Database Message Defense Strategy Generation Method, Device, Equipment and Medium

Abstract

The present disclosure relates to the field of computer network security technology, and in particular to a database message defense strategy generation method, apparatus, device, and medium. The method comprises obtaining a target relationship graph between database messages and preset time within a preset time period for each type of database message; determining a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on the preset time period and the number of database messages obtained within the preset time period; and generating a database message defense strategy set based on multiple token bucket fill thresholds and multiple token bucket sizes, wherein the database message defense strategy set includes a defense strategy for each type of database message. The method can reduce the misjudgment of database drag attacks, database collision attacks, and the like existing in the prior art, and improve the accuracy of defense against database attack behaviors.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer network security, and in particular to a method, apparatus, device and medium for generating a database message defense strategy. Background Art

[0002] Internet technology has been widely adopted in people's lives and work, becoming increasingly intertwined with their daily lives and production. However, this widespread use of internet technology generates massive amounts of user data, which increases the risk of data leakage and loss. Common examples include database dragging attacks and database stuffing attacks. A database dragging attack occurs when a website is hacked and hackers steal user data. A database stuffing attack occurs when hackers collect leaked usernames and passwords from the internet and generate a dictionary of corresponding usernames and passwords. Using these usernames and passwords, hackers can then log in to other websites in batches, successfully logging into these websites and obtaining user data. Therefore, to ensure the security of user data and prevent its leakage, effective measures for user data protection are urgently needed.

[0003] In the existing technology, methods such as hierarchical password management, regular password changes, and website vulnerability detection are usually used to defend against database drag attacks and database collision attacks.

[0004] However, the existing database attack behavior defense methods may misjudge database drag attacks, database collision attacks, etc., which reduces the accuracy of database attack behavior defense. Summary of the Invention

[0005] Based on this, it is necessary to provide a database message defense strategy generation method, device, equipment and medium to address the above technical problems.

[0006] A first aspect of the present disclosure provides a method for generating a database message defense strategy, the method comprising:

[0007] For each type of database message, obtain a target relationship graph between the database message and the preset time within a preset time period;

[0008] Determining a token bucket size according to the target relationship graph and a token bucket filling threshold, wherein the token bucket filling threshold is determined according to a preset time period and the number of database messages obtained within the preset time period;

[0009] A database message defense policy set is generated according to the multiple token bucket filling thresholds and the multiple token bucket sizes, wherein the database message defense policy set includes a defense policy for each type of database message.

[0010] In one embodiment, obtaining a target relationship graph of database messages and preset time within a preset time period includes:

[0011] For each type of database message, within a preset time period, obtain the number of database messages within each preset time period;

[0012] The target relationship graph is determined based on a plurality of preset times and the number of database messages corresponding to the plurality of preset times.

[0013] In one embodiment, determining the token bucket size according to the target relationship graph and the token bucket filling threshold includes:

[0014] Obtain at least one target area according to the target relationship graph and a token bucket filling threshold;

[0015] The token bucket size is obtained according to at least one of the target areas and the token bucket filling threshold.

[0016] In one embodiment, the token bucket fill threshold is determined based on a preset duration and the number of database messages obtained within the preset duration, including:

[0017] Get the number of database messages of preset duration;

[0018] The quotient of the number of database messages and the preset time length is calculated to obtain a token bucket filling threshold.

[0019] In one embodiment, generating a database message defense policy set according to the multiple token bucket filling thresholds and the multiple token bucket sizes includes:

[0020] Storing a plurality of token bucket filling thresholds and a plurality of token bucket sizes to determine a learning record table;

[0021] A database message defense strategy set is generated based on the learning record table.

[0022] In one embodiment, generating a database message defense strategy set based on the learning record table includes:

[0023] Determining the generation time of the learning record table;

[0024] Determining a defense strategy name for each type of database message based on identification information of each type of database message and a generation time of the learning record table;

[0025] The defense strategy for each type of database message is determined according to the defense strategy name, token bucket filling threshold, token bucket size and preset defense action of the database message to obtain the database message defense strategy set.

[0026] In one embodiment, the method further comprises:

[0027] When a database message to be defended is obtained, a corresponding target defense strategy is determined in the database message defense strategy set according to the type of the database message to be defended;

[0028] According to the target defense strategy, the database message to be defended is defended.

[0029] According to a second aspect of the present disclosure, a device for generating a database message defense strategy is provided, the device comprising:

[0030] A target relationship graph acquisition module is used to acquire a target relationship graph of database messages and preset time within a preset time period for each type of database message;

[0031] a token bucket size determination module, configured to determine a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on a preset duration and the number of database messages obtained within the preset duration;

[0032] A generating module is used to generate a database message defense policy set according to the multiple token bucket filling thresholds and the multiple token bucket sizes, wherein the database message defense policy set includes a database message defense policy for each type of database message.

[0033] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0034] one or more processors;

[0035] a storage device for storing one or more programs,

[0036] When the one or more programs are executed by the one or more processors, the one or more processors implement any method as described in the first aspect.

[0037] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any method described in the first aspect.

[0038] The technical solution provided by the embodiments of the present disclosure has the following advantages over the prior art:

[0039] The present disclosure provides a database message defense strategy generation method, apparatus, device, and medium. The method comprises obtaining a target relationship graph between database messages and preset times within a preset time period for each type of database message; determining a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on the preset time period and the number of database messages obtained within the preset time period; and generating a database message defense strategy set based on multiple token bucket fill thresholds and multiple token bucket sizes, wherein the database message defense strategy set includes a defense strategy for each type of database message. In the above process, database messages within a preset time period are obtained in the current environment, and a target relationship graph is determined with multiple preset times included in the preset time period. The target relationship graph and the token bucket fill threshold are then used to determine the token bucket size, thereby constructing a token bucket that conforms to the current environment. The database message defense strategy set is generated based on multiple token bucket fill thresholds and multiple token bucket sizes corresponding to the token bucket that conforms to the current environment. The database message defense strategy set can reduce the misjudgment of database drag attacks, database collision attacks, and the like that exist in the prior art, thereby improving the accuracy of defense against database attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0041] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 A flowchart of a method for generating a database message defense strategy provided by an embodiment of the present disclosure;

[0043] Figure 2 A schematic diagram of a database message and a target relationship diagram of a preset time provided in an embodiment of the present disclosure;

[0044] Figure 3 A schematic diagram of the structure of a database message defense strategy generation device provided by an embodiment of the present disclosure;

[0045] Figure 4 This is a diagram of the internal structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0047] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0048] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present disclosure can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects related to each other are in an "or" relationship.

[0049] In view of the fact that there are misjudgments of database drag attacks and database collision attacks in the existing technology, which reduce the accuracy of defense against database attack behaviors, the present disclosure provides a database message defense strategy generation method. The database message defense strategy generation method obtains a target relationship graph between database messages and preset time within a preset time period for each type of database message; determines the token bucket size according to the target relationship graph and a token bucket filling threshold, wherein the token bucket filling threshold is determined according to the preset time period and the number of database messages obtained within the preset time period; generates a database message defense strategy set according to multiple token bucket filling thresholds and multiple token bucket sizes, wherein the database message defense strategy set includes a defense strategy for each type of database message. In the above process, database messages within a preset time period in the current environment are obtained, and a target relationship graph is determined with multiple preset times included in the preset time period. Then, the target relationship graph and the token bucket filling threshold are used to determine the token bucket size, so as to construct a token bucket that meets the current environment. A database message defense strategy set is generated using multiple token bucket filling thresholds and multiple token bucket sizes corresponding to the token bucket that meets the current environment. According to the database message defense strategy set, the misjudgment of database drag attacks, database collision attacks, etc. in the existing technology can be reduced, thereby improving the accuracy of defense against database attack behaviors.

[0050] The database message defense strategy generation method provided by the present disclosure can be applied to a database message defense strategy generation device, which can be various electronic devices such as personal computers, laptops, smart phones, tablet computers and portable wearable devices. Optionally, the device can also be a functional module or functional entity in these electronic devices that can implement the database message defense strategy generation method.

[0051] In one embodiment, Figure 1 As shown, Figure 1 A flowchart of a method for generating a database message defense strategy provided in an embodiment of the present disclosure specifically includes the following steps:

[0052] S11: For each type of database message, obtain a target relationship graph between the database message and the preset time within a preset time period.

[0053] Among them, there are many types of database messages. For example, the database message may include but is not limited to any one of a database login message, a database query message, a database deletion message, and a database modification message. The preset duration refers to the total time parameter set for obtaining the database message. The preset duration can be determined by setting a timer. The preset duration can be, for example, 12 seconds, that is, the time of the timer can be set to 12 seconds. When the timing starts, it is determined that the database message can be obtained at this time. The preset time refers to the total time parameter set for obtaining the database message, that is, the preset duration, divided, that is, the preset time is divided into multiple preset times, and the number of database messages obtained is determined according to each preset time. The preset time can be, for example, 1 second, but is not limited to this. The present disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0054] Specifically, for each type of database message, a target relationship graph determined according to the database message and the preset time within a preset time period is obtained.

[0055] Optionally, based on the above embodiment, in some embodiments of the present disclosure, an implementation method for obtaining a target relationship diagram of database messages and preset time within a preset time period may be:

[0056] Step A: For each type of database message, within a preset time period, obtain the number of database messages within each preset time period.

[0057] Step B: Determine a target relationship graph based on a plurality of preset times and the number of database messages corresponding to the plurality of preset times.

[0058] Specifically, for each type of database message, within the preset time, the number of database messages received within each preset time is determined; based on the multiple preset times included in the preset time and the number of database messages received within each preset time, the target relationship graph corresponding to each type of database message is determined.

[0059] For example, Figure 2 As shown, when it is determined that the type of the database message is a database query message, and the preset duration is 12 seconds, and the preset time is 1 second, within the preset duration of 12 seconds, the number of database query messages received in each preset time of 1 second is counted, for example, the number of database query messages received from 0 to 1 second is 19, the number of database query messages received from 1 second to 2 seconds is 24, until the number of database query messages received from 11 seconds to 12 seconds is 20. At this time, a coordinate system is established with the preset time as the horizontal axis and the number of database messages as the vertical axis, and a target relationship diagram 201 is obtained based on the preset time of 1 second and the number of database query messages received in each preset time, but is not limited to this. The present disclosure is not specifically limited, and those skilled in the art can set it according to actual conditions.

[0060] S12: Determine the token bucket size according to the target relationship graph and the token bucket filling threshold.

[0061] The token bucket fill threshold is determined based on a preset duration and the number of database messages obtained within the preset duration. The token bucket fill threshold is used to determine the token size corresponding to each type of database message.

[0062] Optionally, based on the above embodiment, in some embodiments of the present disclosure, one implementation method for obtaining the token bucket filling threshold may be:

[0063] Step C: Obtain the number of database messages of a preset duration.

[0064] Step D: Calculate the quotient of the number of database messages and the preset time length to obtain the token bucket filling threshold.

[0065] Specifically, for each type of data message, determine the number of all database messages received within the preset time length. After determining the number of all database messages received within the preset time length, use the number of all database messages and the preset time length to find the quotient, and the corresponding quotient value is the token bucket filling threshold.

[0066] For example, following the above embodiment, the preset duration is 12 seconds and the preset time is 1 second. The total number of all database query messages obtained in the preset duration of 12 seconds is, for example, 264. The total number of database query messages 264 is divided by the preset duration of 12 seconds to determine the token bucket filling threshold as 22 / second, but this is not limited to this. The present disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0067] It should be noted that for other types of database messages, such as database login messages, database deletion messages, database modification messages, etc., the method of obtaining the token bucket filling threshold is the same as that of the database query message. Please refer to the implementation process of steps CD in the above embodiment, which will not be repeated here.

[0068] In this way, the method for generating a database message defense strategy provided by the embodiment of the present disclosure obtains the number of database messages of a preset time length. After determining the number of database messages of the preset time length, the quotient of the number of database messages and the preset time length is calculated to obtain the token bucket filling threshold, which is convenient for subsequent operations.

[0069] Specifically, the token bucket size is determined according to a target relationship graph determined by database messages and preset time, and a token bucket filling threshold determined according to a preset time period and the number of database messages obtained within the preset time period.

[0070] S13: Generate a database message defense policy set according to multiple token bucket filling thresholds and multiple token bucket sizes.

[0071] The database message defense policy set includes a defense policy for each type of database message.

[0072] The multiple token bucket filling thresholds mentioned above refer to token bucket filling thresholds corresponding to all types of database messages, and the multiple token bucket sizes refer to token bucket sizes corresponding to all types of database messages.

[0073] Specifically, according to the token bucket filling thresholds and token bucket sizes corresponding to all types of database messages, a database message defense policy set including a defense policy for each type of database message is generated.

[0074] Thus, the method for generating a database message defense policy provided by the embodiments of the present disclosure obtains a target relationship graph between database messages and preset times within a preset time period for each type of database message; determines a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on the preset time period and the number of database messages obtained within the preset time period; and generates a database message defense policy set based on multiple token bucket fill thresholds and multiple token bucket sizes, wherein the database message defense policy set includes a defense policy for each type of database message. In the above process, by obtaining database messages within a preset time period in the current environment and determining a target relationship graph with multiple preset times included in the preset time period, and then determining a token bucket size using the target relationship graph and the token bucket fill threshold, a token bucket that conforms to the current environment is constructed. The database message defense policy set is generated using multiple token bucket fill thresholds and multiple token bucket sizes corresponding to the token bucket that conforms to the current environment. This database message defense policy set can reduce the misjudgment of database drag attacks, database collision attacks, and the like that exist in the prior art, thereby improving the accuracy of defense against database attack behaviors.

[0075] Optionally, based on the above embodiment, in some embodiments of the present disclosure, an implementation of S12 may be:

[0076] S121: Obtain at least one target area according to the target relationship graph and the token bucket filling threshold.

[0077] The target area is determined by the target relationship graph and the token bucket filling threshold, refer to Figure 2 As shown, continuing with the above embodiment, the token bucket filling threshold is 22 per second. In a coordinate system constructed with the preset time as the horizontal axis and the number of database messages as the vertical axis, the token bucket filling threshold 202 is determined. The shaded area determined according to the token bucket filling threshold 202 and the target relationship diagram 201 is the target area, such as the target area A, but is not limited to this. The present disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0078] It should be noted that the target area can be calculated by integrating the existing technology, which will not be described here.

[0079] S122: Obtain a token bucket size according to at least one target area and a token bucket filling threshold.

[0080] Specifically, based on a target relationship graph determined by a database message and a preset time, and a token bucket filling threshold determined according to a preset time length and the number of database messages obtained within the preset time length, multiple target areas within the preset time length are obtained. After obtaining the multiple target areas within the preset time length, the token bucket size is determined using the multiple target areas within the preset time length and the token bucket filling threshold.

[0081] Optionally, one implementation of obtaining the token bucket size based on at least one target area and a token bucket filling threshold may be:

[0082] When it is determined that any target area among the at least one target area is located above the bucket filling threshold, the inverse of the target area is taken to obtain at least one sub-target area.

[0083] The token bucket size is obtained by summing up the at least one first sub-target area, the at least one target area other than the at least one sub-target area, and the token bucket filling threshold.

[0084] For example, since the target area represents the tokens consumed by the database message within a period of time, when the target area is above the token bucket filling threshold, the target area is determined to be the opposite number. When the target area is below the token bucket filling threshold, the target area is determined to be itself. Figure 2 As shown, for the target area A above the token bucket filling threshold, the area S of the target area A is A The corresponding sub-target area is -S A , if the target area B is below the token bucket filling threshold, then the area S corresponding to the target area B is B For itself S B , but not limited to this, the present disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0085] Thus, the method for generating a database message defense policy provided by the embodiments of the present disclosure determines the token bucket size corresponding to the token bucket that meets the current environment through the above process. The database message defense policy set is then generated using multiple token bucket fill thresholds and multiple token bucket sizes corresponding to the token bucket that meets the current environment.

[0086] Optionally, based on the above embodiment, in some embodiments of the present disclosure, an implementation of S13 may be:

[0087] S131: Store multiple token bucket filling thresholds and multiple token bucket sizes to determine a learning record table.

[0088] S132: Generate a database message defense strategy set according to the learning record table.

[0089] Specifically, the token bucket filling threshold and token bucket size corresponding to each type of database message generated within a preset time period are stored, and a corresponding learning record table is generated. The token bucket filling threshold and token bucket size corresponding to each type of database message stored in the learning record and the learning record table are used to generate a defense strategy corresponding to each type of database message, thereby obtaining a database message defense strategy set including a defense strategy for each type of database message.

[0090] Optionally, based on the above embodiment, in some embodiments of the present disclosure, an implementation of S132 may be:

[0091] S1321: Determine the generation time of the learning record table.

[0092] For example, when the token bucket filling threshold and token bucket size corresponding to all types of database messages received within a preset time period are stored in the learning record table, the generation time of the learning record table at this time is recorded, for example, 2XX0-XX-0X, but not limited to this. This disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0093] S1322: Determine the name of the defense strategy for each type of database message based on the identification information of each type of database message and the generation time of the learning record table.

[0094] Among them, the identification information is used to distinguish different types of database messages. For example, the identification information of the database login message is 01, the identification information of the database query message is 02, the identification information of the database deletion message is 03, and the identification information of the database modification message is 04, but it is not limited to this. The present disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0095] Specifically, the generation time of the learning record table is recorded, and then the name of the defense strategy for each type of database message is determined according to the identification information of each type of database message and the generation time of the learning record table.

[0096] For example, for the database login message, the corresponding defense policy name is determined to be 2XX0-XX-0X-01, but is not limited thereto. The present disclosure does not specifically limit this, and those skilled in the art can set it according to actual conditions.

[0097] S1323: Determine the defense strategy for each type of database message according to the defense strategy name, token bucket fill threshold, token bucket size, and preset defense action of the database message to obtain the database message defense strategy set.

[0098] Among them, the preset defense action refers to the action set by the system for each type of database message, such as interception and release, but is not limited to this. This disclosure does not specifically limit it, and those skilled in the art can set it according to actual conditions.

[0099] Specifically, the defense strategy for each type of database message is determined according to the defense strategy name, token bucket filling threshold, token bucket size and preset defense action of each type of database message to obtain a database message defense strategy set including the defense strategy for each type of database message.

[0100] In this way, the method for generating a database message defense strategy provided in this embodiment can, through the above process, generate a defense strategy for each type of database message in the current environment based on the token bucket filling threshold and token bucket size, preset defense action and generation time corresponding to the token bucket that stores the token bucket that conforms to the current environment. Utilizing this database message defense strategy can improve the accuracy of defense against database attack behaviors.

[0101] Optionally, based on the above embodiment, in some embodiments of the present disclosure, the method further includes the following steps:

[0102] When a database message to be defended is obtained, the corresponding target defense strategy is determined in the database message defense strategy set according to the type of the database message to be defended. The database message to be defended is defended according to the target defense strategy.

[0103] Specifically, when a database message to be defended is received, the database message defense policy set is matched according to the type of the database message to be defended, and the target defense policy corresponding to the database message to be defended is determined. The database message to be defended is defended according to the target defense policy.

[0104] It should be noted that when receiving a message from the database to be defended, it is matched in the database message defense policy set according to the type of the message from the database to be defended. Before determining the target defense policy corresponding to the message from the database to be defended, it is necessary to further calculate the rate of the current message from the database to be defended. When the rate of the message from the database to be defended is greater than the token filling threshold, the corresponding target defense policy is obtained.

[0105] In this way, the method for generating a database message defense policy provided by this embodiment defends the database message to be defended by using the target defense policy corresponding to the database message to be defended in the database message defense policy set, thereby improving the accuracy of defense against database attack behaviors.

[0106] The embodiments of the present disclosure also provide a database message defense strategy generation device, which is used to execute any of the database message defense strategy generation methods provided in the above embodiments and has the corresponding beneficial effects of the database message defense strategy generation method.

[0107] Figure 3 A database message defense strategy generation device provided in an embodiment of the present disclosure includes: a target relationship graph acquisition module 11, a token bucket size determination module 12 and a generation module 13.

[0108] The target relationship graph acquisition module 11 is used to acquire a target relationship graph of database messages and preset time within a preset time period for each type of database message;

[0109] A token bucket size determination module 12 is configured to determine a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on a preset duration and the number of database messages obtained within the preset duration;

[0110] The generating module 13 is configured to generate a database message defense policy set according to multiple token bucket filling thresholds and multiple token bucket sizes, wherein the database message defense policy set includes a database message defense policy for each type of database message.

[0111] In the above embodiment, the target relationship graph acquisition module 11 is specifically configured to obtain the number of database messages within each preset time period for each type of database message;

[0112] The target relationship graph is determined based on a plurality of preset times and the number of database messages corresponding to the plurality of preset times.

[0113] In the above embodiment, the token bucket size determination module 12 is specifically configured to obtain at least one target area according to the target relationship graph and the token bucket filling threshold;

[0114] The token bucket size is obtained according to at least one of the target areas and the token bucket filling threshold.

[0115] In the above embodiment, the apparatus further comprises: a token bucket filling threshold obtaining module, configured to obtain the number of database messages of a preset time length;

[0116] The quotient of the number of database messages and the preset time length is calculated to obtain a token bucket filling threshold.

[0117] In the above embodiment, the generating module 13 is specifically configured to store a plurality of the token bucket filling thresholds and a plurality of the token bucket sizes to determine a learning record table;

[0118] A database message defense strategy set is generated based on the learning record table.

[0119] In the above embodiment, the generating module 13 is further configured to determine the generation time of the learning record table;

[0120] Determining a defense strategy name for each type of database message based on identification information of each type of database message and a generation time of the learning record table;

[0121] The defense strategy for each type of database message is determined according to the defense strategy name, token bucket filling threshold, token bucket size and preset defense action of the database message to obtain the database message defense strategy set.

[0122] In this way, this embodiment uses the target relationship graph acquisition module 11 to obtain, for each type of database message, a target relationship graph of database messages and a preset time within a preset time length; the token bucket size determination module 12 is used to determine the token bucket size based on the target relationship graph and the token bucket fill threshold, wherein the token bucket fill threshold is determined based on the preset time length and the number of database messages obtained within the preset time length; the generation module 13 is used to generate a database message defense policy set based on multiple token bucket fill thresholds and multiple token bucket sizes, wherein the database message defense policy set includes a database message defense policy for each type of database message. In the above process, database messages within a preset time period in the current environment are obtained, and a target relationship graph is determined with multiple preset times included in the preset time period. Then, the target relationship graph and the token bucket filling threshold are used to determine the token bucket size, so as to construct a token bucket that meets the current environment. A database message defense strategy set is generated using multiple token bucket filling thresholds and multiple token bucket sizes corresponding to the token bucket that meets the current environment. According to the database message defense strategy set, the misjudgment of database drag attacks, database collision attacks, etc. in the existing technology can be reduced, thereby improving the accuracy of defense against database attack behaviors.

[0123] Figure 4 is a structural diagram of an electronic device provided by an embodiment of the present disclosure, such as Figure 4 As shown, the electronic device includes a processor 410, a memory 420, an input device 430, and an output device 440; the number of processors 410 in the computer device can be one or more. Figure 4 In the figure, a processor 410 is used as an example; the processor 410, memory 420, input device 430 and output device 440 in the electronic device can be connected via a bus or other means. Figure 3 The bus connection is taken as an example.

[0124] Memory 420, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as program instructions / modules corresponding to the methods in the embodiments of the present invention. Processor 410 executes the software programs, instructions, and modules stored in memory 420 to perform various functional applications and data processing of the computer device, thereby implementing the methods provided in the embodiments of the present invention.

[0125] The memory 420 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created based on the use of the terminal, etc. In addition, the memory 420 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 420 may further include a memory remotely located relative to the processor 410, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0126] The input device 430 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device, and may include a keyboard, a mouse, etc. The output device 440 may include a display device such as a display screen.

[0127] The present disclosure also provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, the method provided by the present disclosure includes:

[0128] For each type of database message, obtain a target relationship graph between the database message and the preset time within a preset time period;

[0129] Determining a token bucket size according to the target relationship graph and a token bucket filling threshold, wherein the token bucket filling threshold is determined according to a preset time period and the number of database messages obtained within the preset time period;

[0130] A database message defense policy set is generated according to the multiple token bucket filling thresholds and the multiple token bucket sizes, wherein the database message defense policy set includes a defense policy for each type of database message.

[0131] Of course, the computer executable instructions of a storage medium containing computer executable instructions provided by an embodiment of the present invention are not limited to the operations of the method described above, and can also execute related operations in the method provided by any embodiment of the present invention.

[0132] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0133] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0134] The foregoing description is intended only to provide specific embodiments of the present disclosure, intended to enable those skilled in the art to understand and implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments described herein, but rather to be construed in the broadest manner consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating a database message defense strategy, characterized in that: The method comprises: For each type of database message, obtain a target relationship graph between the database message and the preset time within a preset time period; Determining a token bucket size according to the target relationship graph and a token bucket filling threshold, wherein the token bucket filling threshold is determined according to a preset time period and the number of database messages obtained within the preset time period; generating a database message defense policy set according to the multiple token bucket filling thresholds and the multiple token bucket sizes, wherein the database message defense policy set includes a defense policy for each type of database message; The step of obtaining a target relationship graph between database messages and preset times within a preset time period includes: obtaining, for each type of database message, the number of database messages within each preset time period within the preset time period; and determining the target relationship graph based on a plurality of preset times and the number of database messages corresponding to the plurality of preset times. Determining the token bucket size according to the target relationship graph and the token bucket filling threshold includes: obtaining at least one target area according to the target relationship graph and the token bucket filling threshold; obtaining the token bucket size according to the at least one target area and the token bucket filling threshold; The token bucket filling threshold is determined based on a preset duration and the number of database messages obtained within the preset duration, including: obtaining the number of database messages of the preset duration; calculating the quotient of the number of database messages and the preset duration to obtain the token bucket filling threshold.

2. The method according to claim 1, characterized in that Generating a database message defense strategy set according to the multiple token bucket filling thresholds and the multiple token bucket sizes includes: Storing a plurality of token bucket filling thresholds and a plurality of token bucket sizes to determine a learning record table; A database message defense strategy set is generated based on the learning record table.

3. The method according to claim 2, characterized in that Generating a database message defense strategy set according to the learning record table includes: Determining the generation time of the learning record table; Determining a defense strategy name for each type of database message based on identification information of each type of database message and a generation time of the learning record table; The defense strategy for each type of database message is determined according to the defense strategy name, token bucket filling threshold, token bucket size and preset defense action of the database message to obtain the database message defense strategy set.

4. The method according to claim 1, wherein The method further comprises: When a database message to be defended is obtained, a corresponding target defense strategy is determined in the database message defense strategy set according to the type of the database message to be defended; According to the target defense strategy, the database message to be defended is defended.

5. A database message defense strategy generation device, characterized in that: The device comprises: A target relationship graph acquisition module is used to acquire a target relationship graph of database messages and preset time within a preset time period for each type of database message; a token bucket size determination module, configured to determine a token bucket size based on the target relationship graph and a token bucket fill threshold, wherein the token bucket fill threshold is determined based on a preset duration and the number of database messages obtained within the preset duration; A generating module, configured to generate a database message defense policy set according to a plurality of token bucket filling thresholds and a plurality of token bucket sizes, wherein the database message defense policy set includes a defense policy for each type of database message; The target relationship graph acquisition module is specifically configured to obtain, for each type of database message, the number of database messages within each preset time within a preset time period; and determine the target relationship graph based on multiple preset time periods and the number of database messages corresponding to the multiple preset time periods. a token bucket size determination module, specifically configured to obtain at least one target area according to the target relationship graph and the token bucket filling threshold; and obtain the token bucket size according to the at least one target area and the token bucket filling threshold; The device further comprises: a token bucket filling threshold obtaining module, which is used to obtain the number of database messages of a preset time length; and calculate the quotient of the number of database messages and the preset time length to obtain the token bucket filling threshold.

6. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the database message defense strategy generation method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for generating a database message defense strategy according to any one of claims 1 to 4 are implemented.

Images