Database table classification method and system based on audit data

Abstract

The application discloses a database table classification method and system based on audit data, and belongs to the technical field of database table processing.The technical problem to be solved by the application is how to classify the database based on the use mode of the user and the corresponding data, so as to better organize the data storage position in line with the use habit of the user, thereby improving the read-write efficiency and read-write.The technical scheme adopted is as follows:the method specifically comprises the following steps: acquiring statistical data: the statistical data comprises read data of a statistical table, write data of the statistical table and the size of the entire database; acquiring a classification chart: the read-write characteristics of the database table are calculated through the statistical data, and then the classification chart is completed; classifying: the database table is divided into categories required by the user according to the category requirement of the user and the classification chart; and optimizing storage: the storage structure of the database table is optimized according to the category of the database table, the read-write performance is improved, and then the corresponding audit strategy is adapted.

Description

Technical Field

[0001] This invention relates to the field of database table processing technology, specifically a database table classification method and system based on audit data. Background Technology

[0002] As an important component of a secure operating system, the audit subsystem plays a vital role in monitoring the normal operation of the system, ensuring the correct implementation of security strategies, and constructing computer intrusion detection systems.

[0003] The database auditing system audits all database access operations. It's a product based on database protocol standard analysis and SQL parsing technology. The system meticulously records user actions such as adding, deleting, modifying, querying, and logging into the database, along with the returned results. By configuring security rules, it provides real-time alerts and post-event traceability for dangerous operations, thus protecting database security. Internal personnel, operations and maintenance staff, DBAs, and developers frequently access database data; however, this large user base and excessively high privileges pose a risk of centralized leakage of sensitive data.

[0004] TF-IDF (term frequency–inverse document frequency) is a commonly used weighting technique for information retrieval and data mining. Here, TF stands for Term Frequency, and IDF stands for Inverse Document Frequency.

[0005] TF-IDF is a statistical method used to assess the importance of a word to a document within a set of documents or a corpus. A word's importance increases proportionally to its frequency within a document, but decreases inversely proportionally to its frequency within the corpus. Various weighted forms of TF-IDF are commonly used by search engines as a measure or ranking of the relevance between documents and user queries. In addition to TF-IDF, internet search engines also use link analysis-based ranking methods to determine the order in which documents appear in search results.

[0006] The Data Manipulation Language (DML) is a programming statement used for database operations to perform access operations on the objects and data in the database. It is usually a subset of a database-specific programming language. For example, in the SQL language, which is a prevalent standard in the information software industry, the three core instructions are INSERT, UPDATE, and DELETE, representing insert (meaning new or create), update (modify), and delete (destroy) respectively. During the system development process of using a database, these are essential instructions for application programs. Along with the SELECT statement in SQL, developers in Europe and America refer to these four instructions as "CRUD" (an acronym formed by the first letters of the English words Create, Read, Update, Delete); or it may be abbreviated as "Add, Query, Modify, Delete" in four Chinese characters.

[0007] Cosine similarity, also known as cosine likeness, evaluates the similarity between two vectors by calculating the cosine value of the angle between them. If the directions of two vectors are the same, that is, the angle is close to zero, then the two vectors are similar.

[0008] To determine whether the directions of two vectors are the same, the cosine theorem can be used to calculate the angle between the vectors. The smaller the angle, the closer the cosine value is to 1, and the more their directions match, the more similar they are. The most common application is to calculate text similarity. By establishing two vectors based on the words in two texts and calculating the cosine value of these two vectors, the similarity of the two texts can be known.

[0009] TF-IDF uses the inverse document frequency IDF to weight the TF values and selects the ones with large weights as keywords. However, the simple structure of IDF cannot effectively reflect the importance of words and the distribution of feature words, making it unable to perform well in adjusting the weights. Therefore, the accuracy of the TF-IDF algorithm is not very high, especially when the text set has already been classified.

[0010] In essence, IDF is a kind of weighting that attempts to suppress noise, and it simply assumes that words with a small text frequency are more important and words with a large text frequency are more useless. This is not entirely correct for most text information. The simple structure of IDF cannot make the extracted keywords effectively reflect the importance of words and the distribution of feature words, making it unable to perform well in adjusting the weights. Especially in a corpus of the same category, this method has significant drawbacks, often covering the keywords of some texts of the same category.

[0011] Current mainstream auditing systems focus primarily on security features, rarely considering database storage, read / write operations based on user habits. Therefore, how to categorize database data according to user usage patterns to ensure better organization of data storage locations that align with user habits, thereby improving read / write efficiency, is a pressing technical challenge that needs to be addressed. Summary of the Invention

[0012] The technical objective of this invention is to provide a database table classification method and system based on audit data, in order to solve the problem of how to classify data based on how users use the database and the corresponding data, so as to ensure that data storage locations that conform to user habits can be better organized, thereby improving read and write efficiency and read / write issues.

[0013] The technical objective of this invention is achieved as follows: a database table classification method based on audit data. This method uses the TF-IDF similarity model based on read and write data generated during auditing to bind database tables with user needs and classify them. The classified database tables are then displayed and output using icons for database administrators to improve database performance and conduct audits. Specifically:

[0014] Obtain statistical data: Statistical data includes data read from statistical tables, data written to statistical tables, and the total size of the database;

[0015] Obtaining category charts: The read / write characteristics of database tables are calculated by statistical data, and then category charts are generated.

[0016] Categorization: Based on user category needs and classification charts, the database tables are divided into categories according to user needs;

[0017] Optimize storage: Based on the type of database table, optimize the storage structure of the database table to improve read and write performance, thereby adapting to the corresponding auditing strategy.

[0018] As a preferred option, the statistical data is obtained as follows:

[0019] Register for table read / write statistics for database tables to obtain read / write data for each table in the database;

[0020] During database initialization, register data read / write statistics for the entire database to obtain the database size;

[0021] Database tables are divided into four quadrants based on their read / write characteristics and table size, which is a quadrant classification based on the read / write performance of database tables.

[0022] As a preferred approach, the database is categorized based on read / write ratio and table size, as follows:

[0023] The database system reads only data from SELECT operations, and writes include data from INSERT, DELETE, and UPDATE operations.

[0024] During registration, SELECT is registered as read statistics, INSERT, DELETE, and UPDATE are registered as write statistics, and the table is registered as size statistics to obtain the read and write data of the table on which the category depends.

[0025] As a preferred approach, the read / write characteristics of the database table are calculated as follows:

[0026] Based on the statistics of read and write operations of database tables, the formula for the read / write ratio of any table is:

[0027]

[0028] Let x be the read ratio and y be the write ratio for any table in the database, then:

[0029] y = 1 - x;

[0030] For all tables in the database, a discrete chart is generated, with the x-axis representing the read / write ratio and the y-axis representing the table size, to represent the distribution of tables in the database.

[0031] As a preferred method, when dividing the categories, the horizontal axis is divided into the categories required by the user based on the number of categories input by the user.

[0032] When the number of categories entered by the user is 2, the division principle is as follows:

[0033] With half the table size as the horizontal axis and 50% of the read / write ratio as the vertical axis, the read / write ratio graph is divided into four quadrants;

[0034] The tables in the first quadrant are uppercase ratio tables where the read ratio is greater than the set read ratio threshold; the tables in the second quadrant are uppercase ratio tables where the write ratio is greater than the set write ratio threshold; the tables in the third quadrant are lowercase ratio tables where the write ratio is less than the set write ratio threshold; and the tables in the fourth quadrant are lowercase read ratio tables where the read ratio is less than the set read ratio threshold.

[0035] More specifically, the TF-IDF similarity model is as follows:

[0036] The TF-IDF formula is:

[0037] TF-IDF = TF × IDF

[0038] The formula for TF is:

[0039]

[0040] The formula for IDF is:

[0041]

[0042] For any table t in the database, the operation (UPDATE) DOWN ,UPDATE UP The data sizes corresponding to INSERT and DELETE are respectively... t INSERT and t DELETE This means that the total number of times a word appears in a document is extended to the number of operations performed on the corresponding operation in the data table, represented by term frequency. Term frequency is further extended to the percentage of the number of operations performed on the database table, represented by TF(t). '|' is used to represent the OR relationship between operations. The formula is as follows:

[0043]

[0044] For an IDF of a table, the total number of samples implies the total number of tables in the database, and the number of samples including the term implies the total number of tables involved in the operation. The operations on the audited tables consist of INSERT, UPDATE, DELETE, and SELECT, and these operations form the basis of the database data source. When the database is not empty, all database tables contain the corresponding term. Therefore, for the IDF formula, the result is distorted from the original meaning, leading to a larger error. Thus, the operation can be refined to modify a few rows or columns; adding or removing data better reflects its inverse weight. For the current target, when calculating the IDF of a table based on the operation data, the disk capacity involved in the corresponding operation is used for calculation. That is, the total number of samples is the total database size (DB_SIZE), and the number of samples including the term is the sum of the data volume affected by the operation in each table, as shown in the following formula:

[0045]

[0046] For a table, in addition to UPDATE, INSERT, DELETE, and SELECT statements, its data also includes data from SELECT statements. Since SELECT statements do not cause the table's data to increase or decrease, and the data size is at most the total amount of data in the table, the characteristics of SELECT statements are set as follows:

[0047]

[0048] Based on the TF-IDF eigenvalues ​​and the SELECT feature, a feature vector for the corresponding database is obtained, as shown in the following formula:

[0049]

[0050] When any table in the database is selected, the cosine similarity formula is used to calculate the similarity between the current table and other tables, thus classifying tables with similar behavior into the same category. The cosine similarity formula is as follows:

[0051]

[0052] A database table classification system based on audit data, the system comprising,

[0053] Module 1 is used to obtain statistical data, including data read from the statistical table, data written to the statistical table, and the total size of the database.

[0054] Module 2 is used to calculate the read and write characteristics of database tables by statistical data, and then complete the classification chart;

[0055] The segmentation module is used to divide the database table into categories based on user needs and classification charts.

[0056] The optimization module is used to optimize the storage structure of database tables according to their categories, improve read and write performance, and thus adapt to the corresponding auditing strategies.

[0057] Preferably, the acquisition module two includes a read / write ratio submodule, a similarity submodule, a read / write ratio chart generator, a similarity chart generator, and an image rendering module. The read / write ratio submodule combines the corresponding data to generate the coordinates of each table, with the table size as y and the read / write ratio as x. It classifies the data into four quadrants based on half the database size and a read / write ratio of 50%, using (… The average center point is calculated based on the coordinates of the table coordinates. The position of the average center point relative to the center point is a feature of the database, indicating a bias towards storing large or small tables, and a bias towards reading or writing. Users refer to the read / write ratio feature to determine the storage strategy of the database table. Currently, only the center point is used as the classification basis, and the database tables are divided into four categories: reading large tables, reading small tables, writing large tables, and writing small tables. The output coordinates and categories are presented to the user through the image rendering module.

[0058] The database table similarity submodule consists of two parts, as follows:

[0059] (1) Relationship closeness calculation is used to show the closeness of the relationship between tables, and what is presented to the user is a line segment of different lengths;

[0060] (2) The relative value of the table size is calculated, and the user is presented with circles of varying radii; the similarity submodule requires the user to configure classification groups, and the group classification configurations are as follows:

[0061] ① Classify into groups of N tables, and then divide them into... There are 1 group, and when the table has less than N, it is divided into 1 group;

[0062] ② Group by the closeness of the relationship. It can be divided into any number of groups within 100. The longest length of the relationship is used as the metric, and the percentage is used as the grouping basis. The user needs to input the number of groups and the percentage range of each group.

[0063] Based on the user's configuration and the calculated chart, the chart is sent to the image rendering module. The chart is generated with the table size ratio as the radius and the table similarity as the length. The chart is then sent to the image rendering module to present the classification results to the user.

[0064] When the chart renders the results, the user re-enters the scale configuration and adjusts the classification strategy to reclassify the data.

[0065] An electronic device includes: a memory and at least one processor;

[0066] The memory contains computer programs;

[0067] The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the database table classification method based on audit data as described above.

[0068] A computer-readable storage medium storing a computer program that can be executed by a processor to implement the database table classification method based on audit data as described above.

[0069] The database table classification method and system based on audit data of the present invention have the following advantages:

[0070] (i) The TF-IDF similarity model of the present invention is usually used for text similarity calculation with a large amount of data. It is used to extract the features of the text and calculate the closeness of the relationship between articles. Its vocabulary is often relatively large and consumes a lot of computing resources. Based on the analysis of user operation audit data, the vocabulary to be calculated is very small and the computing resources consumed are relatively much smaller.

[0071] (ii) Database audit statistics will gradually increase with the running time and the growth of business volume. Based on the audit data and the gradually increasing operations, the similarity between tables can be obtained according to this invention, thereby providing administrators with better references for data adjustment and database partitioning.

[0072] (iii) Based on user habits, this invention can provide developers with data to facilitate the optimization of database read and write performance;

[0073] Current database classification methods are almost all based on design or function, such as sharded tables, global tables, ER tables, system tables, dictionary tables, business tables, etc. Current classification methods do not define the specific meaning of each table, but rather calculate the similarity relationship between tables based on user habits. When the database is organized in a way that better matches user habits, its performance is more in line with expectations.

[0074] (iv) In this invention, the database operation type is used as the dataset and the size of the data involved is used as the inverse text probability of the operation;

[0075] (v) This invention uses the database operation type as vector elements; and uses the read / write ratio and table size as a rough representation of the similarity between database tables;

[0076] (vi) This invention can generate discrete graphs and perform coordinate division and classification, use database operation types as vector elements, and use cosine similarity to calculate the relationship between two tables;

[0077] (vii) Based on how users use the database and classifying the corresponding data, this invention can better organize the storage location of data that conforms to user habits, thereby improving read and write efficiency and performance.

[0078] (viii) Based on user behavior classification, this invention can better identify behaviors that are not similar to user operations, thereby applying security audit strategies to tables of similar categories, thus simplifying the administrator's operations and reducing the technical requirements for the administrator;

[0079] (ix) Based on user operating habits, the present invention can visualize the relationship between database tables, thereby revealing the usage of each table in the database, which makes it easier for developers to optimize the database storage structure.

[0080] (x) Based on the audit user behavior data and the corresponding database basic data, this invention expands and calculates the table similarity between tables in the database based on user operations, using the TF-IDF calculation formula. Based on this similarity, the database data can be classified, and the classified data can be applied to database table partitioning, database read-write separation, security policy application, etc., thereby improving the database security, read-write performance and other needs. Attached Figure Description

[0081] The invention will be further described below with reference to the accompanying drawings.

[0082] Appendix Figure 1 A schematic diagram of a discrete graph of a database table;

[0083] Appendix Figure 2 A schematic diagram of the read / write distribution groups of a database table;

[0084] Appendix Figure 3This is a schematic diagram of the structure of a database table classification system based on audit data. Detailed Implementation

[0085] The database table classification method and system based on audit data of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0086] Example 1:

[0087] This embodiment provides a database table classification method based on audit data. This method uses the TF-IDF similarity model based on read / write data generated during audits to bind database tables to user needs and classify them. The classified database tables are then displayed and output using icons for database administrators to improve database performance and for auditing purposes. Details are as follows:

[0088] S1. Obtain statistical data: Statistical data includes data read from statistical tables, data written to statistical tables, and the total size of the database;

[0089] S2. Obtain the category chart: Calculate the read and write characteristics of the database table by statistical data, and then complete the category chart;

[0090] S3. Categorization: Based on user category needs and classification charts, divide the database tables into categories of user needs;

[0091] S4. Optimize storage: Based on the type of database table, optimize the storage structure of the database table to improve read and write performance, thereby adapting to the corresponding auditing strategy.

[0092] The specific steps for obtaining statistical data in step S1 of this embodiment are as follows:

[0093] S101. Register table read and write statistics for database tables to obtain read and write data for each table in the database;

[0094] S102. During database initialization, register the data read and write statistics for the entire database to obtain the database size;

[0095] S103. Divide database tables into four quadrants based on their read / write characteristics and table size, i.e., quadrant classification based on the read / write performance of database tables.

[0096] In this embodiment, the database is categorized based on read / write ratio and table size, as follows:

[0097] The database system reads only data from SELECT operations, and writes include data from INSERT, DELETE, and UPDATE operations.

[0098] During registration, SELECT is registered as read statistics, INSERT, DELETE, and UPDATE are registered as write statistics, and the table is registered as size statistics to obtain the read and write data of the table on which the category depends.

[0099] In this embodiment, the read / write characteristics of the database table are calculated as follows:

[0100] Based on the statistics of read and write operations of database tables, the formula for the read / write ratio of any table is:

[0101]

[0102] Let x be the read ratio and y be the write ratio for any table in the database, then:

[0103] y = 1 - x;

[0104] For all tables in the database, a discrete chart is generated, with the x-axis representing the read / write ratio and the y-axis representing the table size, to represent the distribution of tables in the database, as shown in the attached chart. Figure 1 As shown.

[0105] In this embodiment, when classifying categories, the system divides the data into categories at equal intervals on the horizontal axis based on the number of categories input by the user.

[0106] When the number of categories entered by the user is 2, the division principle is as follows:

[0107] With half the table size as the horizontal axis and 50% of the read / write ratio as the vertical axis, the read / write ratio graph is divided into four quadrants;

[0108] The tables in the first quadrant are uppercase ratio tables where the read ratio is greater than the set read ratio threshold; the tables in the second quadrant are uppercase ratio tables where the write ratio is greater than the set write ratio threshold; the tables in the third quadrant are lowercase ratio tables where the write ratio is less than the set write ratio threshold; and the tables in the fourth quadrant are lowercase read ratio tables where the read ratio is less than the set read ratio threshold.

[0109] The TF-IDF similarity model in this embodiment is as follows:

[0110] The TF-IDF formula is:

[0111] TF-IDF = TF × IDF

[0112] The formula for TF is:

[0113]

[0114] The formula for IDF is:

[0115]

[0116] For any table t in the database, the operation (UPDATE) DOWN ,UPDATE UP The data sizes corresponding to INSERT and DELETE are respectively... t INSERT and t DELETE This means that the total number of times a word appears in a document is extended to the number of operations performed on the corresponding operation in the data table, represented by term frequency. Term frequency is further extended to the percentage of the number of operations performed on the database table, represented by TF(t). '|' is used to represent the OR relationship between operations. The formula is as follows:

[0117]

[0118] For an IDF of a table, the total number of samples implies the total number of tables in the database, and the number of samples including the term implies the total number of tables involved in the operation. The operations on the audited tables consist of INSERT, UPDATE, DELETE, and SELECT, and these operations form the basis of the database data source. When the database is not empty, all database tables contain the corresponding term. Therefore, for the IDF formula, the result is distorted from the original meaning, leading to a larger error. Thus, the operation can be refined to modify a few rows or columns; adding or removing data better reflects its inverse weight. For the current target, when calculating the IDF of a table based on the operation data, the disk capacity involved in the corresponding operation is used for calculation. That is, the total number of samples is the total database size (DB_SIZE), and the number of samples including the term is the sum of the data volume affected by the operation in each table, as shown in the following formula:

[0119]

[0120] For a table, in addition to UPDATE, INSERT, DELETE, and SELECT statements, its data also includes data from SELECT statements. Since SELECT statements do not cause the table's data to increase or decrease, and the data size is at most the total amount of data in the table, the characteristics of SELECT statements are set as follows:

[0121]

[0122] Based on the TF-IDF eigenvalues ​​and the SELECT feature, a feature vector for the corresponding database is obtained, as shown in the following formula:

[0123]

[0124] When any table in the database is selected, the cosine similarity formula is used to calculate the similarity between the current table and other tables, thus classifying tables with similar behavior into the same category. The cosine similarity formula is as follows:

[0125]

[0126] Based on the number of categories to be divided as input by the user in step S3, the similarity range is divided into the number of categories required by the user to complete the classification.

[0127] Using cosine similarity to calculate the similarity between two tables is more accurate than simply measuring it by read / write operations. However, read / write operations provide a more intuitive understanding of the relationships between database tables than scatter plots.

[0128] Using database tables as circles and the relationships between tables as line segment lengths, groups of data tables of varying sizes can be generated. The radius of the circle is the database size (B / K / M / G). This visually illustrates the read / write distribution of the database tables, as shown in the attached diagram. Figure 2 As shown.

[0129] In step S4 of this embodiment, the corresponding storage and auditing strategies are applied according to the category, thereby achieving the goal of optimizing the read and write performance of the database.

[0130] Example 2:

[0131] As attached Figure 3 As shown, this embodiment provides a database table classification system based on audit data. The system includes:

[0132] Module 1 is used to obtain statistical data, including data read from the statistical table, data written to the statistical table, and the total size of the database.

[0133] Module 2 is used to calculate the read and write characteristics of database tables by statistical data, and then complete the classification chart;

[0134] The segmentation module is used to divide the database table into categories based on user needs and classification charts.

[0135] The optimization module is used to optimize the storage structure of database tables according to their categories, improve read and write performance, and thus adapt to the corresponding auditing strategies.

[0136] The acquisition module two in this embodiment includes a read / write ratio submodule, a similarity submodule, a read / write ratio chart generator, a similarity chart generator, and an image rendering module. The read / write ratio submodule combines the corresponding data to generate the coordinates of each table, with the table size as y and the read / write ratio as x. It classifies the data into four quadrants based on half the database size and a read / write ratio of 50%. The average center point is calculated based on the coordinates of the table coordinates. The position of the average center point relative to the center point is a feature of the database, indicating a bias towards storing large or small tables, and a bias towards reading or writing. Users refer to the read / write ratio feature to determine the storage strategy of the database table. Currently, only the center point is used as the classification basis, and the database tables are divided into four categories: reading large tables, reading small tables, writing large tables, and writing small tables. The output coordinates and categories are presented to the user through the image rendering module.

[0137] The database table similarity submodule consists of two parts, as follows:

[0138] (1) Relationship closeness calculation is used to show the closeness of the relationship between tables, and what is presented to the user is a line segment of different lengths;

[0139] (2) The relative value of the table size is calculated, and the user is presented with circles of varying radii; the similarity submodule requires the user to configure classification groups, and the group classification configurations are as follows:

[0140] ① Classify into groups of N tables, and then divide them into... There are 1 group, and when the table has less than N, it is divided into 1 group;

[0141] ② Group by the closeness of the relationship. It can be divided into any number of groups within 100. The longest length of the relationship is used as the metric, and the percentage is used as the grouping basis. The user needs to input the number of groups and the percentage range of each group.

[0142] Based on the user's configuration and the calculated chart, the data is sent to the image rendering module. The chart is generated using the table size ratio as the radius and the table similarity as the length. The data is then sent to the image rendering module to present the classification results to the user. When the chart is rendered, the user can re-enter the ratio configuration and adjust the classification strategy to re-classify the data.

[0143] Example 3:

[0144] This embodiment also provides an electronic device, including: a memory and a processor;

[0145] The memory stores the instructions executed by the computer.

[0146] The processor executes computer execution instructions stored in the memory, causing the processor to perform the database table classification method based on audit data in any embodiment of the present invention.

[0147] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can be a microprocessor or any conventional processor.

[0148] Memory is used to store computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, at least one application program required for a function, etc.; the data storage area can store data created based on the use of the terminal, etc. In addition, memory can also include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart memory cards (SMC), secure digital cards (SD cards), flash memory cards, at least one disk storage device, flash memory devices, or other volatile solid-state storage devices.

[0149] Example 4:

[0150] This embodiment also provides a computer-readable storage medium storing multiple instructions, which are loaded by a processor to cause the processor to execute the database table classification method based on audit data in any embodiment of the present invention. Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0151] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0152] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RYM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0153] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0154] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A database table classification method based on audit data, characterized in that, This method uses the TF-IDF similarity model based on read / write data generated during auditing to bind database tables to user needs and categorize them. The categorized database tables are then displayed and output using icons for database administrators to improve database performance and conduct audits. Details are as follows: Obtain statistical data: Statistical data includes data read from statistical tables, data written to statistical tables, and the total size of the database; Obtaining category charts: The read / write characteristics of database tables are calculated by statistical data, and then category charts are generated. Categorization: Based on user category needs and classification charts, the database tables are divided into categories according to user needs; Optimize storage: Based on the type of database table, optimize the storage structure of the database table to improve read and write performance, thereby adapting to the corresponding auditing strategy; The TF-IDF similarity model is as follows: For any table t in the database, the operation ( , The data sizes corresponding to INSERT and DELETE are respectively represented by... , , and The term frequency (TF) represents the total number of times a word appears in a document, which is then used to represent the size of the corresponding data in the table. The TF is used to represent the percentage of the data size in the database table relative to the total data size. The "|" operator is used to represent the OR relationship between operations. The formula is as follows: ； For an IDF of a table, the total number of samples implies the total number of tables in the database, and the number of samples including the corresponding keywords implies the total number of tables involved in that operation; the operations on the audited tables all consist of INSERT, UPDATE, DELETE, and SELECT, and these operations form the basis of the database data source; when the database is not empty, all database tables contain the corresponding keywords; the total number of samples is the total database size DB_SIZE, and the number of samples including the corresponding keywords is the sum of the amount of data in each table affected by that operation, as shown in the following formula: ； The characteristics of select are set as follows: ； Based on the TF-IDF eigenvalues ​​and the SELECT feature, a feature vector for the corresponding database is obtained, as shown in the following formula: ； When any table in the database is selected, the cosine similarity formula is used to calculate the similarity between the current table and other tables, thus classifying tables with similar behavior into the same category. The cosine similarity formula is as follows: 。 2. The database table classification method based on audit data according to claim 1, characterized in that, The specific statistical data is as follows: Register for table read / write statistics for database tables to obtain read / write data for each table in the database; During database initialization, register data read / write statistics for the entire database to obtain the database size; Database tables are divided into four quadrants based on their read / write characteristics and table size, which is a quadrant classification based on the read / write performance of database tables.

3. The database table classification method based on audit data according to claim 1, characterized in that, Databases are categorized by their read / write ratio and table size, as follows: The database system reads only data from SELECT operations, and writes include data from INSERT, DELETE, and UPDATE operations. During registration, SELECT is registered as read statistics, INSERT, DELETE, and UPDATE are registered as write statistics, and the table is registered as size statistics to obtain the read and write data of the table on which the category depends.

4. The database table classification method based on audit data according to claim 1, characterized in that, The specific read / write characteristics of the database table are calculated as follows: Let x be the read ratio and y be the write ratio for any table in the database, then: ； For all tables in the database, a discrete chart is generated, with the x-axis representing the read / write ratio and the y-axis representing the table size, to represent the distribution of tables in the database.

5. The database table classification method based on audit data according to claim 1, characterized in that, When categorizing, the system divides the data into the required number of categories based on the user's input, and then divides the data into equal-spaced categories on the horizontal axis. When the number of categories entered by the user is 2, the division principle is as follows: With half the table size as the horizontal axis and 50% of the read / write ratio as the vertical axis, the read / write ratio graph is divided into four quadrants; The tables in the first quadrant are uppercase ratio tables whose read ratio is greater than the set read ratio threshold; The second quadrant is the write ratio table for write ratios greater than the set write ratio threshold. The third quadrant is a small write ratio table where the write ratio is less than the set write ratio threshold, and the fourth quadrant is a small read ratio table where the read ratio is less than the set read ratio threshold.

6. A database table classification system based on audit data, characterized in that, The system includes, Module 1 is used to obtain statistical data, including data read from the statistical table, data written to the statistical table, and the total size of the database. Module 2 is used to calculate the read and write characteristics of database tables by statistical data, and then complete the classification chart; The segmentation module is used to divide the database table into categories based on user needs and classification charts. The optimization module is used to optimize the storage structure of database tables according to their categories, improve read and write performance, and thus adapt to the corresponding auditing strategies. The acquisition module two includes a read / write ratio submodule, a similarity submodule, a read / write ratio chart generator, a similarity chart generator, and an image rendering module. The read / write ratio submodule combines the corresponding data to generate the coordinates of each table, with table size as y and read / write ratio as x. It classifies tables into four quadrants based on half the database size and a read / write ratio of 50%. The average center point is calculated based on the coordinates of the table coordinates. The position of the average center point relative to the center point is a feature of the database, indicating a bias towards storing large or small tables, and a bias towards reading or writing. Users refer to the read / write ratio feature to determine the storage strategy of the database table. Currently, only the center point is used as the classification basis, and the database tables are divided into four categories: reading large tables, reading small tables, writing large tables, and writing small tables. The output coordinates and categories are presented to the user through the image rendering module. The database table similarity submodule consists of two parts, as follows: (1) Relationship closeness calculation is used to show the closeness of the relationship between tables, and what is presented to the user is line segments of different lengths; (2) The relative value of the table size is calculated, and the user is presented with circles of different radii; the similarity submodule requires the user to configure the classification groups, and the group classification configurations are as follows: ① Classify into groups of N tables, and then divide them into... There are 1 group, and when the table has less than N, it is divided into 1 group; ② Group by the closeness of the relationship. It can be divided into any number of groups within 100. The longest length of the relationship is used as the metric, and the percentage is used as the grouping basis. The user needs to input the number of groups and the percentage range of each group. Based on the user's configuration and the calculated chart, the chart is sent to the image rendering module. The chart is generated with the table size ratio as the radius and the table similarity as the length. The chart is then sent to the image rendering module to present the classification results to the user. When the chart renders the results, the user re-enters the scale configuration and adjusts the classification strategy to reclassify the data.

7. An electronic device, characterized in that, include: Memory and at least one processor; The memory contains computer programs; The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the database table classification method based on audit data as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that can be executed by a processor to implement the database table classification method based on audit data as described in any one of claims 1 to 5.

Images