Database security audit configuration optimization method, device, terminal and storage medium

Abstract

The present invention provides a method, device, terminal and storage medium for optimizing database security audit configuration, and relates to the field of database. The method includes: copying the currently effective database security audit configuration as the target audit configuration; obtaining the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item in the target audit configuration; determining the validity of each dimension configuration item in the target audit configuration according to the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item; removing the dimension configuration items whose validity is less than or equal to the effective threshold of the corresponding dimension from the target audit configuration to obtain the optimized target audit configuration; and performing a security audit on the database based on the optimized target audit configuration. The present application can reduce the processing load of the database server for security auditing, improve system performance, and take into account both database system security and system performance.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a database security audit configuration optimization method, device, terminal and storage medium. Background Art

[0002] A database management system is a hardware and software system used to define, create, manipulate, control, manage, and use databases. In the field of database technology, security auditing is the creation of records of selected user activities. Through security auditing, the database server can record sensitive operations performed by ordinary users or administrators. Afterwards, the audit administrator analyzes the audit records to identify unauthorized or suspicious database activities.

[0003] Security auditing contributes to data security in the following ways: active monitoring of audit records by administrators can provide evidence of violations or compromises of data security; security auditing is a preventive measure - intruders do not dare to arbitrarily control the system for fear of leaving audit records; security auditing helps monitor the behavior of privileged users of the system and holds privileged users accountable for their behavior; enabling the system's security auditing function helps meet regulatory requirements; and by archiving audit records, organizations can delve into the past and discover destructive activities carried out by ordinary users or administrators.

[0004] However, after security auditing is enabled on the database system, the database server will generate audit records based on the security auditing configuration, causing the database system to run slowly and affecting system performance. Summary of the invention

[0005] The embodiments of the present invention provide a method, device, terminal and storage medium for optimizing the configuration of a database security audit, so as to solve the problem that the existing method easily causes the database system to run slowly and affects the system performance after the security audit is turned on.

[0006] In a first aspect, an embodiment of the present invention provides a method for optimizing database security audit configuration, including:

[0007] Copy the currently effective database security audit configuration as the target audit configuration;

[0008] Get the audit records and effective period length of the security audit configuration corresponding to each dimension configuration item in the target audit configuration;

[0009] Determine the validity of each dimension configuration item in the target audit configuration according to the audit records and the length of the validity period of the security audit configuration corresponding to each dimension configuration item;

[0010] Remove dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension from the target audit configuration to obtain an optimized target audit configuration;

[0011] Based on the optimized target audit configuration, perform security audit on the database.

[0012] In a possible implementation, the validity of each dimensional configuration item in the target audit configuration is determined according to the audit records of the security audit configuration corresponding to each dimensional configuration item during the effective period and the length of the effective period, including:

[0013] According to the audit records during the effective period of the security audit configuration corresponding to each dimension configuration item, determine the consistency of each dimension configuration item during the effective period of the corresponding security audit configuration;

[0014] Determine the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of fit of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item;

[0015] The validity of each dimensional configuration item in the target audit configuration is determined based on the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration.

[0016] In a possible implementation, according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item, the consistency of each dimensional configuration item during the effective period of the corresponding security audit configuration is determined, including:

[0017] For each security audit configuration corresponding to each dimensional configuration item, the number of audit record items that match the dimensional configuration item in the audit records during the period when the security audit configuration is effective is determined as the degree of consistency of the dimensional configuration item during the period when the corresponding security audit configuration is effective.

[0018] In a possible implementation, the dimension configuration items of the target audit configuration include at least one of the configuration items of the operation dimension, the configuration items of the subject dimension, and the configuration items of the object dimension;

[0019] Accordingly, when the dimension configuration item is a configuration item of the operation dimension, the audit record item matching the dimension configuration item is the audit record item whose operation field matches the dimension configuration item;

[0020] When the dimension configuration item is a configuration item of the subject dimension, the audit record item that matches the dimension configuration item is the audit record item whose subject field matches the dimension configuration item;

[0021] When the dimension configuration item is a configuration item of the object dimension, the audit record item matching the dimension configuration item is the audit record item whose object field matches the dimension configuration item.

[0022] In a possible implementation, the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration is determined according to the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item, including:

[0023] For each security audit configuration corresponding to each dimensional configuration item, the ratio of the degree of fit of the dimensional configuration item during the effective period of the corresponding security audit configuration to the length of the effective period of the security audit configuration is determined as the influence of the dimensional configuration item during the effective period of the corresponding security audit configuration.

[0024] In a possible implementation, determining the validity of each dimensional configuration item in the target audit configuration according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration includes:

[0025] For each dimension configuration item in the target audit configuration, the sum of the impacts of the dimension configuration item during the effective period of each corresponding security audit configuration is determined as the validity of the dimension configuration item.

[0026] In a possible implementation, a security audit is performed on the database based on the optimized target audit configuration, including:

[0027] Based on the preset effective time of the optimized target audit configuration, during the effective period of the optimized target audit configuration, a security audit is performed on the database according to the optimized target audit configuration.

[0028] In a second aspect, an embodiment of the present invention provides a database security audit configuration optimization device, including:

[0029] The target audit configuration determination module is used to copy the currently effective database security audit configuration as the target audit configuration;

[0030] The data acquisition module is used to obtain the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item in the target audit configuration;

[0031] The validity determination module is used to determine the validity of each dimension configuration item in the target audit configuration according to the audit records of the security audit configuration validity period corresponding to each dimension configuration item and the length of the validity period;

[0032] An optimization module, used to remove dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension from the target audit configuration, so as to obtain an optimized target audit configuration;

[0033] The audit module is used to perform security audits on the database based on the optimized target audit configuration.

[0034] In a third aspect, an embodiment of the present invention provides a terminal comprising a memory and a processor, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, and executing the database security audit configuration optimization method as described in the first aspect or any possible implementation of the first aspect.

[0035] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the database security audit configuration optimization method described in the first aspect or any possible implementation method of the first aspect.

[0036] The embodiment of the present invention provides a method, device, terminal and storage medium for optimizing the configuration of a database security audit. The method copies the currently effective database security audit configuration as the target audit configuration, determines the validity of each dimensional configuration item in the target audit configuration according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item in the target audit configuration and the length of the effective period, removes the dimensional configuration items whose validity is less than or equal to the effective threshold of the corresponding dimension from the target audit configuration, thereby optimizing the target audit configuration and reducing the scale of the target audit configuration. Further, when performing a security audit on the database based on the optimized target audit configuration, the processing load of the database server performing the security audit can be reduced, the system performance can be improved, and both the database system security and the system performance can be taken into account. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0038] Figure 1 It is a flowchart of a database security audit configuration optimization method provided by an embodiment of the present invention;

[0039] Figure 2 It is a schematic diagram of the relationship between the database security audit configuration and the database security audit record provided by the embodiment of the present invention;

[0040] Figure 3 It is a structural diagram of a database security audit configuration optimization device provided by an embodiment of the present invention;

[0041] Figure 4is a schematic diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present invention. However, it should be clear to those skilled in the art that the present invention may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present invention.

[0043] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0044] See also Figure 1 , which shows a flowchart of the implementation of the database security audit configuration optimization method provided by the embodiment of the present invention. The execution subject of the above database security audit configuration optimization method can be a terminal.

[0045] The above database security audit configuration optimization method may include:

[0046] In S101, the currently effective database security audit configuration is copied as the target audit configuration.

[0047] In this embodiment, each security audit configuration of the database has a corresponding effective time. According to the effective time of each security audit configuration, the currently effective database security audit configuration can be determined. By copying the currently effective database security audit configuration, the copied security audit configuration is used as the target audit configuration and optimized, that is, the currently effective database security audit configuration is optimized to reduce the processing load of the database server.

[0048] The effective time of the security audit configuration can be understood as the effective time of the security audit configuration.

[0049] In S102, the audit records of the security audit configuration effectiveness period corresponding to each dimension configuration item in the target audit configuration and the length of the effectiveness period are obtained.

[0050] In addition to the above-mentioned effective time, the target audit configuration may also include at least one of the configuration items of the operation dimension, the configuration items of the subject dimension, and the configuration items of the object dimension. In this embodiment, the configuration items of the operation dimension, the configuration items of the subject dimension, and the configuration items of the object dimension are collectively referred to as dimension configuration items.

[0051] The configuration items of the operation dimension may include at least one of the configuration items of successful addition, successful deletion, successful modification, successful query, failed addition, failed deletion, failed modification, and failed query. The configuration items of the subject dimension may include at least one of the configuration items of user, user group, and user role. The configuration items of the object dimension may include at least one of the configuration items of transaction, library, table, index, row, column, trigger, routine, and password.

[0052] An example of a security audit configuration is as follows:

[0053]

[0054] The database corresponds to different security audit configurations at different times, so the database may have multiple security audit configurations. Similarly, each dimension configuration item in the target audit configuration may exist in multiple security audit configurations. In this embodiment, the security audit configuration that has a certain dimension configuration item is called the security audit configuration corresponding to the dimension configuration item, that is, the security audit configuration corresponding to the dimension configuration item is all the security audit configurations that have the dimension configuration item.

[0055] After the database opens security audit, the database server can generate corresponding audit records according to the currently effective security audit configuration, which can also be called security audit records. Exemplarily, the audit record may include fields such as audit time, database server host name, process number, database server name, operation, subject and object, which is similar to a table. Each row of the table is equivalent to an audit record item, and each column of the table is equivalent to a field, as shown in Table 1.

[0056] Table 1 Audit records

[0057]

[0058] The relationship between database security audit configuration and database security audit records is shown in the figure below: Figure 2 As shown. Figure 2 There are n database security audit configurations, and each database security audit configuration will generate a corresponding database security audit record during its effective period.

[0059] The effective period of the security audit configuration is from the effective time of the security audit configuration to the effective time of the next security audit configuration, that is, starting from the effective time of the security audit configuration and ending at the effective time of the next security audit configuration. The length of the effective period of the security audit configuration can be determined based on the effective time of the security audit configuration and the effective time of the next security audit configuration. If the next security audit configuration has not been set, the length of the effective period of the currently effective security audit configuration can be determined based on the current time and the effective time of the currently effective security audit configuration.

[0060] For example, assuming that the effective time of the security audit configuration is 2023, and the effective time of the next security audit configuration is 2024, then the effective period of the security audit configuration is 1 year; assuming that the effective time of the security audit configuration is January 2021, and the effective time of the next security audit configuration is January 2023, then the effective period of the security audit configuration is 2 years; assuming that the effective time of the currently effective security audit configuration is January 2024, and the current time is May 2024, then the effective period of the currently effective security audit configuration is 4 months; and so on.

[0061] The audit records during the period when the security audit configuration is in effect can be determined based on the audit time in the database security audit record table. All audit record items with audit time during the period when the security audit configuration is in effect are regarded as audit records during the period when the security audit configuration is in effect.

[0062] In this embodiment, for each dimension configuration item in the target audit configuration, it is possible to first determine whether the dimension configuration item exists in the various security audit configurations of the database, thereby determining the various security audit configurations corresponding to the dimension configuration item, and then, based on the security audit record table of the database and the effective time of the various security audit configurations corresponding to the dimension configuration item, obtain the audit records of the effective period of each security audit configuration corresponding to the dimension configuration item and the length of the effective period of each security audit configuration corresponding to the dimension configuration item.

[0063] In some possible implementations, the security audit configurations corresponding to the dimensional configuration items can be determined from all the security audit configurations in the database. The security audit configurations corresponding to the dimensional configuration items in the target audit configuration can also be determined from the database's most recent preset number of security audit configurations or the most recent security audit configurations within a preset time period.

[0064] For example, assuming that the database has a total of 10 security audit configurations, then the security audit configurations corresponding to the various dimensional configuration items in the target audit configuration can be determined from the 10 security audit configurations, or the security audit configurations corresponding to the various dimensional configuration items in the target audit configuration can be determined from the most recent 5 security audit configurations, and the security audit configurations corresponding to the various dimensional configuration items in the target audit configuration can be determined from the security audit configurations within the last 5 years.

[0065] In S103, the validity of each dimensional configuration item in the target audit configuration is determined according to the audit records of the security audit configuration validity period corresponding to each dimensional configuration item and the length of the validity period.

[0066] The effectiveness of a dimension configuration item in a target audit configuration may indicate the degree of effectiveness of the dimension configuration item in the target audit configuration.

[0067] This embodiment can determine the validity of each dimensional configuration item in the target audit configuration based on the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item in the target audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item in the target audit configuration.

[0068] In S104, dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension are removed from the target audit configuration to obtain an optimized target audit configuration.

[0069] When the validity of a dimension configuration item in the target audit configuration is less than or equal to the validity threshold of the corresponding dimension, it means that the validity of the dimension configuration item in the target audit configuration is too low. The dimension configuration item is rarely used or not used in the actual security audit process. The dimension configuration item can be removed from the target audit configuration to optimize the target audit configuration. When the validity of a dimension configuration item in the target audit configuration is greater than the validity threshold of the corresponding dimension, the dimension configuration item is retained in the target audit configuration.

[0070] Among them, the configuration items of the operation dimension correspond to the effective threshold of the operation dimension; the configuration items of the subject dimension correspond to the effective threshold of the subject dimension; and the configuration items of the object dimension correspond to the effective threshold of the object dimension.

[0071] The effective threshold of the operation dimension, the effective threshold of the subject dimension, and the effective threshold of the object dimension can be the same or different, and can be set according to actual needs. For example, all three can be 0, or one can be 0 and the other two can be other values, or all three can be different other values, and so on.

[0072] In S105, a security audit is performed on the database based on the optimized target audit configuration.

[0073] This embodiment performs security audit on the database based on the optimized target audit configuration. When security audit is enabled on the database, it can reduce the security audit processing load of the database server, improve system performance, and achieve the goal of balancing system security and performance.

[0074] The embodiment of the present application copies the currently effective database security audit configuration as the target audit configuration, determines the validity of each dimensional configuration item in the target audit configuration according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item in the target audit configuration and the length of the effective period, removes the dimensional configuration items whose validity is less than or equal to the effective threshold of the corresponding dimension from the target audit configuration, thereby optimizing the target audit configuration and reducing the scale of the target audit configuration. Further, when performing a security audit on the database based on the optimized target audit configuration, the processing load of the database server performing the security audit can be reduced, the system performance can be improved, and both database system security and system performance can be taken into account.

[0075] In some embodiments, the above S103 may include:

[0076] According to the audit records during the effective period of the security audit configuration corresponding to each dimension configuration item, determine the consistency of each dimension configuration item during the effective period of the corresponding security audit configuration;

[0077] Determine the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of fit of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item;

[0078] The validity of each dimensional configuration item in the target audit configuration is determined based on the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration.

[0079] In this embodiment, for each dimension configuration item in the target audit configuration, the degree of conformity of the dimension configuration item during the period when each corresponding security audit configuration is in effect can be determined based on the audit records during the period when each corresponding security audit configuration is in effect. That is, each dimension configuration item has a degree of conformity with each corresponding security audit configuration.

[0080] The degree of conformance of a certain dimension configuration item during the period in which a corresponding security audit configuration is effective may represent the number of audit record items of the dimension configuration item during the period in which the security audit configuration is effective.

[0081] For each dimension configuration item in the target audit configuration, the influence of the dimension configuration item during the effective period of each corresponding security audit configuration can be determined according to the degree of fit during the effective period of the corresponding security audit configuration and the length of the effective period of the corresponding security audit configuration. That is, each dimension configuration item has an influence with each corresponding security audit configuration.

[0082] The influence degree of a certain dimension configuration item during the effective period of a corresponding security audit configuration can indicate the influence degree of the dimension configuration item during the effective period of the security audit configuration. The higher the value, the higher the importance of the dimension configuration item in the security audit configuration.

[0083] The validity of each dimension configuration item in the target audit configuration can be determined according to the influence of the dimension configuration item during the validity period of each corresponding security audit configuration.

[0084] Among them, for the configuration items of the operation dimension, the corresponding degree of fit can be called the operation fit, the corresponding degree of influence can be called the operation influence, and the corresponding degree of effectiveness can be called the operation effectiveness. For the configuration items of the subject dimension, the corresponding degree of fit can be called the subject fit, the corresponding degree of influence can be called the subject influence, and the corresponding degree of effectiveness can be called the subject effectiveness. For the configuration items of the object dimension, the corresponding degree of fit can be called the object fit, the corresponding degree of influence can be called the object influence, and the corresponding degree of effectiveness can be called the object effectiveness.

[0085] In some embodiments, the above-mentioned determination of the conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item includes:

[0086] For each security audit configuration corresponding to each dimensional configuration item, the number of audit record items that match the dimensional configuration item in the audit records during the period when the security audit configuration is effective is determined as the degree of consistency of the dimensional configuration item during the period when the corresponding security audit configuration is effective.

[0087] In some embodiments, the dimension configuration items of the target audit configuration include at least one of the configuration items of the operation dimension, the configuration items of the subject dimension, and the configuration items of the object dimension;

[0088] Accordingly, when the dimension configuration item is a configuration item of the operation dimension, the audit record item matching the dimension configuration item is the audit record item whose operation field matches the dimension configuration item;

[0089] When the dimension configuration item is a configuration item of the subject dimension, the audit record item that matches the dimension configuration item is the audit record item whose subject field matches the dimension configuration item;

[0090] When the dimension configuration item is a configuration item of the object dimension, the audit record item matching the dimension configuration item is the audit record item whose object field matches the dimension configuration item.

[0091] Based on the example of the audit record in Table 1 above, for a configuration item of a certain operation dimension in the target audit configuration, the number of audit record items whose operation field values ​​are the same as those of the configuration item of the operation dimension in the audit record during the period when a corresponding security audit configuration is effective is the degree of consistency (operation consistency) of the configuration item of the operation dimension during the period when the corresponding security audit configuration is effective.

[0092] For a configuration item of a subject dimension in the target audit configuration, the number of audit record items whose subject field value is the same as that of the configuration item of the subject dimension in the audit records during the effective period of a corresponding security audit configuration is the degree of consistency (subject consistency) of the configuration item of the subject dimension during the effective period of the corresponding security audit configuration.

[0093] For a configuration item of an object dimension in the target audit configuration, the number of audit record items whose object field value is the same as that of the configuration item of the object dimension in the audit record during the effective period of a corresponding security audit configuration of the configuration item of the object dimension is the degree of consistency of the configuration item of the object dimension during the effective period of the corresponding security audit configuration (object consistency).

[0094] In some embodiments, the above-mentioned determining the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of fit of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item includes:

[0095] For each security audit configuration corresponding to each dimensional configuration item, the ratio of the degree of fit of the dimensional configuration item during the effective period of the corresponding security audit configuration to the length of the effective period of the security audit configuration is determined as the influence of the dimensional configuration item during the effective period of the corresponding security audit configuration.

[0096] For a configuration item of a certain operation dimension in the target audit configuration, the ratio of the degree of fit of the configuration item of the operation dimension during the effective period of a corresponding security audit configuration to the length of the effective period of the security audit configuration is the impact (operation impact) of the configuration item of the operation dimension during the effective period of the corresponding security audit configuration.

[0097] For a configuration item of a subject dimension in the target audit configuration, the ratio of the degree of fit of the configuration item of the subject dimension during the effective period of a corresponding security audit configuration to the length of the effective period of the security audit configuration is the influence of the configuration item of the subject dimension during the effective period of the corresponding security audit configuration (subject influence).

[0098] For a configuration item of an object dimension in the target audit configuration, the ratio of the degree of fit of the configuration item of the object dimension during the effective period of a corresponding security audit configuration to the length of the effective period of the security audit configuration is the influence of the configuration item of the object dimension during the effective period of the corresponding security audit configuration (object influence).

[0099] In some embodiments, determining the validity of each dimensional configuration item in the target audit configuration according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration includes:

[0100] For each dimension configuration item in the target audit configuration, the sum of the impacts of the dimension configuration item during the effective period of each corresponding security audit configuration is determined as the validity of the dimension configuration item.

[0101] For a configuration item of a certain operation dimension in the target audit configuration, the sum of the impacts of the configuration item of the operation dimension during the effective period of each corresponding security audit configuration is the validity of the configuration item of the operation dimension (operation validity).

[0102] For a configuration item of a subject dimension in the target audit configuration, the sum of the influences of the configuration item of the subject dimension during the effective period of each corresponding security audit configuration is the validity of the configuration item of the subject dimension (subject validity).

[0103] For a configuration item of a certain object dimension in the target audit configuration, the sum of the influences of the configuration item of the object dimension during the effective period of each corresponding security audit configuration is the validity of the configuration item of the object dimension (object validity).

[0104] In some embodiments, the above S105 may include:

[0105] Based on the preset effective time of the optimized target audit configuration, during the effective period of the optimized target audit configuration, a security audit is performed on the database according to the optimized target audit configuration.

[0106] The optimized target audit configuration is also set with a corresponding effective time. During the effective period, a security audit can be performed on the database based on the optimized target audit configuration.

[0107] It should be noted that in the process of judging whether to optimize the configuration items of each dimension in the target audit configuration in the embodiment of the present application, the configuration items of each dimension can be judged in sequence, or the configuration items of each dimension can be judged simultaneously. When the computing resources are insufficient, the configuration items of each dimension can be judged in sequence; when the computing resources are sufficient, in order to improve the computing efficiency, the configuration items of each dimension can be judged simultaneously.

[0108] For example, the fit, influence and validity of the first dimension configuration item can be calculated first, and whether to remove the first dimension configuration item is determined based on the validity, and then the fit, influence and validity of the next dimension configuration item are calculated, and whether to remove the next dimension configuration item is determined based on the validity, and so on, until all dimension configuration items in the target audit configuration are judged. Alternatively, the fit, influence and validity of all dimension configuration items in the target audit configuration can be calculated synchronously, and whether to remove each dimension configuration item is determined based on the validity.

[0109] In a specific application scenario, assume that there are two security audit configurations, audit configuration 1 and audit configuration 2.

[0110] Audit configuration 1 will take effect in 2023 and includes three dimensions of configuration items:

[0111] ——Configuration item of operation dimension: Failed to delete

[0112] ——Configuration items of the subject dimension: User A

[0113] ——Configuration items of object dimension: Table A

[0114] Audit configuration 2 takes effect in 2024 and includes two configuration items:

[0115] ——Configuration item of operation dimension: Failed to delete

[0116] ——Configuration items of the subject dimension: User A

[0117] Based on the above two audit configurations, starting from 2023, any database activity involving "failed deletion" or "user A" or "table A" will generate audit records and save them in the audit log. Starting from 2024, any database activity involving "failed deletion" or "user A" will generate audit records and save them in the audit log.

[0118] Audit configuration 2 is the currently effective audit configuration, and audit configuration 2 is copied as the target audit configuration. Therefore, the target audit configuration contains two dimension configuration items, namely, the configuration item of the operation dimension: failure deletion and the configuration item of the subject dimension: user A.

[0119] For the first dimension configuration item "Failed Delete" in the target audit configuration:

[0120] Because "failed deletion" is an operation dimension item in audit configuration 2, based on all audit record items in 2024 in the audit records, first calculate the operation consistency of "failed deletion" during the period when audit configuration 2 is effective, and then calculate the operation impact of "failed deletion" during the period when audit configuration 2 is effective.

[0121] Because "failed deletion" is also an operation dimension item in audit configuration 1, based on all audit record items in 2023 in the audit records, first calculate the operation consistency of "failed deletion" during the period when audit configuration 1 is effective, and then calculate the operation impact of "failed deletion" during the period when audit configuration 1 is effective.

[0122] Because there are only "two audit configurations", the impact of all operations has been calculated, so the effectiveness of the "failed deletion" operation is calculated.

[0123] Assuming that the calculated operational effectiveness of "failure deletion" is large enough, this audit configuration item "failure deletion" is retained in the target audit configuration.

[0124] For the second dimension configuration item "User A" in the target audit configuration:

[0125] Because "User A" is a subject dimension item in Audit Configuration 2, based on all audit record items in 2024 in the audit records, first calculate the subject consistency of "User A" during the period when Audit Configuration 2 is effective, and then calculate the subject influence of "User A" during the period when Audit Configuration 2 is effective.

[0126] Because "User A" is also a subject dimension item in Audit Configuration 1, based on all audit record items in 2023 in the audit records, first calculate the subject consistency of "User A" during the period when Audit Configuration 1 is effective, and then calculate the subject influence of "User A" during the period when Audit Configuration 1 is effective.

[0127] Because there are only "two audit configurations", the influence of all subjects has been calculated, so the subject validity of "User A" is calculated.

[0128] Assuming that the calculated subject validity of "User A" is not large enough, remove this audit configuration item "User A" in the target audit configuration.

[0129] At this point, the optimized target audit configuration contains a dimension configuration item:

[0130] ——Configuration item of operation dimension: Failed to delete

[0131] Based on the optimized target audit configuration, when conducting a security audit, audit record items will be generated for database activities involving "failed deletion" and saved in the audit record.

[0132] The embodiment of the present application proposes a method for optimizing the database security audit configuration. By optimizing the database security audit configuration and reducing the scale of the security audit configuration, it can be ensured that when the system turns on security audit, the database server security audit processing load is reduced and the system performance is improved.

[0133] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0134] The following is an embodiment of the device of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0135] Figure 3 The following is a schematic diagram showing the structure of a database security audit configuration optimization device provided by an embodiment of the present invention. For ease of description, only the parts related to the embodiment of the present invention are shown, which are described in detail as follows:

[0136] like Figure 3 As shown, the database security audit configuration optimization device 20 may include: a target audit configuration determination module 21, a data acquisition module 22, a validity determination module 23, an optimization module 24 and an audit module 25.

[0137] The target audit configuration determination module 21 is used to copy the currently effective database security audit configuration as the target audit configuration;

[0138] The data acquisition module 22 is used to obtain the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item in the target audit configuration;

[0139] The validity determination module 23 is used to determine the validity of each dimensional configuration item in the target audit configuration according to the audit records of the security audit configuration validity period corresponding to each dimensional configuration item and the length of the validity period;

[0140] An optimization module 24, configured to remove dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension from the target audit configuration, to obtain an optimized target audit configuration;

[0141] The audit module 25 is used to perform security audit on the database based on the optimized target audit configuration.

[0142] In a possible implementation, the validity determination module 23 is specifically used to:

[0143] According to the audit records during the effective period of the security audit configuration corresponding to each dimension configuration item, determine the consistency of each dimension configuration item during the effective period of the corresponding security audit configuration;

[0144] Determine the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of fit of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item;

[0145] The validity of each dimensional configuration item in the target audit configuration is determined based on the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration.

[0146] In a possible implementation, in the validity determination module 23, according to the audit records during the validity period of the security audit configuration corresponding to each dimensional configuration item, the consistency of each dimensional configuration item during the validity period of the corresponding security audit configuration is determined, including:

[0147] For each security audit configuration corresponding to each dimensional configuration item, the number of audit record items that match the dimensional configuration item in the audit records during the period when the security audit configuration is effective is determined as the degree of consistency of the dimensional configuration item during the period when the corresponding security audit configuration is effective.

[0148] In a possible implementation, the dimension configuration items of the target audit configuration include at least one of the configuration items of the operation dimension, the configuration items of the subject dimension, and the configuration items of the object dimension;

[0149] Accordingly, when the dimension configuration item is a configuration item of the operation dimension, the audit record item matching the dimension configuration item is the audit record item whose operation field matches the dimension configuration item;

[0150] When the dimension configuration item is a configuration item of the subject dimension, the audit record item that matches the dimension configuration item is the audit record item whose subject field matches the dimension configuration item;

[0151] When the dimension configuration item is a configuration item of the object dimension, the audit record item matching the dimension configuration item is the audit record item whose object field matches the dimension configuration item.

[0152] In a possible implementation, in the effectiveness determination module 23, the influence of each dimensional configuration item during the effectiveness period of the corresponding security audit configuration is determined according to the degree of fit of each dimensional configuration item during the effectiveness period of the corresponding security audit configuration and the length of the effectiveness period of the security audit configuration corresponding to each dimensional configuration item, including:

[0153] For each security audit configuration corresponding to each dimensional configuration item, the ratio of the degree of fit of the dimensional configuration item during the effective period of the corresponding security audit configuration to the length of the effective period of the security audit configuration is determined as the influence of the dimensional configuration item during the effective period of the corresponding security audit configuration.

[0154] In a possible implementation, in the validity determination module 23, the validity of each dimensional configuration item in the target audit configuration is determined according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration, including:

[0155] For each dimension configuration item in the target audit configuration, the sum of the impacts of the dimension configuration item during the effective period of each corresponding security audit configuration is determined as the validity of the dimension configuration item.

[0156] In a possible implementation, the audit module 25 is specifically used for:

[0157] Based on the preset effective time of the optimized target audit configuration, during the effective period of the optimized target audit configuration, a security audit is performed on the database according to the optimized target audit configuration.

[0158] Figure 4 is a schematic diagram of a terminal provided by an embodiment of the present invention. Figure 4 As shown, the terminal 3 of this embodiment includes: a processor 30 and a memory 31. The memory 31 is used to store a computer program 32, and the processor 30 is used to call and run the computer program 32 stored in the memory 31 to perform the steps in the above-mentioned various database security audit configuration optimization method embodiments, such as Figure 1 Alternatively, the processor 30 is used to call and run the computer program 32 stored in the memory 31 to implement the functions of each module / unit in the above-mentioned device embodiments, for example Figure 3 The functions of each module are shown.

[0159] Exemplarily, the computer program 32 may be divided into one or more modules / units, which are stored in the memory 31 and executed by the processor 30 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program 32 in the terminal 3. For example, the computer program 32 may be divided into Figure 3 The modules shown.

[0160] The terminal 3 may be a database server or other types of terminals, which are not specifically limited here. The terminal 3 may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will understand that Figure 4 It is only an example of terminal 3 and does not constitute a limitation on terminal 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal may also include input and output devices, network access devices, buses, etc.

[0161] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0162] The memory 31 may be an internal storage unit of the terminal 3, such as a hard disk or memory of the terminal 3. The memory 31 may also be an external storage device of the terminal 3, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal 3. Further, the memory 31 may also include both an internal storage unit and an external storage device of the terminal 3. The memory 31 is used to store the computer program and other programs and data required by the terminal. The memory 31 may also be used to temporarily store data that has been output or is to be output.

[0163] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0164] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0165] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0166] In the embodiments provided by the present invention, it should be understood that the disclosed devices / terminals and methods can be implemented in other ways. For example, the device / terminal embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0167] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0169] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned database security audit configuration optimization method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium.

[0170] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A database security audit configuration optimization method, characterized in that: include: Copy the currently effective database security audit configuration as the target audit configuration; Obtain the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item in the target audit configuration; Determine the validity of each dimensional configuration item in the target audit configuration according to the audit records of the security audit configuration validity period corresponding to each dimensional configuration item and the length of the validity period; Remove dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension from the target audit configuration to obtain an optimized target audit configuration; Based on the optimized target audit configuration, a security audit is performed on the database; The determining the validity of each dimensional configuration item in the target audit configuration according to the audit records of the security audit configuration validity period corresponding to each dimensional configuration item and the length of the validity period includes: Determine the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item; Determine the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of fit of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item; The validity of each dimensional configuration item in the target audit configuration is determined according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration.

2. The database security audit configuration optimization method according to claim 1, characterized in that: The determining, according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item, the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration includes: For each security audit configuration corresponding to each dimensional configuration item, the number of audit record items that match the dimensional configuration item in the audit records during the period when the security audit configuration is effective is determined as the degree of consistency of the dimensional configuration item during the period when the corresponding security audit configuration is effective.

3. The database security audit configuration optimization method according to claim 2 is characterized in that: The dimension configuration items of the target audit configuration include at least one of the configuration items of the operation dimension, the configuration items of the subject dimension and the configuration items of the object dimension; Accordingly, when the dimension configuration item is a configuration item of the operation dimension, the audit record item matching the dimension configuration item is the audit record item whose operation field matches the dimension configuration item; When the dimension configuration item is a configuration item of the subject dimension, the audit record item that matches the dimension configuration item is the audit record item whose subject field matches the dimension configuration item; When the dimension configuration item is a configuration item of the object dimension, the audit record item matching the dimension configuration item is the audit record item whose object field matches the dimension configuration item.

4. The database security audit configuration optimization method according to claim 1, characterized in that: The determining, according to the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item, the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration includes: For each security audit configuration corresponding to each dimensional configuration item, the ratio of the degree of fit of the dimensional configuration item during the effective period of the corresponding security audit configuration to the length of the effective period of the security audit configuration is determined as the influence of the dimensional configuration item during the effective period of the corresponding security audit configuration.

5. The database security audit configuration optimization method according to claim 1, characterized in that: Determining the validity of each dimensional configuration item in the target audit configuration according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration includes: For each dimensional configuration item in the target audit configuration, the sum of the influences of the dimensional configuration item during the effective period of each corresponding security audit configuration is determined as the validity of the dimensional configuration item.

6. The database security audit configuration optimization method according to any one of claims 1 to 5, characterized in that: The step of performing a security audit on the database based on the optimized target audit configuration includes: Based on the preset effective time of the optimized target audit configuration, during the effective period of the optimized target audit configuration, a security audit is performed on the database according to the optimized target audit configuration.

7. A database security audit configuration optimization device, characterized in that: include: The target audit configuration determination module is used to copy the currently effective database security audit configuration as the target audit configuration; A data acquisition module, used to obtain the audit records and the length of the effective period of the security audit configuration corresponding to each dimension configuration item in the target audit configuration; A validity determination module, used to determine the validity of each dimensional configuration item in the target audit configuration according to the audit records of the security audit configuration validity period corresponding to each dimensional configuration item and the length of the validity period; An optimization module, used to remove dimension configuration items whose validity is less than or equal to the validity threshold of the corresponding dimension from the target audit configuration to obtain an optimized target audit configuration; An audit module, used for performing a security audit on the database based on the optimized target audit configuration; Wherein, the validity determination module is specifically used for: Determine the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the audit records during the effective period of the security audit configuration corresponding to each dimensional configuration item; Determine the influence of each dimensional configuration item during the effective period of the corresponding security audit configuration according to the degree of conformity of each dimensional configuration item during the effective period of the corresponding security audit configuration and the length of the effective period of the security audit configuration corresponding to each dimensional configuration item; The validity of each dimensional configuration item in the target audit configuration is determined according to the influence of each dimensional configuration item during the validity period of the corresponding security audit configuration.

8. A terminal, characterized in that: It comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the database security audit configuration optimization method as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the database security audit configuration optimization method as described in any one of claims 1 to 6 are implemented.

Images