MySQL encrypted traffic dynamic auditing method, equipment and medium

Abstract

The invention discloses a MySQL encrypted traffic dynamic auditing method and device and a medium, and relates to the field of database security, the method comprises the following steps: intercepting a handshake request sent by a client, generating a proxy certificate in real time, and establishing a first handshake connection with the client through the proxy certificate; decrypting the encrypted traffic in a first encryption channel, wherein the first encryption channel is a traffic transmission channel pre-deployed with the client; based on a preset multi-level rule engine, performing level-by-level auditing on the decrypted plaintext traffic; and re-encrypting the audited plaintext traffic, and transmitting the encrypted plaintext traffic to the MySQL server through a second encryption channel, the second encryption channel being a traffic transmission channel pre-deployed with the MySQL server. On the premise of not damaging encrypted communication, complete SQL operation semantics are recorded, a traceable log meeting the requirements of a supervision mechanism is generated, a general query log does not need to be started or an auditing plug-in does not need to be installed at a MySQL server side, and performance loss caused by log writing is avoided.

Description

Technical Field

[0001] The present application relates to the field of database security technology, and in particular to a method, device, and medium for dynamic auditing of MySQL encrypted traffic. Background Art

[0002] Data security and privacy protection have become global compliance requirements, requiring full-link audits of database operations, especially monitoring of encrypted communication content.

[0003] Traditional database auditing techniques are broadly categorized into server-side log auditing, client-side agent solutions, and network-layer traffic analysis. Server-side log auditing relies on MySQL's general query log (or an audit plugin), but enabling it significantly increases I / O load and degrades database performance. Client-side agent methods require drivers compatible with different languages, resulting in poor compatibility and high maintenance costs. Network-layer traffic analysis captures traffic through port mirroring, but since mainstream cloud service providers typically enforce encrypted connections by default, decryption is impossible and therefore ineffective. Summary of the Invention

[0004] To solve the above problems, this application proposes a dynamic audit method for MySQL encrypted traffic, which is applied to intermediate agents. The method includes: Intercepting a handshake request from a client, generating a proxy certificate in real time, and establishing a first handshake connection with the client through the proxy certificate; decrypting encrypted traffic in a first encryption channel, where the first encryption channel is a traffic transmission channel pre-deployed with the client; Based on the preset multi-level rule engine, the decrypted plaintext traffic is audited level by level; The audited plaintext traffic is re-encrypted and transmitted to the MySQL server through a second encrypted channel, where the second encrypted channel is a traffic transmission channel pre-deployed with the MySQL server.

[0005] In one implementation of the present application, a proxy certificate is generated in real time, and a first handshake connection with the client is established through the proxy certificate, specifically including: generating a proxy certificate based on the server identity name of the handshake request, returning the proxy certificate to the client, and verifying the proxy certificate through the client; after determining that the verification is successful, establishing the first handshake connection with the client; and establishing a second handshake connection with the MySQL server through a pre-set legal certificate.

[0006] In one implementation of the present application, after the proxy certificate is verified by the client, it also includes: when it is determined that the verification fails, triggering an anti-certificate pinning mechanism; through the client's custom root certificate method, simulating the client's verification process, and forcing trust in the proxy certificate.

[0007] In one implementation of the present application, the encrypted traffic in the first encryption channel is decrypted, specifically including: receiving the encrypted traffic in the first encryption channel, decrypting the encrypted traffic in real time to obtain plaintext traffic; parsing the MySQL fragmented data packets in the plaintext traffic through a streaming reassembly algorithm, and reassembling them to obtain MySQL complete protocol instructions.

[0008] In one implementation of the present application, based on a preset multi-level rule engine, the decrypted plaintext traffic is audited step by step, specifically including: determining multiple audit rules existing in the preset multi-level rule engine, and determining the audit order based on the priorities corresponding to the audit rules; based on the audit order, auditing the MySQL complete protocol instructions through the audit rules; when responding to the current audit rule, automatically skipping the subsequent audit rules of the current audit rule based on the audit order.

[0009] In one implementation of the present application, after performing a real-time audit of the decrypted plaintext traffic based on a preset multi-level rule engine, it also includes: assigning a weight score to the audit rule according to the priority; obtaining the audit result corresponding to the audit rule, weighting the audit result based on the weight score, and determining whether the weighted audit score exceeds a preset threshold; if so, determining that the MySQL complete protocol instruction is a high-risk instruction, generating a proxy response to the high-risk instruction according to a preset response rule, and returning it to the client.

[0010] In one implementation of the present application, after determining that the MySQL complete protocol instruction is a high-risk instruction, it also includes: triggering an access control mechanism; determining the risk level of the handshake request according to the audit score, and adjusting the access rights of the client based on the risk level.

[0011] In one implementation of the present application, after the plaintext traffic that has passed the audit is re-encrypted and transmitted to the MySQL server through the second encryption channel, it also includes: receiving the encrypted response of the MySQL server, decrypting the encrypted response to obtain a plaintext response; based on the preset multi-level rule engine, auditing the plaintext response step by step; re-encrypting the plaintext response that has passed the audit, and transmitting it to the client through the first encryption channel.

[0012] On the other hand, this application also proposes a MySQL encrypted traffic dynamic audit device, including: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute a MySQL encrypted traffic dynamic audit method as described in the above example.

[0013] On the other hand, the present application also proposes a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: a MySQL encrypted traffic dynamic audit method described in the above example.

[0014] This application proposes a method for dynamic auditing of MySQL encrypted traffic, which can bring the following beneficial effects: Without compromising SSL / TLS encrypted communications, it records complete SQL operation semantics and generates traceable logs that meet regulatory requirements. This eliminates the need to enable general query logging or install audit plug-ins on the MySQL server, thus avoiding I / O performance loss caused by log writing.

[0015] This approach addresses the shortcomings of traditional auditing methods based on network-layer traffic analysis. In terms of security and compliance, it addresses the industry challenge of "encryption means non-auditability" and meets stringent regulatory requirements in sectors such as finance and healthcare. A multi-level rules engine identifies high-risk operations in real time and generates camouflaged responses to block attack chains. It also dynamically limits user permissions based on risk scores. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 This is a flow chart of a method for dynamic auditing of MySQL encrypted traffic according to an embodiment of the present application; Figure 2 This is a schematic diagram of the process of establishing a TLS connection in an embodiment of the present application; Figure 3 This is a schematic diagram of a MySQL encrypted traffic dynamic audit device in an embodiment of the present application. DETAILED DESCRIPTION

[0017] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0019] like Figure 1 As shown, the embodiment of the present application provides a MySQL encrypted traffic dynamic audit method, including: S101: intercepting a handshake request sent by a client, generating a proxy certificate in real time, and establishing a first handshake connection with the client through the proxy certificate.

[0020] Specifically, deploying an intermediate proxy between the client and the MySQL server can intercept all SSL / TLS handshake requests between the client and the MySQL server, such as Figure 2 When intercepting the handshake request from the client, a proxy certificate with the same Common Name (CN) as the server's identity is dynamically generated to deceive the client and complete the handshake connection.

[0021] It's important to note that the SSL / TLS handshake is a series of communication steps between the client and server during the HTTPS connection process to ensure secure communication. The primary purpose of the SSL / TLS handshake is to negotiate encryption algorithms, exchange keys, and verify the identities of both parties. The transport protocol refers to the use of plaintext TCP for unencrypted traffic, directly transmitting native MySQL protocol packets; encrypted traffic is encapsulated over the TLS layer, with the native MySQL protocol encrypted. TLS transport uses a combination of symmetric and asymmetric encryption: leveraging the irreversibility of asymmetric encryption to generate keys for encrypted transmission, and leveraging the performance advantages of symmetric encryption to symmetrically encrypt the transmitted content.

[0022] Among them, encrypted transmission channels are deployed between the intermediate proxy and the client, and between the intermediate proxy and the MySQL server, respectively, to realize the transmission of encrypted traffic to the intermediate proxy, which are the first encryption channel and the second encryption channel.

[0023] Furthermore, when a proxy certificate is generated based on the server identity name in the handshake request and the proxy certificate is returned to the client, the client verifies the proxy certificate. The verification process includes certificate chain verification, CN matching verification, validity period verification, etc. Certificate chain verification refers to the client checking whether the proxy certificate is issued by a trusted root certificate authority (CA). The core is that if the proxy certificate is a self-signed certificate or is issued by a CA that is not trusted by the client, the client will prompt a certificate error. CN matching verification refers to the client verifying whether the CN field of the certificate is consistent with the requested target domain name (or IP). Its proxy strategy is to dynamically generate a CN field that is exactly the same as the server certificate, bypassing CN verification. Validity period verification refers to the client checking whether the certificate is within the validity period. Its proxy strategy is to ensure that the validity period is consistent with the server certificate or covers the session time when the proxy dynamically generates a certificate.

[0024] Furthermore, after the client successfully verifies the proxy certificate, it establishes a first handshake connection with the intermediate proxy and a second handshake connection with the MySQL server using a pre-configured legitimate certificate. A pre-configured legitimate certificate refers to an SSL / TLS certificate issued by a trusted certificate authority (CA) or a certificate configured on the MySQL server itself. This certificate is pre-configured on the intermediate proxy and is used to establish a legitimate encrypted connection with the MySQL server, enabling identity authentication and encrypted communication between the MySQL servers.

[0025] When it is determined that the client fails to verify the proxy certificate, the anti-certificate pinning mechanism is triggered. Through the client's custom root certificate method, the client's verification process is simulated to force trust in the proxy certificate.

[0026] It should be noted that the anti-certificate pinning mechanism is a mechanism used to bypass or circumvent the certificate pinning strategy of client applications, allowing intermediate agents to successfully hijack and decrypt encrypted traffic when certificate pinning is enabled on the client. Its core goal is to solve the defense of certificate pinning against man-in-the-middle attacks and achieve non-intrusive auditing of encrypted traffic.

[0027] S102: Decrypting the encrypted traffic in a first encryption channel, where the first encryption channel is a traffic transmission channel pre-deployed with the client.

[0028] Specifically, the encrypted traffic in the first encryption channel is received, the encrypted traffic is decrypted in real time to obtain plaintext traffic, and the MySQL fragmented data packets in the plaintext traffic are parsed through a streaming reconstruction algorithm. The length field in the Packet Header can be used to reconstruct the complete instructions, identify the COM_QUERY and COM_STMT_PREPARE instruction types in the MySQL fragmented data packets, extract the original SQL semantics, and reconstruct the complete protocol instructions according to the Packet Length field in the MySQL protocol header to obtain the MySQL complete protocol instructions.

[0029] It should be noted that the MySQL protocol may split large queries or responses into multiple fragments during transmission, and encrypted traffic further obscures packet boundaries. This application uses a streaming reassembly algorithm to parse MySQL protocol instructions and restore the complete semantics of parameterized queries. This ensures seamless splicing of fragmented data, preventing audit information from being invalidated due to data truncation. By restoring the complete semantics, accurate rule matching based on actual parameter values can be performed during the audit process.

[0030] S103: Based on the preset multi-level rule engine, the decrypted plaintext traffic is audited level by level.

[0031] Specifically, multiple audit rules existing in a preset multi-level rule engine are determined, an audit order is determined based on the priorities corresponding to the audit rules, and based on the audit order, the MySQL complete protocol instructions are audited through the audit rules.

[0032] Furthermore, when responding to the current audit rule, that is, in the audit rules at the current level, if it is determined through auditing that there are high-risk instructions in the MySQL complete protocol instructions, the audit rules following the current audit rule will be automatically skipped based on the audit order to reduce computing overhead.

[0033] Among them, the preset multi-level rule engine includes basic access control rules, resource dimension rules, semantic risk rules and dynamic behavior analysis rules.

[0034] The goal of basic access control rules is to quickly filter out illegal sources or obvious violations. Audit content includes IP blacklist and whitelist audits, protocol compliance, etc. According to the IP blacklist and whitelist, the client IP or server IP is directly blocked or released, the legality of the MySQL protocol format (such as packet length and instruction type) is verified, and abnormal traffic is filtered. Hash tables or Bloom filters can be used to achieve O(1) time complexity matching.

[0035] The goal of resource dimension rules is to restrict access to sensitive databases, tables, and columns. Audit content includes database / table-level whitelist auditing, column-level desensitization, and operation frequency restrictions. Specific operations are only allowed to be performed on authorized databases and tables, and query results for sensitive fields are dynamically desensitized to limit DDL operations on the same client within a unit of time. This can be achieved by quickly matching database and table names based on the Trie tree and combining sliding time window counters to count frequencies. The goal of semantic-level risk rules is to identify high-risk operations such as SQL injection and unauthorized access. The rules include parameterized query analysis, syntax tree parsing, context association, etc., restoring the actual parameters of Prepared Statements, detecting malicious values, building SQL abstract syntax trees, identifying dangerous structures, and combining user roles and operation permissions to determine unauthorized behavior. This can be achieved by integrating a lightweight SQL parser (such as ANTLR to generate parsing rules) and combining regular expressions and pattern matching.

[0036] The goal of dynamic behavior analysis rules is to identify abnormal operation patterns through machine learning. The rule content includes baseline modeling, anomaly detection, adaptive rule generation, etc., statistics on the operation type, time distribution, and parameter range of historical traffic, establish a normal behavior baseline, use isolation forest and LOF algorithms to mark operations that deviate from the baseline in real time, and dynamically generate temporary rules based on threat intelligence. A streaming machine learning framework can be used to update model parameters in real time.

[0037] Furthermore, weighted scores are assigned to audit rules according to their priorities, and the audit results corresponding to each audit rule are obtained. The audit results are weighted based on the weighted scores to determine whether the weighted audit scores exceed the preset threshold. If so, the MySQL full protocol instruction is determined to be a high-risk instruction, triggering the access control mechanism. The risk level of the handshake request is determined based on the audit score, the client's access rights are adjusted based on the risk level, and a proxy response is generated for the high-risk instruction according to the preset response rules. The proxy response is returned to the client, and a false success message is returned, which actually blocks execution.

[0038] S104: Re-encrypt the audited plaintext traffic and transmit it to the MySQL server through a second encryption channel, where the second encryption channel is a traffic transmission channel pre-deployed with the MySQL server.

[0039] Specifically, the intermediate proxy re-encrypts audited plaintext traffic and transmits it to the MySQL server via a second encrypted channel. The MySQL server responds to the encrypted traffic and transmits it to the intermediate proxy via a second encrypted channel. The intermediate proxy receives the encrypted response from the MySQL server, decrypts it, and obtains a plaintext response. Based on a pre-set multi-level rule engine, it audits the plaintext response level by level, re-encrypts the audited plaintext response, and transmits it to the client via the first encrypted channel.

[0040] It should be noted that after receiving the client request and the server response, the intermediate proxy copies the traffic for auditing. Because from the perspective of the intermediate proxy, the client request and the server response are both in plain text, the audit process is similar to that of a typical network traffic analysis solution.

[0041] This application records the complete semantics of SQL operations without destroying SSL / TLS encrypted communications, generating traceable logs that meet the requirements of regulatory agencies. It also eliminates the need to enable general query logs or install audit plug-ins on the MySQL server side, thus avoiding I / O performance loss caused by log writing.

[0042] This approach addresses the shortcomings of traditional auditing methods based on network-layer traffic analysis. In terms of security and compliance, it addresses the industry challenge of "encryption means non-auditability" and meets stringent regulatory requirements in sectors such as finance and healthcare. A multi-level rules engine identifies high-risk operations in real time and generates camouflaged responses to block attack chains. It also dynamically limits user permissions based on risk scores.

[0043] like Figure 3 As shown, the embodiment of the present application also proposes a MySQL encrypted traffic dynamic audit device, including: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a MySQL encrypted traffic dynamic audit method as described in any of the above embodiments.

[0044] An embodiment of the present application further provides a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to be: a MySQL encrypted traffic dynamic audit method as described in any of the above embodiments.

[0045] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device and medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0046] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0047] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0048] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0049] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0050] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0051] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0052] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0053] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media such as modulated data signals and carrier waves.

[0054] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0055] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for dynamic auditing of MySQL encrypted traffic, characterized in that: Applied to intermediate agents, the methods include: Intercepting a handshake request from a client, generating a proxy certificate in real time, and establishing a first handshake connection with the client through the proxy certificate; decrypting encrypted traffic in a first encryption channel, where the first encryption channel is a traffic transmission channel pre-deployed with the client; Based on the preset multi-level rule engine, the decrypted plaintext traffic is audited level by level; The audited plaintext traffic is re-encrypted and transmitted to the MySQL server through a second encrypted channel, where the second encrypted channel is a traffic transmission channel pre-deployed with the MySQL server.

2. A MySQL encrypted traffic dynamic audit method according to claim 1, characterized in that: Generating a proxy certificate in real time and establishing a first handshake connection with the client through the proxy certificate specifically includes: Generate a proxy certificate based on the server identity name of the handshake request, return the proxy certificate to the client, and verify the proxy certificate through the client; After confirming that the verification is passed, establishing a first handshake connection with the client; Establish a second handshake connection with the MySQL server by pre-setting a valid certificate.

3. A MySQL encrypted traffic dynamic audit method according to claim 2, characterized in that: After verifying the proxy certificate by the client, the method further includes: When it is determined that the verification fails, the anti-certificate pinning mechanism is triggered; The client's verification process is simulated through the client's custom root certificate method to force trust in the proxy certificate.

4. A MySQL encrypted traffic dynamic audit method according to claim 1, characterized in that: Decrypting the encrypted traffic in the first encryption channel specifically includes: receiving encrypted traffic in the first encryption channel, and decrypting the encrypted traffic in real time to obtain plaintext traffic; The MySQL fragmented data packets in the plaintext traffic are parsed by a streaming reassembly algorithm and reassembled to obtain MySQL complete protocol instructions.

5. A MySQL encrypted traffic dynamic audit method according to claim 4, characterized in that: The decrypted plaintext traffic is audited level by level based on the preset multi-level rule engine, specifically including: Determine multiple audit rules existing in a preset multi-level rule engine, and determine an audit order based on the priorities corresponding to the audit rules; Based on the audit order, auditing the MySQL complete protocol instruction using the audit rule; When responding to a current audit rule, the subsequent audit rules of the current audit rule are automatically skipped based on the audit sequence.

6. A MySQL encrypted traffic dynamic audit method according to claim 5, characterized in that: After performing real-time auditing on the decrypted plaintext traffic based on the preset multi-level rule engine, the method further includes: assigning weights to the audit rules according to the priorities; Obtaining an audit result corresponding to the audit rule, weighting the audit result based on the weight score, and determining whether the weighted audit score exceeds a preset threshold; If so, the MySQL complete protocol instruction is determined to be a high-risk instruction, and a proxy response is generated for the high-risk instruction according to a preset response rule and returned to the client.

7. A MySQL encrypted traffic dynamic audit method according to claim 6, characterized in that: After determining that the MySQL complete protocol instruction is a high-risk instruction, the method further includes: Triggering access control mechanisms; The risk level of the handshake request is determined according to the audit score, and the access rights of the client are adjusted based on the risk level.

8. A MySQL encrypted traffic dynamic audit method according to claim 1, characterized in that: After re-encrypting the audited plaintext traffic and transmitting it to the MySQL server through the second encryption channel, the method further includes: Receive the encrypted response from the MySQL server, decrypt the encrypted response, and obtain a plaintext response; Based on the preset multi-level rule engine, audit the plaintext response level by level; The plaintext response that has passed the audit is re-encrypted and transmitted to the client through the first encryption channel.

9. A MySQL encrypted traffic dynamic audit device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a MySQL encrypted traffic dynamic audit method as described in any one of claims 1 to 8.

10. A non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured as: a MySQL encrypted traffic dynamic audit method as described in any one of claims 1 to 8.

Images