Database security auditing method and device and electronic equipment

Abstract

The invention provides a database security auditing method and device and electronic equipment. The method comprises the steps of obtaining DPI database log data in real time, and obtaining an SQL statement access event according to the log data; matching the SQL statement access event with a preset user behavior rule base, wherein the preset user behavior rule base is a rule base of user behaviors obtained by performing association analysis according to historical log data and / or real-time log data of the DPI database; and if the SQL statement access event is not matched with a preset user behavior rule base or partially not matched with the preset user behavior rule base, determining the danger level of the SQL statement access event. According to the method, the association rule can beadjusted according to the structural change of the database and the new behavior of the user, the user behavior is dynamically discovered, and the auditing strategy is adjusted, so that the method adapts to different application scenarios and novel user behaviors, and an effective database security guarantee can be provided.

Description

technical field [0001] The present invention relates to the field of information security, and more specifically, to a database security audit method, device and electronic equipment. Background technique [0002] The most basic problem to be solved in the database security audit service is the collection of security elements, as well as the normalization of events and the definition of event audit rules. In terms of security element collection, one method is to use network mirroring to collect data packets for accessing the database, analyze the data packets through protocols, extract database access statements and return data content as security analysis objects, and then extract security elements through certain rules; The advantage of this method is that the information collected by the specific port of the database is more comprehensive, including both access information and return information. The disadvantage is that the cost of hardware deployment is high, and the pr...

AI Technical Summary

Problems solved by technology

This method cannot identify special scenarios. The user's behavior of obtaining sensitive information in the database may change according to the structure of the database itself. However, the audit cannot customize these characteristic behaviors; nor can it discover new user behaviors, so new user behaviors cannot be identified. audit user behavior

Images