Anomaly detection method and system for database, and storage medium

Abstract

The present invention relates to the technical field of databases. Disclosed are an anomaly detection method and system for a database, and a storage medium. The method comprises: acquiring a data acquisition request, determining, on the basis of the data acquisition request, a database to be queried, and intercepting a data packet generated when the database to be queried and a client perform data interaction; parsing the data packet to obtain a key used when the database to be queried and the client perform the data interaction; on the basis of the key, decrypting the data packet generated when the database to be queried and the client perform the data interaction, and obtaining data to be detected; inputting the data to be detected into a database security model, and determining whether the data to be detected is anomaly data; and when the data to be detected is anomaly data, acquiring user login information of the client, and on the basis of the user login information, generating alarm information for the data to be detected. The present invention solves the technical problem of being incapable of performing real-time detection on anomaly behaviors present in databases, reduces the false alarm rate, and effectively improves the efficiency of database anomaly behavior detection.

Description

Anomaly detection method, system and storage medium for database Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a method, system and storage medium for detecting anomalies in a database. Background Art

[0002] A database is a collection of data organized according to a data model and stored in secondary storage. Database security has always been a concern within network information security systems. Database threats are primarily categorized as external attacks and internal attacks. External attacks involve unauthorized users exploiting system vulnerabilities to gain illegal database access. While traditional database security services can provide some defenses against external attacks, they are less effective against security issues caused by internal personnel abusing their privileges. These attacks are known as insider attacks. Because insiders are fully aware of system security settings and may even have access to certain data, these database transactions are difficult to detect, posing a potential threat to data. Therefore, preventing internal attacks has become particularly important. Given the inadequacy of existing security measures and the need to prevent these attacks, it is necessary to design a database anomaly detection method to protect database information security.

[0003] Currently, methods for detecting abnormal records are proposed by mining normal user history records and using machine learning models for detection. Methods for intrusion detection have been proposed that extract behavioral features from relevant system data, or that use support vector machine classification methods to detect network intrusions. However, while existing anomaly detection methods improve intrusion detection capabilities, they also increase false alarm rates, causing some disruption to legitimate users. Summary of the Invention

[0004] The embodiments of the present invention provide a method, system and storage medium for detecting anomalies in a database, which are used to solve the technical problems in the prior art that abnormal behaviors in the database cannot be detected in real time, the false alarm rate cannot be reduced, and the efficiency of detecting abnormal behaviors in the database is low.

[0005] To achieve the above object, the present invention provides a method for detecting anomalies in a database, the method comprising:

[0006] Obtaining a data acquisition request, determining a database to be queried based on the data acquisition request, and intercepting data packets generated when the database to be queried interacts with a client;

[0007] Parsing the data packet to obtain a key used by the database to be queried and the client for data interaction;

[0008] Decrypting the data packets generated when the database to be queried interacts with the client according to the key, and obtaining the data to be detected;

[0009] Inputting the data to be detected into a database security model to determine whether the data to be detected is abnormal data;

[0010] When the data to be detected is abnormal data, user login information of the client is obtained, and alarm information of the data to be detected is generated according to the user login information.

[0011] In one embodiment, before intercepting the data packet generated when the database to be queried interacts with the client, the method further includes:

[0012] Acquire interception information corresponding to the database to be queried, wherein the interception information is used to indicate the interception frequency of data packets when the database to be queried interacts with the client;

[0013] According to the interception frequency of the data packets, data packets generated when the database to be queried interacts with the client are intercepted at intervals.

[0014] In one embodiment, when parsing the data packet to obtain a key used by the database to be queried and the client for data interaction, the method includes:

[0015] Inputting a data packet generated when the database to be queried interacts with the client into the machine learning model, inputting a label into the machine learning model, and marking the data packet carrying the key if the label indicates that the data packet carries a key;

[0016] Parsing the marked data packets based on the machine learning model to obtain a key used when the database to be queried interacts with the client;

[0017] The machine learning model is obtained by training multiple sets of training data, and each set of training data includes a data packet and a label for identifying whether the data packet carries a key.

[0018] In one embodiment, the database security model is constructed according to the following method:

[0019] Acquire historical abnormal data generated when the client interacts with the database to be queried;

[0020] Setting model parameters according to the operating environment of the database to be queried;

[0021] Extracting an abnormality verification field from the field content of the historical abnormal data according to the model parameters;

[0022] The database security model is constructed according to the abnormal verification field and the model parameters.

[0023] In one embodiment, when inputting the data to be detected into a database security model and determining whether the data to be detected is abnormal data, the process includes:

[0024] Determine whether the data to be detected contains the abnormal verification field,

[0025] If yes, then the data to be detected is determined to be abnormal data;

[0026] If not, it is determined that the data to be detected is normal data.

[0027] In one embodiment, when obtaining the user login information of the client and generating the alarm information of the data to be detected according to the user login information, the method includes:

[0028] Setting information collection rules, and obtaining the user login information of the client according to the information collection rules, wherein the information collection rules include collecting account numbers and collecting passwords;

[0029] Based on the user login information, the network traffic data of the database to be queried is collected and analyzed, and the alarm information of the data to be detected is generated according to the network traffic data.

[0030] In one embodiment, when generating the alarm information of the data to be detected based on the network traffic data, it includes:

[0031] Setting network traffic analysis parameters, and analyzing the network traffic data of the query database according to the network traffic analysis parameters, wherein the network traffic data includes: download data volume and download speed;

[0032] When the amount of downloaded data is greater than or equal to the preset amount of downloaded data, and the download speed is greater than or equal to the preset amount of downloaded data, a first-level alarm message is generated;

[0033] When the downloaded data amount is greater than or equal to the preset downloaded data amount, and the download speed is less than the preset downloaded data amount, a second-level alarm message is generated;

[0034] When the downloaded data amount is less than the preset downloaded data amount and the download speed is greater than or equal to the preset downloaded data amount, a second-level alarm message is generated;

[0035] When the downloaded data amount is less than the preset downloaded data amount and the download speed is less than the preset downloaded data amount, a third-level alarm message is generated.

[0036] In one embodiment, a database anomaly detection system is also disclosed, the system comprising:

[0037] An interception module is used to obtain a data acquisition request, determine a database to be queried based on the data acquisition request, and intercept data packets generated when the database to be queried interacts with the client;

[0038] A parsing module, configured to parse the data packet to obtain a key used when the database to be queried interacts with the client;

[0039] an obtaining module, configured to decrypt, according to the key, a data packet generated when the database to be queried interacts with the client, and obtain the data to be detected;

[0040] A judgment module, configured to input the data to be detected into a database security model and judge whether the data to be detected is abnormal data;

[0041] The alarm module is used to obtain the user login information of the client when the data to be detected is abnormal data, and generate alarm information of the data to be detected according to the user login information.

[0042] In one embodiment, a computer device is also disclosed, comprising a processor, a memory, and an anomaly detection management program for a database stored in the memory and executable by the processor. When the anomaly detection management program for a database is executed by the processor, the steps of the above-mentioned anomaly detection method for a database are implemented.

[0043] In one embodiment, a computer-readable storage medium is further disclosed, characterized in that a database anomaly detection management program is stored on the computer-readable storage medium, wherein when the database anomaly detection management program is executed by a processor, the steps of the above-mentioned database anomaly detection method are implemented.

[0044] The present invention provides a method, system, and storage medium for detecting anomalies in a database, which have the following advantages over the prior art:

[0045] The present invention discloses a method, system and storage medium for detecting anomalies in a database. The method comprises the following steps: obtaining a data acquisition request, determining a database to be queried based on the data acquisition request, intercepting a data packet generated when the database to be queried interacts with a client, parsing the data packet, obtaining a key used when the database to be queried interacts with the client, decrypting the data packet generated when the database to be queried interacts with the client according to the key, obtaining data to be detected, inputting the data to be detected into a database security model, determining whether the data to be detected is abnormal data, obtaining user login information of the client when the data to be detected is abnormal data, and generating alarm information of the data to be detected according to the user login information. The present invention solves the technical problem of being unable to perform real-time detection of abnormal behavior in a database, reduces the false alarm rate, and effectively improves the efficiency of detecting abnormal behavior in the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] FIG1 is a schematic diagram showing a flow chart of a method for detecting anomalies in a database according to an embodiment of the present invention;

[0047] FIG2 shows a schematic structural diagram of an anomaly detection system for a database according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following embodiments are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0049] In the description of this application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on this application.

[0050] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0051] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in this application based on the specific circumstances.

[0052] The following is a description of preferred embodiments of the present invention with reference to the accompanying drawings.

[0053] As shown in FIG1 , an embodiment of the present invention discloses a method for detecting anomalies in a database, the method comprising:

[0054] S110: Obtain a data acquisition request, determine a database to be queried based on the data acquisition request, and intercept data packets generated when the database to be queried interacts with a client.

[0055] In this embodiment, when data needs to be obtained from a database, the user sends a data acquisition request through a client, and the database to be queried is determined based on the data acquisition request.

[0056] S120: Parse the data packet to obtain a key used when the database to be queried and the client perform data interaction.

[0057] In some embodiments of the present application, before intercepting the data packet generated when the database to be queried interacts with the client, the method further includes:

[0058] Acquire interception information corresponding to the database to be queried, wherein the interception information is used to indicate the interception frequency of data packets when the database to be queried interacts with the client;

[0059] According to the interception frequency of the data packets, data packets generated when the database to be queried interacts with the client are intercepted at intervals.

[0060] In this embodiment, the data packets generated when the database to be queried interacts with the client are intercepted at intervals according to the interception frequency. The interception frequency can be set according to actual conditions, such as 10 seconds, 15 seconds, etc., and is not specifically limited here. By setting the interception frequency, the present invention can ensure that each data packet is detected for anomalies to avoid missed detections.

[0061] In some embodiments of the present application, parsing the data packet to obtain a key used by the database to be queried and the client for data interaction includes:

[0062] Inputting a data packet generated when the database to be queried interacts with the client into the machine learning model, inputting a label into the machine learning model, and marking the data packet carrying the key if the label indicates that the data packet carries a key;

[0063] Parsing the marked data packets based on the machine learning model to obtain a key used when the database to be queried interacts with the client;

[0064] The machine learning model is obtained by training multiple sets of training data, and each set of training data includes a data packet and a label for identifying whether the data packet carries a key.

[0065] In this embodiment, the data packet generated when the database to be queried interacts with the client for data is input into the machine learning model. Since the machine learning model is trained with multiple sets of training data, each set of training data includes a data packet and a label for identifying whether the data packet carries a key. Therefore, it is possible to determine whether the generated data packet is an encrypted data packet, and mark the encrypted data packet. The marked data packet is parsed based on the machine learning model to obtain the key, and the encrypted data packet is decrypted according to the key. It should be understood that if the generated data packet is not encrypted, the data packet is directly monitored for abnormalities. The present invention ensures data security and prevents data leakage when the data packet is parsed. At the same time, it can prevent criminals from attacking the database through encryption.

[0066] S130: Decrypting the data packet generated when the database to be queried and the client perform data interaction according to the key, and obtaining the data to be detected.

[0067] In this embodiment, after the key is obtained, the corresponding data packet is decrypted according to the obtained key to obtain the data to be detected.

[0068] S140: Input the data to be detected into the database security model to determine whether the data to be detected is abnormal data.

[0069] In some embodiments of the present application, the database security model is constructed according to the following method:

[0070] Acquire historical abnormal data generated when the client interacts with the database to be queried;

[0071] Setting model parameters according to the operating environment of the database to be queried;

[0072] Extracting an abnormality verification field from the field content of the historical abnormal data according to the model parameters;

[0073] The database security model is constructed according to the abnormal verification field and the model parameters.

[0074] In this embodiment, historical abnormal data generated when the client and the database to be queried have historical interactions are obtained. The model parameters can be implemented by the user according to the corresponding needs. The model parameters set by the user according to the system environment of the database are received, and the abnormal verification field is extracted from the field content of the historical abnormal data. It should be understood that there are abnormal fields in the historical abnormal data. All abnormal fields are integrated to obtain the abnormal verification field. Finally, a database security model is constructed based on the abnormal verification field and the model parameters. The present invention can realize real-time and rapid detection of the data to be detected by constructing a database security model, thereby improving the efficiency of abnormal data detection.

[0075] In some embodiments of the present application, when inputting the data to be detected into a database security model and determining whether the data to be detected is abnormal data, the process includes:

[0076] Determine whether the data to be detected contains the abnormal verification field,

[0077] If yes, then the data to be detected is determined to be abnormal data;

[0078] If not, it is determined that the data to be detected is normal data.

[0079] In this embodiment, if the data to be detected contains an abnormal verification field, the data to be detected is judged to be abnormal data. Otherwise, the data to be detected is judged to be normal data. It should be understood that as long as the data to be detected contains an abnormal verification field, the data to be detected is judged to be abnormal data. It is not necessary to include all of them. The present invention can protect the security of the database and ensure the security of user access behavior.

[0080] S150: When the data to be detected is abnormal data, obtaining user login information of the client, and generating alarm information of the data to be detected according to the user login information.

[0081] In some embodiments of the present application, when obtaining the user login information of the client and generating the alarm information of the data to be detected according to the user login information, the process includes:

[0082] Setting information collection rules, and obtaining the user login information of the client according to the information collection rules, wherein the information collection rules include collecting account numbers and collecting passwords;

[0083] Based on the user login information, the network traffic data of the database to be queried is collected and analyzed, and the alarm information of the data to be detected is generated according to the network traffic data.

[0084] In this embodiment, information collection rules are set, and the user login information of the client is obtained according to the information collection rules, the network traffic data of the database to be queried is collected and analyzed, and alarm information of the data to be detected is generated based on the network traffic data. When the data to be detected is abnormal data, the present invention can issue an alarm in real time to remind the staff to perform relevant processing.

[0085] In some embodiments of the present application, when generating the alarm information of the data to be detected according to the network traffic data, it includes:

[0086] Setting network traffic analysis parameters, and analyzing the network traffic data of the query database according to the network traffic analysis parameters, wherein the network traffic data includes: download data volume and download speed;

[0087] When the amount of downloaded data is greater than or equal to the preset amount of downloaded data, and the download speed is greater than or equal to the preset amount of downloaded data, a first-level alarm message is generated;

[0088] When the downloaded data amount is greater than or equal to the preset downloaded data amount, and the download speed is less than the preset downloaded data amount, a second-level alarm message is generated;

[0089] When the downloaded data amount is less than the preset downloaded data amount and the download speed is greater than or equal to the preset downloaded data amount, a second-level alarm message is generated;

[0090] When the downloaded data amount is less than the preset downloaded data amount and the download speed is less than the preset downloaded data amount, a third-level alarm message is generated.

[0091] In this embodiment, the network traffic data includes the amount of downloaded data and the download speed. The preset amount of downloaded data and the preset download speed can be set according to actual conditions. According to the relationship between the amount of downloaded data, the download speed, the preset amount of downloaded data and the download speed, a first-level alarm information, a second-level alarm information and a third-level alarm information can be generated. Among them, the first-level alarm information is the most serious, the second-level alarm information is medium, and the third-level alarm information is weak. The present invention can give different alarm head reminders to the staff through different alarm levels, which can improve the processing efficiency of the staff, shorten the abnormal data processing time, avoid affecting the normal use of the user, improve the user experience, and at the same time ensure the normal operation of the database, reduce the workload of manual monitoring, and reduce the database operation and maintenance costs.

[0092] In order to further illustrate the technical idea of ​​the present invention, the technical solution of the present invention is now described in combination with specific application scenarios.

[0093] Correspondingly, as shown in FIG2 , the present application further provides an anomaly detection system for a database, the system comprising:

[0094] An interception module is used to obtain a data acquisition request, determine a database to be queried based on the data acquisition request, and intercept data packets generated when the database to be queried interacts with the client;

[0095] A parsing module, configured to parse the data packet to obtain a key used when the database to be queried interacts with the client;

[0096] an obtaining module, configured to decrypt, according to the key, a data packet generated when the database to be queried interacts with the client, and obtain the data to be detected;

[0097] A judgment module, configured to input the data to be detected into a database security model and judge whether the data to be detected is abnormal data;

[0098] The alarm module is used to obtain the user login information of the client when the data to be detected is abnormal data, and generate alarm information of the data to be detected according to the user login information.

[0099] In some embodiments of the present application, the parsing module is specifically used to:

[0100] Acquire interception information corresponding to the database to be queried, wherein the interception information is used to indicate the interception frequency of data packets when the database to be queried interacts with the client;

[0101] According to the interception frequency of the data packets, data packets generated when the database to be queried interacts with the client are intercepted at intervals.

[0102] In some embodiments of the present application, the parsing module is specifically used to:

[0103] Inputting a data packet generated when the database to be queried interacts with the client into the machine learning model, inputting a label into the machine learning model, and marking the data packet carrying the key if the label indicates that the data packet carries a key;

[0104] Parsing the marked data packets based on the machine learning model to obtain a key used when the database to be queried interacts with the client;

[0105] The machine learning model is obtained by training multiple sets of training data, and each set of training data includes a data packet and a label for identifying whether the data packet carries a key.

[0106] In some embodiments of the present application, the judgment module is specifically configured to:

[0107] Acquire historical abnormal data generated when the client interacts with the database to be queried;

[0108] Setting model parameters according to the operating environment of the database to be queried;

[0109] Extracting an abnormality verification field from the field content of the historical abnormal data according to the model parameters;

[0110] The database security model is constructed according to the abnormal verification field and the model parameters.

[0111] In some embodiments of the present application, the judgment module is specifically configured to:

[0112] Determine whether the data to be detected contains the abnormal verification field,

[0113] If yes, then the data to be detected is determined to be abnormal data;

[0114] If not, it is determined that the data to be detected is normal data.

[0115] In some embodiments of the present application, the alarm module is specifically used to:

[0116] Setting information collection rules, and obtaining the user login information of the client according to the information collection rules, wherein the information collection rules include collecting account numbers and collecting passwords;

[0117] Based on the user login information, the network traffic data of the database to be queried is collected and analyzed, and the alarm information of the data to be detected is generated according to the network traffic data.

[0118] In some embodiments of the present application, the alarm module is specifically used to:

[0119] Setting network traffic analysis parameters, and analyzing the network traffic data of the query database according to the network traffic analysis parameters, wherein the network traffic data includes: download data volume and download speed;

[0120] When the amount of downloaded data is greater than or equal to the preset amount of downloaded data, and the download speed is greater than or equal to the preset amount of downloaded data, a first-level alarm message is generated;

[0121] When the downloaded data amount is greater than or equal to the preset downloaded data amount, and the download speed is less than the preset downloaded data amount, a second-level alarm message is generated;

[0122] When the downloaded data amount is less than the preset downloaded data amount and the download speed is greater than or equal to the preset downloaded data amount, a second-level alarm message is generated;

[0123] When the downloaded data amount is less than the preset downloaded data amount and the download speed is less than the preset downloaded data amount, a third-level alarm message is generated.

[0124] In some embodiments of the present application, a computer device is also disclosed, comprising a processor, a memory, and an anomaly detection management program for a database stored in the memory and executable by the processor, wherein when the anomaly detection management program for a database is executed by the processor, the steps of the above-mentioned anomaly detection method for a database are implemented.

[0125] In some embodiments of the present application, a computer-readable storage medium is further disclosed, characterized in that a database anomaly detection management program is stored on the computer-readable storage medium, wherein when the database anomaly detection management program is executed by a processor, the steps of the above-mentioned database anomaly detection method are implemented.

[0126] In summary, the embodiment of the present invention obtains a data acquisition request, determines the database to be queried based on the data acquisition request, intercepts the data packet generated when the database to be queried interacts with the client for data, parses the data packet, obtains the key used when the database to be queried interacts with the client for data, decrypts the data packet generated when the database to be queried interacts with the client according to the key, obtains the data to be detected, inputs the data to be detected into the database security model, determines whether the data to be detected is abnormal data, and when the data to be detected is abnormal data, obtains the user login information of the client, and generates alarm information of the data to be detected according to the user login information. The present invention solves the technical problem that abnormal behavior in the database cannot be detected in real time, reduces the false alarm rate, and effectively improves the efficiency of detecting abnormal behavior in the database.

[0127] In the description of the above embodiments, specific features, structures, materials or characteristics may be combined in an appropriate manner in any one or more embodiments or examples.

[0128] Although the present invention has been described above with reference to exemplary embodiments, various modifications may be made and equivalent components may be substituted without departing from the scope of the present invention. In particular, the various features of the disclosed embodiments may be combined with one another in any manner, provided no structural conflicts exist. These combinations are not fully described in this specification solely for the sake of space and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but encompasses all technical solutions within the scope of the claims.

[0129] Those skilled in the art will understand that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will still be able to modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein with equivalents. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in a database, characterized in that: The method comprises: Obtaining a data acquisition request, determining a database to be queried based on the data acquisition request, and intercepting a data packet generated when the database to be queried interacts with a client; Parsing the data packet to obtain a key used by the database to be queried and the client for data interaction; Decrypting the data packets generated when the database to be queried interacts with the client according to the key, and obtaining the data to be detected; Inputting the data to be detected into a database security model to determine whether the data to be detected is abnormal data; When the data to be detected is abnormal data, user login information of the client is obtained, and alarm information of the data to be detected is generated according to the user login information.

2. The method for detecting anomalies in a database according to claim 1, characterized in that: Before intercepting the data packet generated when the database to be queried interacts with the client, the method further includes: Acquire interception information corresponding to the database to be queried, wherein the interception information is used to indicate the interception frequency of data packets when the database to be queried interacts with the client; According to the interception frequency of the data packets, data packets generated when the database to be queried interacts with the client are intercepted at intervals.

3. The method for detecting anomalies in a database according to claim 1, characterized in that: When the data packet is parsed to obtain a key used by the database to be queried for data interaction with the client, the method includes: Inputting a data packet generated when the database to be queried interacts with the client into the machine learning model, inputting a label into the machine learning model, and marking the data packet carrying the key if the label indicates that the data packet carries a key; Parsing the marked data packet based on the machine learning model to obtain a key used when the database to be queried interacts with the client for data; The machine learning model is obtained by training with multiple sets of training data, and each set of training data includes a data packet and a label for identifying whether the data packet carries a key.

4. The method for detecting anomalies in a database according to claim 1, characterized in that: The database security model is constructed according to the following method: Acquire historical abnormal data generated when the client and the database to be queried have historical interactions; Setting model parameters according to the operating environment of the database to be queried; Extracting an abnormal verification field from the field content of the historical abnormal data according to the model parameters; The database security model is constructed according to the abnormal verification field and the model parameters.

5. The method for detecting anomalies in a database according to claim 4, characterized in that: When the data to be detected is input into the database security model and whether the data to be detected is abnormal data is determined, it includes: Determine whether the data to be detected contains the abnormal verification field, If yes, then the data to be detected is determined to be abnormal data; If not, it is determined that the data to be detected is normal data.

6. The method for detecting anomalies in a database according to claim 1, characterized in that: When the user login information of the client is obtained and the alarm information of the data to be detected is generated according to the user login information, it includes: Setting information collection rules, and obtaining the user login information of the client according to the information collection rules, wherein the information collection rules include collecting account numbers and collecting passwords; Based on the user login information, the network traffic data of the database to be queried is collected and analyzed, and the alarm information of the data to be detected is generated according to the network traffic data.

7. The method for detecting anomalies in a database according to claim 6, characterized in that: When generating the alarm information of the data to be detected according to the network traffic data, it includes: Setting network traffic analysis parameters, and analyzing the network traffic data with the query database according to the network traffic analysis parameters, wherein the network traffic data includes: download data volume and download speed; When the amount of downloaded data is greater than or equal to the preset amount of downloaded data, and the download speed is greater than or equal to the preset amount of downloaded data, a first-level alarm message is generated; When the amount of downloaded data is greater than or equal to the preset amount of downloaded data, and the download speed is less than the preset amount of downloaded data, a second-level alarm message is generated; When the downloaded data amount is less than the preset downloaded data amount, and the download speed is greater than or equal to the preset downloaded data amount, a second-level alarm message is generated; When the downloaded data amount is less than the preset downloaded data amount, and the download speed is less than the preset downloaded data amount, a third-level alarm message is generated.

8. An anomaly detection system for a database, characterized in that: The system comprises: An interception module, used to obtain a data acquisition request, determine a database to be queried based on the data acquisition request, and intercept a data packet generated when the database to be queried interacts with a client; A parsing module, used to parse the data packet to obtain a key used when the database to be queried interacts with the client; An acquisition module, used to decrypt the data packet generated when the database to be queried interacts with the client according to the key, and obtain the data to be detected; A judgment module, used for inputting the data to be detected into a database security model to judge whether the data to be detected is abnormal data; The alarm module is used to obtain the user login information of the client when the data to be detected is abnormal data, and generate alarm information of the data to be detected according to the user login information.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and an anomaly detection management program for a database stored in the memory and executable by the processor, wherein when the anomaly detection management program for a database is executed by the processor, the steps of an anomaly detection method for a database as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an anomaly detection management program for a database, wherein when the anomaly detection management program for a database is executed by a processor, the steps of an anomaly detection method for a database as described in any one of claims 1 to 7 are implemented.

Images