Database operation processing method, device and storage medium

Abstract

Embodiments of the present application provide a database operation processing method, device, and storage medium. In these embodiments, the event types of operation requests are divided into finer granularity based on the various operational attributes of the operation requests. This allows for finer granularity detection of abnormal operation events, reduces the probability of missed abnormal event detection, and contributes to improved database data security. Furthermore, for abnormal operation events, an exception handling method adapted to the event type of the operation request is employed to process the operation request, enabling timely prevention of abnormal operations and further contributing to improved database security.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a database operation processing method, device, and storage medium. Background Art

[0002] With the development of information technology, data has exploded, and databases are constantly being developed and utilized. As the core and foundation of information technology, databases carry a wealth of critical data. This data is crucial to the production, economy, and even the safety of users who host it. Therefore, database security has become particularly important. Therefore, improving database security has become a technical issue that requires continuous research and improvement by those skilled in the art. Summary of the Invention

[0003] Various aspects of the present application provide a database operation processing method, device, and storage medium to improve the security of a database.

[0004] The present invention provides a method for processing database operations, including:

[0005] Get operation requests for the database;

[0006] Determining, according to the operation request, multiple operation attributes of the operation request;

[0007] determining, based on the multiple operation attributes, an event type of the operation request;

[0008] Performing anomaly detection on the operation request according to the event type of the operation request;

[0009] In the case where the operation request is an abnormal operation, determining a target abnormal operation processing method adapted to the event type from a plurality of abnormal operation processing methods;

[0010] Process the operation request according to the target abnormal operation processing method.

[0011] The embodiment of the present application further provides a computing device, comprising: a memory, a processor, and a communication component; wherein the memory is used to store computer programs and multiple abnormal operation processing methods;

[0012] The processor is coupled to the memory and the communication component, and is configured to execute the computer program to perform the steps in the above database operation processing method.

[0013] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the above-mentioned database operation processing method.

[0014] In the embodiments of the present application, the event types of operation requests can be classified at a finer granularity based on the various operational attributes of the operation requests. This allows for more fine-grained detection of abnormal operation events, reduces the probability of missed abnormal event detection, and helps improve database data security. Furthermore, for abnormal operation events, an exception handling method adapted to the event type of the operation request is used to process the operation request, enabling timely prevention of abnormal operations and further improving database security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 A flowchart of a database operation processing method provided in an embodiment of the present application;

[0017] Figure 2 and Figure 3 A schematic diagram of the database operation process provided in an embodiment of the present application;

[0018] Figure 4 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0020] Some existing database plugins can log database operations based on custom monitoring events. However, these plugins only log a subset of database behavior and cannot promptly respond to illegal operations. In database security, preventing abnormal operations is often more important than correcting them. Therefore, enabling databases to detect and address abnormal operations is a crucial component of database information security.

[0021] In the embodiments of the present application, to improve database security, a more fine-grained classification of the event types of operation requests can be performed based on the various operational attributes of the operation requests. This enables more fine-grained detection of abnormal operation events, reduces the probability of missed abnormal event detection, and helps improve database data security. Furthermore, for abnormal operation events, an exception handling method adapted to the event type of the operation request is used to process the operation request, enabling timely prevention of abnormal operations, further helping to improve database security.

[0022] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0023] It should be noted that the same reference numerals denote the same objects in the following drawings and embodiments, and therefore, once an object is defined in one drawing or embodiment, it does not need to be further discussed in the subsequent drawings and embodiments.

[0024] Figure 1 This is a flow chart of the database operation processing method provided in the embodiment of the present application. Figure 1 As shown, the method mainly includes:

[0025] 101. Get an operation request for the database.

[0026] 102. Determine, according to the operation request, multiple operation attributes included in the operation request.

[0027] 103. Determine the event type of the operation request based on multiple operation attributes.

[0028] 104. Perform anomaly detection on the operation request according to the event type of the operation request.

[0029] 105. In the case that the operation request is an abnormal operation, determine a target abnormal operation processing method adapted to the event type of the operation request from multiple abnormal operation processing methods.

[0030] 106. Process the operation request according to the target abnormal operation processing method.

[0031] In the embodiments of the present application, the database may be any database. For example, the database may be a relational database, an object storage database, or an object-relational database. The operation request for the database may be any request for performing an operation on the database, including but not limited to: a database definition language (DDL) request, a data manipulation language (DML) request, a data control language (DCL) request, and a login request, etc., but not limited thereto.

[0032] Among them, DDL requests are mainly used for statements that create database objects, including but not limited to: CREATE, ALTER, DROP, TRUNCATE, COMMENT, GRANT and REVOKE statements. In the embodiment of the present application, database objects refer to entity objects in the database, including tables, views and indexes.

[0033] DML requests are mainly used to manipulate database objects, including but not limited to: SELECT, INSERT, UPDATE, DELETE, CALL, EXPLAIN PLAN, LOCK TABLE and other statements.

[0034] DCL requests are mainly used to set or change database user or role permissions, including but not limited to: COMMIT, SAVEPOINT, ROLLBACK, SET TRANSACTION and other statements.

[0035] In this embodiment, in order to improve the security of the database, anomaly detection of operation requests and timely response to abnormal operations are added to prevent the execution of abnormal operations. The inventors of this application have found that the main security risks currently faced by databases are: (1) the inability to identify internal personnel's misoperation and malicious damage to the database; (2) it is difficult to detect situations where internal legitimate users are exploited by attackers; (3) there is a lack of control over database information leakage. For database manufacturers, it is difficult to formulate very detailed operating procedures to regulate access to the database. Therefore, multiple logins to the same account, access during non-operating hours, and various other irregular operating behaviors may become security vulnerabilities.

[0036] The inventors of this application have also discovered that abnormal operations on the database mainly include the following methods: (1) illegally obtaining higher permissions to tamper with or obtain data; (2) stealing data through existing permissions; (3) maliciously tampering with or deleting data within the user's permission range; (4) establishing illegal users to provide the possibility of data manipulation, etc. Therefore, it can be seen that abnormal operations on the database are manifested in many aspects, and it is impossible to accurately detect whether an operation request is abnormal based on a single operation attribute of the operation request. For example, it is impossible to identify abnormal operations based solely on the operation type of the operation request. The operation type of the operation request mainly refers to the operation method of the database object, including but not limited to the various operation types in the DDL request, DML request, DCL request and login request shown in the above embodiment.

[0037] Based on this, to improve the accuracy of anomaly detection of operation types, in step 102, for the operation request for the database obtained in step 101, multiple operation attributes contained in the operation request can be determined based on the operation request. Multiple operation attributes refers to two or more types. The operation attributes of the operation request refer to information used to reflect the content of the operation request, including but not limited to: the user identifier providing the operation request, the operation type of the operation request, and the operation object of the operation request.

[0038] Among them, user identification refers to information that can uniquely identify a user. Optionally, the user identification can be a user name, a user's access credentials, an IP address of the user's device, or a user number, etc. The operation type refers to the operation type of the operation request, and the operation object refers to the database object requested to be accessed by the operation request, including but not limited to: a table, view or index of the database, etc. In some embodiments, the operation object can be represented by a combination of a database identifier, a schema name, and an object name. Among them, a schema refers to a logical grouping of tables in a database. An operation object with only a database identifier indicates that the operation object is all objects under the database. For example, an operation object of "MyDatabase.*" indicates that the operation object is all objects under the database "MyDatabase". For an operation object that only includes a schema name, it indicates that the operation object is all objects under the schema. For example, an operation object of "MySchema.*" indicates that the operation object is all objects under the schema "MySchema".

[0039] In this embodiment, in order to divide the operation events into finer granularity, the event type corresponding to the operation request can be identified by various operation data of the operation request. Accordingly, in step 103, the event type of the operation request can be determined based on the various operation attributes of the operation request.

[0040] The inventors of this application have discovered that, in actual applications, different users have different database access rights. Different user access rights to a database can be reflected in different types of operations that different users can perform on the database and / or different database objects that different users can access. Therefore, based on the database access rights of the user identifier of the known operation request, as well as the user identifier of the operation request, the operation type of the operation request, and the operation object of the operation request, it can be determined whether the user identifier of the operation request's access to the database is an abnormal operation. Based on this, a combination of the user identifier, operation type, and operation object can be used to identify an event type.

[0041] Accordingly, step 102 may be implemented as: obtaining, from the operation request, the user identifier providing the operation request, the operation type of the operation request, and the operation object corresponding to the operation request.

[0042] Specifically, if Figure 2 and Figure 3 As shown, on the database engine side, a parser can be used to perform lexical and syntactic analysis on the operation request to obtain a parse tree. Furthermore, a semantic parser can be used to perform semantic analysis on the parse tree to generate a query tree. Based on the query tree corresponding to the operation request, the user ID providing the operation request, the operation type of the operation request, and the corresponding operation object of the operation request can be obtained from the query tree.

[0043] Accordingly, step 103 may be implemented as follows: identifying the event type of the operation request by using the user identifier of the operation request, the operation type of the operation request, and the operation object.

[0044] Furthermore, in step 104, an abnormality check can be performed on the operation request based on the event type of the operation request. Since the user's access rights to the database are known and the user's access rights to the database are verified, it can be determined whether the user's access operation to the database exceeds the user's permission. If the user exceeds the permission, the user's database operation request is determined to be an abnormal operation.

[0045] Based on this, in some embodiments, the abnormal event type can be determined based on a database user's access rights to the database. A database user's access rights to the database include: the user's access rights to database operation objects and / or the user's access rights to database operation types. For example, user A may have access rights to certain database objects but not to other objects; another example, user A may have login rights but not permissions to add, delete, or modify database objects; another example, user A may have certain operation rights on certain database objects but not permissions to other operations. Based on this, the abnormal event type can be determined based on the operation objects and / or operation types for which the user lacks permission. Accordingly, an abnormal event type can be identified using a user identifier, operation type, and operation object. The user identifier, operation type, and operation object in the abnormal event type indicate that the user corresponding to the user identifier in the abnormal event type does not have permission to perform the operation corresponding to the operation type in the abnormal event type on the operation object in the abnormal event type. For example, an abnormal event type including user A, delete operation, and data table A may indicate that user A does not have permission to delete data table A. If the event type of the operation request in step 101 matches the abnormal event type, it means that the operation request is an abnormal operation.

[0046] Based on the predetermined abnormal event type, an optional implementation of step 104 is to query the event type of the operation request against the predetermined abnormal event types; if the event type of the operation request is found in the abnormal event types, the operation request is determined to be an abnormal operation. Correspondingly, if the event type of the operation request is not found in the abnormal event types, the operation request is determined to be a normal operation.

[0047] For normal operation requests, such as Figure 2 and Figure 3 As shown, based on normal operation requests, relevant operations can be performed on the database to obtain operation results. Specifically, for the query tree of the operation request generated by the semantic analyzer (Analyzer), the rewriter (Rewriter) can be used to rewrite the query tree according to the set rules, and the execution plan generator (Planner) can be used to generate an execution plan based on the rewritten query tree. Furthermore, the executor (Executor) executes the above execution plan to obtain the operation result corresponding to the operation request. Furthermore, the operation request can be returned to the application layer, and the application layer provides the operation result to the client that initiated the operation request.

[0048] If the result of abnormality detection on the operation request in step 104 is that the operation request is an abnormal operation, then in step 105, a target abnormal operation processing method adapted to the event type of the operation request may be determined from a plurality of abnormal operation processing methods.

[0049] In the embodiments of the present application, multiple abnormal operation request handling methods can be pre-set. Multiple refers to two or more methods. The abnormal operation handling method refers to the method of blocking abnormal operation requests. The abnormal operation handling method can be developed by database developers or operation and maintenance personnel based on the structure of abnormal operation simulation tests, or can be developed by database developers or operation and maintenance personnel based on the security impact of each abnormal operation type on the database.

[0050] In some embodiments, the correspondence between the abnormal event type and the abnormal operation processing method can be pre-configured. The abnormal event type in the object relationship can be identified by the user identifier, operation type and operation object; the abnormal operation processing method can be formulated by the database developer or operation and maintenance personnel to simulate the structure of the abnormal operation, or it can be formulated by the database developer or operation and maintenance personnel based on the security impact of each abnormal operation type on the database. Based on the correspondence between the abnormal event type and the abnormal operation processing method, one implementation method of step 105 is: in the case where the operation request is an abnormal operation, the event type of the operation request is queried in the correspondence between the abnormal event type and the abnormal operation processing method to obtain the target abnormal operation processing method adapted to the event type of the operation request.

[0051] In the embodiments of the present application, the implementation form of the correspondence between the abnormal event type and the abnormal operation processing method is not limited. In some embodiments, the correspondence between the abnormal event type and the abnormal operation processing method can be implemented in the form of a key-value pair (Key-Value), a list form, or a hash table form. Storing the correspondence between the abnormal event type and the abnormal operation processing method in a hash table can reduce the amount of data storage. Optionally, the hash table can be loaded into the memory of the database, so that when querying the abnormal event type, the query can be accelerated and the query efficiency can be improved.

[0052] Based on the correspondence between the abnormal event type and the abnormal operation processing method stored in the hash table, the event type of the operation request can be hashed to obtain the hash result of the operation request type; further, the hash result of the event type of the operation request can be used as the target address, and the abnormal operation processing method stored in the target address can be obtained from the hash table as the target abnormal operation processing method adapted to the event type of the operation request.

[0053] In actual applications, different abnormal events have different impacts on the security of the database and cause different damage to the data. Therefore, different abnormal events have different abnormal levels. Among them, the higher the abnormal level of the abnormal event, the greater the impact on the security of the database, and the greater the strength of the abnormal operation handling method adopted for the abnormal event to prevent abnormal operations. Based on this, the correspondence between the abnormal event type, the abnormal level and the abnormal operation handling method can be configured. That is, the correspondence between the abnormal event type and the abnormal operation handling method includes: the correspondence between the abnormal event type, the abnormal level and the abnormal operation handling method. In the embodiment of the present application, the abnormal operation handling methods for different abnormal levels are different. Optionally, the abnormal operation handling method of abnormal level A may include: abnormal operation handling methods of a lower level than the abnormal level A.

[0054] Optionally, the correspondence between the abnormal event type, the abnormal level and the abnormal operation processing method can also be stored in the above-mentioned hash table format.

[0055] Based on the correspondence between the abnormal event type, abnormal level and abnormal operation processing method, the event type of the operation request can be queried in the correspondence between the abnormal event type, abnormal level and abnormal operation processing method to determine the target abnormal level of the event type of the operation request; further, based on the correspondence between the abnormal event type, abnormal level and abnormal operation processing method, the abnormal operation processing method corresponding to the target abnormal level and the abnormal operation processing methods corresponding to other abnormal levels lower than the target abnormal level can be determined; thereafter, the abnormal operation processing method corresponding to the target abnormal level and the abnormal operation processing methods corresponding to other abnormal levels lower than the target abnormal level can be used as the target abnormal operation processing method.

[0056] For example, in some embodiments, an abnormal event can be customized in the database. The syntax used for the customized abnormal event is as follows:

[0057] CREATE AGGRESSION aggressionname ON database.schema.relation to USERusername[,...]ON LEVEL{LOG|CANCEL QUERY|TERMINATE|LOCKUSER|USERDF}[WITHFUNCTION name].

[0058] In the above statement, CREATE AGGRESSION is the command keyword, indicating the creation of an exception event; aggressionname is the name of the exception event; database.schema.relation is the operation object of the exception event; USER username is the user ID of the exception event; LEVEL is the exception level, including LOG (log record), CANCEL QUERY (cancel operation request), TERMINATE (terminate process), LOCKUSER (lock user), and USERDF user-defined exception levels. FUNCTION name is the response function that handles the exception operation request.

[0059] Based on these custom exception events, the following exception levels can be determined: logging, canceling the operation request, terminating the process, locking the user, and user-defined, with these levels increasing in order. Logging refers to logging the abnormal operation. Cancelling the request cancels the currently executing operation request. Terminating the process exits the currently executing process. Locking the user removes the user's login permissions.

[0060] Accordingly, the abnormal operation handling method for a high abnormality level may include the abnormal operation handling method for a low abnormality level. For example, the target abnormal operation handling method for locking a user level includes: the abnormal operation handling method corresponding to the locked user level, and the abnormal operation handling methods corresponding to logging, canceling a request, terminating a process, and locking a user. The target abnormal operation handling method corresponding to a cancel request includes: the abnormal operation handling method corresponding to the cancel request, and the abnormal operation handling method corresponding to logging.

[0061] After determining the target abnormal operation processing method adapted to the event type of the operation request, in step 106, the operation request can be processed according to the target abnormal operation processing method. Figure 3 As shown, for abnormal operations, the operation request can be blocked and the execution of the operation request can be stopped. For example, the rewriting of the query tree of the operation request, the generation of the execution plan, and the execution of the execution plan can be stopped to achieve the blocking of the operation request.

[0062] In the embodiments of this application, the event types of operation requests are classified at a finer granularity based on the various operational attributes of the operation requests. This enables more fine-grained detection of abnormal operation events, reduces the probability of missed abnormal event detection, and helps improve database data security. Furthermore, for abnormal operation events, an exception handling method adapted to the event type of the operation request is used to process the operation request, enabling timely prevention of abnormal operations and further improving database security.

[0063] In the embodiments of this application, the specific implementation method for handling an operation request according to the target abnormal operation handling method is not limited. Specifically, different target abnormality levels of the operation request result in different target abnormal operation handling methods; and the specific implementation method for handling an operation request according to the target abnormal operation handling method also varies. The following exemplifies the specific implementation method for blocking an operation request according to the target abnormal operation handling method for several abnormality levels.

[0064] Implementation method 1: If the target exception level of the operation request is a cancel request, then a response function corresponding to the cancel request may be called and the operation request may be canceled using the response function.

[0065] Implementation method 2: The target abnormality level of the operation request is to terminate the process; the lower abnormality level of the termination process includes the cancellation request. Accordingly, according to the target abnormal operation processing method, the operation request can be processed as follows: calling the response function corresponding to the cancellation request; and canceling the operation request using the response function corresponding to the cancellation request; and calling the response function corresponding to the termination process; and closing the current execution process of the operation request using the response function corresponding to the termination process. The current execution process of the operation request is the execution Figure 2 and Figure 3The process of the operation flow corresponding to the normal operation request.

[0066] Implementation 3: The target exception level of the operation request is to lock the user. Lower exception levels for locking the user include canceling the request and terminating the process. Accordingly, according to the target exception operation handling method, processing the operation request can be implemented as follows: calling the response function corresponding to the cancel request; canceling the operation request using the corresponding response function; calling the response function corresponding to the terminate process; closing the currently executing process of the operation request using the corresponding response function; and calling the response function corresponding to the locked user; canceling the login permission of the user ID corresponding to the operation request using the corresponding response function.

[0067] The inventors of this application have found that the database still has security risks such as difficulty in tracking and analyzing database security events and insufficient auditing of database operation behaviors. In the embodiment of this application, in order to track or audit abnormal events in the database, Figure 2 and Figure 3 As shown, if the operation request is an abnormal operation, the log information of the operation request can also be recorded in the log file. In this embodiment, the specific content of the operation request log information is not limited. Optionally, the operation request log information may include one or more of the following information: the IP address of the device providing the operation request, the user identifier, the operation object, the operation type, and the timestamp of the operation request. Multiple refers to two or more types.

[0068] The log information of any operation in a traditional database will be recorded in a log file. In an embodiment of the present application, in order to reduce the impact of the recording of log information of abnormal operations on the recording of log information of a traditional database, the log information of the operation request of the abnormal operation and the log information of the traditional database can be recorded in different log files. Specifically, in the case where the operation request is an abnormal operation, the log information of the operation request can be recorded in a first log file; if the operation request is a normal operation, the log information of the operation request can be recorded in a second log file, so that normal operations and abnormal operations are stored separately. Among them, the first log file and the second log file are different log files. The log information of the operation request can be marked with an abnormal identifier.

[0069] In some embodiments, to reduce the performance impact of abnormal operation log information recording on traditional database log information recording and to increase the speed of log information recording, a separate process independent of the recording process in the second log file can be initiated for abnormal operation log recording, and log information of the operation request of the abnormal operation can be recorded in the first log file. This embodiment adds a new link for recording abnormal operation log information, which is independent of the link for recording operation log information in traditional databases, thereby reducing the performance impact of traditional database log recording and improving log recording efficiency.

[0070] Because the log information of the abnormal event is stored separately in the first log file, when tracing back the abnormal event, the log information of the abnormal event can be obtained from the first log file; and the abnormal event can be traced back based on the log information of the abnormal event. Tracing back the abnormal event can determine the operational attributes of the abnormal event; further, based on the operational attributes of the abnormal event, the corresponding relationship between the abnormal event type, abnormal level, and abnormal operation handling method can be updated.

[0071] It should be noted that the execution entity of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution entity of steps 101 and 102 can be device A; for another example, the execution entity of step 101 can be device A, and the execution entity of step 102 can be device B; and so on.

[0072] In addition, some of the processes described in the above embodiments and the accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The sequence numbers of the operations, such as 101, 102, etc., are merely used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0073] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the above-mentioned database operation processing method.

[0074] Figure 4 This is a schematic diagram of the structure of the computing device provided in the embodiment of the present application. Figure 4 As shown, the computing device includes: a memory 40a, a processor 40b and a communication component 40c. The memory 40a is used to store computer programs and various abnormal operation processing methods.

[0075] The processor 40b is coupled to the memory 40a and the communication component 40c, and is used to execute a computer program for: obtaining an operation request for a database through the communication component 40c; determining multiple operation attributes of the operation request based on the operation request; determining an event type of the operation request based on the multiple operation attributes; performing anomaly detection on the operation request based on the event type of the operation request; when the operation request is an abnormal operation, determining a target abnormal operation processing method adapted to the event type from multiple abnormal operation processing methods; and processing the operation request according to the target abnormal operation processing method.

[0076] Optionally, when determining the multiple attribute information of the operation request according to the operation request, the processor 40b is specifically configured to obtain from the operation request the user identifier providing the operation request, the operation type of the operation request, and the operation object corresponding to the operation request.

[0077] Accordingly, when determining the event type of the operation request according to multiple operation attributes, the processor 40b is specifically configured to: identify the event type of the operation request by a combination of the user identifier, the operation type, and the operation object.

[0078] In some embodiments, when the processor 40b performs anomaly detection on the operation request based on the event type of the operation request, it is specifically used to: query the event type of the operation request in the predetermined abnormal event type; if the event type of the operation request is found in the abnormal event type, determine that the operation request is an abnormal operation.

[0079] Optionally, when the processor 40b determines a target abnormal operation processing method that is adapted to an event type from a plurality of abnormal operation processing methods, it is specifically used to: query the event type of the operation request in the correspondence between the abnormal event type and the abnormal operation processing method to obtain the target abnormal operation processing method corresponding to the event type of the operation request.

[0080] Furthermore, the correspondence between the abnormal event type and the abnormal operation handling method includes: a correspondence between the abnormal event type, the abnormal level, and the abnormal operation handling method. Accordingly, when the processor 40b queries the event type of the operation request in the correspondence between the abnormal event type and the abnormal operation handling method, it is specifically configured to: query the event type of the operation request in the correspondence between the abnormal event type, the abnormal level, and the abnormal operation handling method to determine the target abnormal level of the event type of the operation request; determine the abnormal operation handling method corresponding to the target abnormal level and the abnormal operation handling methods corresponding to other abnormal levels lower than the target abnormal level based on the correspondence between the abnormal event type, the abnormal level, and the abnormal operation handling method; and use the abnormal operation handling method corresponding to the target abnormal level and the abnormal operation handling methods corresponding to other abnormal levels lower than the target abnormal level as the target abnormal operation handling method.

[0081] In some embodiments, the target exception level is a cancel request. Accordingly, when processing the operation request according to the target exception operation processing mode, the processor 40b is specifically configured to: call a response function corresponding to the cancel request, and cancel the operation request using the response function corresponding to the cancel request.

[0082] In other embodiments, the target exception level is process termination; lower exception levels for process termination include cancellation requests. Accordingly, when processing an operation request in accordance with the target exception operation handling method, processor 40b is specifically configured to: call a response function corresponding to the cancellation request and cancel the operation request using the corresponding response function; and call a response function corresponding to the process termination and close the currently executing process of the operation request using the corresponding response function.

[0083] In yet other embodiments, the target exception level is locking the user; lower levels of locking the user include canceling the request and terminating the process. Accordingly, when processing the operation request according to the target exception operation handling method, the processor 40b is specifically configured to: call the response function corresponding to the cancel request and cancel the operation request using the corresponding response function; call the response function corresponding to the terminate process and close the currently executing process of the operation request using the corresponding response function; and call the response function corresponding to the locked user and cancel the login permission of the user identifier corresponding to the operation request using the corresponding response function.

[0084] Optionally, the correspondence between abnormal event types and abnormal operation handling methods is stored in the form of a hash table. Accordingly, when processor 40b queries the correspondence between abnormal event types and abnormal operation handling methods for the event type of the operation request, it is specifically configured to: hash the event type of the operation request to obtain a hash result of the event type of the operation request; and, using the hash result of the event type of the operation request as the target address, retrieve the abnormal operation handling method stored at the target address from the hash table as the target abnormal operation handling method.

[0085] In some embodiments of the present application, the processor 40b is also used to: when the operation request is an abnormal operation, record the log information of the operation request in a first log file; when the operation request is a normal operation, record the log information of the operation request in a second log file.

[0086] Optionally, when recording the log information of the operation request into the first log file, the processor 40b is specifically configured to: start a process independent of the recording process of the second log file, and record the log information of the operation request into the first log file.

[0087] Optionally, the processor 40b is further configured to: obtain log information of the abnormal event from the first log file; and backtrace the abnormal event according to the log information of the abnormal event.

[0088] In some optional embodiments, such as Figure 4 As shown, the computing device may further include: a power supply component 40d and other components. In some embodiments, the computing device may be implemented as a terminal device such as a computer or a mobile phone. Accordingly, the computing device may further include: a display component 40e and an audio component 40f and other optional components. Figure 4 Only some components are shown schematically, and it does not mean that the computing device must include Figure 4 The components shown do not necessarily mean that the computing device can only include Figure 4 Components shown.

[0089] The computing device provided in this embodiment can further fine-grainedly classify the event types of operation requests based on their various operational attributes. This enables more fine-grained detection of abnormal operation events, reduces the probability of missed abnormal event detection, and helps improve database data security. Furthermore, for abnormal operation events, an exception handling method adapted to the event type of the operation request is used to process the operation request, enabling timely prevention of abnormal operations and further improving database security.

[0090] In an embodiment of the present application, the memory is used to store computer programs and can be configured to store various other data to support operations on the device where it is located. The processor can execute the computer program stored in the memory to implement the corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0091] In the embodiment of the present application, the processor can be any hardware processing device that can execute the logic of the above method. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU) or a microcontroller unit (MCU); it can also be a programmable device such as a field programmable gate array (FPGA), a programmable array logic device (PAL), a general array logic device (GAL), a complex programmable logic device (CPLD); or an advanced reduced instruction set (RISC) processor (Advanced RISC Machines, ARM) or a system on chip (System on Chip, SOC), etc., but is not limited thereto.

[0092] In an embodiment of the present application, the communication component is configured to facilitate wired or wireless communication between the device in which it is located and other devices. The device in which the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, 4G, 5G or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can also be implemented based on near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology or other technologies.

[0093] In an embodiment of the present application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor may not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0094] In embodiments of the present application, a power supply assembly is configured to provide power to various components of the device in which it is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0095] In an embodiment of the present application, the audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component further includes a speaker for outputting an audio signal. For example, for a device with a language interaction function, voice interaction with a user can be achieved through the audio component.

[0096] It should be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit "first" and "second" to different types.

[0097] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0102] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0103] Computer storage media is readable storage media, also known as computer-readable media. Computer-readable storage media include both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, commodity, or apparatus comprising the aforementioned elements.

[0105] The above contents are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A database operation processing method, comprising: Get operation requests for the database; Determining multiple operation attributes of the operation request according to the operation request, including: obtaining from the operation request a user identifier providing the operation request, an operation type of the operation request, and an operation object corresponding to the operation request; Determining the event type of the operation request according to the multiple operation attributes includes: identifying the event type of the operation request by a combination of the user identifier, the operation type, and the operation object; Performing anomaly detection on the operation request according to the event type of the operation request; In the case where the operation request is an abnormal operation, determining a target abnormal operation processing method adapted to the event type from a plurality of abnormal operation processing methods, including: querying the event type of the operation request in the correspondence between abnormal event types and abnormal operation processing methods to obtain a target abnormal operation processing method corresponding to the event type of the operation request, including: performing hash processing on the event type of the operation request to obtain a hash result of the event type of the operation request; using the hash result of the event type of the operation request as the target address, obtaining the abnormal operation processing method stored at the target address from a hash table as the target abnormal operation processing method; the correspondence between the abnormal event type and the abnormal operation processing method includes: a correspondence between the abnormal event type, the abnormal level and the abnormal operation processing method; the correspondence between the abnormal event type and the abnormal operation processing method is stored in the form of a hash table; Process the operation request according to the target abnormal operation processing method.

2. The method according to claim 1, wherein the performing anomaly detection on the operation request according to the event type of the operation request comprises: Searching the event type of the operation request among predetermined abnormal event types; If the event type of the operation request is found in the abnormal event type, it is determined that the operation request is an abnormal operation.

3. The method according to claim 1, wherein querying the event type of the operation request in the correspondence between abnormal event types and abnormal operation processing methods to obtain the target abnormal operation processing method corresponding to the event type of the operation request comprises: querying the event type of the operation request in the correspondence between the abnormal event type, the abnormal level, and the abnormal operation processing mode to determine the target abnormal level of the event type of the operation request; Determining, based on the correspondence between the abnormal event type, abnormal level, and abnormal operation processing method, the abnormal operation processing method corresponding to the target abnormal level, and abnormal operation processing methods corresponding to other abnormal levels lower than the target abnormal level; The abnormal operation processing method corresponding to the target abnormal level and the abnormal operation processing methods corresponding to other abnormal levels lower than the target abnormal level are used as the target abnormal operation processing method.

4. The method according to claim 3, wherein the target exception level is a cancel request; and processing the operation request according to the target exception operation processing method comprises: The response function corresponding to the cancellation request is called, and the operation request is canceled using the response function corresponding to the cancellation request.

5. The method according to claim 3, wherein the target exception level is to terminate a process; the low exception level of the terminated process includes a cancellation request; and processing the operation request according to the target exception operation processing method comprises: Calling a response function corresponding to the cancellation request, and canceling the operation request using the response function corresponding to the cancellation request; The response function corresponding to the termination process is called, and the current execution process of the operation request is closed using the response function corresponding to the termination process.

6. The method according to claim 3, wherein the target abnormality level is locking the user; the lower levels of locking the user include canceling the request and terminating the process; and processing the operation request according to the target abnormal operation processing method comprises: Calling a response function corresponding to the cancellation request, and canceling the operation request using the response function corresponding to the cancellation request; Calling a response function corresponding to the terminated process, and using the response function corresponding to the terminated process to close the current execution process of the operation request; The response function corresponding to the locked user is called, and the login authority of the user identification corresponding to the operation request is cancelled using the response function corresponding to the locked user.

7. The method according to any one of claims 1 to 6, further comprising: If the operation request is an abnormal operation, log information of the operation request is recorded in a first log file; If the operation request is a normal operation, log information of the operation request is recorded in a second log file.

8. The method according to claim 7, wherein recording the log information of the operation request into the first log file comprises: A process independent of the recording process of the second log file is started to record the log information of the operation request in the first log file.

9. The method according to claim 7, further comprising: Obtaining log information of abnormal events from the first log file; The abnormal event is backtracked according to the log information of the abnormal event.

10. A computing device comprising: Memory, processor and communication components; wherein the memory is used to store computer programs and various abnormal operation processing methods; The processor is coupled to the memory and the communication component, and is configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 9.

11. A computer-readable storage medium storing computer instructions, which, when executed by one or more processors, causes the one or more processors to perform the steps of the method according to any one of claims 1 to 9.

Images