A database audit monitoring system and method thereof

Abstract

The invention discloses a database auditing monitoring system and a database auditing monitoring method. The database auditing monitoring system comprises a hardware part and a module part, wherein the hardware part comprises a switchboard, a local area network and a database auditing server, the switchboard is respectively connected into the local area network at the two ends through a duplicated port, and is connected with the database auditing server through a mirror port, the local area network at the two ends is respectively communicated with a database accessing client and a database server, and the module part comprises a WEB management module, a local database module, a data collecting module and a data analysis and processing module. The database auditing monitoring system and the database auditing monitoring method have the advantages that various kinds of operation behaviors on the database server are monitored and recorded through a monitoring module arranged in the data analysis and processing module, through the analysis on network data, various kinds of operation and hostile attack event information on the database server can be analyzed intelligently in real time and is recorded into an auditing database so that inquiry and analysis can be realized in future, and the monitoring and the auditing on the operation of a target database system are realized.

Description

technical field [0001] The invention relates to the field of computers, in particular to a database audit monitoring system and method for the electric power industry. Background technique [0002] With the wide application of databases and the increasing awareness of user data protection and operation monitoring, more and more users have put forward higher requirements for database security: in addition to supporting the normal operation of business systems, the database system is also required to have High reliability, confidentiality, controllability and traceability. Various operations on the database system are carried out under monitoring conditions, and at the same time, operations on important data must also retain historical traces. In this way, when there is a major secret-related business handling error and responsibility investigation and identification are required, the database audit will provide strong evidence for post-event tracking and responsibility ident...

AI Technical Summary

Problems solved by technology

Usually the database server has its own log audit function, and such log functions are also divided into various types, such as: connection audit, C2 audit, SQL statement tracking, etc., which can be set to enable or disable by modifying configuration items. The log audit function has its own defects and hazards

The log audit function cannot be flexibly configured. It is only a simple log record, which cannot help managers find problems in time and quickly locate problems; Abnormal information is reported to the database manager, which can only be used for problem verification; the log audit record will exist in a specific file or a table, and malicious attackers or legitimate users with permissions can delete such log files, thereby recording Destruction; it will have an impact on the resources and performance of the database server: after some log audit functions are enabled, sometimes if the log file cannot be written, the database will stop; once some log audit functions are enabled, the record The amount is very large, taking up a lot of hard disk space, and greatly reducing the performance of database services, seriously affecting the smooth progress of normal applications

Images