Database operation statement detection method and device, electronic device and storage medium

Abstract

The embodiment of the present application provides a method and device for detecting database operation statements, an electronic device, and a storage medium, which belongs to the field of financial technology. The method includes: obtaining parsed data of the target operation statement, the parsed data including execution user data, statement type label, target operation object, and statement execution status; filtering out target type rules from a preset rule table based on the statement type label; writing the target operation statement, execution user data, target type rule, and statement type label into a target stack; writing the acquired object name, object mode, and object type into a target stack based on the statement type label; determining the target execution function from the registered execution function based on the target type rule; obtaining a timing detection status based on the preset execution status of the target execution function and the statement execution status detection; and generating a statement detection report based on the timing detection status and the target stack. The embodiment of the present application can improve the detection accuracy of database operation statements.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a method and device for detecting database operation statements, an electronic device, and a storage medium. Background Art

[0002] Currently, with the increase in database size and complexity, database security issues are becoming increasingly important. Databases typically have logging systems. Related technologies can use logging processes to write Structured Query Language (SQL) statements executed by users in the database into log files. Based on these log files, SQL statements corresponding to user operations can be detected, thereby ensuring database security. For example, in the insurance sector of FinTech, the corresponding database will collect a large number of SQL statements corresponding to user operations in a single day. By accurately detecting SQL statements, errors and exceptions that occur during the execution of SQL statements can be captured and analyzed in a timely manner, ensuring that the execution of SQL statements complies with relevant security policies and compliance requirements.

[0003] However, related SQL statement detection methods can only detect broad categories of SQL statements, such as Data Definition Language (DDL) and Data Manipulation Language (DML), but cannot detect the details of certain SQL statements, which reduces database security. Therefore, how to improve the accuracy of detecting database operation statements has become a technical problem that needs to be solved urgently. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to provide a database operation statement detection method and device, electronic device and storage medium, aiming to improve the detection accuracy of database operation statements.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a database statement detection method, the method comprising:

[0006] Obtaining parsed data of a target operation statement, the parsed data including execution user data, a statement type tag, a target operation object, and a statement execution status. The target operation statement is a database operation statement used to perform an operation on data in a target database. The statement execution status indicates whether the operation performed by the target operation statement on the data in the target database is successful or failed.

[0007] Filtering a target type rule from a preset rule table based on the statement type label, and writing the target operation statement, the execution user data, the target type rule and the statement type label into a target stack;

[0008] Acquire the object name, object mode, and object type of the target operation object based on the statement type tag, and write the object name, the object mode, and the object type into the target stack;

[0009] determining a target execution function from registered execution functions based on the target type rule;

[0010] Performing a timing detection on the target operation statement based on a preset execution state of the target execution function and the statement execution state to obtain a timing detection state of the target operation statement, wherein the preset execution state is an execution state expected to be obtained by calling the target execution function, and the timing detection state is used to indicate whether the detection of the target operation statement is successful or failed;

[0011] A statement detection report of the target operation statement is generated based on the timing detection state and the target stack, and the statement detection report is used to analyze abnormal conditions in a process of executing the target operation statement on data in the target database.

[0012] In some embodiments, before filtering out target type rules from a preset rule table based on the statement type tag, the method further includes:

[0013] determining a rule cache state of the preset rule table based on a preset invalidation message function, wherein the rule cache state includes an invalid state, and the invalid state is used to indicate that a rule in the preset cache of the preset rule table has changed;

[0014] If the rule cache state is the invalid state, obtaining the currently configured rule data;

[0015] Loading the rule data into the preset cache;

[0016] The preset rule table is constructed based on the mapping relationship between the rule data and the type of the rule data.

[0017] In some embodiments, obtaining the object name, object mode, and object type of the target operation object based on the statement type tag includes:

[0018] If the statement type tag is a preset type tag, obtaining the object name, the object mode, and the object type of the target operation object based on the target type rule; or

[0019] If the statement type tag is not the preset type tag, the object name, the object mode, and the object type of the target operation object are obtained based on a preset trigger.

[0020] In some embodiments, obtaining the object name, the object mode, and the object type of the target operation object based on the target type rule includes:

[0021] Performing object rule matching based on the object name of the target operation object and the target type rule to obtain an object rule matching status; the object rule matching status includes an inclusion status, wherein the inclusion status indicates that the target type rule includes a rule that matches the object name of the target operation object;

[0022] If the object rule matching result is the inclusion state, the object name, the object mode, and the object type of the target operation object are acquired based on a preset data acquisition function.

[0023] In some embodiments, the timing detection status includes a detection success status, where the detection success status indicates that the preset execution status is of the same type as the statement execution status; and generating a statement detection report for the target operation statement based on the timing detection status and the target stack includes:

[0024] If the timing detection status is the detection success status, acquiring the transaction data of the target operation statement, the database name of the target database, and statement execution data;

[0025] The statement detection report is generated based on the transaction data, the database name, the statement execution data, and the data in the target stack.

[0026] In some embodiments, performing timing detection on the target operation statement based on the preset execution state of the target execution function and the statement execution state to obtain the timing detection state of the target operation statement includes:

[0027] Performing a traversal operation on the target stack to obtain stack data;

[0028] Performing type detection on the stack data to obtain a data type of the stack data, wherein the data type includes a type to be tested, and the type to be tested is used to indicate that the stack data is relevant to statement detection of the target operation statement;

[0029] If the data type is the type to be tested, a timing detection is performed on the target operation statement based on the preset execution state and the statement execution state to obtain the timing detection state.

[0030] In some embodiments, the timing detection status further includes a detection failure status, where the detection failure status indicates that the preset execution state and the statement execution state are of different types; and generating a statement detection report for the target operation statement based on the timing detection status and the target stack further includes:

[0031] If the timing detection state is the detection failure state, releasing the target stack;

[0032] Perform stack detection on the target stack to obtain a stack state.

[0033] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a database operation statement detection device, the device comprising:

[0034] an acquisition module, which acquires parsed data of a target operation statement, the parsed data including execution user data, a statement type label, a target operation object, and a statement execution status, wherein the target operation statement is a database operation statement and is used to perform an operation on data in a target database, and the statement execution status is used to indicate whether the operation performed by the target operation statement on the data in the target database is successful or failed;

[0035] A first writing module is configured to filter out a target type rule from a preset rule table based on the statement type label, and write the target operation statement, the execution user data, the target type rule and the statement type label into a target stack;

[0036] a second writing module, configured to obtain an object name, an object mode, and an object type of the target operation object based on the statement type tag, and write the object name, the object mode, and the object type into the target stack;

[0037] a determination module, configured to determine a target execution function from registered execution functions based on the target type rule;

[0038] a detection module, performing a timing detection on the target operation statement based on a preset execution state of the target execution function and the statement execution state, to obtain a timing detection state of the target operation statement, wherein the preset execution state is an execution state expected to be obtained by calling the target execution function, and the timing detection state is used to indicate whether the detection of the target operation statement is successful or failed;

[0039] A generating module is used to generate a statement detection report of the target operation statement based on the timing detection state and the target stack, wherein the statement detection report is used to analyze abnormal conditions in the execution process of the target operation statement on the data of the target database.

[0040] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory storing a computer program, and the processor implementing the database operation statement detection method described in the first aspect when executing the computer program.

[0041] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the database operation statement detection method described in the first aspect above.

[0042] The present application proposes a database operation statement detection method and device, electronic device and storage medium, which obtains parsed data of a target operation statement, the parsed data including execution user data, statement type label, target operation object and statement execution status, the target operation statement is a database operation statement and is used to perform an operation on the data of the target database, and the statement execution status is used to characterize whether the operation performed by the target operation statement on the data of the target database is successful or failed; based on the statement type label, a target type rule is filtered out from a preset rule table; the target operation statement, execution user data, target type rule and statement type label are written into a target stack; and the target operation object is obtained based on the statement type label. The object name, object mode and object type are obtained, and the object name, object mode and object type are written into the target stack; the target execution function is determined from the registered execution function based on the target type rule; the target operation statement is detected at the right time based on the preset execution state and statement execution state of the target execution function to obtain the timing detection state of the target operation statement, the preset execution state is the execution state expected to be obtained by calling the target execution function, and the timing detection state is used to characterize whether the detection of the target operation statement is successful or failed; a statement detection report of the target operation statement is generated based on the timing detection state and the target stack, and the statement detection report is used to analyze the abnormal situation of the target operation statement in the data execution process of the target database. The embodiment of the present application can perform statement detection from the perspectives of user, object, execution state, matching rules, etc. corresponding to a target operation statement based on the statement type label. Compared with the method in which the related technology can only use log files to detect large categories of operation statements such as DDL and DML, the detection granularity of the present application is finer, and the detailed detection of a certain type of SQL statement can be realized, thereby improving the detection accuracy of database operation statements. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is the first flow chart of the database operation statement detection method provided in the embodiment of the present application;

[0044] Figure 2 This is the second flow chart of the database operation statement detection method provided in the embodiment of the present application;

[0045] Figure 3 This is a flowchart of the database startup phase provided by an embodiment of the present application;

[0046] Figure 4 yes Figure 1 A flowchart of step S130 in FIG.

[0047] Figure 5 yes Figure 1 A flowchart of step S150 in FIG.

[0048] Figure 6 yes Figure 1 The first flowchart of step S160 in FIG.

[0049] Figure 7 yes Figure 1 The second flowchart of step S160 in FIG.

[0050] Figure 8 This is a specific flow chart of the database operation statement detection method provided in an embodiment of the present application;

[0051] Figure 9 This is a structural diagram of a database operation statement detection device provided in an embodiment of the present application;

[0052] Figure 10 This is a hardware structure diagram of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0054] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0056] First, let’s analyze some of the terms used in this application:

[0057] Structured Query Language (SQL): A standardized programming language for managing and manipulating relational databases. SQL is widely used in database systems such as MySQL, PostgreSQL, Oracle, and SQL Server to execute queries, update data, manage database structures, and control database access permissions.

[0058] A database is a system used to store, manage, and retrieve data. A database typically consists of an organized set of data and is managed by a database management system (DBMS). Database technology addresses the organization, storage, management, query, and statistics of large amounts of data during information processing. This reduces data redundancy, enables data sharing, ensures data consistency, and facilitates rapid data retrieval and statistical analysis within database systems.

[0059] Data Definition Language (DDL): A language used to describe real-world entities stored in a database. DDL is primarily used to define or change table structures, data types, and table links. Common DDL keywords include CREATE, DROP, and ALTER.

[0060] Data Manipulation Language (DML): A set of SQL statements used to manipulate data in a database. DML primarily includes operations such as INSERT, UPDATE, DELETE, and SELECT.

[0061] A transaction is a key concept in database management systems. It is a sequence of operations performed on a database that is either all or none of them, forming an indivisible unit of work. The primary function of a transaction is to ensure data consistency and integrity. Transactions ensure that a set of related data operations are either all successfully committed or all rolled back, preventing the database from being left in an intermediate state.

[0062] Databases are central to organizing and storing large amounts of critical information. As databases grow in size and complexity, attackers may attempt to exploit vulnerabilities, gain unauthorized access, or conduct other malicious activities, posing a threat to the integrity and confidentiality of the database. Therefore, database security is becoming increasingly important. Based on the above considerations, databases typically have logging systems. Related technologies can use logging processes to write SQL statements executed by users in the database to log files, enabling detection of SQL statements corresponding to user operations based on these log files, thereby ensuring database security. For example, in the insurance sector of FinTech, the corresponding database collects a large number of SQL statements corresponding to user operations in a single day. By accurately detecting SQL statements, errors and exceptions that occur during SQL statement execution can be captured and analyzed in a timely manner, ensuring that the execution of SQL statements complies with relevant security policies and compliance requirements.

[0063] However, related SQL statement detection methods can only detect broad categories of SQL statements, such as DDL and DML, but cannot detect specific SQL statements (e.g., CREATE and DELETE), which reduces database security. Therefore, improving the accuracy of database operation statement detection, and thus enhancing database security, has become a pressing technical issue.

[0064] Based on this, the embodiments of the present application provide a database operation statement detection method and device, electronic device and storage medium, which can improve the detection accuracy of database operation statements, thereby improving the security of the database.

[0065] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0066] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0067] The database operation statement detection method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The database operation statement detection method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server side, and can also be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured to provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDNs) and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms; the software can be an application that implements the database operation statement detection method, etc., but is not limited to the above forms.

[0068] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0069] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on user operation behavior information and user information and other data related to user identity or characteristics, the user's permission or consent will be obtained first, and the collection, use and processing of such data will comply with relevant laws, regulations and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0070] See also Figure 1 , Figure 1This is an optional flow chart of the database operation statement detection method provided in the embodiment of the present application. In some embodiments, Figure 1 The method may include but is not limited to steps S110 to S160:

[0071] Step S110, obtaining parsed data of the target operation statement;

[0072] Step S120, filtering out target type rules from the preset rule table based on the statement type tag, and writing the target operation statement, execution user data, target type rules and statement type tag into the target stack;

[0073] Step S130, obtaining the object name, object mode, and object type of the target operation object based on the statement type tag, and writing the object name, object mode, and object type into the target stack;

[0074] Step S140, determining a target execution function from registered execution functions based on a target type rule;

[0075] Step S150, performing a timing detection on the target operation statement based on the preset execution state and statement execution state of the target execution function to obtain the timing detection state of the target operation statement;

[0076] Step S160: Generate a statement detection report for the target operation statement based on the opportunity detection status and the target stack.

[0077] In steps S110 to S160 of some embodiments, statement detection can be performed on the user, object, execution status, matching rules, etc. corresponding to a target operation statement based on the statement type label. Compared with the related technology that can only use log files to detect large-scale operation statements such as DDL and DML, the detection granularity of this application is finer, and detailed detection of a certain type of SQL statement can be achieved, thereby improving the detection accuracy of database operation statements and thus improving the security of the database.

[0078] In step S110 of some embodiments, the target operation statement is a database operation statement (i.e., an SQL statement) and is used to perform operations on the data of the target database. That is, when the target user performs operations on the data of the target database, such as adding data, deleting data, modifying data, etc., a corresponding target operation statement will be generated on the server corresponding to the database. Parsed data refers to the data that can be obtained after the target operation statement is parsed. Parsed data includes execution user data, statement type label, target operation object, and statement execution status, wherein execution user data refers to the user who executes the target operation language, that is, the execution user data can be obtained through the account information bound to the target operation statement. The statement type label is used to characterize the command label corresponding to the statement, that is, the specific category to which the statement belongs, including insert (INSERT), update (UPDATE), delete (DELETE), and query (SELECT), etc. The target operation object refers to the database entity involved in the target operation statement. Object types in this application include tables, views, indexes, sequences, procedures, and functions, each with specific properties and behaviors. The statement execution status indicates whether the target operation statement succeeded or failed in executing the operation on the target database data.

[0079] In step S120 of some embodiments, after obtaining the parsed data of the target operation statement, the target type rule can be filtered out from the preset rule table based on the statement type label. Furthermore, if the target type rule is obtained, the target operation statement, execution user data, target type rule and statement type label can be written into the target stack, which refers to the stack structure corresponding to the target operation statement. Among them, different statement types and corresponding type rules are loaded in the preset rule table. The present application can match the statement type label corresponding to the target operation statement with the statement type in the preset rule table to determine the target type rule corresponding to the target operation statement. For example, when the statement type label is SELECT, the type rule corresponding to SELECT can be taken from the preset rule table as the target type rule. In addition, the preset rule table of the present application can be a hash table, which is not limited.

[0080] It should be noted that if the type rule corresponding to the statement type label is not matched in the preset rule table, it means that the user operation behavior corresponding to the type does not need to be detected and the process can be ended directly.

[0081] It should be noted that when this application detects the behavior of user operations on the database, the database administrator needs to set up detection rules in advance according to the internal method provided, and the rules are at the library level. The rules between different databases are isolated from each other and do not affect each other. In addition, this application has two characteristics for detecting user operation statements: one is to register the corresponding methods and functions during the database startup phase, and the other is to detect the user's operation statements according to the set detection rules after the database server is started and write them into the corresponding detection report (i.e., file). The written results can include user name, database name, IP address, rule ID, SQL statement, execution status (success or failure), etc., without limitation.

[0082] In some embodiments, see Figure 2 , Figure 2 This is another optional flow chart of the database operation statement detection method provided by the embodiment of the present application. Before step S120, the database operation statement detection method of the present application may also include steps S210 to S240:

[0083] Step S210, determining the rule cache status of the preset rule table based on the preset invalidation message function;

[0084] Step S220: If the rule cache status is invalid, obtain the currently configured rule data;

[0085] Step S230, loading the rule data into a preset cache;

[0086] Step S240: constructing a preset rule table based on the mapping relationship between the rule data and the type of the rule data.

[0087] In step S210 of some embodiments, the preset invalidation message function is pre-registered and configured during the startup phase of the target database and is invoked when a type rule changes. The rule cache status indicates whether the rules in the preset cache of the preset rule table have changed. The rule cache status can include an invalid state and a valid state. The invalid state indicates that the rules in the preset cache of the preset rule table have changed, and the valid state indicates that the rules in the preset cache of the preset rule table have not changed.

[0088] It should be noted that the rules are pre-loaded into the cache, but the rules may change, so here determining whether the cache is valid is to determine whether the rules have changed. Specifically, if the rules have changed, an invalidation message will be received, so that it can be determined whether the rules of the preset rule table have changed.

[0089] In some embodiments, in steps S220 to S240, if the rule cache state is invalid, the currently configured rule data may be obtained, loaded into the preset cache, and a preset rule table may be constructed based on the mapping relationship between the rule data and the rule data type. The currently configured rule data refers to all rule data including the changed rules, to avoid duplication of rule data by simply loading only the changed rule data.

[0090] It should be noted that if the rule cache status is valid, the current preset rule table can be used to perform subsequent operations.

[0091] In some embodiments, see Figure 3 , Figure 3 This is a flowchart of the database startup phase provided by an embodiment of the present application. Before step S110, the present application will first start the database, and the steps of the database startup phase of the present application may specifically include steps S310 to S350:

[0092] Step S310, start;

[0093] Step S320: registering a configuration rule method.

[0094] This step is a method registered for use by a database administrator, and is called when the database administrator configures detection rules to generate a preset rule table.

[0095] Step S330, registering a preset invalidation message function;

[0096] Step S340: register the function for transaction submission.

[0097] The function used to register a transaction commit in this step refers to a registration execution function, which also indicates the function that determines whether the SQL statement of the registered transaction is executed successfully or failed, and is called during the transaction commit phase.

[0098] Step S350, end.

[0099] In step S130 of some embodiments, after determining the target type rule, the object name, object schema, and object type of the target operation object can be obtained based on the statement type tag, and the object name, object schema, and object type can be written to the target stack. The object name refers to the name of a specific entity in the database. For example, if the object is a table, the object name is the name of the table. For other database objects, such as views, indexes, and stored procedures, the object name also refers to the corresponding name. The object schema is a logical concept that defines the namespace and structure of objects in the database. In relational databases, a schema typically contains a set of related tables, views, indexes, and other database objects. The schema name uniquely identifies different parts of the database, particularly in a multi-user environment, to prevent naming conflicts. For example, in PostgreSQL, users can use public as the default schema or create custom schemas to organize their database objects. The object type refers to the type of entity in the database. In SQL, common object types include table, view, index, sequence, stored procedure, and function.

[0100] In some embodiments, obtaining the object name, object mode, and object type of the target operation object based on the statement type tag in step S130 may specifically include the following steps:

[0101] If the statement type tag is a preset type tag, obtaining the object name, object mode, and object type of the target operation object based on the target type rule; or,

[0102] If the statement type label is not a preset type label, the object name, object mode, and object type of the target operation object are obtained based on the preset trigger.

[0103] Among them, since different statement types have different ways of obtaining data, the present application can first determine the statement type of the target operation statement based on a preset type label, and then further obtain the object name, object mode and object type of the target operation object under the statement type. Specifically, the preset type label can be the type corresponding to the DML statement. That is, if the statement type label is a preset type label, it can be determined that the target operation statement is a DML statement, and the object name, object mode and object type of the target operation object can be obtained based on the target type rule; if the statement type label is not a preset type label, it can be determined that the target operation statement is not a DML statement, and the object name, object mode and object type of the target operation object can be directly obtained based on the preset trigger, and the obtained object name, object mode and object type are further written to the target stack. The preset trigger is a stored procedure automatically executed by the database management system. The preset trigger can be associated with a specific table event, such as INSERT, UPDATE or DELETE operations. In this way, when these events occur, the trigger will automatically execute the predefined SQL code block.

[0104] In some embodiments, see Figure 4 , Figure 4 This is an optional flowchart of step S130 provided in an embodiment of the present application. In step S130, the object name, object mode, and object type of the target operation object are obtained based on the target type rule, which may specifically include steps S410 to S420:

[0105] Step S410, performing object rule matching based on the object name and target type rule of the target operation object to obtain an object rule matching status;

[0106] Step S420: If the object rule matching result is an inclusion state, the object name, object mode, and object type of the target operation object are obtained based on a preset data acquisition function.

[0107] In step S410 of some embodiments, if the statement type label is a preset type label, object rule matching can be further performed based on the object name of the target operation object and the target type rule to obtain an object rule matching status that can reflect whether the object name of the target operation object satisfies the detection rule. Among them, the object rule matching status includes an inclusion state and a non-inclusion state. The inclusion state indicates that the target type rule contains a rule that matches the object name of the target operation object, and the non-inclusion state indicates that the target type rule does not contain a rule that matches the object name of the target operation object. For example, if the object is a table, the target type rule may have rules corresponding to different tables loaded in it. Then, the object rule matching status can be determined by comparing the object name of the target operation object with the table name loaded in the target type rule.

[0108] In step S420 of some embodiments, if the object rule matching result is an inclusion state, the object name, object mode and object type of the target operation object are obtained based on a preset data acquisition function, wherein the preset data acquisition function is used by the user to obtain the required data, and the preset acquisition function can be a C function.

[0109] It should be noted that if the object rule matching result is a non-contained state, the target stack can be released. Releasing the stack means returning all allocated memory space in the target stack to the system so that it can reuse the memory. In the C language, when a stack is created, a contiguous block of memory is typically allocated for it. This block of memory is used to store the elements in the stack. When the stack is no longer needed, the corresponding release function should be called to release this memory space to avoid memory leaks.

[0110] In step S140 of some embodiments, during the transaction commit phase, the present application may determine a target execution function from registered execution functions based on a target type rule. The target execution function is used to indicate whether the target operation statement is executed successfully or failed when the transaction is committed.

[0111] In some embodiments, in step S150, a timing check may be further performed on the target operation statement based on the preset execution state and statement execution state of the target execution function to obtain a timing check state for the target operation statement. The timing check state is used to indicate whether the current target operation statement meets the timing check. The preset execution state is the expected execution state obtained by calling the target execution function, and the timing check state is used to indicate whether the detection of the target operation statement is successful or unsuccessful.

[0112] In some embodiments, see Figure 5 , Figure 5 This is an optional flowchart of step S150 provided in an embodiment of the present application. Step S150 may specifically include steps S510 to S530:

[0113] Step S510, traverse the target stack to obtain stack data;

[0114] Step S520, performing type detection on the stack data to obtain the data type of the stack data;

[0115] Step S530: If the data type is the type to be tested, a timing detection is performed on the target operation statement based on the preset execution state and the statement execution state to obtain a timing detection state.

[0116] In steps S510 to S530 of some embodiments, when performing timing detection, the target stack can be traversed first to determine whether the current target stack still contains stack data for user detection. It should be noted that after each detection of a stack data, the stack data can be marked as having been detected, so whether the target stack still contains data for user detection can be determined based on the mark of the stack data. Specifically, for each stack data obtained, a type detection will be performed on the stack data first to obtain the data type of the stack data, and the stack data may be data that is irrelevant to the user corresponding to the target operation statement. The data type includes a type to be tested, and the type to be tested is used to characterize that the stack data is related to the statement detection of the target operation statement. Further, if the data type is a type to be tested, that is, the stack data is data related to the user corresponding to the target operation statement, the target operation statement can be subjected to timing detection based on the preset execution state and the statement execution state to obtain the timing detection state.

[0117] It should be noted that if the data type is not the type to be tested, the stack data can be directly released to avoid affecting subsequent judgments, and the process returns to re-execute step S510.

[0118] In step S160 of some embodiments, after obtaining the timing detection status, a statement detection report of the target operation statement can be generated based on the timing detection status and the target stack. The statement detection report is used to analyze abnormal situations in the data execution process of the target operation statement on the target database.

[0119] In some embodiments, see Figure 6 , Figure 6 This is an optional flowchart of step S160 provided in an embodiment of the present application. Step S160 may specifically include steps S610 to S620:

[0120] Step S610: If the opportunity detection status is a detection success status, the transaction data of the target operation statement, the database name of the target database, and the statement execution data are obtained;

[0121] Step S620: Generate a statement detection report based on the transaction data, database name, statement execution data, and data in the target stack.

[0122] In steps S610 to S620 of some embodiments, the timing detection status includes a detection success status and a detection failure status. The detection success status indicates that the preset execution status is of the same type as the statement execution status, and the detection failure status indicates that the preset execution status is of a different type than the statement execution status. Specifically, if the timing detection status is a detection success status, the transaction data of the target operation statement, the database name of the target database, and the statement execution data can be obtained. Among them, the transaction data may include the transaction number, virtual transaction number, etc. corresponding to the target operation statement, and the statement execution data may include the process number, IP address, etc. Further, the transaction data, database name, statement execution data, and the data in the target stack can be combined to generate a statement detection file corresponding to the target operation statement. Therefore, the statement detection file may include rule ID, status, transaction number, virtual transaction number, database name, process number, IP address, etc.

[0123] It should be noted that during the database startup phase, when the database administrator configures the detection rules, he or she can configure a detection function for the success or failure of the user's SQL statement execution, that is, register the execution function. Then, when the transaction is committed, if the successful function is executed and the configuration is to detect the user's successful operation, the detection timing is met, and vice versa.

[0124] It should be noted that the present application detects statements corresponding to user operation behaviors to obtain statement detection files, which can quickly identify SQL statements that execute slowly or consume a lot of resources, perform performance tuning, and ensure that the query optimizer selects the optimal execution path. It can also detect potential SQL injection attacks and other malicious SQL statements, audit access and modification operations of sensitive data, and ensure data security. In addition, it can also obtain and analyze errors and anomalies that occur during the execution of SQL statements, provide error reports and alerts, and help to discover and solve problems in a timely manner. In addition, the statement detection report obtained by the present application can also realize compliance verification, that is, ensure that the execution of SQL statements complies with relevant security policies and compliance requirements, and verify the legality and compliance of database operations through statement detection reports.

[0125] In some embodiments, see Figure 7 , Figure 7 This is another optional flow chart of step S160 provided in an embodiment of the present application. In particular, step S160 may further include steps S710 to S720:

[0126] Step S710: If the timing detection status is a detection failure status, release the target stack;

[0127] Step S720: Perform stack detection on the target stack to obtain the stack status.

[0128] In steps S710 to S720 of some embodiments, if the opportunity detection status is a detection failure status, data corresponding to the target stack is released, and stack detection is performed on the target stack again to obtain a stack status.

[0129] In one embodiment, see Figure 8 , Figure 8 This is a specific flow chart of the database operation statement detection method provided by the embodiment of the present application. The database operation statement detection method may specifically include a semantic phase, an execution phase, and a transaction commit phase. The database operation statement detection method of the present application may specifically include:

[0130] Step S801, start;

[0131] Step S802, determining whether the preset cache of the preset rule table is valid, if so, executing step S803; if not, executing step S804;

[0132] Step S803: traverse the preset rule table, match the target type rule, and further execute step S805;

[0133] Step S804, loading the currently configured rule data to update the preset rule table, and further executing step S805;

[0134] Step S805: Determine whether there is a rule corresponding to the statement type label in the preset rule table. If so, execute step S806; if not, execute step S817;

[0135] Step S806, writing the target operation statement, execution user data, target type rule and statement type tag into the target stack;

[0136] Step S807, determine whether the sentence type tag meets the preset type tag, if so, execute step S808, if not, execute step S811;

[0137] Step S808, determining whether the object name of the target operation object matches the object name included in the target type rule, if so, executing step S809, if not, executing step S810;

[0138] Step S809, obtaining the object name, object mode and object type of the target operation object and writing them into the target stack;

[0139] Step S810, releasing the undetected SQL stack, and further executing step S812;

[0140] Step S811, obtaining the object name, object mode and object type through a preset trigger, and writing them into the target stack;

[0141] Step S812, traverse the target stack;

[0142] Step S813, determine whether the target stack has stack data of the type to be tested, if so, execute step S814, if not, execute step S817;

[0143] Step S814, determining whether the preset execution state of the target execution function and the statement execution state match the target operation statement, if so, executing step S815, if not, executing step S816;

[0144] Step S815, generating a statement detection report of the target operation statement;

[0145] Step S816, releasing stack data;

[0146] Step S817, end.

[0147] An embodiment of the present application provides a method for detecting database operation statements. Compared to the native fixed method of the database that can only record the DDL and DML statements, the present application first allows the database administrator to configure detection rules for a specific SQL statement, a user, a mode or a specific object according to the internal SQL method. The database server then detects the user's operation according to the rules. This method has a higher granularity and can realize detailed detection of a certain type of SQL statement, thereby improving the detection accuracy of database operation statements, increasing the flexibility of user database operations, and improving the security of the database.

[0148] See also Figure 9 The present application also provides a database operation statement detection device that can implement the above-mentioned database operation statement detection method. The device includes:

[0149] Acquisition module 910 acquires parsed data of a target operation statement, the parsed data including execution user data, statement type label, target operation object, and statement execution status. The target operation statement is a database operation statement and is used to perform an operation on data in a target database. The statement execution status indicates whether the operation performed by the target operation statement on the data in the target database is successful or failed.

[0150] A first writing module 920 is configured to filter out a target type rule from a preset rule table based on the statement type tag, and write the target operation statement, execution user data, target type rule, and statement type tag into a target stack;

[0151] A second writing module 930 is configured to obtain an object name, an object mode, and an object type of a target operation object based on the statement type tag, and write the object name, object mode, and object type into a target stack;

[0152] A determination module 940 is configured to determine a target execution function from registered execution functions based on a target type rule;

[0153] A detection module 950 performs a timing detection on a target operation statement based on a preset execution state and a statement execution state of a target execution function, and obtains a timing detection state of the target operation statement. The preset execution state is the execution state expected by calling the target execution function, and the timing detection state is used to indicate whether the detection of the target operation statement is successful or unsuccessful.

[0154] The generating module 960 is used to generate a statement detection report of the target operation statement based on the opportunity detection state and the target stack. The statement detection report is used to analyze abnormal conditions in the execution process of the target operation statement on the data of the target database.

[0155] The specific implementation of the database operation statement detection device is basically the same as the specific embodiment of the above-mentioned database operation statement detection method, and will not be repeated here.

[0156] The present application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned database operation statement detection method when executing the computer program. The electronic device can be any smart terminal including a tablet computer, an in-vehicle computer, or the like.

[0157] See also Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0158] The processor 1010 may be implemented using a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0159] The memory 1020 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called by the processor 1010 to execute the database operation statement detection method of the embodiments of this application.

[0160] Input / output interface 1030, used to implement information input and output;

[0161] Communication interface 1040, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0162] bus 1050 , which transmits information between various components of the device (e.g., processor 1010 , memory 1020 , input / output interface 1030 , and communication interface 1040 );

[0163] The processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 are connected to each other in communication within the device via a bus 1050 .

[0164] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned database operation statement detection method is implemented.

[0165] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0166] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0167] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0168] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0169] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0170] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0171] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0172] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0173] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0174] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0175] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0176] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for detecting database operation statements, characterized in that: The method comprises: Obtaining parsed data of a target operation statement, the parsed data including execution user data, a statement type tag, a target operation object, and a statement execution status. The target operation statement is a database operation statement used to perform an operation on data in a target database. The statement execution status indicates whether the operation performed by the target operation statement on the data in the target database is successful or failed. Filtering a target type rule from a preset rule table based on the statement type label, and writing the target operation statement, the execution user data, the target type rule and the statement type label into a target stack; Acquire the object name, object mode, and object type of the target operation object based on the statement type tag, and write the object name, the object mode, and the object type into the target stack; determining a target execution function from registered execution functions based on the target type rule; Performing a timing detection on the target operation statement based on a preset execution state of the target execution function and the statement execution state to obtain a timing detection state of the target operation statement, wherein the preset execution state is an execution state expected to be obtained by calling the target execution function, and the timing detection state is used to indicate whether the detection of the target operation statement is successful or failed; A statement detection report of the target operation statement is generated based on the timing detection state and the target stack, and the statement detection report is used to analyze abnormal conditions in a process of executing the target operation statement on data in the target database.

2. The method according to claim 1, characterized in that Before filtering out target type rules from a preset rule table based on the statement type label, the method further includes: determining a rule cache state of the preset rule table based on a preset invalidation message function, wherein the rule cache state includes an invalid state, and the invalid state is used to indicate that a rule in the preset cache of the preset rule table has changed; If the rule cache state is the invalid state, obtaining the currently configured rule data; Loading the rule data into the preset cache; The preset rule table is constructed based on the mapping relationship between the rule data and the type of the rule data.

3. The method according to claim 1, characterized in that The acquiring the object name, object mode, and object type of the target operation object based on the statement type label includes: If the statement type tag is a preset type tag, obtaining the object name, the object mode, and the object type of the target operation object based on the target type rule; or If the statement type tag is not the preset type tag, the object name, the object mode, and the object type of the target operation object are obtained based on a preset trigger.

4. The method according to claim 3, characterized in that The acquiring the object name, the object mode, and the object type of the target operation object based on the target type rule includes: Performing object rule matching based on the object name of the target operation object and the target type rule to obtain an object rule matching status; the object rule matching status includes an inclusion status, wherein the inclusion status indicates that the target type rule includes a rule that matches the object name of the target operation object; If the object rule matching result is the inclusion state, the object name, the object mode, and the object type of the target operation object are acquired based on a preset data acquisition function.

5. The method according to any one of claims 1 to 4, characterized in that The timing detection state includes a detection success state, and the detection success state indicates that the preset execution state and the statement execution state are of the same type; The generating of a statement detection report of the target operation statement based on the timing detection state and the target stack includes: If the timing detection status is the detection success status, acquiring the transaction data of the target operation statement, the database name of the target database, and statement execution data; The statement detection report is generated based on the transaction data, the database name, the statement execution data, and the data in the target stack.

6. The method according to claim 5, characterized in that The performing timing detection on the target operation statement based on the preset execution state of the target execution function and the statement execution state to obtain the timing detection state of the target operation statement includes: Performing a traversal operation on the target stack to obtain stack data; Performing type detection on the stack data to obtain a data type of the stack data, wherein the data type includes a type to be tested, and the type to be tested is used to indicate that the stack data is relevant to statement detection of the target operation statement; If the data type is the type to be tested, a timing detection is performed on the target operation statement based on the preset execution state and the statement execution state to obtain the timing detection state.

7. The method according to claim 6, characterized in that The timing detection state also includes a detection failure state, where the detection failure state indicates that the preset execution state and the statement execution state are of different types; and generating a statement detection report for the target operation statement based on the timing detection state and the target stack further includes: If the timing detection state is the detection failure state, releasing the target stack; Perform stack detection on the target stack to obtain a stack state.

8. A database statement detection device, characterized in that: The device comprises: an acquisition module, which acquires parsed data of a target operation statement, the parsed data including execution user data, a statement type label, a target operation object, and a statement execution status, wherein the target operation statement is a database operation statement and is used to perform an operation on data in a target database, and the statement execution status is used to indicate whether the operation performed by the target operation statement on the data in the target database is successful or failed; A first writing module is configured to filter out a target type rule from a preset rule table based on the statement type label, and write the target operation statement, the execution user data, the target type rule and the statement type label into a target stack; a second writing module, configured to obtain an object name, an object mode, and an object type of the target operation object based on the statement type tag, and write the object name, the object mode, and the object type into the target stack; a determination module, configured to determine a target execution function from registered execution functions based on the target type rule; a detection module, performing a timing detection on the target operation statement based on a preset execution state of the target execution function and the statement execution state, to obtain a timing detection state of the target operation statement, wherein the preset execution state is an execution state expected to be obtained by calling the target execution function, and the timing detection state is used to indicate whether the detection of the target operation statement is successful or failed; A generating module is used to generate a statement detection report of the target operation statement based on the timing detection state and the target stack, wherein the statement detection report is used to analyze abnormal conditions in the execution process of the target operation statement on the data of the target database.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images