Database abnormal behavior detection method and device

Abstract

The invention provides a database abnormal behavior detection method and device. The method comprises the steps of obtaining a database log data set; performing sliding processing on each log by utilizing a fixed window, and extracting contents of three fields of SQL (Structured Query Language) statement, running time and operation time in each window as a sliding window database behavior sample, so as to obtain a sliding window database behavior data set; encoding SQL statements and operation time of each sliding window database behavior sample in the sliding window database behavior data set to form a sliding window database behavior sample matrix, and summing the matrix according to columns to obtain a sliding window database behavior vector data set; and normalizing the sliding window database behavior vector data set, and inputting the normalized sliding window database behavior vector data set into a pre-trained DAGMM database abnormal behavior detection model to obtain a detection result. According to the method, the problems of single SQL statement detection vulnerabilities and manual data annotation in the previous database abnormal behavior detection research are well solved.

Description

technical field [0001] The invention relates to a database abnormal behavior detection method based on DAGMM (Deep AutoEncoder Gaussion Mixture Model, DAGMM), which belongs to the technical field of network security. Background technique [0002] Data is the core asset in the operation of an enterprise, and a lot of valuable information is contained in the data. At present, most enterprises store their daily operation data in the database, so the database has become one of the important attack targets of malicious personnel. According to the Data Breach Investigations Report, most data breaches are caused by insiders. Internal personnel are familiar with the security detection system in the enterprise and can effectively evade the detection mechanism; some internal personnel's misuse will also affect the detection work, which brings great difficulties and challenges to the detection of abnormal database behaviors. [0003] Experts have conducted a lot of research on abnorm...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a DAGMM-based abnormal behavior detection model for databases to solve the single SQL statement detection defect and the need for manual data processing in the current application of machine learning algorithms for abnormal database behavior detection. The problem of labeling for model training

Images