Financial data processing method and system

Abstract

The invention belongs to the technical field of data processing and data security, and provides a financial data processing method and system, and the method specifically comprises the steps: firstly obtaining a load state of a server, triggering a security policy to a database when the load state accords with a high-frequency transaction condition, after the security policy is released, the query delay of the database in the cache region is monitored in real time, and whether the SQL injection attack risk occurs is identified; and finally, when the SQL injection attack risk occurs, the security policy release behavior is stopped, and early warning information is sent. According to the attack judgment probability, time sequence analysis is carried out according to the read-write features of the cache region, and the read-write features of the cache region are constructed for effectively identifying the SQL injection attack risk occurring in the security policy release scene triggered by the high-frequency transaction, so that the risk that financial data are tampered or stolen by the SQL injection attack is reduced; and data security and network security early warning of the financial transaction system is provided.

Description

Technical Field

[0001] The present invention belongs to the field of data processing and data security technology, and specifically relates to a financial data processing method and system. Background Art

[0002] Financial trading systems generally rely on transaction processing mechanisms to process transaction information of financial data. After receiving a transaction request from a client, the server needs to verify the integrity and legitimacy of the data. After completing the transaction step by step according to the preset security steps, the transaction results are stored in the database and fed back to the client, thereby ensuring the accuracy of the capital flow and account status. However, high-frequency trading has always been a technical difficulty in the field of financial data processing. First of all, the emergence of high-frequency trading is sudden in time, and there is uncertainty in the user group and the timeliness of the popularity of financial categories. These factors are the bottleneck triggering opportunities for high-frequency trading. Secondly, high-frequency trading will cause serious problems such as slow response speed and even system paralysis. At present, one of the solutions to the response speed of high-frequency trading under high-frequency access is to apply a distributed cache mechanism, which commonly includes the Redis mechanism and the Memcached mechanism. The principle is to cache data in memory to reduce the number of direct accesses to the database, thereby improving the system response speed. However, the distributed cache mechanism is prone to malicious SQL injection attacks in a high-frequency trading environment, resulting in threats to the security of funds and trading systems. This is because when there is a lack of a strictly enforced SQL statement verification mechanism in the cache system, especially when the system lowers some security policies, such as temporary adjustment of database permissions or skipping verification steps, attackers use these policy decentralization vulnerabilities to execute higher-authority SQL commands or malicious SQL statements, such as UNION SELECT, which is commonly used to bypass permission verification and then read or tamper with sensitive financial data. This attack method is often due to the server's concession to response speed, resulting in insufficient SQL input escape or filtering. Therefore, it is necessary to promptly discover these malicious SQL injection attack risks and prevent financial data security risks caused by security policy decentralization. Summary of the invention

[0003] The purpose of the present invention is to provide a financial data processing method and system to solve one or more technical problems existing in the prior art and at least provide a beneficial choice or create conditions.

[0004] In order to achieve the above object, according to one aspect of the present invention, a financial data processing method is provided, the method comprising the following steps:

[0005] Get server load status;

[0006] When the load status meets the high-frequency trading conditions, the security policy is triggered to be decentralized to the database;

[0007] After the security policy is decentralized, the cache database query delay is monitored in real time to identify whether the SQL injection attack risk occurs;

[0008] When the risk of SQL injection attack occurs, the security policy decentralization behavior is stopped and an early warning message is sent;

[0009] Furthermore, the method for obtaining the server load status is: the server load status is composed of server indicators, and the server indicators include one or more real-time values ​​of CPU utilization, cache hit rate, network bandwidth and TCP connection number. The various server indicators obtained in real time in the server at any moment constitute the server load status corresponding to that moment.

[0010] Furthermore, when the load status meets the high-frequency trading conditions, the method of triggering the security policy decentralization to the database is:

[0011] The server load status includes several server indicators;

[0012] Any server indicator has a preset corresponding indicator threshold. When any server indicator in the server load status exceeds its indicator threshold, the load status is determined to meet the high-frequency trading conditions, and the security policy is triggered to be decentralized to the database, thereby relaxing the database read and write permissions and reducing the server load;

[0013] The decentralization of security policies includes, but is not limited to, dynamically adjusting access rights restrictions or establishing hash values ​​for caching sensitive data.

[0014] Furthermore, the method of real-time monitoring of cache database query latency and identifying whether the SQL injection attack risk occurs is: obtaining cache read and write characteristics every 1 to 60 seconds; cache read and write characteristics include: excessively long access volume and high latency level;

[0015] The excessively long access volume refers to the number of cache-related data records whose response speed exceeds the preset threshold, and the high latency level refers to the average response speed of each cache-related data record that exceeds the preset threshold; cache-related data records refer to any data records involved in cache mechanism processing.

[0016] Furthermore, the method for real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is: set a time period as the monitoring period TL, TL∈[0.1,24] hours, and within the monitoring period, record the time scale of obtaining the cache read and write characteristics as the monitoring point; if a monitoring point has a larger number of over-long accesses than the previous monitoring point and the over-long accesses of the previous monitoring point are not zero, then define the monitoring point as the first cache increment;

[0017] Obtain the cache read and write characteristics of all first cache increments and write the sequence as the first increment sequence; if the high delay level of a monitoring point is greater than the minimum high delay level of all first cache increments in the monitoring period TL, and the monitoring point is not the first cache increment, then define the monitoring point as the second cache increment; obtain the cache read and write characteristics of the second cache increment and write the sequence as the second increment sequence;

[0018] Divide the variance of the high delay level corresponding to all elements in the first bit-increasing sequence by the variance of the high delay level corresponding to all elements in the second bit-increasing sequence, and record the obtained ratio as the delay increment level value Bivu;

[0019] The principle of obtaining the delay increment value here is actually to compare the variance of the high delay level in the first increment sequence and the second increment sequence, quantify the discreteness of the two sequences at the high delay level, and thus imply and compare the fluctuation trend in the difference between the two increment sequences. In the process of mathematical analysis, it can be understood as achieving an effect based on the bias of the data discreteness. This fluctuation trend dynamically and effectively quantifies the long-term or continuous significance of the high delay level of the cache area at the monitoring point location. From the perspective of malicious SQL injection risk, the long-term or continuous high delay level at the monitoring point location reflects the concentration of the server's response to SQL input escaping or filtering when malicious SQL injection occurs, and then explains the fluctuation trend of the server's response timeliness to SQL input escaping or filtering, providing mathematical support for the application of delay increment value in time series analysis to observe SQL injection feature probability analysis.

[0020] The Mahalanobis distance between the read-write characteristics of the cache area of ​​the current monitoring point and the read-write characteristics of the cache area of ​​each other monitoring point is calculated and recorded as the risk effectiveness value MhD; in the first increasing sequence and the second increasing sequence, all monitoring points whose risk effectiveness values ​​are greater than the upper quartile of the risk effectiveness value in the corresponding sequence are screened out respectively, and the sequence formed by all the screened monitoring points is recorded as the risk analysis sequence; the risk settlement value Rsst is calculated according to the risk analysis sequence: Rsst = exp(Bivu) × (hs<An.LS> -min.MhD)÷min.MhD; where i1 is the cumulative variable, hs<> is the harmonic mean function, exp() is the exponential function with the natural constant e as the base, An.LS is the sequence composed of the risk efficacy values ​​in the risk analysis sequence, and min.MhD is the minimum value of the risk efficacy values ​​corresponding to all elements in the risk analysis sequence;

[0021] Get the percentile value of the risk settlement value obtained at the current monitoring point among all risk settlement values ​​in the monitoring period TL. If the percentile value is greater than 0.8, it is judged that high settlement occurs at the current moment. The proportion of the number of monitoring points that have high settlement in the monitoring period TL is recorded as the high settlement ratio. When the high settlement ratio exceeds the preset ratio threshold, the current monitoring point has the risk of SQL injection attack. The ratio threshold value range is [0.5,1].

[0022] Since each monitoring point will obtain the corresponding high-level settlement when it is used as the current monitoring point and the high-level settlement status of the monitoring point will not be changed by subsequent data, there is no logical contradiction between the proportion of the number of monitoring points that have high-level settlements within the monitoring period TL and the percentile value of all risk settlement values ​​within the monitoring period TL.

[0023] The calculation of the risk settlement value is obtained by processing the risk analysis sequence corresponding to the current monitoring point, so the risk of insufficient SQL input escape or filtering caused by the policy decentralization formed by the server's concession to the response speed is effectively quantified. However, the acquisition of the risk analysis sequence is too dependent on the second increment sequence, which will lead to the problem of excessive sensitivity in the risk analysis sequence analysis process, resulting in decision deviation, especially in the period when the delayed increment sequence value calculated by the first increment sequence and the second increment sequence has a large volatility. This problem is more prominent. However, the existing technology cannot effectively compensate for this phenomenon of excessive sensitivity. In order to eliminate this influence, the present invention proposes a more preferred solution as follows:

[0024] Furthermore, the method for real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is: set a time period as a monitoring period PCEK, PCEK∈[0.1,24] hours; record all cache read and write feature groups within the monitoring period as the first feature group sequence, where the cache read and write feature group includes an excessively long access volume Lbsa and a high delay level Hlie;

[0025] A scatter plot of the first feature group sequence is drawn on the two-dimensional xoy plane, where the horizontal axis of the scatter plot is the super-long access volume, and the vertical axis is the high delay level. The average value of all super-long access volumes in the monitoring period is the first benchmark access volume FS_bsa, and the maximum value is the second benchmark access volume Sc_bsa. The median value of all high delay levels is the first benchmark delay level FS_lie, and the maximum value is the second benchmark delay level Sc_lie. Four dividing lines are constructed, namely x=FS_bsa, x=Sc_bsa, y=FS_lie and y=Sc_lie, and the first quadrant of the plane is divided into four closed areas, where the closed areas do not contain dividing lines. The closed area closest to the origin is the double low risk domain. Starting from any point in the double low risk domain, the three closed areas passed in a clockwise direction are recorded as the high access risk domain, the double high risk domain, and the high response risk domain; the number of points in the double high risk domain is recorded as the first outlier number FDp, and the first cutting number is obtained. Where sqrt is the symbol of the square root function, is the rounding down symbol, that is, the square root of the first outlier number is multiplied by 0.5 and the value obtained by rounding down is the first cutting number; the horizontal axis and vertical axis of each closed area are divided into Fslip segments at equal intervals and cut to form a grid. For each closed area, the ratio of the number of isolated points in the grid formed by cutting in the area to the total number of points in the closed area is recorded as the attack risk weight Atrwe; an isolated point refers to a data point that is defined as an isolated point when the grid where any data point is located has only this data point;

[0026] The attack risk weight is based on the characteristic that outliers with high alienation from the data group can be isolated with fewer segmentation times, so it can effectively identify abnormal monitoring moments under extreme fluctuation conditions, and promote the probability of predicting irregular changes in the next monitoring moment, thereby identifying abnormal monitoring moments or corresponding data points where attackers execute SQL commands with higher permissions or malicious SQL statement features, and improving the prediction accuracy and hit rate of future monitoring attack risk probability;

[0027] The average and standard deviation of the super-long access volume of all isolated points in the high access risk domain and the double high risk domain are respectively the third benchmark access volume TH_bsa and the first fluctuation level FS_flu, and the injection acceptance interval of the super-long access volume is [0, TH_bsa+FS_flu]; the median and standard deviation of the high delay level of all isolated points in the high response risk domain and the double high risk domain are the third benchmark delay level TH_lie and the second fluctuation level SC_flu, and the injection acceptance interval of the high delay level is [0, TH_lie+SC_flu];

[0028] The calculation principle of the injection acceptance interval is to use the abnormal cache read and write feature group data for sample training, extract the unique feature information of the abnormal value and provide a reference for the reasonable dynamic range of the monitoring period. Then, in the monitoring stage, the new cache read and write feature group data can be input to directly determine the injection attack risk, thereby improving the judgment speed and efficiency.

[0029] After obtaining the read and write characteristics of the buffer area at the current moment, locate the attack risk weight of the closed area to which it belongs, and calculate the attack judgment probability Atdep at the current moment: Atdep = sigmod (Atrwe × Lbsa × Hlie); where sigmoid() is the activation function, defined as: The output range is between 0 and 1;

[0030] If the attack judgment probability at the current moment is greater than the preset probability or the values ​​of the excessively long access volume and the high latency level do not fall within the injection acceptance interval, then it is determined that the SQL injection attack risk occurs, and the preset probability value range is [0.3,1].

[0031] Beneficial effects: Since the attack judgment probability is obtained by timing analysis based on the read and write characteristics of the cache area, and the query processing complexity increased by SQL injection requires the database to perform more table connections, data filtering or sorting operations, which significantly prolongs the execution time. At the same time, the essential difference between normal requests and SQL injection attacks lies in the data flow pattern, which can be reflected in the injection attacks executed by automated scripts. There are high-frequency, large-scale and irregular database accesses. These requests bring abnormal read and write frequencies of the database or cache layer in a short period of time. Therefore, the read and write characteristics of the cache area constructed by the response time can effectively identify the risk of SQL injection attacks occurring in the security policy decentralization scenario triggered by high-frequency transactions, thereby reducing the risk of SQL injection attacks tampering with or stealing financial data, and providing data security and network security for financial transaction systems.

[0032] Furthermore, when the SQL injection attack risk occurs, the method of stopping the security policy decentralization behavior and sending a warning message is: when the SQL injection attack risk is identified, the security policy decentralization behavior being executed by all servers is stopped, and a SQL injection attack risk warning is sent to the administrator client.

[0033] Preferably, all undefined variables in the present invention, if not clearly defined, can be manually set thresholds.

[0034] The present invention also provides a financial data processing system, the financial data processing system comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, the processor implementing the steps in the financial data processing method when executing the computer program, the financial data processing system can be run in computing devices such as desktop computers, notebook computers, PDAs, and cloud data centers, and the executable system may include, but is not limited to, a processor, a memory, and a server cluster, and the processor executes the computer program to run in the following system units:

[0035] Obtain a server load monitoring unit for obtaining server load status;

[0036] The security policy decentralization unit is used to trigger the security policy decentralization of the database when the load status meets the high-frequency trading conditions;

[0037] The injection attack risk identification unit is used to monitor the cache database query delay in real time after the security policy is decentralized and identify whether the SQL injection attack risk occurs;

[0038] The security policy decentralization termination unit is used to stop the security policy decentralization behavior and send warning information when the risk of SQL injection attack occurs.

[0039] The beneficial effects of the present invention are as follows: the present invention provides a financial data processing method and system, which performs timing analysis based on the read and write characteristics of the cache area through attack judgment probability, constructs the read and write characteristics of the cache area for effectively identifying the risk of SQL injection attacks occurring in security policy decentralization scenarios triggered by high-frequency transactions, thereby reducing the risk of SQL injection attacks tampering with or stealing financial data, and providing data security and network security warnings for financial transaction systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features of the present invention will become more obvious by describing in detail the embodiments shown in the accompanying drawings. The same reference numerals in the accompanying drawings of the present invention represent the same or similar elements. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work. In the accompanying drawings:

[0041] Figure 1 Shown is a flow chart of a financial data processing method;

[0042] Figure 2 Shown is a structural diagram of a financial data processing system. DETAILED DESCRIPTION

[0043] The following will be combined with the embodiments and drawings to clearly and completely describe the concept, specific structure and technical effects of the present invention, so as to fully understand the purpose, scheme and effect of the present invention. It should be noted that the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0044] like Figure 1 The flowchart of a financial data processing method is shown below. Figure 1 A financial data processing method according to an embodiment of the present invention is described below. The method comprises the following steps:

[0045] Get server load status;

[0046] When the load status meets the high-frequency trading conditions, the security policy is triggered to be decentralized to the database;

[0047] After the security policy is decentralized, the cache database query delay is monitored in real time to identify whether the SQL injection attack risk occurs;

[0048] When the risk of SQL injection attack occurs, the security policy decentralization behavior is stopped and an early warning message is sent;

[0049] Furthermore, the method for obtaining the server load status is: the server load status is composed of server indicators, and the server indicators include one or more real-time values ​​of CPU utilization, cache hit rate, network bandwidth and TCP connection number. The various server indicators obtained in real time in the server at any moment constitute the server load status corresponding to that moment.

[0050] Among them, CPU utilization directly reflects the load of the server when processing computing-intensive tasks. In high-frequency trading, a large number of trading orders and complex algorithms need to be processed quickly. High CPU utilization will reduce the transaction response speed. It is the most authoritative explanation of server stability. However, even if the CPU utilization is low in a high-frequency trading environment, memory or I / O bottlenecks may also cause delays, so it cannot be used as the only load status standard.

[0051] Since the cache hit rate requires the system to quickly read information from the cache and reduce the latency of accessing storage when the transaction data is real-time, the cache hit rate will drop significantly when the transaction volume is intensive. Therefore, the cache hit rate is an important component of high-frequency trading conditions.

[0052] In addition, network bandwidth is the premise for judging other indicators. Network bandwidth determines the server's ability to process and transmit transaction data. The number of TCP connections reflects the concurrent transaction connections, thereby monitoring whether the concurrency of the transaction system exceeds the preset service pressure of the server.

[0053] Furthermore, when the load status meets the high-frequency trading conditions, the method of triggering the security policy decentralization to the database is:

[0054] The server load status includes several server indicators;

[0055] Any server indicator has a preset corresponding indicator threshold. When any server indicator in the server load status exceeds its indicator threshold, the load status is determined to meet the high-frequency trading conditions, and the security policy is triggered to be decentralized to the database, thereby relaxing the database read and write permissions and reducing the server load;

[0056] The decentralization of security policies includes, but is not limited to, dynamically adjusting access rights restrictions or establishing hash values ​​for caching sensitive data.

[0057] Adjustment of access rights refers to temporarily increasing access rights for low-risk operations (such as read-only query, reading and writing notes) to reduce delays caused by permission verification. Alternatively, the hierarchical relative permission method can be used. Hierarchical relative permissions refer to gradually relaxing permissions according to relative permission levels, allowing operations with relatively low permissions to be executed, while operations with high relative levels are delayed or temporarily disabled. Adjustment of access rights can induce the weakening of fine-grained permission control. This is because account permissions in financial transactions usually need to be strictly controlled at the operation level, such as only being able to view or trade specified assets. Temporarily skipping fine-grained permission control by adjusting permissions can allow attackers to access or modify unauthorized data through SQL injection. Especially in complex multi-level permission systems, temporary adjustment of permissions is more likely to cause control gaps.

[0058] Establishing hash values ​​for cached sensitive data means reducing the frequency of direct access to the database by building cache hashes for frequently verified sensitive data, including database user passwords and sensitive API keys, thereby reducing the query pressure on the system. Establishing hash values ​​for cached sensitive data increases the system's reliance on cache layer security, and cached data makes it easier to bypass the verification mechanism to obtain sensitive data, allowing attackers to tamper with transaction instructions or hijack customer data through SQL injection attacks.

[0059] Furthermore, the method for real-time monitoring of cache database query latency and identifying whether the SQL injection attack risk occurs is: obtaining cache read and write characteristics every 30 seconds; cache read and write characteristics include: excessively long access volume and high latency level;

[0060] The excessively long access volume refers to the number of cache-related data records whose response speed exceeds the preset threshold, and the high latency level refers to the average response speed of each cache-related data record that exceeds the preset threshold; cache-related data records refer to any data records involved in cache mechanism processing.

[0061] The data records include transaction order data, transaction execution data and user position data, and in their specific presentation form, they belong to server requests involving transaction data. These server requests include transaction price, transaction quantity, transaction pair, trigger condition, order direction, user ID or account information, timestamp and order type.

[0062] Furthermore, the method for real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is: set a time period as a monitoring period TL, with a value of 5 hours, and within the monitoring period, record the time scale of obtaining the cache read and write characteristics as a monitoring point; if a monitoring point has a larger number of over-long accesses than the previous monitoring point and the over-long accesses of the previous monitoring point are not zero, then define the monitoring point as the first cache increment;

[0063] Obtain the cache read and write characteristics of all first cache increments and write the sequence as the first increment sequence; if the high delay level of a monitoring point is greater than the minimum high delay level of all first cache increments in the monitoring period TL, and the monitoring point is not the first cache increment, then define the monitoring point as the second cache increment; obtain the cache read and write characteristics of the second cache increment and write the sequence as the second increment sequence;

[0064] Divide the variance of the high delay level corresponding to all elements in the first bit-increasing sequence by the variance of the high delay level corresponding to all elements in the second bit-increasing sequence, and record the obtained ratio as the delay increment level value Bivu;

[0065] The Mahalanobis distance between the read-write characteristics of the cache area of ​​the current monitoring point and the read-write characteristics of the cache area of ​​each other monitoring point is calculated and recorded as the risk effectiveness value MhD; in the first increasing sequence and the second increasing sequence, all monitoring points whose risk effectiveness values ​​are greater than the upper quartile of the risk effectiveness value in the corresponding sequence are screened out respectively, and the sequence formed by all the screened monitoring points is recorded as the risk analysis sequence; the risk settlement value Rsst is calculated according to the risk analysis sequence: Rsst = exp(Bivu) × (hs<An.LS> -min.MhD)÷min.MhD; where i1 is the cumulative variable, hs<> is the harmonic mean function, exp() is the exponential function with the natural constant e as the base, An.LS is the sequence composed of the risk efficacy values ​​in the risk analysis sequence, and min.MhD is the minimum value of the risk efficacy values ​​corresponding to all elements in the risk analysis sequence;

[0066] Get the percentile value of the risk settlement value obtained at the current monitoring point among all risk settlement values ​​in the monitoring period TL. If the percentile value is greater than 0.8, it is judged that high settlement occurs at the current moment. The proportion of the number of monitoring points that have high settlement in the monitoring period TL is recorded as the high settlement ratio. When the high settlement ratio exceeds the preset ratio threshold, the current monitoring point has the risk of SQL injection attack. The ratio threshold value range is 0.85.

[0067] Since each monitoring point will obtain the corresponding high-level settlement when it is used as the current monitoring point and the high-level settlement status of the monitoring point will not be changed by subsequent data, there is no logical contradiction between the proportion of the number of monitoring points that have high-level settlements within the monitoring period TL and the percentile value of all risk settlement values ​​within the monitoring period TL.

[0068] Further, the method for real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is: set a time period as a monitoring period PCEK, and PCEK takes a value of 5 hours; record all cache read and write feature groups within the monitoring period as the first feature group sequence, wherein the cache read and write feature group includes an excessively long access volume Lbsa and a high delay level Hlie;

[0069] A scatter plot of the first feature group sequence is drawn on the two-dimensional xoy plane, where the horizontal axis of the scatter plot is the super-long access volume, and the vertical axis is the high delay level. The average value of all super-long access volumes in the monitoring period is the first benchmark access volume FS_bsa, and the maximum value is the second benchmark access volume Sc_bsa. The median value of all high delay levels is the first benchmark delay level FS_lie, and the maximum value is the second benchmark delay level Sc_lie. Four dividing lines are constructed, namely x=FS_bsa, x=Sc_bsa, y=FS_lie and y=Sc_lie, and the first quadrant of the plane is divided into four closed areas, where the closed areas do not contain dividing lines. The closed area closest to the origin is the double low risk domain. Starting from any point in the double low risk domain, the three closed areas passed in a clockwise direction are recorded as the high access risk domain, the double high risk domain, and the high response risk domain; the number of points in the double high risk domain is recorded as the first outlier number FDp, and the first cutting number is obtained. Where sqrt is the symbol of the square root function, is the rounding down symbol, that is, the square root of the first outlier number is multiplied by 0.5 and the value obtained by rounding down is the first cutting number; the horizontal axis and vertical axis of each closed area are divided into Fslip segments at equal intervals and cut to form a grid. For each closed area, the ratio of the number of isolated points in the grid formed by cutting in the area to the total number of points in the closed area is recorded as the attack risk weight Atrwe; an isolated point refers to a data point that is defined as an isolated point when the grid where any data point is located has only this data point;

[0070] The average and standard deviation of the super-long access volume of all isolated points in the high access risk domain and the double high risk domain are respectively the third benchmark access volume TH_bsa and the first fluctuation level FS_flu, and the injection acceptance interval of the super-long access volume is [0, TH_bsa+FS_flu]; the median and standard deviation of the high delay level of all isolated points in the high response risk domain and the double high risk domain are the third benchmark delay level TH_lie and the second fluctuation level SC_flu, and the injection acceptance interval of the high delay level is [0, TH_lie+SC_flu];

[0071] After obtaining the read and write characteristics of the buffer area at the current moment, locate the attack risk weight of the closed area to which it belongs, and calculate the attack judgment probability Atdep at the current moment: Atdep = sigmod (Atrwe × Lbsa × Hlie); where sigmoid() is the activation function, defined as: The output range is between 0 and 1;

[0072] If the attack judgment probability at the current moment is greater than the preset probability or the values ​​of the ultra-long access volume and the high latency level do not fall within the injection acceptance interval, it is determined that the SQL injection attack risk occurs, and the preset probability value is 0.8.

[0073] Furthermore, when the SQL injection attack risk occurs, the method of stopping the security policy decentralization behavior and sending a warning message is: when the SQL injection attack risk is identified, the security policy decentralization behavior being executed by all servers is stopped, and a SQL injection attack risk warning is sent to the administrator client.

[0074] An embodiment of the present invention provides a financial data processing system, such as Figure 2 The figure shows a structure diagram of a financial data processing system of the present invention. A financial data processing system of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned financial data processing method embodiment are implemented.

[0075] The system comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to run in the following units of the system:

[0076] Obtain a server load monitoring unit for obtaining server load status;

[0077] The security policy decentralization unit is used to trigger the security policy decentralization of the database when the load status meets the high-frequency trading conditions;

[0078] The injection attack risk identification unit is used to monitor the cache database query delay in real time after the security policy is decentralized and identify whether the SQL injection attack risk occurs;

[0079] The security policy decentralization termination unit is used to stop the security policy decentralization behavior and send warning information when the risk of SQL injection attack occurs.

[0080] The financial data processing system can be run in computing devices such as desktop computers, laptop computers, PDAs, and cloud servers. The financial data processing system can include, but is not limited to, processors and memories. Those skilled in the art will appreciate that the example is only an example of a financial data processing system and does not constitute a limitation on a financial data processing system. The system can include more or fewer components than the example, or combine certain components, or different components. For example, the financial data processing system can also include input and output devices, network access devices, buses, etc.

[0081] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the operating system of the financial data processing system, and uses various interfaces and lines to connect various parts of the entire operating system of the financial data processing system.

[0082] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the financial data processing system by running or executing the computer program and / or module stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0083] Although the description of the present invention has been quite detailed and has been described in particular with respect to several described embodiments, it is not intended to be limited to any of these details or embodiments or any particular embodiment, so as to effectively cover the intended scope of the present invention. In addition, the present invention is described above with the embodiments foreseeable by the inventors, and its purpose is to provide a useful description, and those non-substantial changes to the present invention that are not currently foreseen may still represent equivalent changes of the present invention.

Claims

1. A financial data processing method, characterized in that: The method comprises the following steps: Obtain the server load status; when the load status meets the high-frequency trading conditions, trigger the security policy decentralization to the database; after the security policy decentralization begins, monitor the cache database query delay in real time and identify whether the SQL injection attack risk occurs; when the SQL injection attack risk occurs, stop the security policy decentralization behavior and send an early warning message; The method for real-time monitoring of cache database query latency and identifying whether SQL injection attack risks occur is: obtaining cache read and write characteristics every 1 to 60 seconds; cache read and write characteristics include: excessively long access volume and high latency level; The number of extremely long visits is the number of cache-related data records whose response speed exceeds the preset threshold. The high latency level is the average response speed of each cache-related data record that exceeds the preset threshold. Cache-related data records refer to any data records involved in cache mechanism processing. The risk of SQL injection attacks is identified based on the read and write characteristics of the cache area.

2. A financial data processing method according to claim 1, characterized in that: The method for obtaining the server load status is: the server load status is composed of server indicators, which include one or more real-time values ​​of CPU usage, cache hit rate, network bandwidth and number of TCP connections. The various server indicators obtained in real time in the server at any moment constitute the server load status corresponding to that moment.

3. A financial data processing method according to claim 1, characterized in that: When the load status meets the high-frequency trading conditions, the method of triggering the security policy decentralization of the database is: any server indicator is preset with a corresponding indicator threshold. When any server indicator in the server load status exceeds its indicator threshold, it is determined that the load status meets the high-frequency trading conditions, and the security policy decentralization is triggered for the database, thereby relaxing the database read and write permissions and reducing the server load; The decentralization of security policies includes, but is not limited to, dynamically adjusting access rights restrictions or establishing hash values ​​for caching sensitive data.

4. A financial data processing method according to claim 1, characterized in that: The method for real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is as follows: set a time period as the monitoring period TL, TL∈[0.1,24] hours, and within the monitoring period, record the time scale of obtaining the cache read and write characteristics as the monitoring point; if a monitoring point has a larger number of over-long accesses than the previous monitoring point and the over-long accesses of the previous monitoring point are not zero, then define the monitoring point as the first cache increment; Obtain the cache read and write characteristics of all first cache increments and write the sequence as the first increment sequence; if the high delay level of a monitoring point is greater than the minimum high delay level of all first cache increments in the monitoring period TL, and the monitoring point is not the first cache increment, then define the monitoring point as the second cache increment; obtain the cache read and write characteristics of the second cache increment and write the sequence as the second increment sequence; Divide the variance of the high delay level corresponding to all elements in the first bit-increasing sequence by the variance of the high delay level corresponding to all elements in the second bit-increasing sequence, and record the obtained ratio as the delay increment level value Bivu; The Mahalanobis distance between the read-write characteristics of the cache area of ​​the current monitoring point and the read-write characteristics of the cache area of ​​each other monitoring point is calculated and recorded as the risk effectiveness value MhD; in the first increasing sequence and the second increasing sequence, all monitoring points whose risk effectiveness values ​​are greater than the upper quartile of the risk effectiveness value in the corresponding sequence are screened out respectively, and the sequence formed by all the screened monitoring points is recorded as the risk analysis sequence; the risk settlement value Rsst is calculated according to the risk analysis sequence: Rsst = exp(Bivu) × (hs<An.LS> -min.MhD)÷min.MhD; Where i1 is the cumulative variable, hs<> is the harmonic mean function, exp() is the exponential function with the natural constant e as the base, An.LS is the sequence composed of the risk efficacy values ​​in the risk analysis sequence, and min.MhD is the minimum value of the risk efficacy values ​​corresponding to all elements in the risk analysis sequence; Get the percentile value of the risk settlement value obtained at the current monitoring point among all risk settlement values ​​in the monitoring period TL. If the percentile value is greater than 0.8, it is judged that high settlement occurs at the current moment. The proportion of the number of monitoring points that have high settlement in the monitoring period TL is recorded as the high settlement ratio. When the high settlement ratio exceeds the preset ratio threshold, the current monitoring point has the risk of SQL injection attack. The ratio threshold value range is [0.5, 1].

5. A financial data processing method according to claim 1, characterized in that: The method of real-time monitoring of cache database query delay and identifying whether the SQL injection attack risk occurs is as follows: set a time period as a monitoring period PCEK, PCEK∈[0.1,24] hours; record all cache read and write feature groups within the monitoring period as the first feature group sequence, and the cache read and write feature group includes an excessively long access volume Lbsa and a high latency level Hlie; Draw a scatter plot of the first feature group sequence on the two-dimensional xoy plane, and record the average value of all super-long accesses during the monitoring period as the first benchmark access FS_bsa, the maximum value as the second benchmark access Sc_bsa, the median value of all high delay levels as the first benchmark delay level FS_lie, and the maximum value as the second benchmark delay level Sc_lie. Construct four dividing lines, namely x=FS_bsa, x=Sc_bsa, y=FS_lie and y=Sc_lie, and divide the first quadrant of the plane into 4 closed areas. The closed area closest to the origin is the double low risk domain. Starting from any point in the double low risk domain, the three closed areas passed in a clockwise direction are recorded as the high access risk domain, the double high risk domain, and the high response risk domain; record the number of points in the double high risk domain as the first outlier number FDp, and obtain the first cutting number The horizontal and vertical axes of each closed area are divided into Fslip segments at equal intervals and cut to form a grid. For each closed area, the ratio of the number of isolated points in the grid formed by cutting in the area to the total number of points in the closed area is recorded as the attack risk weight Atrwe; The average and standard deviation of the super-long access volume of all isolated points in the high access risk domain and the double high risk domain are respectively the third benchmark access volume TH_bsa and the first fluctuation level FS_flu, and the injection acceptance interval of the super-long access volume is [0, TH_bsa+FS_flu]; the median and standard deviation of the high delay level of all isolated points in the high response risk domain and the double high risk domain are the third benchmark delay level TH_lie and the second fluctuation level SC_flu, and the injection acceptance interval of the high delay level is [0, TH_lie+SC_flu]; After obtaining the read and write characteristics of the cache area at the current moment, locate the attack risk weight of the closed area to which it belongs and calculate the attack judgment probability Atdep at the current moment; if the attack judgment probability at the current moment is greater than the preset probability or the values ​​of the ultra-long access volume and the high latency level do not fall within the injection acceptance interval, it is determined that the SQL injection attack risk occurs, and the preset probability value range is [0.5,1].

6. A financial data processing method according to claim 1, characterized in that: The method of stopping the security policy decentralization behavior and sending a warning message when the SQL injection attack risk occurs is: when the SQL injection attack risk is identified, the security policy decentralization behavior being executed by all servers is stopped, and a SQL injection attack risk warning is sent to the administrator client.

7. A financial data processing system, characterized in that: The financial data processing system includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of a financial data processing method described in any one of claims 1 to 6 are implemented. The financial data processing system runs on a desktop computer, a laptop computer, a PDA, and a computing device in a cloud data center.

Images