Database abnormal behavior detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a database abnormal behavior detection method and device, electronic equipment and a storage medium, and relates to the technical field of database security analysis, the method comprises the following steps: obtaining an operation log of a target database, and generating an operation embedding feature based on an operation record of the operation log; generating an operation feature sequence based on a recording sequence of operation records corresponding to the operation embedding features; processing the operation feature sequence according to an attention model to obtain a semantic feature sequence after intention weight adjustment; and determining an abnormal semantic proportion in the semantic feature sequence based on the abnormal behavior detection model, and generating an abnormal behavior detection result of the target database based on the abnormal semantic proportion. According to the embodiment of the invention, the operation feature sequence is generated based on the record sequence, the attention model is utilized to focus on the important features of the operation feature sequence, the recognition precision of the abnormal behaviors is improved, and the false alarm rate and the missing report rate are reduced by calculating the abnormal semantic proportion and accurately quantifying the proportion of the abnormal behaviors.

Description

Technical Field

[0001] The present invention relates to the technical field of database security analysis, and in particular to a method, device, electronic device and storage medium for detecting abnormal behavior of a database. Background Art

[0002] In recent years, in order to ensure the confidentiality and integrity of database systems, database systems are protected by various peripheral defenses. However, database systems still face dual threats from accidental erroneous operations or deliberate attacks by attackers, which may lead to data tampering or data leakage. Traditional database abnormal behavior detection methods mainly focus on identifying known attacks or known abnormal data accesses with significant deviations in database behavior. When abnormal data access behavior becomes hidden, for example, when attackers adopt intermittent strategies or only initiate a small number of database operations that make minor changes to confidential data, the effectiveness of traditional methods will be greatly reduced. However, such highly hidden abnormal data access is common in real-world database systems, posing a security risk that cannot be ignored. Therefore, improving the accuracy of abnormal behavior recognition, reducing the false alarm rate and missed alarm rate of abnormal behavior detection, and improving detection efficiency have become urgent issues to be solved in the field of database security analysis technology. Summary of the invention

[0003] The present invention provides a method, device, electronic device and storage medium for detecting abnormal behavior in a database, which improves the recognition accuracy of abnormal behavior, reduces the false alarm rate and missed alarm rate of abnormal behavior detection, and improves the detection efficiency of abnormal behavior.

[0004] In one aspect of an embodiment of the present invention, a method for detecting abnormal behavior of a database is provided, comprising:

[0005] Obtain the operation log of the target database, and generate operation embedding features based on the operation records in the operation log;

[0006] Generate an operation feature sequence based on the record order of the operation records corresponding to the operation embedded features;

[0007] Process the operation feature sequence according to the attention model to obtain the semantic feature sequence adjusted by the intention weight;

[0008] The abnormal behavior detection model is used to determine the abnormal semantic ratio in the semantic feature sequence, and the abnormal behavior detection result of the target database is generated based on the abnormal semantic ratio.

[0009] Another aspect of an embodiment of the present invention provides a database abnormal behavior detection device, including:

[0010] A feature extraction module is used to obtain the operation log of the target database and generate operation embedding features based on the operation records of the operation log;

[0011] A feature sequence module, used for generating an operation feature sequence based on a record order of operation records corresponding to the operation embedded features;

[0012] The intention processing module is used to process the operation feature sequence according to the attention model to obtain the semantic feature sequence adjusted by the intention weight;

[0013] The anomaly detection module is used to determine the abnormal semantic proportion in the semantic feature sequence based on the abnormal behavior detection model, and generate the abnormal behavior detection result of the target database based on the abnormal semantic proportion.

[0014] Another aspect of an embodiment of the present invention provides an electronic device, including:

[0015] at least one processor;

[0016] and a memory communicatively coupled to the at least one processor;

[0017] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute any one of the database abnormal behavior detection methods in the embodiments of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the database abnormal behavior detection method of any embodiment of the present invention when executed.

[0019] In an embodiment of the present invention, a target database is selected, an operation log containing all data operations in the target database is extracted from the target database, an operation record containing detailed information of a single data operation in the target database is extracted from the operation log, each operation record is processed to obtain an operation embedded feature, a record order of each operation record in the operation log is obtained, the operation embedded features are sorted according to the record order of the operation records, the sorted operation embedded features are used as an operation feature sequence, the operation feature sequence is input into an attention model, the attention model can set different intention weights for different positions of the operation feature sequence according to the importance of information at different positions of the operation feature sequence, the intention weights and the operation feature sequence are weighted to obtain a semantic feature sequence, the semantic feature sequence is input into an abnormal behavior detection model, the abnormal behavior detection model processes and analyzes the semantic feature sequence to obtain an abnormal semantic ratio, a preset threshold can be obtained, and based on the abnormal semantic ratio, the abnormal behavior detection model compares the abnormal semantic ratio with the preset threshold to obtain an abnormal behavior detection result. In the embodiment of the present invention, the embodiment of the present invention generates an operation feature sequence based on the record order of the operation records, so that the context relevance of the operation feature sequence is enhanced, and the accuracy of abnormal behavior detection is improved. By using the attention model to focus on the key features in the operation feature sequence to generate a semantic feature sequence, the sensitivity of the abnormal behavior detection model to data fluctuations is reduced, thereby enhancing the recognition accuracy of the abnormal behavior detection model for abnormal behavior. By calculating the proportion of abnormal semantics in the semantic feature sequence, the proportion of abnormal behavior in the semantic feature sequence is accurately quantified, so that the false alarm rate and missed alarm rate of abnormal behavior are reduced, thereby improving the detection efficiency of the abnormal behavior detection model.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 This is a flow chart of a method for detecting abnormal behavior of a database provided according to the first embodiment of the present invention;

[0023] Figure 2 is a flow chart of another method for detecting abnormal behavior of a database provided according to the second embodiment of the present invention;

[0024] Figure 3 is a flow chart of another method for detecting abnormal behavior of a database provided in the second embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of a device for implementing a database abnormal behavior detection method provided by an embodiment of the present invention;

[0026] Figure 5 It is a structural schematic diagram of an electronic device for implementing the database abnormal behavior detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 A flow chart of a method for detecting abnormal behavior of a database is provided for an embodiment of the present invention. This embodiment is applicable to the case of detecting potential abnormal behavior in a database. The method can be performed by database abnormal behavior detection. The database abnormal behavior detection device can be implemented in the form of hardware and / or software. The database abnormal behavior detection device can be configured in an electronic device.

[0031] like Figure 1 As shown, the method includes:

[0032] S101. Obtain an operation log of a target database, and generate an operation embedding feature based on the operation record of the operation log.

[0033] In the embodiment of the present invention, the target database refers to a database instance that needs to perform abnormal behavior detection. For example, the type of the database instance may include: a relational database instance or a non-relational database instance.

[0034] The operation log can be understood as a document used to record all data operations in the target database. For example, the types of data operations recorded in the operation log may include: insert operation type, update operation type, delete operation type or query operation type, etc.

[0035] An operation record can be understood as a specific entry in an operation log, which contains detailed information of a single data operation in a target database. For example, an operation record may include: an operation object of a data operation or a timestamp of the data operation.

[0036] The operation embedding feature can be understood as a combination vector, where each vector represents an operation record in the database operation log.

[0037] Specifically, a target database is selected, and an operation log containing all data operations in the target database is extracted from the target database. In the operation log, operation records containing detailed information of a single data operation in the target database are extracted, and each operation record extracted from the operation log is processed to obtain operation embedded features.

[0038] For example, the step of processing each operation record to obtain an operation embedding feature may include: encoding each operation record to obtain a vector corresponding to each operation record, combining each vector to obtain a combined vector corresponding to all operation records, and defining the combined vector as an operation embedding feature.

[0039] S102: Generate an operation feature sequence based on the record order of the operation records corresponding to the operation embedded features.

[0040] In the embodiment of the present invention, the record sequence can be understood as a position order, which reflects the order in which the operation records appear in the operation log.

[0041] The operation feature sequence refers to a sequence of operation embedding features arranged in the order of records. The generation of the operation feature sequence enables the attention model to perform abnormal behavior detection tasks by utilizing the sequential relationship of operation records.

[0042] Specifically, in the operation log of the target database, the position order of each operation record in the operation log is obtained, and the position order is used as the record order of the operation records. The operation embedded features are sorted according to the record order of the operation records, and the sorted operation embedded features are used as the operation feature sequence.

[0043] S103. Process the operation feature sequence according to the attention model to obtain a semantic feature sequence adjusted by the intention weight.

[0044] In an embodiment of the present invention, the attention model can be understood as a machine learning model with an attention mechanism added. The attention model can dynamically focus on important parts of the input data to improve model performance. For example, the form of the attention mechanism may include: self-attention mechanism or multi-head attention mechanism, etc.

[0045] The intention weight can be understood as a numerical value that is used to measure the importance of information at different positions in the operation feature sequence.

[0046] A semantic feature sequence refers to a weighted operational feature sequence that focuses on features that play a key role in abnormal behavior detection and can improve the accuracy and efficiency of the abnormal behavior detection model in processing and understanding input data.

[0047] Specifically, an operation feature sequence generated based on the record order of operation records corresponding to the operation embedded features is input into the attention model. The attention model can set different intention weights for different positions of the operation feature sequence according to the importance of information at different positions in the operation feature sequence, and weight the intention weights and the operation feature sequence to obtain a weighted operation feature sequence, and use the weighted operation feature sequence as a semantic feature sequence.

[0048] S104: determining the abnormal semantic proportion in the semantic feature sequence based on the abnormal behavior detection model, and generating an abnormal behavior detection result of the target database based on the abnormal semantic proportion.

[0049] In the embodiment of the present invention, the abnormal semantic ratio can be understood as a quantitative indicator, which reflects the proportion of abnormal semantic features in the semantic feature sequence.

[0050] The abnormal behavior detection result may be understood as a classification result. For example, the abnormal behavior detection result may include: the presence of an abnormality or the absence of an abnormality.

[0051] Specifically, a preset threshold can be obtained, and the preset threshold can be used to determine whether there is abnormal behavior in the target database. The semantic feature sequence is input into the abnormal behavior detection model, and the abnormal behavior detection model processes and analyzes the semantic feature sequence to obtain an abnormal semantic ratio that reflects the proportion of abnormal semantic features in the semantic feature sequence. Based on the abnormal semantic ratio, the abnormal behavior detection model can compare the abnormal semantic ratio with the preset threshold to obtain a comparison result, and use the comparison result as the abnormal behavior detection result. By way of example, the step of determining whether there is abnormal behavior in the target database based on the abnormal behavior detection result may include: comparing the abnormal semantic ratio with the preset threshold; if the abnormal behavior detection result is that the abnormal semantic ratio is greater than the preset threshold, then determining that there is no abnormal behavior in the target database.

[0052] In an embodiment of the present invention, a target database is selected, an operation log containing all data operations in the target database is extracted from the target database, an operation record containing detailed information of a single data operation in the target database is extracted from the operation log, each operation record is processed to obtain an operation embedded feature, a record order of each operation record in the operation log is obtained, the operation embedded features are sorted according to the record order of the operation records, the sorted operation embedded features are used as an operation feature sequence, the operation feature sequence is input into an attention model, the attention model can set different intention weights for different positions of the operation feature sequence according to the importance of information at different positions of the operation feature sequence, the intention weights and the operation feature sequence are weighted to obtain a semantic feature sequence, the semantic feature sequence is input into an abnormal behavior detection model, the abnormal behavior detection model processes and analyzes the semantic feature sequence to obtain an abnormal semantic ratio, a preset threshold can be obtained, and based on the abnormal semantic ratio, the abnormal behavior detection model compares the abnormal semantic ratio with the preset threshold to obtain an abnormal behavior detection result. In the embodiment of the present invention, the embodiment of the present invention generates an operation feature sequence based on the record order of the operation records, so that the context relevance of the operation feature sequence is enhanced, and the accuracy of abnormal behavior detection is improved. By using the attention model to focus on the key features in the operation feature sequence to generate a semantic feature sequence, the sensitivity of the abnormal behavior detection model to data fluctuations is reduced, thereby enhancing the recognition accuracy of the abnormal behavior detection model for abnormal behavior. By calculating the proportion of abnormal semantics in the semantic feature sequence, the proportion of abnormal behavior in the semantic feature sequence is accurately quantified, so that the false alarm rate and missed alarm rate of abnormal behavior are reduced, thereby improving the detection efficiency of the abnormal behavior detection model.

[0053] Embodiment 2

[0054] Figure 2This is a flow chart of another method for detecting abnormal behavior of a database provided by an embodiment of the present invention. Based on the above embodiment, the embodiment of the present invention provides another method for detecting abnormal behavior of a database. Figure 2 As shown, the method includes:

[0055] S201, extracting the operation log of the target database.

[0056] Specifically, a target database is selected, and an operation log containing all data operations in the target database is extracted from the target database. For example, a method for extracting the operation log from the target database may include: using a log viewing function provided by a database management system to obtain the operation log or using a log extraction plug-in to extract the operation log.

[0057] S202: Read the operation record of the specified window length in the operation log.

[0058] In the embodiment of the present invention, the window length can be understood as a reading range, and the reading range at least includes the number of operation records to be read when reading the operation log.

[0059] Specifically, the window length of the operation records to be read may be specified according to the detection service requirements, and the operation records of the specified window length may be read in the operation log according to the specified window length.

[0060] S203: Input each operation record into a word embedding vector generation model to obtain operation embedding features.

[0061] In the embodiment of the present invention, the word embedding vector generation model refers to an algorithm model used to convert text information in the operation record into a vector.

[0062] Specifically, a trained word embedding vector generation model is obtained, each operation record is input into the word embedding vector generation model, and the word embedding vector generation model processes each operation record to obtain an operation embedding feature.

[0063] For example, the step of processing each operation record by the word embedding vector generation model may include: the word embedding vector generation model reads the text information in the operation record, encodes the read text information, and generates a word embedding vector corresponding to the operation record.

[0064] S204: Determine the location information of the operation record corresponding to each operation embedding feature in the operation log.

[0065] In the embodiment of the present invention, the location information can be understood as a kind of identification information, and the identification information includes the specific location of the operation record corresponding to each operation embedding feature in the operation log.

[0066] Specifically, based on each generated operation embedded feature, corresponding operation records and the recording order of the operation records can be obtained in the operation log, and the position information of the operation embedded feature corresponding to each operation record can be determined based on the recording order of the operation records.

[0067] S205 , arranging the operation embedding features in sequence into an operation feature sequence according to the position information.

[0068] Specifically, in the operation log, determine the location information of each operation embedded feature, and based on the location information of each operation embedded feature, obtain the order in which each operation embedded feature appears in the operation log; sort each operation embedded feature based on the obtained order in which each operation embedded feature appears in the operation log, and use the sorted operation embedded features as an operation feature sequence.

[0069] S206: Generate a query vector, a key vector, and a value vector of the operation feature sequence.

[0070] In an embodiment of the present invention, a query vector refers to a vector generated by multiplying a feature vector at a current position in an operation feature sequence by a query weight matrix, and the query vector determines which elements in the operation feature sequence are related to the current element by matching the key vector of each element in the operation feature sequence, wherein a key vector refers to a vector generated by multiplying a feature vector at a current position in the operation feature sequence by a key weight matrix.

[0071] The value vector is generated by multiplying the feature vector of the current position in the operation feature sequence by a value weight matrix. The value vector is used in the attention mechanism to generate the final output.

[0072] Specifically, the query weight matrix, key weight matrix and value weight matrix are obtained, and the feature vector of the current position in the operation feature sequence is multiplied by the query weight matrix, key weight matrix and value weight matrix respectively to obtain the query vector, key vector and value vector of the operation feature sequence, wherein the query weight matrix, key weight matrix and value weight matrix can be obtained through neural network training.

[0073] S207 . Determine similarity scores of operation embedded features at different positions in the operation feature sequence based on the query vector and the key vector.

[0074] In the embodiment of the present invention, the similarity score can be understood as a quantitative value used to indicate the similarity between operation embedding features at different positions in the operation feature sequence.

[0075] Specifically, query vectors and key vectors of operation embedded features at different positions in the operation feature sequence are obtained, and similarity scores of operation embedded features at different positions are calculated based on a similarity calculation method. For example, the similarity calculation method may include: a dot product calculation method or a cosine similarity calculation method.

[0076] S208: Normalize each similarity score to obtain an intention weight.

[0077] In the embodiment of the present invention, normalization processing refers to a method of converting data from different magnitudes to the same magnitude. For example, the normalization processing method may include: a minimum-maximum normalization method or a Z-score normalization method.

[0078] Specifically, obtain each similarity score of the operation embedding feature, select a suitable normalization method according to the data characteristics and subsequent analysis requirements, normalize each similarity score, convert each similarity score of different magnitudes to the same magnitude, obtain normalized data with a unified dimension, and use the normalized data as the intention weight of the operation embedding feature.

[0079] S209: Inject each intention weight into the corresponding operation embedding feature in the operation feature sequence to obtain a semantic feature sequence.

[0080] Specifically, weighted operations can be performed on the calculated intention weights of the operation embedding features and the corresponding operation embedding features to obtain weighted operation embedding features, and the weighted operation embedding features can be used as semantic feature sequences.

[0081] S210 , inputting each semantic feature in the semantic feature sequence into an abnormal behavior detection model to obtain an abnormal probability of each semantic feature.

[0082] In the embodiment of the present invention, a semantic feature refers to a basic unit constituting a semantic feature sequence. A semantic feature has clear semantic information. For example, the semantic information contained in the semantic feature may include: a position sequence between operation records or an intention weight of an operation record.

[0083] The anomaly probability can be understood as a quantitative indicator, which is used to indicate the probability that the content represented by each semantic feature is judged as abnormal behavior by the abnormal behavior detection model.

[0084] Specifically, a semantic feature sequence is obtained, and the semantic features in the semantic feature sequence are input into the abnormal behavior detection model according to certain rules. The abnormal behavior detection model processes the input semantic features, calculates the probability of abnormal behavior of each semantic feature, obtains the calculation result, and uses the calculation result as the abnormal probability of each semantic feature.

[0085] S211, arranging the abnormal probabilities into an abnormal probability sequence according to their values, and extracting a threshold number of abnormal probabilities from the abnormal probability sequence as abnormal probabilities to be screened.

[0086] In the embodiment of the present invention, the abnormal probability sequence can be understood as an ordered set, which is obtained by sorting the abnormal probabilities of all semantic features according to the values ​​of the abnormal probabilities.

[0087] The threshold number can be understood as a pre-set parameter, which is used to indicate the number of abnormal probabilities that need to be extracted in the abnormal probability sequence. The abnormal probability to be screened refers to the abnormal probability extracted according to the threshold number in the abnormal probability sequence. By extracting the abnormal probability to be screened, the search scope of abnormal behavior can be further narrowed and the detection efficiency can be improved.

[0088] Specifically, a preset threshold number is obtained, the abnormal probability of each semantic feature is obtained, each abnormal probability is arranged based on the value of the abnormal probability to obtain an abnormal probability sequence, and the abnormal probabilities of the same number as the threshold number are extracted from the abnormal probability sequence, and these extracted abnormal probabilities are used as abnormal probabilities to be screened.

[0089] S212: Determine the number of abnormal probabilities whose abnormal probabilities to be screened are greater than the threshold probability, and take the ratio of the number of abnormal probabilities to the total number of abnormal probabilities to be screened as the abnormal semantic ratio.

[0090] In the embodiment of the present invention, the threshold probability can be understood as a preset value used to determine the number of abnormal probabilities in the abnormal probabilities to be screened.

[0091] The number of abnormal probabilities can be understood as a statistical indicator, reflecting the number of abnormal probabilities greater than the threshold probability among the abnormal probabilities to be screened.

[0092] Specifically, a threshold probability for determining the number of abnormal probabilities in the abnormal probabilities to be screened is obtained, the abnormal probability in each abnormal probability to be screened is compared with the threshold probability, the number of abnormal probabilities greater than the threshold probability is counted, the number of abnormal probabilities greater than the threshold probability is compared with the total number of abnormal probabilities in the abnormal probabilities to be screened, and the comparison result is used as the abnormal semantic proportion.

[0093] S213: When the abnormal semantic ratio is greater than the threshold ratio, determine that the abnormal behavior detection result is that an abnormality exists; otherwise, determine that the abnormal behavior detection result is that an abnormality does not exist.

[0094] In the embodiment of the present invention, the threshold ratio may be understood as a preset value used to determine whether the target database has abnormal behavior.

[0095] Specifically, the abnormal semantic proportion is compared with the threshold proportion to obtain a comparison result, and the comparison result is used as the abnormal behavior detection result. When the abnormal behavior detection result is that the abnormal semantic proportion is greater than the threshold proportion, the abnormal behavior detection result is determined to be that an abnormality exists; when the abnormal behavior detection result is that the abnormal semantic proportion is less than the threshold proportion, the abnormal behavior detection result is determined to be that no abnormality exists.

[0096] In an embodiment of the present invention, a target database is selected, and an operation log containing all data operations in the target database is extracted from the target database. According to the detection business requirements, a window length for reading operation records can be specified. According to the specified window length, operation records of the specified window length are read in the operation log, and a trained word embedding vector generation model is obtained. Each operation record is input into the word embedding vector generation model. The word embedding vector generation model processes each operation record to obtain an operation embedding feature. Based on the generated operation embedding features, corresponding operation records and the recording order of the operation records can be obtained in the operation log. According to the recording order of the operation records, the position information of the operation embedding feature corresponding to each operation record is determined. Based on each operation embedding feature, The position information of the embedded features is obtained, and the order in which each operation embedded feature appears in the operation log is obtained. The operation embedded features are sorted based on the order in which each operation embedded feature appears in the operation log, and the sorted operation embedded features are used as the operation feature sequence. The query weight matrix, key weight matrix and value weight matrix are obtained, and the feature vector of the current position in the operation feature sequence is multiplied by the query weight matrix, key weight matrix and value weight matrix respectively to obtain the query vector, key vector and value vector of the operation feature sequence. The similarity scores of the operation embedded features at different positions are calculated to obtain the similarity scores of each operation embedded feature, and each similarity score is normalized to convert each similarity score of different magnitudes to the same In terms of magnitude, the intention weight with a unified dimension is obtained. The intention weight of each operation embedding feature calculated can be weighted with the corresponding operation embedding feature to obtain the weighted operation embedding feature. The weighted operation embedding feature is used as a semantic feature sequence. The semantic features in the semantic feature sequence are input into the abnormal behavior detection model according to certain rules. The abnormal behavior detection model processes the input semantic features, calculates the abnormal probability of each semantic feature, obtains a preset threshold number, arranges each abnormal probability based on the value of the abnormal probability, obtains an abnormal probability sequence, extracts the same number of abnormal probabilities as the threshold number from the abnormal probability sequence, and uses these extracted abnormal probabilities as abnormal probabilities to be screened. , obtain a threshold probability for determining the number of abnormal probabilities in the abnormal probabilities to be screened, compare the abnormal probability in each abnormal probability to be screened with the threshold probability, count the number of abnormal probabilities greater than the threshold probability, compare the number of abnormal probabilities greater than the threshold probability with the total number of abnormal probabilities in the abnormal probabilities to be screened, use the comparison result as the abnormal semantic proportion, compare the abnormal semantic proportion with the threshold proportion, obtain a comparison result, use the comparison result as the abnormal behavior detection result, when the abnormal behavior detection result is that the abnormal semantic proportion is greater than the threshold proportion, then determine that the abnormal behavior detection result is that an abnormality exists, when the abnormal behavior detection result is that the abnormal semantic proportion is less than the threshold proportion, then determine that the abnormal behavior detection result is that no abnormality exists.In an embodiment of the present invention, operation records are read in an operation log by specifying an appropriate window length, thereby ensuring the reading efficiency of the operation records. Each operation embedded feature is arranged based on the position information corresponding to each operation embedded feature to form an operation feature sequence, so that the contextual relationship of each operation record is retained in each operation embedded feature. Abnormal behavior is detected based on the operation embedded features that retain the contextual relationship of each operation record, so that the abnormal behavior detection model can more accurately identify abnormal behavior. By calculating the similarity score of each operation embedded feature based on the query vector and key vector of the operation feature sequence, the correlation between each operation embedded feature can be accurately measured, so that the recognition accuracy of the abnormal behavior detection model is improved. The similarity score is normalized to obtain the intention weight, which can ensure that similarity scores of different magnitudes are compared under a unified scale, thereby more accurately reflecting the importance of different positions of each operation embedded feature, thereby improving the accuracy and reliability of abnormal behavior detection.

[0097] Furthermore, based on the above embodiments, in an embodiment of the present invention, similarity scores of operation embedded features at different positions in an operation feature sequence are determined based on a query vector and a key vector, including: determining inner product results of the query vector of the operation embedded feature with each key vector respectively; and calling a Sigmoid function to process the inner product result to obtain a similarity score.

[0098] In the embodiment of the present invention, the inner product result can be understood as an algebraic operation, which is used to represent the similarity between two vectors.

[0099] The Sigmoid function is an activation function used to convert the inner product result into a similarity score.

[0100] Specifically, the step of determining the similarity scores of operation embedded features at different positions in the operation feature sequence based on the query vector and the key vector at least includes: obtaining the query vector and the key vector of each operation embedded feature, respectively calculating the inner product of the query vector and the key vector of each operation embedded feature, and converting the inner product result into a similarity score using the Sigmoid function.

[0101] Based on the above embodiments, an embodiment of the present invention includes: an abnormal behavior detection model is generated based on Tripletloss loss function training.

[0102] Specifically, the abnormal behavior detection model is trained based on the Triplet loss function. After the abnormal behavior detection model is trained, an embedding space is generated. In this embedding space, normal operation features are close and abnormal operation features are far. When a new operation feature is input into the abnormal behavior detection model, the abnormal behavior detection model can determine whether it is an abnormal behavior by calculating the distance between it and the known operation feature in the embedding space.

[0103] Based on the above-mentioned embodiment, the embodiment of the present invention provides another method for detecting abnormal behavior of a database, such as Figure 3 As shown, the method includes: collecting and obtaining a normal training data set containing L normal user sessions, the training data set provides a data basis for subsequent anomaly detection, using a sliding window of size L to extract an operation embedding sequence from the training data set, generating a combined feature based on the specific position information of the operation embedding feature in the training data set, defining the combined feature as an operation feature sequence, the operation feature sequence contains the position information and related context information of the operation embedding feature, and comprehensively reflects the characteristics of the database operation, and using the operation feature sequence as the input of the Transformer model, and inputting it into the Transformer model, wherein the Transformer model can be understood as a deep learning model that is good at processing sequence data and capturing the long-term dependencies therein, and inside the Transformer model, the attention module is different in the operation feature sequence according to the importance of different positions in the operation feature sequence. Different attention weights are set for different positions. The attention weight distribution enables the Transformer model to focus on more critical information and ignore irrelevant or minor details. After the weights are adjusted, the corresponding semantic feature sequence is obtained. The abnormal behavior detection module in the Transformer model is used to process and analyze the semantic feature sequence again to obtain the probability sequence of abnormal statements in the semantic feature sequence. In order to more intuitively evaluate the degree of abnormality, the above probabilities are arranged in order of size. The ranking value of the abnormal semantics in the probability sequence is determined according to the position of the abnormal semantics in the semantic feature sequence. The ranking value is compared with the total number of left and right elements contained in the operation embedding feature series to obtain the proportion of abnormal semantics. The abnormal semantic proportion reflects the relative frequency of abnormal behavior in the overall database operation. The abnormal semantic proportion is compared with the preset probability threshold. When the abnormal semantic proportion is greater than the threshold proportion, it is determined that there is abnormal behavior in the training data set. The above method can efficiently and accurately detect abnormal behavior in the database and can timely discover potential database security issues.

[0104] Embodiment 3

[0105] Figure 4 The following is a schematic diagram of the structure of a database abnormal behavior detection device provided by an embodiment of the present invention. Figure 4 As shown, the device comprises:

[0106] A feature extraction module 301 is used to obtain an operation log of a target database and generate an operation embedding feature based on the operation record of the operation log;

[0107] A feature sequence module 302, used to generate an operation feature sequence based on the record order of the operation records corresponding to the operation embedded features;

[0108] The intention processing module 303 is used to process the operation feature sequence according to the attention model to obtain a semantic feature sequence adjusted by the intention weight;

[0109] The anomaly detection module 304 is used to determine the abnormal semantic ratio in the semantic feature sequence based on the abnormal behavior detection model, and generate an abnormal behavior detection result of the target database based on the abnormal semantic ratio.

[0110] In an embodiment of the present invention, a target database is selected, an operation log containing all data operations in the target database is extracted from the target database, an operation record containing detailed information of a single data operation in the target database is extracted from the operation log, each operation record is processed to obtain an operation embedded feature, a record order of each operation record in the operation log is obtained, the operation embedded features are sorted according to the record order of the operation records, the sorted operation embedded features are used as an operation feature sequence, the operation feature sequence is input into an attention model, the attention model can set different intention weights for different positions of the operation feature sequence according to the importance of information at different positions of the operation feature sequence, the intention weights and the operation feature sequence are weighted to obtain a semantic feature sequence, the semantic feature sequence is input into an abnormal behavior detection model, the abnormal behavior detection model processes and analyzes the semantic feature sequence to obtain an abnormal semantic ratio, a preset threshold can be obtained, and based on the abnormal semantic ratio, the abnormal behavior detection model compares the abnormal semantic ratio with the preset threshold to obtain an abnormal behavior detection result. In the embodiment of the present invention, the embodiment of the present invention generates an operation feature sequence based on the record order of the operation records, so that the context relevance of the operation feature sequence is enhanced, and the accuracy of abnormal behavior detection is improved. By using the attention model to focus on the key features in the operation feature sequence to generate a semantic feature sequence, the sensitivity of the abnormal behavior detection model to data fluctuations is reduced, thereby enhancing the recognition accuracy of the abnormal behavior detection model for abnormal behavior. By calculating the proportion of abnormal semantics in the semantic feature sequence, the proportion of abnormal behavior in the semantic feature sequence is accurately quantified, so that the false alarm rate and missed alarm rate of abnormal behavior are reduced, thereby improving the detection efficiency of the abnormal behavior detection model.

[0111] On the basis of the above-mentioned embodiment, the abnormal behavior detection model in the embodiment of the present invention is generated based on the training of the Triplet loss function.

[0112] Based on the above embodiment, the intention processing module 303 also includes: a vector generation unit, which is used to generate a query vector, a key vector and a value vector of an operation feature sequence; a score determination unit, which is used to determine the similarity scores of the operation embedded features at different positions in the operation feature sequence based on the query vector and the key vector; an intention weight determination unit, which is used to normalize each similarity score to obtain an intention weight; and a semantic feature sequence determination unit, which is used to inject each intention weight into the corresponding operation embedded feature in the operation feature sequence to obtain a semantic feature sequence.

[0113] Based on the above embodiment, the score determination unit is specifically used to determine the inner product results of the query vector of the operation embedded feature and each key vector respectively; and call the Sigmoid function to process the inner product result to obtain a similarity score.

[0114] Based on the above embodiment, the feature extraction module 301 is specifically used to extract the operation log of the target database; read the operation record of the specified window length in the operation log; input each operation record into the word embedding vector generation model to obtain the operation embedding feature.

[0115] Based on the above embodiment, the feature sequence module 302 is specifically used to determine the position information of the operation record corresponding to each operation embedded feature in the operation log; and arrange each operation embedded feature in sequence into an operation feature sequence according to the position information.

[0116] On the basis of the above embodiment, the anomaly detection module 304 is specifically used to input each semantic feature in the semantic feature sequence into the detection model to obtain the anomaly probability of each semantic feature; arrange each anomaly probability into an anomaly probability sequence according to the value size, and extract a threshold number of anomaly probabilities from the anomaly probability sequence as the anomaly probabilities to be screened; determine the number of anomaly probabilities for each anomaly probability to be screened that is greater than the threshold probability, and take the ratio of the number of anomaly probabilities to the total number of anomaly probabilities to be screened as the anomaly semantic proportion; when the anomaly semantic proportion is greater than the threshold proportion, determine that the abnormal behavior detection result is that an anomaly exists; otherwise, determine that the abnormal behavior detection result is that an anomaly does not exist.

[0117] Embodiment 4

[0118] Figure 5A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown in the embodiments of the present invention, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present invention described and / or required herein.

[0119] like Figure 5 As shown, the electronic device includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the ROM 12 or the computer program loaded from the storage unit 18 to the RAM 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0120] A number of components in the electronic device are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit, a graphics processing unit, various special artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, for example, the process safety control method.

[0122] In some embodiments, the process safety control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the process safety control method may be performed. Alternatively, in other embodiments, the processor 11 may be configured as the process safety control method in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above in the embodiments of the present invention may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard products, systems on a chip, load programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: being implemented in one or more computer programs, which may be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general programmable processor, which may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of an embodiment of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a cathode ray tube or a liquid crystal display monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including: acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area networks, wide area networks, blockchain networks, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private server services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the embodiments of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal behavior of a database, characterized in that: The method comprises: Obtaining an operation log of a target database, and generating an operation embedding feature based on the operation record of the operation log; Generate an operation feature sequence based on the record order of the operation records corresponding to the operation embedded features; Processing the operation feature sequence according to the attention model to obtain a semantic feature sequence adjusted by the intention weight; The abnormal behavior detection model determines the abnormal semantic proportion in the semantic feature sequence, and generates the abnormal behavior detection result of the target database based on the abnormal semantic proportion.

2. The method according to claim 1, characterized in that: The step of obtaining an operation log of the target database and generating an operation embedding feature based on the operation record of the operation log includes: Extracting the operation log of the target database; Reading operation records of a specified window length in the operation log; Each of the operation records is input into a word embedding vector generation model to obtain the operation embedding features.

3. The method according to claim 1, characterized in that: The generating the operation feature sequence based on the record order of the operation records corresponding to the operation embedded features includes: Determine the location information of the operation record corresponding to each of the operation embedded features in the operation log; The operation embedding features are arranged in sequence into the operation feature sequence according to the position information.

4. The method according to claim 1, characterized in that: The step of processing the operation feature sequence according to the attention model to obtain a semantic feature sequence adjusted by the intention weight includes: Generate a query vector, a key vector, and a value vector of the operation feature sequence; Determining similarity scores of the operation embedded features at different positions in the operation feature sequence based on the query vector and the key vector; Normalizing each of the similarity scores to obtain the intention weight; Each intention weight is injected into the operation feature sequence corresponding to the operation embedding feature to obtain the semantic feature sequence.

5. The method according to claim 4, characterized in that: The determining, based on the query vector and the key vector, similarity scores of the operation embedded features at different positions in the operation feature sequence comprises: Determine inner product results of the query vector of the operation embedded feature and each of the key vectors respectively; The Sigmoid function is called to process the inner product result to obtain the similarity score.

6. The method according to claim 1, characterized in that: The determining the abnormal semantic proportion in the semantic feature sequence based on the abnormal behavior detection model, and generating the abnormal behavior detection result of the target database based on the abnormal semantic proportion, includes: Inputting each semantic feature in the semantic feature sequence into the abnormal behavior detection model to obtain the abnormal probability of each semantic feature; Arrange the abnormal probabilities according to their values ​​into an abnormal probability sequence, and extract a threshold number of abnormal probabilities from the abnormal probability sequence as abnormal probabilities to be screened; Determine the number of abnormal probabilities whose abnormal probabilities to be screened are greater than the threshold probability, and take the ratio of the number of abnormal probabilities to the total number of abnormal probabilities to be screened as the abnormal semantic proportion; When the abnormal semantic ratio is greater than the threshold ratio, the abnormal behavior detection result is determined to be abnormal; otherwise, the abnormal behavior detection result is determined to be abnormal.

7. The method according to claim 1, characterized in that: The abnormal behavior detection model is generated based on the training of the Triplet loss function.

8. A database anomaly detection device, characterized in that: The device comprises: A feature extraction module, used to obtain an operation log of a target database, and generate an operation embedding feature based on the operation record of the operation log; A feature sequence module, used to generate an operation feature sequence based on the record order of the operation records corresponding to the operation embedded features; An intention processing module, used for processing the operation feature sequence according to the attention model to obtain a semantic feature sequence adjusted by the intention weight; The anomaly detection module is used to determine the abnormal semantic proportion in the semantic feature sequence based on the abnormal behavior detection model, and generate the abnormal behavior detection result of the target database based on the abnormal semantic proportion.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the database abnormal behavior detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the database abnormal behavior detection method according to any one of claims 1 to 7 when executed.

Images