US20210357553A1 (en) Apparatus and method for option data object performance prediction and modeling
Fan et al. A novel hybrid decision-making model for team building in cloud service environment
US20180314562A1 (en) Machine learning task compartmentalization and classification
CN109951859B (zh) 无线网络连接推荐方法、装置、电子设备及可读介质
Zheng et al. On dynamic performance estimation of fault-prone Infrastructure-as-a-Service clouds

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17879292

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17879292

Country of ref document: EP

Kind code of ref document: A1