Screen method and equipment for processing on-line database behaviors of giga-above network

Abstract

The invention discloses a screening method for processing online database action of a network with more than kilomega and equipment thereof. The screening method comprises the following steps of: copying a network flow, carrying out shunt processing to the network data, receiving processing data of the network shunt, carrying out identification and screening according to the shunt data, extracting data for operating action of database and discarding data for operating action of non-database; the screening equipment is connected with network equipment in a bypass connection mode and comprises a primary data acquisition device, a data shunt processing device, a secondary data acquisition device and a data identifying and screening device which are connected in sequence. By adopting the method and the equipment, the invention can greatly reduce the package loss rate caused by acquiring large data flow, guarantee timely and effective screening of database action to the data flow, is safe and reliable, does not have any influence on the network, does not need to increase hardware configuration and reduces the cost.

Description

technical field [0001] The invention relates to the technical field of database auditing, in particular to a screening method and equipment for processing behaviors of an online database of a gigabit network or more. Background technique [0002] With the continuous development of the information system business, the application scope of the database system is becoming wider and wider, and the enterprise's accounting data, trade records, engineering data, etc. need to use a large number of database resources. [0003] Due to the increasing role and influence of databases, the security threats to enterprise database information security are becoming more and more obvious. The theft and tampering of important and sensitive data that have occurred continuously in recent years has attracted great attention from all parties and has become an urgent problem to be solved. [0004] The basic network scale of the information system is also constantly expanding. From the past 100M ne...

AI Technical Summary

Problems solved by technology

If the background network traffic exceeds 100000000000000000000000000000000000000000000000000000000000000 by above-mentioned data collection device 1-D-A in the step of receiving mirrored data, there will be a certain amount of data flow loss, the loss rate is over 30%

When the data screening device 1-D-B receives the data sent from the data acquisition device 1-D-A, there is also a risk of processing overflow. At this time, the data overflow is inversely proportional to the hardware processing and software algorithm.

[0006] When using the current database behavior screening method or equipment to realize the data screening of gigabit traffic, in order to prevent the packet loss rate from being increased due to the collection of large data streams and to ensure that the data streams can be screened in a timely manner, it is theoretically necessary to improve the hardware configuration. Only by exchanging resources for data can the integrity be ensured, which greatly increases the cost; and in the case of a 10G network, it is impossible to achieve with the current hardware level

Images