Database query statement legality checking method and device, equipment and medium

Abstract

The application discloses a legality verification method, device and equipment of a database query statement and a medium. The application decouples the features of historical query statements in a database into two levels, respectively performs frequent item set mining, obtains a first candidate item set and a second candidate item set, constructs an association rule library according to the two candidate item sets, performs matching inspection on a target transaction feature vector of a target query statement through the association rule library, and verifies the legality of the query, thereby realizing online monitoring of potential leakage risks of database access, which is fast, accurate and interpretable.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, device, and medium for validating the validity of database query statements. Background Technology

[0002] In today's rapidly evolving digital economy, core business data in industries such as finance, government affairs, telecommunications, and healthcare heavily rely on relational databases for storage and scheduling. SQL (Structured Query Language) queries have become the primary entry point for accessing, analyzing, and even bulk exporting sensitive data. If insiders or intruders use unconventional SQL operations to perform bulk reads or exports of sensitive tables and fields, it often triggers serious consequences such as customer privacy leaks, trade secret breaches, compliance penalties, and even cascading social risks.

[0003] Existing database query validity verification and leakage early warning technologies generally fall into three categories, but all have significant shortcomings in large-scale database auditing practices. Single-stage association rule methods require scanning all historical transactions at once. As the table or field dimensions increase, the FP-Tree (Frequent-Pattern Tree) expands rapidly, rule generation can easily take over ten minutes, and it's prone to generating noisy itemsets containing only fields and no commands, leading to a high false positive rate. Furthermore, the rule base can only be fully re-mined, not incrementally updated. Role-based or profile-based supervised classification heavily relies on large-scale labeled samples, which are difficult to obtain in sensitive data scenarios. The model only outputs anomaly probabilities, failing to accurately locate violating tables or fields, resulting in insufficient interpretability. Frequent business iterations also cause severe conceptual drift, requiring high-frequency retraining and incurring high maintenance costs. Deep learning behavioral modeling methods primarily focus on the SQL call order while neglecting semantic fine-grainedness, making it difficult to capture sensitive field-level operations. Their inference latency is significant, failing to meet millisecond-level alert requirements, and the black-box decision-making process is unacceptable in compliance audits.

[0004] Therefore, there is an urgent need for a method to verify the validity of database query statements that can solve the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and storage medium for validating the validity of database query statements, so as to achieve rapid, accurate, and interpretable online monitoring of potential leakage risks from database access.

[0006] In a first aspect, embodiments of the present invention provide a method for validating the validity of a database query statement, the method comprising: The transaction feature vector of each historical query statement in the database is determined, and the four features in the transaction feature vector are orthogonally partitioned to construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition. The first transaction view is used to represent the data access pattern at the operation command-associated table level; the second transaction view is used to represent the data access pattern at the associated table-projection field-filter condition level. Frequent itemset mining is performed on the first transaction view to generate a first candidate itemset, and frequent itemset mining is performed on the second transaction view to generate a second candidate itemset; Based on the first and second candidate sets, determine the association rule base; Determine the target transaction feature vector of the target query statement; Based on the association rule base, the target transaction feature vector is matched to determine the legality of the target query statement.

[0007] Secondly, embodiments of the present invention also provide a database query statement validity verification device, the device comprising: The transaction view determination module is used to determine the transaction feature vector of each historical query statement in the database, and orthogonally divide the four features in the transaction feature vector to construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition. The first transaction view is used to represent the data access pattern at the operation command-associated table level; the second transaction view is used to represent the data access pattern at the associated table-projection field-filter condition level. The frequent itemset mining module is used to perform frequent itemset mining on the first transaction view to generate a first candidate itemset, and to perform frequent itemset mining on the second transaction view to generate a second candidate itemset. The rule base determination module is used to determine the associated rule base based on the first candidate set and the second candidate set; The target vector determination module is used to determine the target transaction feature vector of the target query statement; The target statement verification module is used to match the target transaction feature vector according to the association rule base to determine the legality of the target query statement.

[0008] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a database query statement validity verification method as described in any of the embodiments of the present invention.

[0009] Fourthly, embodiments of the present invention also provide a storage medium for storing computer-executable instructions, which, when executed by a computer processor, are used to perform a database query statement validity verification method as described in any of the embodiments of the present invention.

[0010] The technical solution of this invention decouples the features of historical query statements in the database in two levels and performs frequent itemset mining on each level to obtain a first candidate itemset and a second candidate itemset. An association rule base is then constructed based on these two candidate itemsets. The two candidate itemsets focus on data access patterns at the operation command-association table level and the association table-projection field-filter condition level, respectively. This reduces the complexity of association rule mining while improving the business relevance and interpretability of the association rules. It also provides a lightweight and accurate basis for judging the legality of target query statements. This invention matches the target transaction feature vector of the target query statement using the association rule base, facilitating rapid judgment of the legality of the target query statement and locating abnormal access fields, thus improving the efficiency of data legality verification. This invention enables rapid, accurate, and interpretable online monitoring of potential database access leakage risks.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a database query statement validity verification method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of a database query statement validity verification method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of a database query statement validity verification device provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device that implements the database query statement validity verification method of this invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Example 1 Figure 1 This is a flowchart illustrating a method for validating the validity of a database query statement, as provided in Embodiment 1 of the present invention. This embodiment is applicable to the validity verification of database query statements. The method can be executed by a database query statement validity verification device, which can be implemented in hardware and / or software. This device can be configured in any electronic device with network communication and computing capabilities. Figure 1 As shown, the method includes: S110. Determine the transaction feature vector of each historical query statement in the database, and orthogonally divide the four features in the transaction feature vector to construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition. The first transaction view consists of at least one first transaction, which is composed of at least one operation command-associated table combination item. The second transaction view consists of at least one second transaction, which is composed of at least one associated table-projection field-filter condition combination item.

[0017] In this embodiment, the historical query statements are all historical SQL access records in the database prior to the current time. The transaction feature vector consists of four features: operation command, related table, projection field, and filter condition. The first transaction view is used to represent the data access pattern at the operation command-related table level; the second transaction view is used to represent the data access pattern at the related table-projection field-filter condition level.

[0018] This embodiment describes the preliminary steps for generating association rules. By comprehensively collecting, de-identifying and cleaning, screening samples, and preprocessing the original SQL access logs, it provides high-quality and traceable input data for subsequent fine-grained feature analysis and association rule mining.

[0019] Specifically, the raw SQL access logs are comprehensively collected, and all SQL access records within a historical time period are automatically captured by setting a polling interval. In practical applications, key information such as the request timestamp of the SQL statement, operator identifier, client IP (Internet Protocol) address, and raw SQL text can be completely preserved. After creating a unique index with an incrementing serial number, the data is written to the audit repository to ensure the traceability and data integrity of subsequent evidence collection.

[0020] Furthermore, the original SQL access logs are anonymized and sampled. The collected SQL logs are anonymized by using regular expressions to mask and replace numeric, string, and date constants, thus removing user privacy and business-sensitive information. Subsequently, clustering and deduplication are performed based on the SQL statement structure template, and stratified sampling is implemented according to business scenarios and operation types. Finally, a representative SQL statement sample set that can cover various query modes is constructed as the historical query statements of the database.

[0021] Furthermore, by extracting the four-element features of each historical query statement, a syntax parser can be invoked to decompose each historical query statement into four major features: "operation command (Cmd), relation table (Relation), projection field (Attr), and filter condition (Where)". Subsequently, after unifying the capitalization and deduplicating the four-element features of the historical query statements, the results are serialized in JSON format. Based on the four-element features of each historical query statement, a standardized transaction set is constructed to provide high-quality input for subsequent association rule mining.

[0022] Furthermore, in practical applications, data quality verification can be performed on the constructed standardized transaction set, and integrity and consistency verification can be performed on the structured transaction set, including confirming that there are no empty feature values, verifying that the field set matches the database meta-model, statistically analyzing the distribution of each feature to check for deviations, and generating a quality report for auditing. Only after ensuring that the standardized transaction set meets the expected specifications can it enter the association rule mining stage.

[0023] Furthermore, fine-grained parsing of the four-element features of historical query statements is performed, transforming the anonymized and filtered historical SQL text into a unified formatted feature set with comparability and consistency, thereby improving the quality and stability of transaction input. By eliminating differences in capitalization, field order, and syntax style of SQL statements, it ensures that functionally equivalent but textually different isomorphic historical query statements can be mapped to the same feature vector space, providing accurate and unbiased input for subsequent association rule mining.

[0024] Specifically, historical query statements are preprocessed. First, the original SQL text of the anonymized historical query statements is input into the preprocessing engine, where the following operations are performed: redundant spaces, comments, and line breaks are removed; all identifiers (such as table names, column names, and keywords) are uniformly mapped to uppercase to ensure no case ambiguity between keywords (SELECT, FROM, WHERE, etc.) and custom identifiers; regular expressions are used to remove subquery bracket hierarchy tags and useless aliases from the statements to avoid ambiguity in the parser caused by complex nesting. Then, after preprocessing, the cleaned results are retained along with the original serial number for subsequent tracing and comparison.

[0025] Furthermore, the preprocessed historical query statements are subjected to syntax parsing and four-element feature mapping. Specifically, the preprocessed historical query statements... During syntax parsing, an abstract syntax tree (AST) is first constructed with linear complexity to preserve all semantic information of historical query statements and standardize their written form. Then, the AST is traversed layer by layer to extract transaction feature vectors and perform case reduction, duplication resolution, and lexicographical sorting. This ensures that functionally equivalent but differently written statements are mapped to the same feature space, guaranteeing that transaction inputs entering the association rule mining stage are both accurate and consistent. Its formal definition is as follows: ; Here, Cmd represents the top-level data manipulation language type of the historical query statement, which determines the operation category; Relation is the complete set of physical tables in the database, which limits the tables that are accessed or modified; Attr represents the projection field, which describes the externally visible field; and Where represents the filtering conditions, including the filtering granularity and access path.

[0026] Furthermore, regarding The output quadruple feature sets are sequentially subjected to null value removal, duplicate resolution, lexicographical normalization, and format encapsulation to ensure that any semantically equivalent SQL statements but with different writing order or capitalization can be mapped to completely consistent transaction feature vectors.

[0027] Specifically, firstly, null value filtering is performed on each feature component (Cmd, Relation, Attr, Where) to automatically remove invalid entries such as empty strings, system temporary tables, and non-business fields, ensuring the business validity of the feature set. Next, the set operation `unique(·)` is called to eliminate duplicate elements caused by view expansion or statement redundancy, avoiding bias in frequency statistics. Then, the Relation, Attr, and Where lists are sorted lexicographically according to their Unicode sequences, mapping isomorphic historical query statements with different writing orders to the same permutation sequence, thereby enhancing the comparability and deduplication capabilities of subsequent frequent itemset mining. Finally, the normalized quadruple feature groups are concatenated in a fixed slot order and encapsulated into a transaction feature vector.

[0028] Furthermore, in practical applications, the transaction feature vectors corresponding to historical query statements can be formatted and written into a standardized transaction set to ensure the retrieval ease of the query statements. Specifically, the transaction feature vector T corresponding to the standardized historical query statements is automatically assigned an incrementing serial number and a unique identifier ID is generated to ensure traceability for subsequent tracking and evidence collection. Subsequently, (ID, T) is encapsulated into a standard JSON object conforming to RFC8259 specifications according to a predefined key order (id, cmd, relation, attr, where). Among them, the cmd field records the top-level data manipulation language operator, and relation, attr, and where store the associated table, projection field, and filter condition elements in the form of string arrays, respectively, to ensure that the self-descriptive structure corresponds one-to-one with the database metadata.

[0029] In this embodiment, the "JSON-Lines" format (one complete JSON object per line) is used to continuously write to the standardized transaction set file, enabling any single record to be parsed independently or scanned in a streaming manner. At the same time, with the help of columnar indexing and batch buffering mechanisms, the random read and write performance in high-concurrency environments can be significantly improved, taking into account easy retrieval, compression efficiency and horizontal scalability. This provides low-latency, high-throughput and fast-locating persistent data support for subsequent offline rule mining and online real-time detection.

[0030] Furthermore, in practical applications, batch consistency and integrity checks are performed on the standardized transaction sets from the preceding steps to ensure the accuracy and unbiasedness of the data upon which subsequent association rule mining depends. First, regarding field consistency, the verification engine compares each element in the `relation`, `attr`, and `where` lists row by row to ensure its existence in the current database metamodel (i.e., data dictionary). If a table or field name is found not in the metamodel, it is immediately marked as a structural anomaly. Second, in the non-empty and validity checks, it verifies that each field in the four-tuple of the transaction's features is a non-empty set and that the `Cmd` field strictly belongs to the predefined data manipulation language set {SELECT, INSERT, UPDATE, DELETE}, preventing the inclusion of "empty transactions" or illegal operation types.

[0031] Subsequently, the statistical distribution comparison process begins. The frequency vectors of operation commands, table names, and field names for the entire standardized transaction set are calculated and compared with the historical baseline distribution using a two-sample Kolmogorov-Smirnov (KS, nonparametric statistical verification) test. If the test statistic exceeds a threshold, a significant shift in recent SQL access data is identified, and the anomaly category is recorded. After completing the above verification, an XML-formatted verification report is automatically generated, containing pass and fail flags, an index of anomaly entries, and specific reasons for violations, for traceability by the operations and security audit departments. The consistency determination function is expressed by the following formula: C(T)∈{0,1}; The transaction feature vector of the historical query statement is C(T)=1 if and only if the three conditions of field consistency, non-empty validity and KS distribution test are met; if any sub-item fails, C(T)=0 is output, and the corresponding transaction line number and error type are attached to the report for manual review.

[0032] In this embodiment, through the verification mechanism, the standardized transaction set can maintain structural integrity, statistical stability and traceability in the long term under large-scale continuous writing, which can provide a solid and reliable data foundation for subsequent rule mining and real-time data leakage judgment and early warning.

[0033] Furthermore, in practical applications, standardized transaction sets can be archived. Specifically, all structured transaction data that has passed consistency and integrity checks is finally solidified. First, according to the columnar data layout specification, the transaction feature vector set corresponding to the historical query statements is written in batches to the persistent storage medium. The compression and vectorized scanning capabilities of columnar storage significantly reduce disk usage and improve the efficiency of subsequent batch processing. Second, a metadata list corresponding to each data file is automatically generated, recording in detail the total number of transactions in the standardized transaction set, the count of deduplicated Cmd types, the cardinality and frequency histogram of each field set of Relation, Attr, and Where, the timestamp of the most recent check, and the file partition key information. This metadata file can use self-describing JSON or Avro format, which facilitates direct type binding and column pruning during association rule mining.

[0034] It should be noted that, to meet the read / write throughput requirements of a large-scale distributed database environment, the metadata files are partitioned and segmented based on business domain, date, or serial number range. Column-level statistical indexes are automatically created for each partition. This allows for data retrieval by simply scanning the relevant partitions in incremental rule mining or real-time detection and playback scenarios, significantly reducing I / O latency and network bandwidth consumption. Through this standardized transaction set archiving strategy, the standardized transaction set not only achieves a highly compressed and quickly searchable physical disk storage format but also forms a metadata indexing system naturally compatible with the computing engine. This provides continuous, stable, and horizontally scalable data support for subsequent updates to the association rule base and high-speed online early warning in this invention.

[0035] Furthermore, the four features in the transaction feature vector of the historical query statement are orthogonally partitioned to construct the first transaction view and the second transaction view.

[0036] First, the preprocessed transaction feature vector T is logically split, dividing the four features of the same SQL statement into two non-overlapping transaction views, as expressed by the following formula: ; ; Among them, the first transaction view The focus is on expressing the data access patterns at the "operation command - associated table" level, used to capture the combination patterns between user top-level DML operations (SELECT / INSERT / UPDATE / DELETE) and associated tables; the second transaction view. This focuses on fine-grained dependencies at the level of "related table - projection field - filtering conditions" to characterize the joint occurrence characteristics of various fields (Attr, Where) within a specific related table.

[0037] In this embodiment, by orthogonally partitioning the four features Cmd, Relation, Attr, and Where, a first transaction view and a second transaction view are constructed. This achieves semantic decoupling and dimensional noise reduction without introducing redundant cross-items. On the one hand, it reduces the complexity of subsequent association rule mining; on the other hand, it ensures that the frequent itemsets obtained from each subsequent level of mining have clear business interpretability, facilitating rapid determination of the legality of query statements and quick location of triggering causes during online alerts. Furthermore, this hierarchical mechanism allows for independent remining of any level of transaction view during incremental updates of historical query statements, thereby reducing the number of global recalculations and improving the maintenance efficiency of the association rule base.

[0038] In this embodiment, historical query statements in the database are automatically captured, preprocessed, and feature extracted to determine the transaction feature vector of each historical query statement in the database. The four features in the transaction feature vector are orthogonally divided to construct a first transaction view and a second transaction view. By performing semantic decoupling and dimensional noise reduction on the SQL data in the database, the complexity of subsequent association rule mining can be reduced, ensuring that the frequent itemsets obtained from each level of association rule mining have clear business interpretability. This facilitates the rapid determination of the legality of query statements in subsequent steps and the rapid location of triggering causes during online alerts.

[0039] S120. Perform frequent itemset mining on the first transaction view to generate a first candidate itemset, and perform frequent itemset mining on the second transaction view to generate a second candidate itemset.

[0040] In this embodiment, the first candidate set is a set of single-element operation command-association table combination items and a set of operation command-association table combination items of at least two combination items, and the second candidate set is a set of single-combination item association table-projection field-filter condition combination items and a set of at least two combination items association table-projection field-filter condition combination items.

[0041] Specifically, extract all single associated table-projection field-filter condition combination items from all first transactions in the first transaction view. That is, extract different operation command items and associated table items from operation command-associated table combination items, calculate the occurrence frequency of each operation command item and associated table item, and filter operation command items and / or associated table items with an occurrence frequency greater than a preset frequency threshold based on the occurrence frequency of each operation command item and associated table item to form the first candidate set.

[0042] Similarly, extract all single association table-projection field-filter condition combinations from all second transactions in the second transaction view. That is, extract different association table-projection field-filter condition combinations from the association table-projection field-filter condition combinations. Calculate the occurrence frequency of each association table-projection field-filter condition combination. Based on the occurrence frequency of each association table-projection field-filter condition combination, filter the association table items and / or projection field items and / or filter condition items whose occurrence frequency is greater than a preset frequency threshold to form the second candidate set.

[0043] Optionally, frequent itemset mining is performed on the first transaction view to generate a first candidate itemset, including: Determine each operation command-related table combination item in the first transaction view, and the total number of first transactions in the first transaction view; For each type of operation command-association table combination, a first support degree for the operation command-association table combination is determined based on the ratio of the number of first transactions containing the type of operation command-association table combination to the total number of the first transactions. Based on the operation command-association table combination item whose first support is greater than the preset support threshold, determine the first candidate combination; Based on the first candidate combination, a first candidate set is determined.

[0044] In this embodiment, the first transaction view consists of at least one first transaction, and the first transaction consists of at least one operation command-association table combination item.

[0045] The first total number of transactions refers to the total number of transactions in the first transaction view, and the first support is the support of each operation command-related table combination item in the first transaction view. To ensure that the rules are both statistically significant and cover long-tail scenarios, the preset support threshold can be set to 0.03. The first candidate combination can be a single operation command-related table combination item or a set of multiple operation command-related table combination items.

[0046] Among them, the first candidate combination can be a single operation command-related table combination item, such as "query-order table", or the first candidate combination can be an item set consisting of multiple operation command-related table combination items, such as "insert-order table, update-inventory table, insert-payment table". Furthermore, the first candidate set consists of multiple first candidate combinations.

[0047] It should be noted that the first candidate set is a list of frequently occurring operation-table combinations. Each element in the list corresponds to a "specific operation and target table". The entire list corresponds to the occurrence of this type of operation together, and the support indicates the frequency of this type of operation occurring together.

[0048] Specifically, an improved FP-Tree structure can be used to perform frequent itemset mining on the first transaction view. First, the operation command-association table combination items in the first transaction are reordered and compressed according to the first support to reduce memory usage. Then, a conditional FP-Tree is recursively grown along the compression path. When the first support of a certain operation command-association table combination item or a certain operation command-association table combination item set is greater than the preset support threshold, it is retained as the first candidate combination to generate the first candidate itemset.

[0049] In this embodiment, the operation command-association table combination items are filtered by a preset support threshold to generate a first candidate set, which can both filter noisy combinations and take into account low-frequency but business-critical secure access modes.

[0050] Optionally, after performing frequent itemset mining on the first transaction view to generate the first candidate itemset, the process includes: Determine whether each first candidate combination in the first candidate set contains at least one operation command and at least one association table; If the first candidate combination contains only operation commands or only association tables, then the first candidate combination is removed from the first candidate set.

[0051] In this embodiment, after performing a full set scan of the frequent itemset mining on the first transaction view composed of operation command-related table combination items to generate the first candidate itemset, the first candidate itemset is... Further implement a dual noise removal strategy to improve the business relevance of association rules and suppress false alarms caused by low-information itemsets.

[0052] Specifically, if the first candidate combination in the first candidate set contains only a single element (which may be just a table or a command), it is determined that its information content is insufficient, and the first candidate combination is directly removed from the first candidate set.

[0053] In this embodiment, by denoising the first candidate set, we can prevent "isolated table names" or "isolated commands" from being mistakenly identified as valid patterns. This reduces the noise in the subsequent matching of association rules with query statements and improves the accuracy of query statement validity judgment.

[0054] Optionally, frequent itemset mining is performed on the second transaction view to generate a second candidate itemset, including: Determine each combination of related table-projection field-filter condition in the second transaction view, and the total number of second transactions in the second transaction view; For each combination of association table-projection field-filter condition, the second support of the combination of association table-projection field-filter condition is determined based on the ratio of the number of second transactions containing the combination of association table-projection field-filter condition to the total number of second transactions. The second candidate combination is determined based on the combination of association table-projection field-filter conditions where the second support is greater than the preset support threshold; Based on the second candidate combination, a second candidate set is determined.

[0055] In this embodiment, the second transaction view consists of at least one second transaction, and the second transaction consists of at least one combination of related table, projection field, and filter condition.

[0056] The second total number of transactions refers to the total number of second transactions in the second transaction view, and the second support refers to the support of each associated table-projection field-filter condition combination in the second transaction view. The second candidate combination can be a single associated table-projection field-filter condition combination or a set of multiple associated table-projection field-filter condition combinations.

[0057] Specifically, an improved FP-Tree structure can be used to mine frequent itemsets in the second transaction view. First, the itemsets of each association table-projection field-filter condition combination are reordered and compressed according to the second support to reduce memory usage. Then, the condition FP-Tree is recursively grown along the compression path. When the second support of a certain association table-projection field-filter condition combination or a certain association table-projection field-filter condition combination set is greater than the preset support threshold, it is retained as the second candidate combination to construct the second candidate itemset.

[0058] It should be noted that the frequent itemset mining in the first transaction view focuses on the macro-relationship of "operation command - associated table," while this embodiment focuses on the fine-grained dependency features of "associated table - projected field - filtering condition." By applying the improved FP-Growth algorithm to the three types of element combinations—Relation, Attr, and Where—a conditional FP-Tree is quickly constructed and high-confidence field-level association patterns are recursively mined. The mining results form the second candidate itemset. This second set of candidate options intuitively reflects common query or filtering methods for the combined occurrence of multiple fields in the same related table, and can be used to detect the compliance of potentially sensitive field association access with high precision.

[0059] Optionally, after performing frequent itemset mining on the second transaction view to generate a second candidate itemset, the following can be included: Determine whether each second candidate combination in the second candidate set contains at least one associated table and at least one column-level element, wherein the column-level element is a projection field or a filtering condition; If the second candidate combination contains only associated tables or only column-level elements, then the second candidate combination is removed from the second candidate set.

[0060] In this embodiment, column-level elements are projection fields or filter conditions.

[0061] After completing the Relation-Attr / Where frequent itemset mining and generating the second candidate itemset, implementing complementary filtering of the association table and fields on the second candidate itemset can further improve the business interpretability and judgment accuracy of the association rules.

[0062] Specifically, a second candidate combination in the second candidate set is considered to have complete access semantics and is retained only if it contains at least one physical table name (Relation dimension) and at least one column-level element (Attr or Where dimension). If a second candidate combination in the second candidate set contains only a table name without fields, or contains only fields without specifying the table it belongs to, it is considered semantically incomplete and is discarded.

[0063] This complementary filtering strategy ensures that the final generated association rule base covers both "table-level" and "field-level" information, accurately depicting the joint access patterns of tables and fields in real business query scenarios. This rule convergence step significantly reduces noisy itemsets caused by isolated fields or cross-table concatenation, further compressing the size of the association rule base. It also effectively improves the hit rate and interpretability of subsequent online query matching. All high-confidence transaction items retained after complementary filtering are ultimately written into the rule file of the association rule base, available for use in query matching and alerting.

[0064] Furthermore, in practical applications, after denoising the first and second candidate sets, coverage evaluations are performed on the first and second candidate sets respectively to verify whether the generated first and second candidate sets can fully reflect the actual business query patterns.

[0065] Specifically, for each level of transaction view Each record is traversed sequentially, and the number of records where at least one frequent itemset is completely contained in the transaction feature vector of transaction T is counted. This number is then divided by the total number of transactions in that transaction view to obtain the coverage index cov(k). The higher the coverage, the more fully the generated results interpret historical samples. Furthermore, the evaluation results are automatically output as a verification report, with two thresholds set: a first-level rule coverage threshold of 90% and a second-level rule coverage threshold of 85%. When the first-level rule coverage threshold falls below 90% or the second-level rule coverage threshold falls below 85%, an adaptive coverage threshold mechanism is triggered, dynamically lowering the minimum support and re-executing FP-Growth mining until the coverage meets the requirements or reaches the system's preset support threshold. This achieves closed-loop verification and re-mining, ensuring that the first and second candidate itemsets maintain high completeness and business adaptability, while avoiding rule omissions due to excessively high preset support thresholds or noise inflation introduced by excessively low preset support thresholds.

[0066] S130. Determine the association rule base based on the first candidate set and the second candidate set.

[0067] In this embodiment, the generated first candidate set and second candidate set are merged to form an association rule base.

[0068] In this embodiment, the original transaction vector is orthogonally decomposed. One part consists of operation commands and association tables, while the other part consists of association tables, projection fields, and filtering conditions. Frequent itemset mining is performed independently on each part to generate a first candidate itemset and a second candidate itemset. The results are then merged to form the association rule base. This embodiment, by merging the two parts to construct the association rule base, breaks down the originally exponentially increasing computational complexity into a sum of two parts, effectively reducing the number of nodes and memory usage, thereby significantly improving the efficiency of association rule generation.

[0069] It should be noted that, to ensure the accessibility and compatibility of the association rule data in subsequent use, in practical applications, both the first and second candidate sets are stored on disk in both Excel and Parquet file formats. The Excel format offers good human-computer readability and editability, facilitating manual review and rule backtracking by security auditors; the Parquet format uses a columnar storage structure, supporting high compression ratios and efficient random access, making it suitable for fast I / O operations during rule base loading and batch matching.

[0070] Parallel writing in dual formats ensures the flexible applicability of the association rule base in various application scenarios such as auditing, verification, and secondary analysis. Furthermore, redundant writing with multiple replicas enhances storage security and reliability. In practical applications, the association rule base can be used to generate a unified rule directory structure, archived by version number and generation date, ensuring traceability and accurate version management across different batches of rules.

[0071] Optionally, after determining the association rule base based on the first candidate set and the second candidate set, the method further includes: New query statements from the database are obtained at preset time intervals, and the transaction feature vector of the new query statements is determined. Based on the transaction feature vector of the newly added query statement, frequent itemset mining is performed to generate an incremental rule set; The association rule base is updated based on the incremental rule set.

[0072] In this embodiment, the newly added query statement is a newly arrived SQL statement from the database, and the preset time interval can be preset.

[0073] This embodiment describes the update process of the association rule base. The parser parses the newly added query statement and extracts four features: operation command, association table, projection field, and filter conditions. These four features are then mapped to obtain the transaction feature vector of the newly added query statement.

[0074] Furthermore, the transaction feature vector of the newly added query statement is orthogonally divided into two parts: one part is the combination of operation command and related table of the newly added query statement, and the other part is the combination of related table, projection field and filter condition of the newly added query statement.

[0075] Based on the above frequent itemset mining method, frequent itemset mining is performed on the two combined items to generate corresponding incremental rule sets, including the first newly added candidate itemset and the second newly added candidate itemset. The first newly added candidate itemset and the second newly added candidate itemset are then merged with the first candidate itemset and the second candidate itemset in the association rule base, respectively, thereby realizing the periodic update of the association rule base.

[0076] It's important to note that to prevent the rule base from quickly becoming obsolete due to data accumulation, a periodic incremental update mechanism is introduced. At preset time intervals (e.g., daily or weekly), a rule generation process for new query statements is automatically triggered. Offline FP-Growth mining is specifically performed on newly added SQL transaction data to generate incremental rule sets. Subsequently, a set operation strategy is used to merge the existing rule base with the incremental rule sets, forming a new rule version. This merging process ensures that the rule base can dynamically absorb new access patterns while retaining historically valid rules, avoiding the high computational costs associated with full re-mining. In scenarios where data access patterns change rapidly with business needs, this strategy significantly improves the adaptability and update speed of the associated rule base, consistently maintaining high detection accuracy and coverage.

[0077] In this embodiment, by periodically and incrementally updating the association rule base, it is possible to ensure that the association rules adapt to the latest database access mode in a timely manner, achieve integrity verification, prevent data tampering or loss, ensure the long-term reliable operation of the association rules, and adapt to the latest business dynamics.

[0078] Furthermore, after the rule files in the association rule base are written and updated, strict integrity and consistency checks can be performed to prevent the rule files from being lost or tampered with during generation, storage, or transmission. Regarding integrity, the checksum of the rule file is calculated and compared with the reference value at the time of generation to ensure that the file content has not been modified. Regarding consistency, cross-validation is performed by counting the number of rules in the file and comparing it with corresponding support thresholds, filtering strategies, and other metadata to ensure that the structure and parameter configurations of the old and new versions remain consistent. In addition, a detailed verification report can be generated, including the file path, version number, verification time, detection results, and explanations of anomalies, for the security operations team to archive and review. Through this mechanism, data anomalies can be detected and corrective measures taken promptly at any stage of the association rule base's lifecycle, thereby ensuring the reliability and credibility of data matching and legality judgment.

[0079] Furthermore, in practical applications, to support efficient online matching of query data and related databases during subsequent data validity checks, after rule file generation and data verification are completed, the core metadata of the related rule base (such as the total number of rules, field dimension distribution, support threshold, version number, generation time, etc.) can be registered in a unified metadata management system. This metadata serves as a fast retrieval index before loading the related rule base, allowing the online detection engine to load only a portion of the rule file as needed, rather than the entire file, significantly shortening initialization time. Simultaneously, maintaining the rule lifecycle status (such as "currently enabled," "candidate backup," "obsolete") through the metadata system facilitates flexible switching between different rule set versions by operations personnel to cope with unexpected scenarios. This supports converting the related rule base into a Bloom filter or a hash-based fast matching structure in extremely high-concurrency environments, thereby maintaining the verification accuracy of query statements while further reducing query latency and achieving millisecond-level real-time alerts.

[0080] S140. Determine the target transaction feature vector of the target query statement.

[0081] In this embodiment, the target query statement is a database query statement whose legality needs to be determined, and the target transaction feature vector is generated from the target operation command, target association table, target projection field, and target filtering conditions of the target query statement.

[0082] Specifically, the target query statement of the database can be obtained in real time through the database's built-in logs, built-in tools / views, extension plugins, or third-party monitoring tools.

[0083] Furthermore, when the database receives a newly arrived SQL statement, it quickly parses the target query statement, extracting four core features: target operation command, target related table, target projection field, and target filtering condition. It also standardizes the case sensitivity, order, and redundancy of the target query statement to ensure that the generated feature representation is consistent with the format of the association rule base, thereby avoiding rule matching failures due to format differences. Simultaneously, it maps the target operation command, target related table, target projection field, and target filtering condition to generate a corresponding target transaction feature vector.

[0084] S150. Based on the association rule base, match the target transaction feature vector to determine the legality of the target query statement.

[0085] In this embodiment, the legality of the target query statement is determined by matching the target transaction feature vector according to the association rule base.

[0086] Specifically, the target operation command of the target query statement is combined with the target associated table and matched against the first candidate set in the association rule base. The target associated table, target projection fields, and target filter conditions involved in the target query statement are then compared against the second candidate set in the association rule base, resulting in two matching results. Finally, based on the combined matching results from both stages, the final judgment result is derived.

[0087] If both stages of the matching are successful, the target query is considered a legitimate access request that complies with security rules. If the matching fails at either stage, the target query is considered an abnormal access request that does not comply with security rules, and an alert event is immediately generated, along with detailed information such as the violation item set, missing commands or fields, for subsequent security auditing and forensics. Furthermore, by generating alert events and supporting real-time push to the security operations platform, as well as persistent storage, direct evidence can be provided for subsequent rule optimization and behavior analysis in the related rule base.

[0088] In this embodiment, each newly arrived SQL statement is analyzed and matched in milliseconds based on the association rule base to quickly determine whether its access behavior conforms to the existing security association rule base, and an alarm is triggered immediately when a potential data leakage risk is identified.

[0089] The technical solution of this invention decouples the features of historical query statements in the database in two levels and performs frequent itemset mining on each level to obtain a first candidate itemset and a second candidate itemset. The two candidate itemsets focus on data access patterns at the operation command-association table level and the association table-projection field-filter condition level, respectively. This reduces the complexity of association rule mining, improves the business relevance and interpretability of association rules, and provides a lightweight and accurate basis for judging the legality of target query statements. By matching the target transaction feature vector of the target query statement with the association rule base, it is easy to quickly judge the legality of the target query statement and locate abnormal access fields, improve the efficiency of data legality verification, and realize fast, accurate and interpretable online monitoring of potential leakage risks of database access.

[0090] Example 2 Figure 2 This is a flowchart illustrating a database query statement validity verification method according to Embodiment 2 of the present invention. This embodiment further specifies the method based on the previous embodiment. This embodiment is applicable to database query statement validity verification. The method can be executed by a database query statement validity verification device, which can be implemented in hardware and / or software and can be configured in any electronic device with network communication and computing capabilities. Figure 2 As shown, the method includes: S210. Determine the transaction feature vector of each historical query statement in the database, orthogonally divide the four features in the transaction feature vector, and construct a first transaction view and a second transaction view; the transaction feature vector consists of four features: operation command, associated table, projection field, and filter condition. The first transaction view is used to represent the data access pattern at the operation command-associated table level; the second transaction view is used to represent the data access pattern at the associated table-projection field-filter condition level.

[0091] S220. Perform frequent itemset mining on the first transaction view to generate a first candidate itemset, and perform frequent itemset mining on the second transaction view to generate a second candidate itemset.

[0092] S230. Determine the association rule base based on the first candidate set and the second candidate set.

[0093] S240. Determine the target transaction feature vector of the target query statement.

[0094] S250. Combine the target operation command and target association table in the target transaction feature vector to obtain the first-level combination, and combine the target association table, target projection field and target filtering conditions in the target transaction feature vector to obtain the second-level combination.

[0095] In this embodiment, the first-level combination is the target operation command - target association table combination item, and the second-level combination is the target association table - target projection field - target filter condition combination item.

[0096] S260. Match the first level combination with the first candidate set in the association rule base to obtain a first matching result, and match the second level combination with the second candidate set in the association rule base to obtain a second matching result.

[0097] In this embodiment, the first-level combination is matched with the first candidate set in the association rule base. If the first-level combination can be matched with any transaction item in the first candidate set of the association rule base, the first matching result is successful; otherwise, the first matching result is unsuccessful.

[0098] At the same time, the second-level combination is matched with the second candidate set in the association rule base. If the second-level combination can be matched with any transaction item in the second candidate set in the association rule base, the second matching result is successful; otherwise, the second matching result is unsuccessful.

[0099] It's important to note that when matching the first-level combination with the first candidate set in the association rule base, the matching logic not only requires a direct match to the first candidate set but also performs subset matching to capture broader patterns contained within the association rules. When matching the second-level combination with the second candidate set in the association rule base, the matching requires that the combination must match an itemset within the second candidate set or constitute a subset of it; otherwise, it is considered an anomaly and an alert is immediately issued. Because the second candidate set focuses on field-level access patterns, it can identify more granular violations, such as abnormal field access on legitimate tables, thereby significantly improving the accuracy and coverage of detection.

[0100] S270. If both the first and second matching results are successful, then the target query statement is deemed valid.

[0101] In this embodiment, the target query statement is determined to be a normal access request that conforms to the security rules if only the first matching result and the second matching result are both successfully matched.

[0102] It should be noted that the matching process can also determine whether to proceed with the second-level combination matching based on the first matching result. Specifically, the first-level combination is matched against the first candidate itemset in the association rule base. The matching logic not only requires a direct match to the first candidate itemset but also performs subset matching to capture broader patterns contained in the association rules. If the first-level combination neither completely matches the first candidate itemset nor constitutes a subset of any itemset, it is immediately identified as having potential risks and triggers a data leakage warning. This eliminates the need to proceed to the subsequent second-level combination matching stage, effectively shortening invalid matching paths and improving the overall legality verification speed.

[0103] S280. Otherwise, the target query statement is determined to be invalid, and the abnormal access fields on the target query statement are determined based on the first matching result and the second matching result.

[0104] In this embodiment, if both the first and second matching results are successful, the target query statement is determined to be a normal access request that complies with security rules. Otherwise, the target query statement is determined to be an abnormal access request that does not comply with security rules, and an alarm event is generated. The abnormal access field is located based on the first and second matching results. At the same time, the alarm is accompanied by detailed information such as the violation item set, missing command or abnormal access field, to provide evidence for subsequent security audits.

[0105] The technical solution of this invention decouples the features of historical query statements in the database in two levels and performs frequent itemset mining on each level to obtain a first candidate itemset and a second candidate itemset. The two candidate itemsets focus on data access patterns at the operation command-association table level and the association table-projection field-filter condition level, respectively. This reduces the complexity of association rule mining, improves the business relevance and interpretability of association rules, and provides a lightweight and accurate basis for judging the legality of target query statements. By matching the target transaction feature vector of the target query statement with the association rule base, it is easy to quickly judge the legality of the target query statement and locate abnormal access fields, improve the efficiency of data legality verification, and realize fast, accurate and interpretable online monitoring of potential leakage risks of database access.

[0106] Example 3 Figure 3 This is a schematic diagram of a database query statement validity verification device provided in Embodiment 3 of the present invention. This embodiment is applicable to the validity verification of database query statements. The database query statement validity verification device can be implemented in hardware and / or software, and can be configured in any electronic device with network communication and computing capabilities. Figure 3 As shown, the device includes: The transaction view determination module is used to determine the transaction feature vector of each historical query statement in the database, and orthogonally divide the features corresponding to the transaction feature vector to construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition. The first transaction view represents the data access pattern at the operation command-associated table level; the second transaction view represents the data access pattern at the associated table-projection field-filter condition level. The frequent itemset mining module is used to perform frequent itemset mining on the first transaction view to generate a first candidate itemset, and to perform frequent itemset mining on the second transaction view to generate a second candidate itemset. The rule base determination module is used to determine the associated rule base based on the first candidate set and the second candidate set; The target vector determination module is used to determine the target transaction feature vector of the target query statement; The target statement verification module is used to match the target transaction feature vector according to the association rule base to determine the legality of the target query statement.

[0107] Optionally, the first transaction view consists of at least one first transaction, and the first transaction consists of at least one operation command-related table combination item; frequent itemset mining is performed on the first transaction view to generate a first candidate itemset, including: Determine each operation command-related table combination item in the first transaction view, and the total number of first transactions in the first transaction view; For each type of operation command-association table combination, a first support degree for the operation command-association table combination is determined based on the ratio of the number of first transactions containing the type of operation command-association table combination to the total number of the first transactions. Based on the operation command-association table combination item whose first support is greater than the preset support threshold, determine the first candidate combination; Based on the first candidate combination, a first candidate set is determined.

[0108] Optionally, the second transaction view consists of at least one second transaction, and the second transaction consists of at least one combination of related table, projection field, and filter condition; frequent itemset mining is performed on the second transaction view to generate a second candidate itemset, including: Determine each combination of related table-projection field-filter condition in the second transaction view, and the total number of second transactions in the second transaction view; For each combination of association table-projection field-filter condition, the second support of the combination of association table-projection field-filter condition is determined based on the ratio of the number of second transactions containing the combination of association table-projection field-filter condition to the total number of second transactions. The second candidate combination is determined based on the combination of association table-projection field-filter conditions where the second support is greater than the preset support threshold; Based on the second candidate combination, a second candidate set is determined.

[0109] Optionally, after performing frequent itemset mining on the first transaction view to generate the first candidate itemset, the process includes: Determine whether each first candidate combination in the first candidate set contains at least one operation command and at least one association table; If the first candidate combination contains only operation commands or only association tables, then the first candidate combination is removed from the first candidate set.

[0110] Optionally, after performing frequent itemset mining on the second transaction view to generate a second candidate itemset, the following can be included: Determine whether each second candidate combination in the second candidate set contains at least one associated table and at least one column-level element, wherein the column-level element is a projection field or a filtering condition; If the second candidate combination contains only associated tables or only column-level elements, then the second candidate combination is removed from the second candidate set.

[0111] Optionally, based on the association rule base, the target transaction feature vector is matched to determine the legality of the target query statement, including: The first level combination is obtained by combining the target operation command and the target association table in the target transaction feature vector, and the second level combination is obtained by combining the target association table, the target projection field and the target filtering conditions in the target transaction feature vector. The first level combination is matched with the first candidate set in the association rule base to obtain a first matching result, and the second level combination is matched with the second candidate set in the association rule base to obtain a second matching result. If both the first and second matching results are successful, then the target query statement is considered valid. Otherwise, the target query statement is determined to be invalid, and the abnormal access fields on the target query statement are determined based on the first matching result and the second matching result.

[0112] Optionally, after determining the association rule base based on the first candidate set and the second candidate set, the method further includes: New query statements from the database are obtained at preset time intervals, and the transaction feature vector of the new query statements is determined. Based on the transaction feature vector of the newly added query statement, frequent itemset mining is performed to generate an incremental rule set; The association rule base is updated based on the incremental rule set.

[0113] The database query statement validity verification device provided in this embodiment of the invention can execute the database query statement validity verification method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0114] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0115] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0116] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0117] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as methods for validating the validity of database query statements.

[0118] In some embodiments, the database query statement validity verification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the database query statement validity verification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the database query statement validity verification method by any other suitable means (e.g., by means of firmware).

[0119] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0120] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0122] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0124] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0125] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0126] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0127] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for validating the validity of a database query statement, characterized in that, include: Determine the transaction feature vector of each historical query statement in the database, orthogonally partition the features corresponding to the transaction feature vector, and construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition; the first transaction view represents the data access pattern at the operation command-associated table level; the second transaction view represents the data access pattern at the associated table-projection field-filter condition level. Frequent itemset mining is performed on the first transaction view to generate a first candidate itemset, and frequent itemset mining is performed on the second transaction view to generate a second candidate itemset; Based on the first and second candidate sets, determine the association rule base; Determine the target transaction feature vector of the target query statement; The target transaction feature vector is generated from the target operation command, the target association table, the target projection field, and the target filtering conditions. Based on the association rule base, the target transaction feature vector is matched to determine the legality of the target query statement.

2. The method according to claim 1, characterized in that, The first transaction view consists of at least one first transaction, and the first transaction consists of at least one operation command-related table combination item; frequent itemset mining is performed on the first transaction view to generate a first candidate itemset, including: Determine each operation command-related table combination item in the first transaction view, and the total number of first transactions in the first transaction view; For each type of operation command-association table combination, a first support degree for the operation command-association table combination is determined based on the ratio of the number of first transactions containing the type of operation command-association table combination to the total number of the first transactions. Based on the operation command-association table combination item whose first support is greater than the preset support threshold, determine the first candidate combination; Based on the first candidate combination, a first candidate set is determined.

3. The method according to claim 1, characterized in that, The second transaction view consists of at least one second transaction, which is composed of at least one combination of related table, projection field, and filter condition. Frequent itemset mining is performed on the second transaction view to generate a second candidate itemset, including: Determine each combination of related table-projection field-filter condition in the second transaction view, and the total number of second transactions in the second transaction view; For each combination of association table-projection field-filter condition, the second support of the combination of association table-projection field-filter condition is determined based on the ratio of the number of second transactions containing the combination of association table-projection field-filter condition to the total number of second transactions. The second candidate combination is determined based on the combination of association table-projection field-filter conditions where the second support is greater than the preset support threshold; Based on the second candidate combination, a second candidate set is determined.

4. The method according to claim 2, characterized in that, After performing frequent itemset mining on the first transaction view to generate the first candidate itemset, the process includes: Determine whether each first candidate combination in the first candidate set contains at least one operation command and at least one association table; If the first candidate combination contains only operation commands or only association tables, then the first candidate combination is removed from the first candidate set.

5. The method according to claim 3, characterized in that, After performing frequent itemset mining on the second transaction view to generate a second candidate itemset, it includes: Determine whether each second candidate combination in the second candidate set contains at least one associated table and at least one column-level element, wherein the column-level element is a projection field or a filtering condition; If the second candidate combination contains only associated tables or only column-level elements, then the second candidate combination is removed from the second candidate set.

6. The method according to claim 1, characterized in that, Based on the aforementioned association rule base, the target transaction feature vector is matched to determine the legality of the target query statement, including: The first level combination is obtained by combining the target operation command and the target association table in the target transaction feature vector, and the second level combination is obtained by combining the target association table, the target projection field and the target filtering conditions in the target transaction feature vector. The first level combination is matched with the first candidate set in the association rule base to obtain a first matching result, and the second level combination is matched with the second candidate set in the association rule base to obtain a second matching result. If both the first and second matching results are successful, then the target query statement is considered valid. Otherwise, the target query statement is deemed invalid, and the abnormal access fields on the target query statement are determined based on the first and second matching results.

7. The method according to claim 1, characterized in that, After determining the association rule base based on the first and second candidate sets, the following steps are also included: New query statements from the database are obtained at preset time intervals, and the transaction feature vector of the new query statements is determined. Based on the transaction feature vector of the newly added query statement, frequent itemset mining is performed to generate an incremental rule set; The association rule base is updated based on the incremental rule set.

8. A database query statement validity verification device, characterized in that, include: The transaction view determination module is used to determine the transaction feature vector of each historical query statement in the database, orthogonally divide the features corresponding to the transaction feature vector, and construct a first transaction view and a second transaction view. The transaction feature vector is determined by four features: operation command, associated table, projection field, and filter condition; the first transaction view represents the data access pattern at the operation command-associated table level; the second transaction view represents the data access pattern at the associated table-projection field-filter condition level. The frequent itemset mining module is used to perform frequent itemset mining on the first transaction view to generate a first candidate itemset, and to perform frequent itemset mining on the second transaction view to generate a second candidate itemset. The rule base determination module is used to determine the associated rule base based on the first candidate set and the second candidate set; The target vector determination module is used to determine the target transaction feature vector of the target query statement; The target transaction feature vector is generated from the target operation command of the target query statement, the target association table, the target projection field, and the target filtering conditions. The target statement verification module is used to match the target transaction feature vector according to the association rule base to determine the legality of the target query statement.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the database query statement validity verification method as described in any one of claims 1-7.

10. A storage medium for storing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the legality verification method for database query statements as described in any one of claims 1-7.

Images