An audit method and system for matching database access users

Abstract

The invention provides an audit method for matching a database access user, which comprises the following steps: registering a uri used by a web server user for login and obtaining a user name; registering a session name of the web server, and obtaining http data of all web operations corresponding to the user according to the session ID of the user; obtaining a first key from http data of all operations corresponding to the user; Filtering the first keyword whose occurrence frequency exceeds a preset value to obtain a second keyword, and storing the second keyword in correspondence with a corresponding session ID; obtaining the operation of the web server to the database, parsing and extracting the third keyword from the corresponding SQL; the second keyword is matched with the third keyword, and the user name corresponding to the matched second keyword and the SQL statement corresponding to the third keyword are stored correspondingly. The invention also provides an audit system formatching a database access user, which creates an association relationship between a user access behavior of a front end and a database change of a back end, and has high accuracy and high efficiency.

Description

technical field [0001] The invention relates to the field of database auditing, in particular to an auditing method and system for matching database access users. Background technique [0002] At present, the database security audit system is mainly used to monitor and record various operations on the database server. Through the analysis of network data, it can analyze various operations on the database server in real time and intelligently, and record them in the audit database for future inspection. Query, analyze, and filter to realize the monitoring and auditing of user operations on the target database system. [0003] In a common information network, users operate databases in various ways, including: accessing through standard database clients, connecting to databases through programs, logging into databases through Telnet, SSH, etc. for nested operations, and accessing business system websites Indirect operation database, etc. Among them, the access to the databas...

AI Technical Summary

Problems solved by technology

[0004] Traditional database auditing can only audit the user account for accessing the database, or the user account of the web server. The business system website accesses the database. Users use different accounts to access the web server, but the operation of the web server on the database is through If it is performed by a built-in fixed database account, if you simply audit the operation of the web server on the database, you cannot map the database operation to a specific web user, and if you simply audit the operation of the web user on the web server, you cannot know the consequences of these operations. database changes

The existing technology usually needs to use multiple fuzzy matching for the processing of related audits, which has the problems of low efficiency and low accuracy

Images