SQL log anomaly detection method, device, storage medium and electronic device

Abstract

The disclosed embodiments provide a method, device, storage medium and electronic device for detecting anomalies in SQL logs, which relate to the fields of network technology and security technology, and are used to solve the problem of low efficiency of SQL log anomaly detection methods in related technologies. The SQL log anomaly detection method involved includes: obtaining a structured query language SQL log to be tested; extracting SQL operation data from the SQL log to be tested, and obtaining a test sequence based on the SQL operation data; generating a word vector for each word in the test sequence based on the test sequence and the word vector library obtained by pre-training, and obtaining a test word vector sequence; calculating the similarity between the word vectors in the test word vector sequence; and determining whether there is an abnormal SQL operation in the SQL log to be tested based on the similarity. The disclosed embodiments can quickly locate anomalies in SQL logs and reduce data loss caused by SQL log anomalies.

Description

Background Art

[0002] At present, by analyzing the database SQL (Structured Query Language) log, it is possible to detect the theft, tampering and destruction of database data by illegal personnel. Common SQL log anomaly analysis technologies include SQL log template anomaly detection, SQL operation statistics anomaly, and sequence neural network model detection of specific SQL anomalies such as SQL injection. However, data access to databases / big data platforms is usually implemented through SQL or SQL-like languages ​​(such as HQL (Hibernate Query Language)), and users' SQL data access behaviors will be recorded in the logs. However, in order to detect abnormal operations from massive SQL logs, it is usually necessary to build a more complex neural network model or perform a large number of complex operations, resulting in low efficiency in SQL log anomaly detection. Summary of the invention

[0003] The embodiments of the present disclosure provide a SQL log anomaly detection method, device, storage medium and electronic device, which are used to at least partially solve the technical problem of low efficiency of SQL log anomaly detection methods existing in related technologies.

[0004] According to a first aspect of the present disclosure, a method for detecting anomalies in an SQL log is provided, which is characterized by comprising: obtaining a structured query language SQL log to be tested; extracting SQL operation data from the SQL log to be tested, and obtaining a test sequence according to the SQL operation data; generating a word vector for each word in the test sequence according to the test sequence and a pre-trained word vector library to obtain a test word vector sequence, wherein the word vector library is trained based on SQL operation data in a preset SQL log; calculating the similarity between word vectors in the test word vector sequence; and determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity.

[0005] Optionally, extracting SQL operation data from the SQL log to be tested and obtaining a test sequence according to the SQL operation data includes: extracting words from each SQL statement in the SQL log to be tested; arranging the words extracted from each SQL statement according to access IP address or user name to obtain the test sequence.

[0006] Optionally, extracting words from each SQL statement in the SQL log to be tested includes: extracting table names and field names from each SQL statement, and composing words from the table names and field names.

[0007] Optionally, the word vectors in the test word vector sequence include word vectors corresponding to words extracted from each SQL statement in the SQL log to be tested, and the word vectors for each word in the test sequence are generated according to the test sequence and a pre-trained word vector library to obtain a test word vector sequence, including: dividing the test sequence into multiple SQL statements according to each SQL statement to obtain a segmented test sequence; generating a word vector for each word in the test sequence according to the segmented test sequence and a pre-trained word vector library to obtain the test word vector sequence; calculating the similarity between the word vectors in the test word vector sequence, including: calculating the mean of the similarities between the word vectors in the test word vector sequence to obtain the similarity, wherein the similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business.

[0008] Optionally, the word vectors in the test word vector sequence include: words extracted from each SQL statement in the SQL log to be tested correspond to word vectors of sentences composed of access IP addresses or user names, and calculating the similarity between the word vectors in the test word vector sequence, including: calculating the mean of the similarities between the word vectors in the test word vector sequence to obtain the similarity, wherein the similarity is used to characterize the difference between the operation behavior of the user or access IP address in the SQL log to be tested and the legitimate operation behavior.

[0009] Optionally, determining whether there is an abnormal SQL operation in the SQL log to be tested based on the similarity includes: comparing the similarity with a first threshold; if the similarity is greater than the first threshold, determining that there is an abnormal operation in the SQL log to be tested; if the similarity is not greater than the first threshold, determining that there is no abnormal operation in the SQL log to be tested.

[0010] Optionally, a word vector for each word in the test sequence is generated according to the test sequence and a word vector library obtained by pre-training to obtain a test word vector sequence, including: dividing the test sequence into multiple SQL statements according to each SQL statement; generating a first test word vector sequence according to the test sequence and a first word vector library obtained by pre-training; generating a second test word vector sequence according to the test sequence and a second word vector library obtained by pre-training, wherein the word vectors in the first word vector library are different from those in the second word vector library; calculating the similarity between the word vectors in the test word vector sequence, including: calculating the mean of the similarities between the word vectors in the first test word vector sequence to obtain a first similarity, wherein the first similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business; calculating the mean of the similarities between the word vectors in the second test word vector sequence to obtain a second similarity, wherein the second similarity is used to characterize the difference between the operation behavior of the user or access IP address in the SQL log to be tested and the legitimate operation behavior.

[0011] Optionally, the method also includes: extracting words from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log; arranging the words extracted from each SQL statement as a sentence to generate a first corpus; and using the first corpus to train word2vec to generate the first word vector library.

[0012] Optionally, the method also includes: extracting words from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log; forming different sentences by combining the words extracted from each SQL statement according to the access IP address or user name to generate a second corpus; and using the second corpus to train word2vec to generate the second word vector library.

[0013] Optionally, determining whether there is an abnormal SQL operation in the SQL log to be tested based on the similarity includes: comparing the first similarity with a second threshold, and if the first similarity is not less than the second threshold, determining that there is a business operation abnormality in the SQL log to be tested; comparing the second similarity with a third threshold, and if the second similarity is not less than the third threshold, determining that there is a behavioral operation abnormality in the SQL log to be tested.

[0014] Optionally, the method also includes: if it is determined that there is a business operation abnormality in the SQL log to be tested, issuing a business operation abnormality prompt message, and outputting abnormal user information and / or abnormal SQL list corresponding to the business operation abnormality; if it is determined that there is a behavioral operation abnormality in the SQL log to be tested, issuing a behavioral operation abnormality prompt message, and outputting abnormal user information and / or abnormal SQL list corresponding to the behavioral operation abnormality.

[0015] Optionally, determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity includes: determining whether there is an abnormality in the SQL log according to the first similarity and the second similarity.

[0016] According to a second aspect of the present disclosure, a SQL log anomaly detection device is provided, comprising: an acquisition module, used to acquire a structured query language SQL log to be tested; an extraction module, used to extract SQL operation data from the SQL log to be tested, and obtain a test sequence according to the SQL operation data; a generation module, used to generate a word vector for each word in the test sequence according to the test sequence and a pre-trained word vector library, and obtain a test word vector sequence, wherein the word vector library is trained based on SQL operation data in a preset SQL log; a calculation module, used to calculate the similarity between word vectors in the test word vector sequence; and a determination module, used to determine whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity.

[0017] According to a third aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the SQL log anomaly detection methods provided by the embodiments of the present disclosure by executing the executable instructions.

[0018] According to a fourth aspect of the present disclosure, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the SQL log anomaly detection methods provided in the embodiments of the present disclosure is implemented.

[0019] The SQL log anomaly detection method, device, storage medium and electronic device of the embodiments of the present invention construct a test sequence based on the SQL log to be tested, obtain the word vector of each word in the sequence to be tested according to the test sequence using a pre-trained word vector library, obtain a test word vector sequence, calculate the similarity between the word vectors in the test word vector sequence, and thus determine whether there is an abnormal operation in the SQL log to be tested based on the similarity. The calculation amount is small, the anomaly detection efficiency is high, the SQL log anomaly can be quickly located, and the data loss caused by the SQL log anomaly is reduced.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0023] Figure 2 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0024] Figure 3 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0025] Figure 4 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0026] Figure 5 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0027] Figure 6 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0028] Figure 7 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0029] Figure 8 is a schematic diagram showing the distance relationship between words in a first corpus according to an exemplary embodiment of the present disclosure;

[0030] Fig. 9 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0031] Fig.10 is a schematic diagram showing the distance relationship between words in the second corpus according to an exemplary embodiment of the present disclosure;

[0032] Fig.11is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure;

[0033] Fig.12 It is a structural schematic diagram of a SQL log anomaly detection device according to an exemplary embodiment of the present disclosure;

[0034] Fig.13 It is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0036] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0037] Figure 1 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure. Figure 1 As shown, the method includes:

[0038] In step S102, the SQL log to be tested is obtained;

[0039] In an embodiment of the present disclosure, for a new SQL log stream, all SQL logs within a time period may be extracted to obtain the SQL log to be tested, wherein the time period, such as 10 minutes or 1 hour, may be customized according to test requirements.

[0040] In step S104, SQL operation data is extracted from the SQL log to be tested, and a test sequence is obtained according to the SQL operation data;

[0041] In an embodiment of the present disclosure, the SQL operation data extracted from the SQL log to be tested may be a keyword extracted from an SQL statement in the SQL log to be tested. The keyword may be information in the SQL statement that can characterize the user's data access behavior.

[0042] In step S106, a word vector for each word in the test sequence is generated according to the test sequence and the pre-trained word vector library to obtain a test word vector sequence; wherein the word vector library is trained based on the SQL operation data in the preset SQL log;

[0043] The preset SQL log may be a normal SQL log, which refers to an SQL log without abnormal operations such as stealing, tampering and destroying data.

[0044] In an embodiment of the present disclosure, the pre-trained word vector library may include at least two word vector libraries with different word vectors. In this case, in step S106, different test sequences can be obtained according to the test sequences and different word vector libraries, so that in the SQL log anomaly detection process, anomaly detection can be performed based on different test sequences to detect different types of anomalies in the SQL log, thereby obtaining diversified anomaly detection results and realizing more comprehensive anomaly detection of the SQL log.

[0045] In an exemplary embodiment, training data can be extracted based on a preset log, a corpus can be extracted based on the training data, and the corpus can be used to train a word2vec model to generate a word vector library. Extracting a corpus based on the training data can include: extracting words from each SQL statement in the training data; and generating a corpus based on the extracted words.

[0046] In step S108, the similarity between the word vectors in the test word vector sequence is calculated, wherein the similarity is used to characterize the difference between the SQL operation data in the SQL log to be tested and the legal SQL operation data;

[0047] In the embodiments of the present disclosure, the similarity between the word vectors in the test word vector sequence can be used to characterize the difference between the SQL statements in the SQL log to be tested and the SQL statements of the legitimate business, or the similarity between the operation data in the SQL log to be tested and the legitimate SQL operation data can be used to characterize the difference between the SQL operation sequence of a user and the SQL operation sequence of a legitimate user. Among them, the legitimate business can refer to the business transactions without abnormal business such as theft, tampering and destruction of data.

[0048] In step S110, the abnormal SQL operation in the SQL log to be tested is determined according to the similarity.

[0049] In an embodiment of the present disclosure, a similarity threshold, such as a first threshold, can be set in advance. Based on this, the similarity between the word vectors in the test word vector sequence can be compared with the threshold, and whether there is an abnormal operation in the SQL log to be tested can be determined according to the size of the comparison result. For example, if the similarity between the word vectors in the word vector sequence to be tested is greater than the similarity threshold, it can be determined that there is an abnormal operation in the SQL log to be tested. Conversely, if the similarity between the word vectors in the word vector sequence to be tested is not greater than the threshold, it can be determined that there is no abnormal operation in the SQL log to be tested. In addition, the similarity between word vectors in the test word vector sequence in the embodiment of the present disclosure may include the similarities between multiple different word vectors, which are used to characterize the multiple differences between the SQL operation data in the SQL log to be tested and the legal SQL operation data. For example, different test word vector sequences can be generated based on different word vector libraries obtained by pre-training, and the similarities between word vectors in different test word vector sequences are calculated, so that it can be determined in turn whether the SQL log has an abnormality according to the calculated multiple similarities. Alternatively, a comprehensive indicator can be calculated based on the calculated multiple similarities, such as assigning corresponding weights to multiple similarities respectively, and then weighted summing the multiple similarities to obtain a comprehensive indicator, and determining whether there are differences in the SQL log based on the comprehensive indicator.

[0050] The SQL log anomaly detection method of the disclosed embodiment builds a test sequence based on the SQL log to be tested, obtains the word vector of each word in the sequence to be tested according to the test sequence using a pre-trained word vector library, obtains a test word vector sequence, and calculates the similarity between the word vectors in the test word vector sequence, so as to judge whether there is an abnormal operation in the SQL log to be tested based on the similarity. The calculation amount is small, the anomaly detection efficiency is high, the anomaly of the SQL log can be quickly located, and the data loss caused by the SQL log anomaly is reduced.

[0051] In addition, the SQL log anomaly detection method of the disclosed embodiment can be applied to real-time anomaly detection of enterprise database operations, and can also be used for real-time anomaly detection of hive operations on enterprise big data platforms. It is used to identify data access behaviors of internal or external malicious users in real time, reduce data leakage risks, and improve data security capabilities.

[0052] Figure 2 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure. Figure 2 As shown, extracting SQL operation data from the SQL log to be tested and obtaining a test sequence according to the SQL operation data may include:

[0053] In step S1042, extract words from each SQL statement in the SQL log to be tested;

[0054] In step S1044, the words extracted from each SQL statement are arranged according to the access IP address (Internet Protocol Address) or user name to obtain the test sequence.

[0055] In an exemplary embodiment, after obtaining the test sequence, the initial positions of the words generated by different SQL statements in the test sequence can also be recorded so that the test sequence can be segmented based on the initial positions later. In one example, all the words extracted from an SQL statement form a sentence. For example, in a test sequence consisting of two SQL statements, the first SQL statement extracts 5 words and the second SQL statement extracts 3 words. Then the initial position corresponding to the first SQL statement is the first position, and the initial position corresponding to the second SQL statement is the sixth position.

[0056] In an exemplary embodiment, if Figure 3 As shown, extracting words from each SQL statement in the SQL log to be tested may include:

[0057] In step S10422, table names and field names are extracted from each SQL statement, and the table names and field names are combined into words. For example, taking extracting words from a single SQL statement as an example, the extracted words are as follows:

[0058] tid, tname, tdate

[0059] sid,stime,sip,sport,tname

[0060] In the above words, s and t represent table names, and the others represent field names.

[0061] In an embodiment of the present disclosure, the word vectors in the test word vector sequence may include word vectors corresponding to words extracted from each SQL statement in the SQL log to be tested, such as Figure 4 As shown, generating a word vector for each word in the test sequence according to the test sequence and the word vector library obtained by pre-training to obtain a test word vector sequence may include:

[0062] In step S1062, the test sequence is divided into multiple SQL statements according to each SQL statement to obtain a divided test sequence;

[0063] For example, according to the initial positions of words generated by different SQL statements in the recorded test sequence, the test sequence can be segmented into multiple SQL statements according to each SQL statement, and each word obtained after segmentation originates from one SQL statement.

[0064] In step S1064, a word vector for each word in the test sequence is generated according to the segmented test sequence and the word vector library obtained by pre-training to obtain the test word vector sequence;

[0065] Calculating the similarity between the word vectors in the test word vector sequence may include:

[0066] In step S1082, the mean of the similarities between the word vectors in the test word vector sequence is calculated to obtain the similarity, wherein the similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business. The first similarity can reflect the business characteristics. Therefore, in the embodiment of the present disclosure, the first similarity can be used to represent the business deviation of the log to be tested.

[0067] Exemplarily, the similarity between word vectors can be obtained by calculating any one of the cosine distance, Euclidean distance, or Manhattan distance between the word vectors.

[0068] Among them, legitimate business may refer to business that does not involve abnormal operations such as theft, tampering and destruction of data.

[0069] In this embodiment, a single SQL statement can be detected to effectively identify a single SQL statement, locate the anomaly to each SQL statement, and improve the detection accuracy of SQL anomalies. Determining the business deviation based on the distance between word vectors in the test word vector sequence can effectively reduce the computational complexity of SQL anomaly detection, and has high efficiency. It can be applied to SQL anomaly detection in quasi-real-time scenarios to quickly locate anomalies.

[0070] In an embodiment of the present disclosure, the word vectors in the test word vector sequence may include: the words extracted from each SQL statement of the SQL log to be tested correspond to the word vectors of the sentences composed of the access IP address or the user name, and the similarity between the word vectors in the test word vector sequence is calculated, which may include:

[0071] The mean of the similarities between the word vectors in the test word vector sequence is calculated to obtain the similarity, wherein the similarity is used to characterize the difference between the operation behavior of the user or the access IP address in the SQL log to be tested and the legal operation behavior. The second similarity can reflect the user behavior, so the second similarity can be used to represent the behavior deviation of the SQL log to be tested.

[0072] The disclosed embodiment can perform anomaly detection on multiple SQL sequences of a certain user or a certain access IP address within a period of time according to the SQL log to be tested, thereby effectively locating abnormal users or abnormal IPs.

[0073] In this embodiment, the behavior deviation is determined according to the distance between word vectors in the test word vector sequence, which can effectively reduce the computational complexity of SQL anomaly detection. It is highly efficient and can be applied to SQL anomaly detection in quasi-real-time scenarios to quickly locate anomalies.

[0074] In the embodiments of the present disclosure, Figure 5 As shown, determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity may include:

[0075] In step S1102, the similarity is compared with a first threshold;

[0076] In step S1104, if the similarity is greater than the first threshold, it is determined that there is an abnormal operation in the SQL log to be tested;

[0077] In step S1106, if the similarity is not greater than the first threshold, it is determined that there is no abnormal operation in the SQL log to be tested.

[0078] In this embodiment, after calculating the similarity between the word vectors in the test word vector sequence, since the similarity represents the difference between the SQL operation data in the SQL log to be tested and the legitimate SQL operation data, the size of the indicator value represents the difference between the SQL operation data in the SQL log to be tested and the long-queue SQL operation data. Therefore, by comparing the indicator with the first threshold, it is possible to quickly and conveniently determine whether there is an abnormal operation in the log to be tested.

[0079] In the embodiments of the present disclosure, Figure 6 As shown, generating a word vector for each word in the test sequence according to the test sequence and the word vector library obtained by pre-training to obtain a test word vector sequence may include:

[0080] In step S1066, the test sequence is divided into multiple SQL statements according to each SQL statement;

[0081] In step S1068, a first test word vector sequence is generated according to the test sequence and the first word vector library obtained by pre-training;

[0082] In step S10610, a second test word vector sequence is generated according to the test sequence and a second word vector library obtained by pre-training, wherein the word vectors in the first word vector library are different from those in the second word vector library;

[0083] Calculating the similarity between the word vectors in the test word vector sequence includes:

[0084] In step S1084, the mean of the similarities between the word vectors in the first test word vector sequence is calculated to obtain a first similarity, wherein the first similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business;

[0085] In step S1086, the mean of the similarities between the word vectors in the second test word vector sequence is calculated to obtain a second similarity, wherein the second similarity is used to characterize the difference between the operation behavior of the user or the access IP address in the SQL log to be tested and the legal operation behavior;

[0086] In this embodiment, based on the test sequence, the first test word vector sequence and the second test word vector sequence are generated by using the first word vector library and the second word vector library with different word vectors obtained by pre-training, so that the word vectors in the first test word vector sequence and the second test word vector sequence have different business meanings, so that the business deviation can be calculated according to the first test vector to realize the abnormality detection of a single SQL statement, and the behavior deviation can be calculated according to the second test vector to realize the abnormality detection of multiple SQL sequences of a certain user or access IP address in a period of time. The single SQL abnormality detection and the abnormality detection of multiple SQL sequences of a certain user or access IP address in a period of time are integrated and realized without the need to establish different models separately, thereby simplifying the process of SQL abnormality detection.

[0087] Figure 7 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure. Figure 7 As shown, this method Figure 1 Based on the method shown, it can further include:

[0088] In step S702, words are extracted from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log;

[0089] In step S704, the words extracted from each SQL statement are arranged as a sentence to generate a first corpus;

[0090] In one example, the first corpus includes the following two sentences:

[0091] tid, tname, tdate

[0092] sid,stime,sip,sport,tname

[0093] The first SQL statement in the first corpus operates the id field, name field, and date field on the t table, and the second SQL statement operates the id field, time field, ip field, port field, and name field on the s table. Both SQL statements operate the name field of the t table. Therefore, Figure 8 As shown in the figure, there is an intersection between the two SQL statements. tid and tdate are in one SQL statement, while tid and sport are in different SQL statements. Therefore, in terms of the distance between words, the business deviation of tid and sport in the new SQL statement should be greater than the business deviation of the first SQL statement.

[0094] In step S706, word2vec is trained using the first corpus to generate the first word vector library.

[0095] It should be noted that steps S702 to S706 can be performed at Figure 1 It can be executed before step S102 shown in , and can also be repeatedly executed in a loop during the execution of the SQL log anomaly detection method to obtain a better first word vector library through continuous training. Figure 7 The above is only an example of a situation where step S702 and step S706 are performed before step S102.

[0096] In the embodiments of the present disclosure, the word2vec model results are most affected by the corpus. According to the principle of word2vec, a word predicts the previous and next words or the previous and next words predict the current word, so as to maximize the probability. This leads to similar words in the same position of similar sentences in the corpus, and adjacent words in a sentence are also similar. Based on this, the embodiments of the present disclosure organize the same SQL log data into corpora of different forms, and can train different word vector representations of words, and associate them with business and user behaviors. The abnormal state of a single SQL operation or multiple SQL behaviors of a user can be judged by the similarity between word vectors, so that business anomalies and user behavior anomalies in SQL logs can be effectively identified.

[0097] Fig. 9 is a flow chart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure. Fig. 9 As shown, this method Figure 1 Based on the method shown, it can further include:

[0098] In step S902, words are extracted from each SQL statement in the preset training data, wherein the preset training data includes a preset SQL log;

[0099] In step S904, the words extracted from each SQL statement are combined into different sentences according to the access IP address or user name to generate a second corpus;

[0100] In one example, the second corpus includes the following two sentences:

[0101] tid, tname, tdate, sid, stime, sip, sport

[0102] tid, tdate, tag, xid, xname, xsalary…

[0103] like Fig.10 As shown in the figure, both sentences in the second corpus contain the SQL statement tid and tdate, so the two sentences have an intersection, but each sentence also has another SQL statement. For example, the first sentence queries the sport and ip fields of the s table, and also queries the name field in the t table; while the second sentence queries the name and salary fields of the x table. For a new SQL statement sid, sip, xid, xname, the distance between sid and xid is greater than the distance between tid and xid.

[0104] In step S906, word2vec is trained using the second corpus to generate the second word vector library.

[0105] It should be noted that steps S902 to S906 can be performed at Figure 1 It can be executed before step S102 shown in , and can also be repeatedly executed in a loop during the execution of the SQL log anomaly detection method to obtain a better first word vector library through continuous training. Fig. 9 The above is only an example of a situation where step S902 and step S906 are performed before step S102.

[0106] The disclosed embodiment constructs different corpora and obtains different word vector libraries through training. Different test word vector sequences can be obtained based on different word vector libraries and the test sequence of the SQL log to be tested. Based on the similarity between word vectors in the test word vector sequence, SQL statements different from normal business SQL requests can be detected, and the difference between a user's SQL operation sequence and a normal user's SQL operation sequence can also be detected. There is no need to build a complex neural network model. After word2vec is trained, only the similarity between word vectors needs to be compared in the abnormal recognition stage, which has a small amount of calculation and high efficiency.

[0107] In an embodiment of the present disclosure, determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity may include:

[0108] Compare the first similarity with a second threshold, and if the first similarity is not less than the second threshold, determine that there is a business operation abnormality in the SQL log to be tested;

[0109] The second similarity is compared with a third threshold value. If the second similarity is not less than the third threshold value, it is determined that there is a behavioral operation abnormality in the SQL log to be tested.

[0110] Among them, the values ​​of the first threshold, the second threshold and the third threshold in the embodiment of the present disclosure can be set according to actual conditions, the first threshold, the second threshold and the third threshold can be equal, or, according to different detection accuracy requirements for different abnormalities, the first threshold, the second threshold and the third threshold can be set to different values.

[0111] There is similarity between the word vectors in the word vector library generated by training the word2vec model using the first corpus and the second corpus respectively. The similarity between the words in a single SQL statement reflects the business characteristics. Therefore, the anomalies in the SQL log can be detected based on the similarity. For example, for the following corpus, tid and tdata have high similarity and close distance, and sid, stime, sip, and sport have high similarity and close distance. Since tname exists in both sentences and tname is moderately far from the two regions, for a new SQL statement tid, sport, the similarity between tid and sport is low and the distance is large, which may be an abnormal SQL statement.

[0112] tid,tname,date

[0113] sid, stime, sip, sport, tname……

[0114] Fig.11 is a flowchart of a method for detecting anomalies in SQL logs according to an exemplary embodiment of the present disclosure, the method further comprising:

[0115] In step S1102, if it is determined that there is a business operation abnormality in the SQL log to be tested, a business operation abnormality prompt message is issued, and abnormal user information and / or an abnormal SQL list corresponding to the business operation abnormality is output;

[0116] In step S1104, if it is determined that there is a behavior operation abnormality in the SQL log to be tested, a behavior operation abnormality prompt message is issued, and abnormal user information and / or abnormal SQL list corresponding to the behavior operation abnormality is output.

[0117] In an embodiment of the present disclosure, when it is determined that there is a business operation abnormality or a behavioral operation abnormality in the SQL log to be tested, a business operation abnormality prompt message is issued, and abnormal user information and / or an abnormal SQL list is output, so that the abnormal situation can be fed back in time to facilitate timely processing of the abnormal situation and reduce data loss.

[0118] In an embodiment of the present disclosure, determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity may include:

[0119] It is determined whether there is an abnormal SQL operation in the SQL log to be detected according to the first similarity and the second similarity.

[0120] For example, weights can be set for the first similarity and the second similarity, and a metric value is obtained by weighted summing the first similarity and the second similarity. The metric value is compared with the first threshold. If the metric value is not less than the first threshold, it is determined that there is an abnormality in the SQL log to be tested. If the metric value is less than the first threshold, it is determined that there is no abnormality in the SQL log to be tested.

[0121] The following uses an example of combining business deviation and behavior deviation to perform SQL anomaly detection to illustrate the SQL log anomaly detection method of the embodiment of the present disclosure.

[0122] In this example, the SQL log anomaly detection method includes:

[0123] Generating corpus: manually extract a batch of normal SQL log data as training data; for each SQL statement, extract the table name and field name, and use the table name + field name to form a word. If there are multiple databases, the database name can be added; traverse the training data, arrange the words extracted from each SQL as a sentence, and generate corpus 1 (an example of the first corpus mentioned above); traverse the training data, arrange the words extracted from SQL according to the access IP address or user name to form different sentences, and generate corpus 2 (an example of the first corpus mentioned above);

[0124] Word vector calculation: For Corpus 1 and Corpus 2, use word2vec training to generate word vectors for each word, and generate word vector library 1 (an example of the first word vector library mentioned above) and word vector library 2 (an example of the second word vector library mentioned above);

[0125] Anomaly detection and alarm: For new SQL log streams, extract all SQL logs within a period of time, arrange them by access IP address or user name, and convert them into a test sequence of table name + field name. At the same time, record the initial positions of words generated by different SQL in the test sequence.

[0126] For the test sequence, split it according to the position of a single SQL statement, generate a total of k SQL statements, use the word vector library 1 to generate a test word vector sequence (x1, x2…xn), and calculate the deviation of a single SQL statement

[0127]

[0128] In the above formula, i≤n, j≤n;

[0129] The business deviation is generated by summing up the deviations of multiple SQL statements and dividing it by the number of SQL statements.

[0130] For the test sequence, use word vector library 2 to generate a test word vector sequence (s1, s2…sm) and calculate the behavior deviation

[0131]

[0132] In the above formula, i≤m, j≤m;

[0133] The preset threshold 1 (an example of the above-mentioned second threshold) is used as the threshold of business deviation. If the business deviation is greater than threshold 1, a business operation abnormality alarm is generated; the preset threshold 2 (an example of the above-mentioned third threshold) is used as the threshold of behavior deviation. If the user behavior deviation is greater than threshold 2, a user behavior operation abnormality alarm is generated.

[0134] Fig.12 is a structural diagram of a SQL log anomaly detection device according to an exemplary embodiment of the present disclosure. Fig.12 As shown, the device 120 includes:

[0135] The acquisition module 122 is used to acquire the structured query language SQL log to be tested;

[0136] An extraction module 124 is used to extract SQL operation data from the SQL log to be tested, and obtain a test sequence according to the SQL operation data;

[0137] A generating module 126 is used to generate a word vector for each word in the test sequence according to the test sequence and a pre-trained word vector library to obtain a test word vector sequence, wherein the word vector library is trained based on SQL operation data in a preset SQL log;

[0138] A calculation module 128, configured to calculate the similarity between the word vectors in the test word vector sequence, wherein the similarity is used to characterize the difference between the SQL operation data in the SQL log to be tested and the preset SQL operation data;

[0139] The determination module 1210 is used to determine whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity.

[0140] In an embodiment of the present disclosure, the extraction module may include:

[0141] An extraction submodule, used to extract words from each SQL statement in the SQL log to be tested;

[0142] The arrangement submodule is used to arrange the words extracted from each SQL statement according to the access IP address or user name to obtain the test sequence.

[0143] In an embodiment of the present disclosure, the extraction submodule may be specifically used for:

[0144] Extract table names and field names from each SQL statement, and combine the table names and field names into words.

[0145] In an embodiment of the present disclosure, the word vectors in the test word vector sequence include word vectors corresponding to words extracted from each SQL statement in the SQL log to be tested.

[0146] The generation module can be specifically used for:

[0147] The test sequence is divided into multiple SQL statements according to each SQL statement to obtain a divided test sequence;

[0148] Generate a word vector for each word in the test sequence according to the segmented test sequence and the word vector library obtained by pre-training to obtain the test word vector sequence;

[0149] Calculating the similarity between the word vectors in the test word vector sequence includes:

[0150] The mean of the similarities between the word vectors in the test word vector sequence is calculated to obtain the similarity, wherein the similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business.

[0151] In an embodiment of the present disclosure, the word vectors in the test word vector sequence include: the word vectors corresponding to the sentences composed of the words extracted from each SQL statement of the SQL log to be tested according to the access IP address or user name, and the calculation module can be specifically used to:

[0152] The mean of the similarities between the word vectors in the test word vector sequence is calculated to obtain the similarity, wherein the similarity is used to characterize the difference between the operation behavior of the user or the access IP address in the SQL log to be tested and the legal operation behavior.

[0153] In an embodiment of the present disclosure, the determination module may be specifically used to:

[0154] comparing the similarity with a first threshold;

[0155] If the similarity is greater than the first threshold, it is determined that there is an abnormal operation in the SQL log to be tested;

[0156] If the similarity is not greater than the first threshold, it is determined that there is no abnormal operation in the SQL log to be tested.

[0157] In an embodiment of the present disclosure, the generation module may be specifically used for:

[0158] Divide the test sequence into multiple SQL statements according to each SQL statement;

[0159] Generate a first test word vector sequence according to the test sequence and the first word vector library obtained by pre-training;

[0160] Generate a second test word vector sequence according to the test sequence and a second word vector library obtained by pre-training, wherein the word vectors in the first word vector library are different from those in the second word vector library;

[0161] The computing module can be specifically used for:

[0162] Calculate the mean of the similarities between the word vectors in the first test word vector sequence to obtain a first similarity, wherein the first similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business;

[0163] The mean of the similarities between the word vectors in the second test word vector sequence is calculated to obtain a second similarity, wherein the second similarity is used to characterize the difference between the operation behavior of the user or access IP address in the SQL log to be tested and the legitimate operation behavior.

[0164] In an embodiment of the present disclosure, the SQL log anomaly detection device may further include:

[0165] A first acquisition module, configured to extract words from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log;

[0166] A first arrangement module, used for arranging the words extracted from each SQL statement as a sentence to generate a first corpus;

[0167] The first generating module is used to train word2vec using the first corpus to generate the first word vector library.

[0168] In an embodiment of the present disclosure, the SQL log anomaly detection device may further include:

[0169] A second acquisition module is used to extract words from each SQL statement in the preset training data, wherein the preset training data includes a preset SQL log;

[0170] A second arrangement module is used to form different sentences by composing the words extracted from each SQL statement according to the access IP address or user name to generate a second corpus;

[0171] The second generating module is used to train word2vec using the second corpus to generate the second word vector library.

[0172] In an embodiment of the present disclosure, the determination module may be specifically used to:

[0173] Compare the first similarity with a second threshold, and if the first similarity is not less than the second threshold, determine that there is a business operation abnormality in the SQL log to be tested;

[0174] The second similarity is compared with a third threshold value. If the second similarity is not less than the third threshold value, it is determined that there is a behavioral operation abnormality in the SQL log to be tested.

[0175] In an embodiment of the present disclosure, the SQL log anomaly detection device may further include:

[0176] The first output module is used to send a business operation abnormality prompt message if it is determined that there is a business operation abnormality in the SQL log to be tested, and output abnormal user information and / or abnormal SQL list corresponding to the business operation abnormality;

[0177] The second output module is used to send a behavior operation abnormality prompt message if it is determined that there is a behavior operation abnormality in the SQL log to be tested, and output abnormal user information and / or abnormal SQL list corresponding to the behavior operation abnormality.

[0178] In an embodiment of the present disclosure, the determination module is specifically configured to determine whether there is an anomaly in the SQL log according to the first similarity and the second similarity.

[0179] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0180] like Fig.13As shown, the electronic device 1300 is in the form of a general computing device. The components of the electronic device 1300 may include but are not limited to: at least one processing unit 1310, at least one storage unit 1320, and a bus 1330 connecting different system components (including the storage unit 1320 and the processing unit 1310).

[0181] The storage unit stores program codes, which can be executed by the processing unit 1310, so that the processing unit 1310 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1310 can perform the following steps: Figure 1 Step S102 shown in: obtaining a structured query language SQL log to be tested; step S104: extracting SQL operation data from the SQL log to be tested, and obtaining a test sequence according to the SQL operation data; step S106: generating a word vector for each word in the test sequence according to the test sequence and a pre-trained word vector library, and obtaining a test word vector sequence, wherein the word vector library is trained based on the SQL operation data in a preset SQL log; step S108: calculating the similarity between the word vectors in the test word vector sequence, wherein the similarity is used to characterize the difference between the SQL operation data in the SQL log to be tested and the preset SQL operation data; step S110: determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity.

[0182] The storage unit 1320 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 13201 and / or a cache storage unit 13202 , and may further include a read-only storage unit (ROM) 13203 .

[0183] The storage unit 1320 may also include a program / utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0184] Bus 1330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0185] The electronic device 1300 may also communicate with one or more external devices 1400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1300, and / or communicate with any device that enables the electronic device 1300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1350. Furthermore, the electronic device 1300 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1360. As shown, the network adapter 1360 communicates with other modules of the electronic device 1300 via a bus 1330. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0186] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0187] A program product for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0188] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0189] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0190] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0191] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0192] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0193] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0194] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0195] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A SQL log anomaly detection method, characterized in that: include: Get the SQL log of the structured query language to be tested; Extracting SQL operation data from the SQL log to be tested, and obtaining a test sequence according to the SQL operation data; Generate a word vector for each word in the test sequence according to the test sequence and the pre-trained word vector library to obtain a test word vector sequence, wherein the word vector library is trained based on SQL operation data in a preset SQL log; the preset SQL log refers to an SQL log without abnormal operations such as theft, tampering and destruction of data; Calculating the similarity between the word vectors in the test word vector sequence; Determine whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity; Wherein, calculating the similarity between word vectors in the test word vector sequence includes: calculating the mean of the similarity between word vectors in the test word vector sequence to obtain the similarity; Among them, determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity includes: comparing the similarity with a first threshold; if the similarity is greater than the first threshold, determining that there is an abnormal operation in the SQL log to be tested; if the similarity is not greater than the first threshold, determining that there is no abnormal operation in the SQL log to be tested.

2. The method according to claim 1, characterized in that Extracting SQL operation data from the SQL log to be tested, and obtaining a test sequence according to the SQL operation data, including: Extract words from each SQL statement in the SQL log to be tested; The words extracted from each SQL statement are arranged according to the access IP address or user name to obtain the test sequence.

3. The method according to claim 2, characterized in that Extracting words from each SQL statement in the SQL log to be tested includes: Extract table names and field names from each SQL statement, and combine the table names and field names into words.

4. The method according to claim 1, characterized in that: The word vectors in the test word vector sequence include the word vectors corresponding to the words extracted from each SQL statement in the SQL log to be tested, Generating a word vector for each word in the test sequence according to the test sequence and the word vector library obtained by pre-training to obtain a test word vector sequence includes: The test sequence is divided into multiple SQL statements according to each SQL statement to obtain a divided test sequence; Generate a word vector for each word in the test sequence according to the segmented test sequence and the word vector library obtained by pre-training to obtain the test word vector sequence; The similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business.

5. The method according to claim 1, characterized in that The word vectors in the test word vector sequence include: the word vectors corresponding to the sentences composed of the words extracted from each SQL statement of the SQL log to be tested according to the access IP address or user name, wherein the similarity is used to characterize the difference between the operation behavior of the user or access IP address in the SQL log to be tested and the legitimate operation behavior.

6. The method according to claim 1, characterized in that Generating a word vector for each word in the test sequence according to the test sequence and the word vector library obtained by pre-training to obtain a test word vector sequence includes: Divide the test sequence into multiple SQL statements according to each SQL statement; Generate a first test word vector sequence according to the test sequence and the first word vector library obtained by pre-training; Generate a second test word vector sequence according to the test sequence and a second word vector library obtained by pre-training, wherein the word vectors in the first word vector library are different from those in the second word vector library; Calculating the similarity between the word vectors in the test word vector sequence includes: Calculate the mean of the similarities between the word vectors in the first test word vector sequence to obtain a first similarity, wherein the first similarity is used to characterize the difference between the business in the SQL log to be tested and the legitimate business; Calculate the mean of the similarities between the word vectors in the second test word vector sequence to obtain a second similarity, wherein the second similarity is used to characterize the difference between the operation behavior of the user or access IP address in the SQL log to be tested and the legitimate operation behavior.

7. The method according to claim 6, characterized in that The method further comprises: Extracting words from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log; Arranging the words extracted from each SQL statement as a sentence to generate a first corpus; Use the first corpus to train word2vec to generate the first word vector library.

8. The method according to claim 6, characterized in that The method further comprises: Extracting words from each SQL statement in preset training data, wherein the preset training data includes a preset SQL log; The words extracted from each SQL statement are combined into different sentences according to the access IP address or user name to generate a second corpus; Use the second corpus to train word2vec to generate the second word vector library.

9. The method according to claim 6, characterized in that Determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity includes: Compare the first similarity with a second threshold, and if the first similarity is not less than the second threshold, determine that there is a business operation abnormality in the SQL log to be tested; The second similarity is compared with a third threshold value. If the second similarity is not less than the third threshold value, it is determined that there is a behavioral operation abnormality in the SQL log to be tested.

10. The method according to claim 9, characterized in that The method further comprises: If it is determined that there is a business operation abnormality in the SQL log to be tested, a business operation abnormality prompt message is issued, and abnormal user information and / or abnormal SQL list corresponding to the business operation abnormality is output; If it is determined that there is a behavior operation abnormality in the SQL log to be tested, a behavior operation abnormality prompt message is issued, and abnormal user information and / or abnormal SQL list corresponding to the behavior operation abnormality are output.

11. The method according to claim 8, characterized in that Determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity includes: Determine whether there is an abnormality in the SQL log according to the first similarity and the second similarity.

12. A SQL log anomaly detection device, characterized in that: include: The acquisition module is used to obtain the structured query language SQL log to be tested; An extraction module, used to extract SQL operation data from the SQL log to be tested, and obtain a test sequence according to the SQL operation data; A generating module, configured to generate a word vector for each word in the test sequence according to the test sequence and a pre-trained word vector library, to obtain a test word vector sequence, wherein the word vector library is trained based on SQL operation data in a preset SQL log; the preset SQL log refers to an SQL log in which there is no abnormal operation of stealing, tampering and destroying data; A calculation module, used to calculate the similarity between the word vectors in the test word vector sequence; A determination module, used for determining whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity; The calculation module is specifically used to calculate the similarity between the word vectors in the test word vector sequence, including: calculating the mean of the similarity between the word vectors in the test word vector sequence to obtain the similarity; Among them, the determination module is specifically used to determine whether there is an abnormal SQL operation in the SQL log to be tested according to the similarity, including: comparing the similarity with a first threshold; if the similarity is greater than the first threshold, determining that there is an abnormal operation in the SQL log to be tested; if the similarity is not greater than the first threshold, determining that there is no abnormal operation in the SQL log to be tested.

13. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the SQL log anomaly detection method according to any one of claims 1 to 11 by executing the executable instructions.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the SQL log anomaly detection method according to any one of claims 1 to 11 is implemented.

Images