A method and device for scanning sensitive data in a database

Abstract

The present invention provides a method for scanning sensitive data in a database, which relates to the technical field of database scanning. The method includes: obtaining the databases alive in the network; identifying the databases to obtain the database types; scanning the databases to obtain the data information in the databases; identifying the data information to obtain the sensitive data; and organizing the sensitive data to form visual data, which has the characteristics of convenient and fast searching and accurate and friendly data. The present invention also provides a device for scanning sensitive data in a database, which applies the above method and has the same technical advantages.

Description

Technical Field

[0001] The present invention relates to the technical field of database scanning, and in particular, to a method and device for scanning sensitive data in a database. Background Art

[0002] There are many databases in the user network. Due to historical reasons, many databases are no longer managed and become zombie databases, lacking means for rapid scanning and discovery, and having relatively high security risks. In addition, a large amount of sensitive data is stored in the databases, and it is impossible to discover and locate the sensitive data from the massive data, lacking unified supervision of the sensitive data. Therefore, the existing technology needs to be improved. Summary of the Invention

[0003] The purpose of the present invention is to provide a method for scanning sensitive data in a database, which can propose a solution for the deficiencies of the existing technology and has the characteristics of convenient and fast searching and accurate and friendly data.

[0004] Another purpose of the present invention is to provide a device for scanning sensitive data in a database, which has the same characteristics.

[0005] The embodiments of the present invention are implemented as follows:

[0006] In a first aspect, the present invention provides a method for scanning sensitive data in a database, including:

[0007] Obtain the databases alive in the network;

[0008] Identify the databases to obtain the database types;

[0009] Scan the databases to obtain the data information in the databases;

[0010] Identify the data information to obtain the sensitive data;

[0011] Sort out the sensitive data to form visual data.

[0012] Further, in some embodiments of the present invention, the above-mentioned obtaining the existing databases in the network includes:

[0013] Obtain the alive user IP addresses in the network;

[0014] According to the user IP addresses, obtain the open ports;

[0015] Through the ports, obtain the alive databases.

[0016] Further, in some embodiments of the present invention, the above-mentioned identifying the databases to obtain the database types includes:

[0017] Obtain the open port information;

[0018] Compare the port information to identify the database type corresponding to the port information.

[0019] Further, in some embodiments of the present invention, scan the above-mentioned database to obtain data information in the database, including:

[0020] Obtain the database type and determine the services that the database can output;

[0021] Obtain the data in the services that the database can output to form data information.

[0022] Further, in some embodiments of the present invention, identify the above-mentioned data information to obtain sensitive data, including:

[0023] Identify the data information and extract data features;

[0024] Compare the data features with the sensitive data features in the sensitive data feature library to obtain the sensitive data features in the library;

[0025] Obtain the distribution information and location information of the sensitive data features;

[0026] Obtain the sensitive data according to the distribution information and location information.

[0027] Further, in some embodiments of the present invention, organize the above-mentioned sensitive data to form visual data, including:

[0028] Obtain the time information of this acquisition of sensitive data and record it to form a recording time;

[0029] Arrange the recording time and the obtained sensitive data regularly to form a final data form;

[0030] Output the final data form as visual data.

[0031] In a second aspect, the present invention also provides a database sensitive data scanning device, including:

[0032] A database scanning module for scanning the databases in the network to obtain scan data;

[0033] A database service discovery module for identifying the obtained scan data to determine the database and its type;

[0034] A data feature matching module for performing feature matching with the sensitive data features stored in the database fields through the data feature matching module to determine the distribution and location of the sensitive data;

[0035] A visual display module for visually displaying the information of the sensitive data.

[0036] Further, in some embodiments of the present invention, the above visualization display module includes an arrangement module and a visualization processing module. The arrangement module is used to arrange sensitive data in an organized and regular manner to form a final data form. The visualization processing module is used to perform visualization processing on the final data form to form visualization data.

[0037] In a third aspect, the present invention also provides an electronic device, including:

[0038] A memory for storing one or more programs;

[0039] A processor;

[0040] When the one or more programs are executed by the processor, the above method is implemented.

[0041] In a fourth aspect, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above method is implemented.

[0042] Compared with the prior art, the embodiments of the present invention at least have the following advantages or beneficial effects:

[0043] Effect 1: It is convenient and fast to search. The present invention first obtains the surviving databases in the network; identifies the databases to obtain the database types; then scans the databases to obtain the data information in the databases; then identifies the data information to obtain the sensitive data; and finally arranges the sensitive data to form visualization data. The above method can be implemented by the following device. The device includes a database scanning module for scanning the databases in the network to obtain scanning data; a database service discovery module for identifying the obtained scanning data to determine the databases and their types; a data feature matching module for performing feature matching with the sensitive data features stored in the database fields through the data feature matching module to determine the distribution and location of the sensitive data; and a visualization display module for visually displaying the information of the sensitive data. The technical solution realizes the scanning of the databases, identifies the sensitive data we need from them, arranges them, and outputs them for the outside world to know. In the vast ocean of complex and redundant information, the required data can be quickly identified and scanned, which is convenient and fast, and does not require manual search one by one, wasting time and energy. It has the characteristics of fast and convenient search.

[0044] Effect 2: Accurate and user-friendly data; This invention also uses the above-mentioned database scanning method and device. Further, it obtains the open port information; compares the port information to identify the database type corresponding to the port information. After obtaining the database type, it determines whether the database can output services; obtains the data in the services that the database can output to form data information. By judging and identifying the database ports, it identifies the database type and the services that can be output, ensuring the security and accuracy of data collection; at the same time, further, it identifies the data information and extracts data features; compares the data features with the sensitive data feature library to obtain the sensitive data features in the database; obtains the distribution information and location information of the sensitive data features; based on the distribution information and location information, it obtains the sensitive data. Therefore, it can accurately obtain the data features in the database, compare all the data features with the sensitive data features stored in itself, identify the sensitive data features existing in the database, and then obtain its sensitive data, making the sensitive data accurate; finally, it also obtains the time information of this acquisition of sensitive data and records it to form a recording time; arranges the recording time and the obtained sensitive data regularly to form a final data form; outputs the final data form as visual data. It realizes the arrangement of data, and then outputs it as visual data, achieving user-friendly data acquisition, making it easier to identify the data, so as to collect good data for future use. Brief Description of the Drawings

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the embodiments. It should be understood that the following drawings only show some embodiments of the present invention, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other relevant drawings can also be obtained based on these drawings.

[0046] Figure 1 Schematic diagram of the method for the embodiment of the present invention;

[0047] Figure 2 Schematic diagram of the device for the embodiment of the present invention;

[0048] Figure 3 Schematic diagram of the electronic device for the embodiment of the present invention.

[0049] Icons: 100 - Electronic device; 101 - Memory; 102 - Processor; 103 - Communication interface. Detailed Embodiments

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are some, but not all, of the embodiments of this application. Components of the embodiments of this application described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations.

[0051] Therefore, the detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of this application that is claimed, but is merely representative of selected embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this application without creative efforts shall fall within the scope of protection of this application.

[0052] It should be noted that similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not require further definition and explanation in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used for descriptive distinction and cannot be construed as indicating or implying relative importance.

[0053] It should be noted that in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including", or any other variation thereof is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0054] In the description of this application, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", "inner", "outer", etc. is based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this application is customarily placed during use. It is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0055] In the description of the present application, it should also be noted that, unless otherwise clearly specified and limited, the terms "set" and "connect" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the communication inside two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to specific situations.

[0056] The following will describe in detail some embodiments of the present application with reference to the accompanying drawings. Without conflict, the following various embodiments and the various features in the embodiments can be combined with each other.

[0057] Embodiment

[0058] Please refer to Figures 1 - 3 , specifically as Figures 1 - 3 shown in an embodiment of the present invention.

[0059] In a first aspect, the present invention provides a method for scanning sensitive data in a database, including:

[0060] S1. Obtain the databases alive in the network;

[0061] In this embodiment, the above-mentioned obtaining the existing databases in the network includes:

[0062] Obtain the alive user IP addresses in the network; first, actively detect the alive IP addresses of the user network through a preset task; this task can be set in advance through a program and can be automatically scanned and detected when in use.

[0063] According to the user IP addresses, obtain the open ports; after obtaining the alive user IPs (some IPs have become zombie IPs), then scan the open ports that can be collected and scanned under this IP (there are encrypted ports and open ports, and the present invention mainly extracts sensitive information from databases that are not in use and are almost abandoned to avoid omission and forgetting of sensitive information, thereby preventing possible loss and leakage of sensitive information);

[0064] Obtain the alive databases through the ports. Through the open ports, obtain the database information behind the ports.

[0065] S2. Identify the databases to obtain the database types; this embodiment includes:

[0066] Obtain the open port information; according to the open ports, identify the specific port information, such as port 3306 is for Mysql database, port 1521 is for oracle database, port 5236 is for DM database, and port 2003 is for Shentong database.

[0067] Compare the port information to identify the database type corresponding to the port information. Since each database type represents different existing data, it is possible to identify and scan with emphasis according to their differences.

[0068] S3. Scan the database to obtain the data information in the database;

[0069] This embodiment further includes:

[0070] Obtain the database type and judge the services that the database can output; According to the database type, it is possible to judge the services that can be output by the database of this type (there may be some data in the database that cannot be output, so it is necessary to identify the services that can be output), and output its services that can be output.

[0071] Obtain the data in the services that the database can output to form data information. In the services that can be output, extract the data from them (not all of the services that can be output are data) to form data information.

[0072] S4. Identify the data information to obtain sensitive data;

[0073] Identify the data information and extract the data features; Identify the already output data information and extract the data features of this part of the data information. There are many data features, including but not limited to: keywords, tables, pictures, word roots, symbols, etc.

[0074] Compare the data features with the sensitive data feature library to obtain the sensitive data features in the library; The sensitive data features are self-defined and set in advance, and are implanted into the sensitive data feature library in advance. The sensitive data features are determined according to the actual situation, such as: "ID card", "bank card", "mobile phone number", "address", "email", etc. sensitive data features, which are set according to specific scenarios and requirements.

[0075] Obtain the distribution information and location information of the sensitive data features; Identify this part of the sensitive data features, determine their locations and distribution conditions, and obtain their distribution information and location information;

[0076] According to the distribution information and location information, obtain the sensitive data. Thus, according to the distribution and location of the sensitive data features such as "ID card", "bank card", "mobile phone number", "address", "email", etc., extract the final sensitive data, and this part of the sensitive data extracts specific numerical values and texts. Such as "ID card" (sensitive data feature), 1011XX19880502XXXX (sensitive data); "mobile phone number" (sensitive data feature), 13XXXXXXXXXX (sensitive data), etc.

[0077] S5. Organize the sensitive data to form visual data.

[0078] In this embodiment, the above-mentioned organizing the sensitive data to form visual data includes:

[0079] Obtain the time information of this acquisition of sensitive data and record it to form a recorded time; record the time of each acquisition of sensitive data, which may be obtained multiple times, so as to facilitate the later distinction and search for sensitive data at a specific time.

[0080] Arrange the recorded time and the acquired sensitive data regularly to form the final data form; regular arrangement here means that after extracting both the sensitive data features and the sensitive data, arrange them, and as for the arrangement method, set the specific method in advance in the form of a program to form the final data form, and the final data form can be in the form of a table, document, graph, chart, etc., and make an adaptive selection according to its own actual needs.

[0081] Output the final data form as visual data. Finally, output the final data form to the display device for the user to read the relevant information.

[0082] In a second aspect, the present invention also provides a database sensitive data scanning device, including:

[0083] A database scanning module for scanning the databases in the network to obtain scanning data; the scanning data includes open ports.

[0084] A database service discovery module for identifying the obtained scanning data to determine the database and its type; according to the open ports, identify the specific port information, such as port 3306 is for Mysql database, port 1521 is for oracle database, port 5236 is for DM database, port 2003 is for Shentong database, and the specific database type can be identified, so as to judge the possible sensitive data included.

[0085] A data feature matching module for performing feature matching with the sensitive data features stored in the database fields through the data feature matching module to determine the distribution and location of the sensitive data; obtain the sensitive data features included in the database, determine their distribution and location, then extract their sensitive data, features, and record the extraction time, and form a sensitive data set.

[0086] A visual display module for visually displaying the information of the sensitive data. Organize and arrange the sensitive data set to form the final data form, which can be in the form of a table, document, graph, chart, etc., and then display the final data form to achieve visualization.

[0087] In this embodiment, the above-mentioned visualization display module includes an arrangement module and a visualization processing module. The arrangement module is used to arrange sensitive data in an organized and regular manner to form a final data form, and the visualization processing module is used to perform visualization processing on the final data form to form visualization data.

[0088] In a third aspect, the present invention further provides an electronic device, including:

[0089] a memory for storing one or more programs;

[0090] a processor;

[0091] When the one or more programs are executed by the processor, the above-mentioned method is implemented.

[0092] In a fourth aspect, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned method is implemented.

[0093] Please refer to Figure 3 , Figure 3 which is a schematic structural block diagram of the electronic device provided in the embodiment of the present application. The electronic device includes a memory 101, a processor 102, and a communication interface 103. The memory 101, the processor 102, and the communication interface 103 are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The memory 101 can be used to store software programs and modules, such as the program instructions / modules corresponding to the scanning device provided in the embodiment of the present application. The processor 102 executes various functional applications and data processing by executing the software programs and modules stored in the memory 101. The communication interface 103 can be used to communicate signals or data with other node devices.

[0094] Among them, the memory 101 can be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0095] The processor 102 can be an integrated circuit chip with signal processing capabilities. The processor 102 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0096] It can be understood that Figure 2 The structure shown is only illustrative, and the scanning device may also include more or fewer components than those shown Figure 2 in the figure, or have a different configuration from that shown Figure 2 in the figure. Figure 2 Each component shown in the figure can be implemented using hardware, software, or a combination thereof.

[0097] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system for performing the specified functions or actions, or can be implemented using a combination of dedicated hardware and computer instructions.

[0098] In addition, in each embodiment of the present application, the various functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0099] When the above-mentioned functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs.

[0100] In summary, the embodiments of the present invention first obtain the surviving databases in the network; identify the databases to obtain the database types; then scan the databases to obtain the data information in the databases; then identify the data information to obtain the sensitive data; and finally organize the sensitive data to form visual data. The above method can be implemented by the following device. The device includes a database scanning module for scanning the databases in the network to obtain the scanned data; a database service discovery module for identifying the obtained scanned data to determine the databases and their types; a data feature matching module for performing feature matching with the sensitive data features stored in the database fields through the data feature matching module to determine the distribution and location of the sensitive data; and a visual display module for visually displaying the information of the sensitive data. The technical solution realizes the scanning of the databases, identifies the sensitive data we need from them, organizes it, and outputs it for the outside world to know. In the vast ocean of complex and redundant information, it can quickly identify and scan the required data, which is convenient and fast, without the need for manual search one by one, wasting time and energy, and has the characteristics of quick and convenient search.

[0101] In addition, the present invention also uses the above database scanning method and device. Further, open port information is obtained; the port information is compared to identify the database type corresponding to the port information. After obtaining the database type, it is determined whether the database can output services; the data in the database output services is obtained to form data information. By judging and identifying the database ports, the database type and the output services are identified, ensuring the security and accuracy of data collection; at the same time, further, the data information is identified and data features are extracted; the data features are compared with the sensitive data feature library to obtain the sensitive data features in the database; the distribution information and location information of the sensitive data features are obtained; based on the distribution information and location information, the sensitive data is obtained. Therefore, it is possible to accurately obtain the data features in the database, compare all the data features with the sensitive data features stored therein, identify the sensitive data features existing in the database, and then obtain its sensitive data, making the sensitive data accurate; finally, the time information of obtaining the sensitive data this time is also obtained and recorded to form a recording time; the recording time and the obtained sensitive data are arranged regularly to form a final data form; the final data form is output as visual data. The data is sorted and arranged, and then output as visual data, realizing friendly data acquisition, making it easier to identify the data, and thus collecting good data for use.

[0102] In summary, the database sensitive data scanning method and device provided by the embodiments of the present application can propose the above solutions for the deficiencies of the prior art, and have the characteristics of convenient and fast searching, accurate and friendly data, and are suitable for popularization and use in this field.

[0103] The foregoing is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0104] For those skilled in the art, it is obvious that the present application is not limited to the details of the above exemplary embodiments, and can be implemented in other specific forms without departing from the spirit or basic characteristics of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present application is defined by the appended claims rather than the above description. Therefore, it is intended to include all changes falling within the meaning and scope of the equivalent elements of the claims in the present application. Any reference signs in the claims should not be regarded as limiting the claimed rights.

Claims

1. A method for scanning sensitive data in a database, characterized in that, Including: Obtain the surviving databases in the network, including: obtain the surviving user IP addresses in the network; according to the user IP addresses, obtain the open ports; through the ports, obtain the surviving databases. Identify the databases to obtain the database types. Scan the databases to obtain the data information in the databases. Identify the data information to obtain sensitive data, including: identify the data information, extract data features; compare the data features with the sensitive data feature library to obtain the sensitive data features in the database; obtain the distribution information and location information of the sensitive data features; according to the distribution information and location information, obtain the sensitive data; the sensitive data features are self-defined and set in advance, and are implanted into the sensitive data feature library in advance, which are sensitive data features determined according to the actual situation; the data features include keywords, tables, pictures, word roots, symbols. Organize the sensitive data to form visual data, including: obtain the time information of this acquisition of sensitive data and record it to form a recorded time; arrange the recorded time and the obtained sensitive data regularly to form the final data form; output the final data form as visual data.

2. The database sensitive data scanning method according to claim 1, wherein The identifying the databases to obtain the database types includes: Obtain the open port information. Compare the port information to identify the database types corresponding to the port information.

3. The database sensitive data scanning method according to claim 2, wherein The scanning the databases to obtain the data information in the databases includes: Obtain the database types and judge the services that the databases can output. Obtain the data in the services that the databases can output to form data information.

4. A database sensitive data scanning device, characterized in that, Including: A database scanning module, used to scan the databases in the network to obtain scan data, including: obtain the surviving user IP addresses in the network; according to the user IP addresses, obtain the open ports; through the ports, obtain the surviving databases. A database service discovery module, used to identify the obtained scan data to determine the databases and their types. A data feature matching module, used to perform feature matching between the data feature matching module and the sensitive data features stored in the database fields to determine the distribution and location of the sensitive data, including: identify the data information, extract data features; compare the data features with the sensitive data feature library to obtain the sensitive data features in the database; obtain the distribution information and location information of the sensitive data features; according to the distribution information and location information, obtain the sensitive data; the sensitive data features are self-defined and set in advance, and are implanted into the sensitive data feature library in advance, which are sensitive data features determined according to the actual situation; the data features include keywords, tables, pictures, word roots, symbols. A visual display module, used to visually display the information of the sensitive data, including: obtain the time information of this acquisition of sensitive data and record it to form a recorded time; arrange the recorded time and the obtained sensitive data regularly to form the final data form; output the final data form as visual data.

5. The database sensitive data scanning device according to claim 4, wherein The visualization display module includes a sorting module and a visualization processing module. The sorting module is used to sort and arrange sensitive data regularly to form a final data form. The visualization processing module is used to perform visualization processing on the final data form to form visualization data.

6. An electronic device, characterized in that, Comprising: a memory for storing one or more programs; a processor; When the one or more programs are executed by the processor, the method described in any one of claims 1-3 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the method described in any one of claims 1-3 is implemented.

Images