Database three-layer correlation audit method, device, computer equipment and storage medium

Abstract

The invention discloses a database three-layer association auditing method, device, computer equipment and storage medium. The method includes formulating a collection strategy and sending it to the application server, and the application server uses switch mode to set the actual collection strategy according to the collection strategy; the application server uses bytecode enhancement technology to intercept the behavior and data of the user's access to the application, so as to obtain For the intercepted data, collect user behavior data and application transmission data for the intercepted data according to the actual collection strategy, and write the data access link information to obtain the target data; assemble the access link for the data related to database access in the target data , to obtain the access link information map of the user's access to the application and database; extract the database audit information according to the access link information map, and correlate the database audit information to obtain the three-tier associated audit information. The present invention is applicable to business scenarios and application system architecture scenarios with any number of concurrent users, and improves the accuracy rate.

Description

technical field [0001] The present invention relates to a database auditing method, and more specifically refers to a database three-layer association auditing method, device, computer equipment and storage medium. Background technique [0002] Due to laws and regulations and the needs of enterprise security, database auditing is more and more widely used. In the existing database auditing system, the user terminal usually sends an access request to the WEB server through the browser, and the WEB server sends an SQL request to the database. . The access users of the system application layer are associated with the access behavior to the database to generate audit information, and the application users, the application middle layer and the database are associated and audited, which is called the database three-tier associated audit. [0003] At present, the three-layer association audit method of the database includes the fuzzy matching method, that is, by capturing packets ...

AI Technical Summary

Problems solved by technology

[0003] At present, the three-layer association audit method of the database includes the fuzzy matching method, that is, by capturing packets at both ends of the Web server and mirroring traffic, the two types of events from the browser to the Web server and from the Web server to the database are audited, and then the two types of events are compared. Events are associated with fuzzy matching based on time, session ID, thread ID, access IP and other related characteristics, and the accessed resource user account is associated with related database operations for auditing. However, the principle of this method is basically Correlation based on the time dimension and other features that are not sure during this period, the overall accuracy of the association is not high; when the number of user visits is large, it is a disaster, the accuracy of the association is greatly reduced, and the error is very large, only applicable to users Scenarios with a small amount of visits; when used in complex business, complex system architecture, and complex application multi-service calls and inter-application calls, it is basically impossible to perform three-tier association auditing of the database, which is only applicable to simple business scenarios and application systems Scenarios with simple architecture; and need to use packet capture or mirror traffic analysis, making it extremely difficult to deploy in a cloud environment; need to analyze network traffic on the web server, so it is necessary to obtain its users to web services and web servers for different applications The traffic to the database, the deployment is limited by the deployment location and line of the application, and the deployment will become complicated. When the application scale is large, and the system architecture and deployment of the application change, the operation and maintenance will become more and more difficult

Images