A database security audit method and system

Abstract

The present application relates to the technical field of database auditing, and specifically discloses a database security auditing method and system, which extracts SQL statement access events from DPI database log data, and then uses deep learning-based data processing technology to perform semantic analysis on SQL statement access events and preset user behavior rule sets, extracts SQL statement access events and semantic feature representations of each user behavior rule, and then guides query matching between SQL statement access events and user behavior rules based on the global significant semantic features of the preset user behavior rule set, thereby realizing intelligent auditing of SQL statement access events, achieving in-depth understanding of access events and behavior rules, effectively improving the accuracy and comprehensiveness of audit results, reducing the risks of false positives and false negatives, and thus improving the security protection capabilities of the database.

Description

Technical Field

[0001] The present application relates to the technical field of database auditing, and more specifically, to a database security auditing method and system. Background Art

[0002] With the rapid development of information technology, databases, as the core tool for information storage and management, play a vital role in various enterprises and organizations. At the same time, database security issues are becoming increasingly prominent, especially illegal access to databases, malicious attacks, and internal abuse, which seriously threaten the security and integrity of data. Therefore, how to effectively monitor and audit database operations has become an urgent problem to be solved.

[0003] In this regard, the invention patent with publication number CN109977689A discloses a database security audit method, device and electronic device, which uses the DPI database log to record database events as the basis, collects DPI database access log files in real time, obtains SQL statement access events through log analysis, and then performs regular matching with SQL statement access events based on a preset user behavior rule library to obtain audit results and confirm the danger level of SQL statement access events.

[0004] However, this regular expression-based matching method mainly focuses on rule matching at the character level of SQL statements, but fails to deeply understand the true intention of SQL statements at the semantic level. It often has problems such as low matching accuracy and poor rule adaptability, resulting in insufficient accuracy of audit results. It has limited recognition capabilities for complex SQL statements and changing attack patterns, and is prone to false positives or omissions.

[0005] Therefore, an optimized database security audit system and method are desired. Summary of the invention

[0006] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a database security audit method and system, which extracts SQL statement access events from DPI database log data, uses deep learning-based data processing technology to perform semantic analysis on SQL statement access events and preset user behavior rule sets, extracts SQL statement access events and semantic feature representations of each user behavior rule, and then guides the query matching between SQL statement access events and user behavior rules based on the global significant semantic features of the preset user behavior rule set, thereby realizing intelligent auditing of SQL statement access events, achieving in-depth understanding of access events and behavior rules, effectively improving the accuracy and comprehensiveness of audit results, reducing the risk of false positives and false negatives, and thus improving the security protection capabilities of the database.

[0007] According to one aspect of the present application, a database security audit method is provided, which includes:

[0008] Obtaining DPI database log data, and extracting SQL statement access events from the DPI database log data;

[0009] Extracting a set of user behavior rules from a preset user behavior rule library;

[0010] Semantically encoding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors;

[0011] Performing query response encoding on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector to obtain an access event-behavior rule query response encoding vector;

[0012] Based on the access event-behavior rule query response encoding vector, an audit result of the SQL statement access event is determined.

[0013] In the above-mentioned database security audit method, query response encoding is performed on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector, including: extracting the significant semantic features of the set of user behavior rule semantic encoding feature vectors as a prompt template; based on the prompt template, guiding the cross-domain optimized query encoding between the SQL statement access event semantic encoding feature vector and the set of user behavior rule semantic encoding feature vectors to obtain the access event-behavior rule query response encoding vector.

[0014] In the above-mentioned database security audit method, the SQL statement access event and each user behavior rule in the set of user behavior rules are semantically encoded respectively to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors, including: the SQL statement access event and each user behavior rule in the set of user behavior rules are respectively input into a semantic encoder based on the Transformer architecture to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors.

[0015] In the above-mentioned database security audit method, the significant semantic features of the set of semantic encoding feature vectors of user behavior rules are extracted as the prompt template, including: constructing a key matrix based on the set of semantic encoding feature vectors of user behavior rules; extracting the maximum value of each key vector in the key matrix to obtain the global significant semantic feature vector of user behavior rules as the prompt template.

[0016] In the above-mentioned database security audit method, a key matrix is ​​constructed based on the set of user behavior rule semantic encoding feature vectors, including: using a key embedding matrix to linearly embed code each user behavior rule semantic encoding feature vector in the set of user behavior rule semantic encoding feature vectors to obtain a set of user behavior rule semantic encoding feature vectors after linear transformation; using the user behavior rule semantic encoding feature vector after linear transformation as the key vector, and arranging the set of user behavior rule semantic encoding feature vectors after linear transformation into a matrix to obtain the key matrix.

[0017] In the above-mentioned database security audit method, based on the prompt template, the cross-domain optimized query encoding between the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector is guided to obtain the access event-behavior rule query response encoding vector, including: using the query embedding matrix and the value embedding matrix to perform linear embedding encoding on the SQL statement access event semantic encoding feature vector respectively to obtain a value vector and a query vector; the query vector, the value vector, each linearly transformed user behavior rule semantic encoding feature vector in the key matrix and the prompt template are input into a heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimized query feature vectors; query feature aggregation is performed on the set of the access event-behavior rule cross-domain optimized query feature vectors to obtain the access event-behavior rule query response encoding vector.

[0018] In the above-mentioned database security audit method, the query vector, the value vector, each linearly transformed user behavior rule semantic encoding feature vector in the key matrix, and the prompt template are input into a heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimized query feature vectors, including: multiplying the query vector by the transposed vector of the key vector and then dividing it by the bi-norm of the prompt template to obtain an attention score matrix; multiplying the attention score matrix by the prompt template after passing it through a softmax function to obtain a template prompt optimized attention weight vector; calculating the position point multiplication between the template prompt optimized attention weight vector and the value vector to obtain the access event-behavior rule cross-domain optimized query feature vector.

[0019] In the above-mentioned database security audit method, query feature aggregation is performed on the set of access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector, including: calculating the positional mean vector of the set of access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector.

[0020] In the above-mentioned database security audit method, the audit result of the SQL statement access event is determined based on the access event-behavior rule query response coding vector, including: inputting the access event-behavior rule query response coding vector into a classifier-based database audit module to obtain the audit result, and the audit result is a danger level label for the SQL statement access event.

[0021] According to another aspect of the present application, a database security audit system is provided, which includes:

[0022] A log data acquisition module, used to acquire DPI database log data and extract SQL statement access events from the DPI database log data;

[0023] A user behavior rule extraction module is used to extract a set of user behavior rules from a preset user behavior rule library;

[0024] A semantic coding module, used for semantically coding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic coding feature vectors and user behavior rule semantic coding feature vectors;

[0025] A query response encoding module, used for performing query response encoding on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector to obtain an access event-behavior rule query response encoding vector;

[0026] An audit decision module is used to determine the audit result of the SQL statement access event based on the access event-behavior rule query response encoding vector.

[0027] The present application has at least the following technical effects: Compared with the prior art, the database security audit method and system provided by the present application, after extracting SQL statement access events from the DPI database log data, adopts deep learning-based data processing technology to perform semantic analysis on SQL statement access events and preset user behavior rule sets, extracts SQL statement access events and semantic feature representations of each user behavior rule, and then guides the query matching between SQL statement access events and user behavior rules based on the global significant semantic features of the preset user behavior rule set, thereby realizing intelligent auditing of SQL statement access events, and can achieve in-depth understanding of access events and behavior rules, effectively improve the accuracy and comprehensiveness of audit results, reduce the risks of false positives and negative positives, and thus improve the security protection capabilities of the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0029] Figure 1 The present invention is a flowchart of a database security audit method according to an embodiment of the present application.

[0030] Figure 2 Schematic diagram of data flow of a database security audit method according to an embodiment of the present application.

[0031] Figure 3 This is a flowchart of sub-step S4 of the database security audit method according to an embodiment of the present application.

[0032] Figure 4 This is a flowchart of sub-step S42 of the database security audit method according to an embodiment of the present application.

[0033] Figure 5 4 is a block diagram of a database security audit system according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0035] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0036] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0037] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0038] In response to the above technical problems, the present application proposes an optimized database security audit method, which extracts SQL statement access events from DPI database log data, and then uses deep learning-based data processing technology to perform semantic analysis on SQL statement access events and preset user behavior rule sets, extracts SQL statement access events and semantic feature representations of each user behavior rule, and then, based on the global significant semantic features of the preset user behavior rule set, guides the query matching between SQL statement access events and user behavior rules, thereby realizing intelligent auditing of SQL statement access events, which can achieve an in-depth understanding of access events and behavior rules, effectively improve the accuracy and comprehensiveness of audit results, reduce the risks of false positives and negative reports, and thus improve the security protection capabilities of the database.

[0039] Figure 1 The present invention is a flowchart of a database security audit method according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the database security audit method according to the embodiment of the present application. Figure 1 and Figure 2As shown, the database security audit method includes the following steps: S1, obtaining DPI database log data, and extracting SQL statement access events from the DPI database log data; S2, extracting a set of user behavior rules from a preset user behavior rule library; S3, semantically encoding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors; S4, query response encoding the set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors to obtain an access event-behavior rule query response encoding vector; S5, determining the audit result of the SQL statement access event based on the access event-behavior rule query response encoding vector.

[0040] In the above database security audit method, the step S1 obtains DPI database log data and extracts SQL statement access events from the DPI database log data. It should be understood that DPI is a technology that can go deep into the network data packet for inspection. It can not only identify and classify various application layer protocols, but also capture specific application layer content, and record all database access and operation behaviors in detail, including the execution of SQL statements. By extracting SQL statement access events from the DPI database log, the access and operation details of the database can be accurately obtained, including but not limited to the execution time, executor, specific content of the SQL statement, etc., which helps to timely identify potential abnormal behaviors or violations, such as unauthorized access, data leakage risks, or illegal operations on sensitive data, etc., thereby realizing real-time monitoring and auditing of database security.

[0041] In the above-mentioned database security audit method, the step S2 extracts a set of user behavior rules from a preset user behavior rule library. It should be understood that the preset user behavior rule library defines the compliance standards for database access and operation behaviors, and is a set of rules for guiding database security audits. By querying and matching the actual SQL statement access events with the preset user behavior rules, events that are inconsistent with the compliance behaviors defined in the rule library can be effectively identified, thereby marking and warning of potential illegal access or attack behaviors. It should be noted that the preset user behavior rule library involved in this application can be constructed using the principles disclosed in Chinese patent CN109977689A, and of course other equivalent structural configurations can also be used, which is not limited to this application.

[0042] In the above-mentioned database security audit method, the step S3, respectively semantically encodes the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of semantic encoding feature vectors of SQL statement access events and user behavior rules. In a specific example of the present application, the step S3 includes: inputting the SQL statement access event and each user behavior rule in the set of user behavior rules into a semantic encoder based on the Transformer architecture to obtain a set of semantic encoding feature vectors of SQL statement access events and user behavior rules. It should be understood that considering that the traditional string or keyword-based matching method fails to deeply understand the contextual meaning of the data, there are usually problems such as low matching accuracy and poor rule adaptability. In this regard, the present application further adopts a semantic encoder based on the Transformer architecture to extract semantic features for the SQL statement access event and each user behavior rule in the set of user behavior rules. The Transformer architecture is known for its powerful semantic understanding capabilities. Based on the self-attention mechanism, it can effectively capture long-distance semantic dependencies in the input text sequence, thereby more accurately understanding the semantic content of SQL statements and user behavior rules, capturing key information and contextual semantic associations, and generating a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors, thereby providing more accurate semantic feature representation for subsequent query matching.

[0043] In the above-mentioned database security audit method, the step S4 performs query response encoding on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector to obtain the access event-behavior rule query response encoding vector. It should be understood that, considering that in the preset user behavior rule library, there is usually a certain semantic dependency between the various user behavior rules. For example, a group of rules may jointly define a specific access mode. Therefore, in order to make full use of the contextual semantic associations in the preset user behavior rule library to improve the accuracy of query matching, the present application proposes an optimized query matching method, which constructs a prompt template by extracting the global significant semantic features of the set of user behavior rule semantic encoding feature vectors to guide the query matching process between SQL statement access events and user behavior rules, thereby providing important behavioral rule context guidance and further enhancing the pertinence and accuracy of semantic query matching.

[0044] Figure 3 FIG. 4 is a flowchart of sub-step S4 of the database security audit method according to an embodiment of the present application. Figure 3As shown, the step S4 includes the steps of: S41, extracting the significant semantic features of the set of user behavior rule semantic encoding feature vectors as a prompt template; S42, based on the prompt template, guiding the SQL statement to access the cross-domain optimized query encoding between the event semantic encoding feature vector and the set of user behavior rule semantic encoding feature vectors to obtain the access event-behavior rule query response encoding vector.

[0045] Specifically, the step S41 extracts the significant semantic features of the set of semantically encoded feature vectors of the user behavior rules as a prompt template. In a specific example of the present application, the step S4 includes: constructing a key matrix based on the set of semantically encoded feature vectors of the user behavior rules; extracting the maximum value of each key vector in the key matrix to obtain a global significant semantic feature vector of the user behavior rules as the prompt template.

[0046] In a specific example of the present application, a key matrix is ​​constructed based on the set of user behavior rule semantic encoding feature vectors, including: using a key embedding matrix to linearly embed code each user behavior rule semantic encoding feature vector in the set of user behavior rule semantic encoding feature vectors to obtain a set of linearly transformed user behavior rule semantic encoding feature vectors; using the linearly transformed user behavior rule semantic encoding feature vector as the key vector, and arranging the set of linearly transformed user behavior rule semantic encoding feature vectors in a matrix to obtain the key matrix.

[0047] Specifically, each user behavior rule semantic encoding feature vector in the set of user behavior rule semantic encoding feature vectors is linearly transformed to map it to a new latent feature space so that it is suitable for the subsequent query matching process. Then, each user behavior rule semantic encoding feature vector after linear transformation is used as a key vector and arranged into a key matrix for subsequent parallel processing. Then, the maximum value of each key vector is selected from the key matrix to combine into a global significant semantic feature vector of the user behavior rule to capture important behavior rule information and use it as a prompt template to guide the subsequent query matching process to focus more on the key semantic feature parts of each user behavior rule to reduce the interference of redundant information.

[0048] Specifically, the step S42 guides the SQL statement to access the cross-domain optimized query encoding between the set of semantic encoding feature vectors of the event and the semantic encoding feature vectors of the user behavior rules based on the prompt template to obtain the access event-behavior rule query response encoding vector. Figure 4 FIG. 4 is a flowchart of sub-step S42 of the database security audit method according to an embodiment of the present application. Figure 4As shown, the step S42 includes the steps of: S421, using the query embedding matrix and the value embedding matrix to perform linear embedding encoding on the SQL statement access event semantic encoding feature vector respectively to obtain a value vector and a query vector; S422, inputting the query vector, the value vector, each linearly transformed user behavior rule semantic encoding feature vector in the key matrix, and the prompt template into a heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimization query feature vectors; S423, performing query feature aggregation on the set of access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector.

[0049] More specifically, the step S422 inputs the query vector, the value vector, the semantically encoded feature vectors of user behavior rules after each linear transformation in the key matrix, and the prompt template into a heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimization query feature vectors. In a specific example of the present application, the step S422 includes: multiplying the query vector by the transposed vector of the key vector and then dividing it by the bi-norm of the prompt template to obtain an attention score matrix; multiplying the attention score matrix by the prompt template after passing it through a softmax function to obtain a template prompt optimization attention weight vector; calculating the position point multiplication between the template prompt optimization attention weight vector and the value vector to obtain the access event-behavior rule cross-domain optimization query feature vector. That is, through a specially designed heterogeneous transformer structure, the query vector, the value vector, each linearly transformed user behavior rule semantic encoding feature vector in the key matrix, and the prompt template are interactively encoded, and the weight distribution strategy is automatically adjusted by introducing additional prompt templates in the traditional attention mechanism. Not only the semantic relevance between each user behavior rule and the SQL statement access event is considered, but also the global contextual semantic structure of each user behavior rule in the preset user behavior rule library is considered, which helps to generate more accurate and relevant query outputs.

[0050] More specifically, the step S423 performs query feature aggregation on the set of the access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector. In a specific example of the present application, the step S423 includes: calculating the positional mean vector of the set of the access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector. That is, the SQL statement access event and the cross-domain optimization query matching results of each user behavior rule are fused by positional mean to integrate the query matching information of all user behavior rules and generate a global access event-behavior rule query response encoding vector, thereby achieving a comprehensive matching evaluation of the SQL statement access event.

[0051] Accordingly, the step S4 includes: processing the set of user behavior rule semantic encoding feature vectors and the SQL statement access event semantic encoding feature vectors with the following query encoding formula to obtain the access event-behavior rule query response encoding vector, wherein the query encoding formula is:

[0052]

[0053]

[0054]

[0055]

[0056]

[0057]

[0058]

[0059]

[0060] in, represents the set of semantically encoded feature vectors of the user behavior rules, , , and are respectively the first, second, and third in the set of semantic encoding feature vectors of the user behavior rules. and User behavior rule semantic encoding feature vector, The value of is the number of semantic encoding feature vectors of the user behavior rules, , and denote the key embedding matrix, query embedding matrix and value embedding matrix respectively, , and Represent different bias terms, represents the key matrix, , , and are the first, second, and and key vector, i.e., the semantic encoding feature vector of user behavior rules after the linear transformation, represents the maximum value function, represents the prompt template, represents the semantic encoding feature vector of the SQL statement access event, and denote the query vector and value vector respectively, represents the transpose of a vector, represents the two-norm of a vector, is the normalized exponential function, represents the matrix multiplication operation, It means point multiplication by position. The first one in the set of the access event-behavior rule cross-domain optimization query feature vectors Access event-behavior rule cross-domain optimization query feature vector, Represents the access event-behavior rule query response encoding vector.

[0061] In the above-mentioned database security audit method, the step S5 determines the audit result of the SQL statement access event based on the access event-behavior rule query response coding vector. In a specific example of the present application, the step S5 includes: inputting the access event-behavior rule query response coding vector into a classifier-based database audit module to obtain the audit result, and the audit result is a danger level label for the SQL statement access event. That is, the classifier model is used to classify and judge the access event-behavior rule query response coding vector. Through a large amount of training, the classifier can effectively learn the query matching information between the access event behavior rules contained in the access event-behavior rule query response coding vector, fully understand the similarity correlation between the two, and output the corresponding audit result.

[0062] In a preferred example of the present application, the access event-behavior rule query response coding vector is input into a classifier-based database audit module to obtain the audit result, including: determining an access event-behavior rule query response coding association response matrix and an access event-behavior rule query response coding distance response matrix based on the association value and distance value of the characteristic value of the access event-behavior rule query response coding vector; matrix multiplying the access event-behavior rule query response coding vector with the access event-behavior rule query response coding association response matrix to obtain an access event-behavior rule query response coding association response vector; matrix multiplying the access event-behavior rule query response coding distance response matrix with the transposed vector of the access event-behavior rule query response coding vector to obtain Access event-behavior rule query response coding distance response vector; perform dot product on the access event-behavior rule query response coding association response matrix and the access event-behavior rule query response coding distance response matrix, and then perform matrix multiplication with the transpose vector of the access event-behavior rule query response coding vector to obtain an access event-behavior rule query logic bias vector; perform dot product on the access event-behavior rule query response coding association response vector, the access event-behavior rule query response coding distance response vector and the access event-behavior rule query logic bias vector to obtain an optimized access event-behavior rule query response coding vector; input the optimized access event-behavior rule query response coding vector into a classifier-based database audit module to obtain the audit result.

[0063] Accordingly, the optimization process of the access event-behavior rule query response encoding vector is represented by the following optimization formula:

[0064]

[0065]

[0066]

[0067]

[0068]

[0069]

[0070]

[0071] in, Encoding the associated response matrix for accessing event-behavior rule query responses, Encoding distance response matrix for access event-behavior rule query response, For the access event-behavior rule query response encoding association response matrix The eigenvalues ​​of the positions, The access event-behavior rule query response encoding distance response matrix The eigenvalues ​​of the positions, and The first and eigenvalues, The point-add vector between the access event-behavior rule query response encoding association response vector and the access event-behavior rule query response encoding distance response vector, Query the logic bias vector for accessing event-action rules, is the set of real numbers, The length of the encoding vector for accessing event-action rule query responses, It means point multiplication by position. represents matrix multiplication, Indicates adding by position point. To access the event-action rule query response encoding vector, Encoding vectors for optimized access event-behavior rule query responses.

[0072] That is, when the set of the SQL statement access event semantic coding feature vector and the set of the user behavior rule semantic coding feature vector respectively represent the coded semantic features of the SQL statement access event and the set of user behavior rules, when performing query coding optimization, the semantic feature correspondence gap will also cause the key matrix to become significantly sparsely distributed, resulting in large-scale simple repetition of the distribution prompts of the coded semantic features, affecting the query coding semantic logical dependency and reducing the accuracy of the classification results based on the semantic distribution.

[0073] Therefore, by using the self-correlation matrix and self-distance matrix of the access event-behavior rule query response encoding vector as the statistical reference-free distribution response framework of the access event-behavior rule query response encoding vector, based on the retrieval-enhanced reverse response construction for the access event-behavior rule query response encoding vector, simple repetition of feature distribution is avoided, and by ensuring the intrinsic mapping logic of the access event-behavior rule query response encoding vector based on the retrieval-response context, the surface combinatorial mapping of the access event-behavior rule query response encoding vector is avoided, so as to achieve the logical dependency mapping of the access event-behavior rule query response encoding vector to the classification target domain while maintaining the intuitive response correlation, thereby improving the accuracy of the audit result obtained by inputting the access event-behavior rule query response encoding vector into the classifier-based database audit module.

[0074] In summary, the database security audit method based on the embodiment of the present application is explained, which extracts SQL statement access events from the DPI database log data, and then uses deep learning-based data processing technology to perform semantic analysis on SQL statement access events and preset user behavior rule sets, extracts SQL statement access events and semantic feature representations of each user behavior rule, and then, based on the global significant semantic features of the preset user behavior rule set, guides the query matching between SQL statement access events and user behavior rules, thereby realizing intelligent auditing of SQL statement access events. In this way, an in-depth understanding of access events and behavior rules can be achieved, effectively improving the accuracy and comprehensiveness of audit results, reducing the risk of false positives and false negatives, and thus improving the security protection capabilities of the database.

[0075] Furthermore, a database security audit system is also provided.

[0076] Figure 5 FIG. 1 is a block diagram of a database security audit system according to an embodiment of the present application. Figure 5 As shown, according to the database security audit system 100 of the embodiment of the present application, it includes: a log data acquisition module 110, which is used to acquire DPI database log data and extract SQL statement access events from the DPI database log data; a user behavior rule extraction module 120, which is used to extract a set of user behavior rules from a preset user behavior rule library; a semantic encoding module 130, which is used to semantically encode the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors; a query response encoding module 140, which is used to query response encode the set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors to obtain an access event-behavior rule query response encoding vector; an audit decision module 150, which is used to determine the audit result of the SQL statement access event based on the access event-behavior rule query response encoding vector.

[0077] The specific operations of each module in the above database security audit system have been referenced above. Figures 1 to 4 The description of the database security audit method has been introduced in detail, and therefore, its repeated description will be omitted.

[0078] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details of the above embodiments are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0079] In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the unit division is only a logical function division, and there may be other division methods in actual implementation. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0080] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0081] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0082] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A database security audit method, characterized in that: include: Obtaining DPI database log data, and extracting SQL statement access events from the DPI database log data; Extracting a set of user behavior rules from a preset user behavior rule library; Semantically encoding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors; Performing query response encoding on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector to obtain an access event-behavior rule query response encoding vector; Determining an audit result of the SQL statement access event based on the access event-behavior rule query response encoding vector; The query response encoding of the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector comprises: extracting significant semantic features of the set of the user behavior rule semantic encoding feature vector as a prompt template; based on the prompt template, guiding the cross-domain optimization query encoding between the SQL statement access event semantic encoding feature vector and the set of the user behavior rule semantic encoding feature vector to obtain the access event-behavior rule query response encoding vector, which comprises: Use the query embedding matrix and the value embedding matrix to perform linear embedding encoding on the SQL statement access event semantic encoding feature vector to obtain a value vector and a query vector respectively; Inputting the query vector, the value vector, the user behavior rule semantic encoding feature vector after each linear transformation in the key matrix and the prompt template into a heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimization query feature vectors; The query feature aggregation is performed on the set of the access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector.

2. The database security audit method according to claim 1, characterized in that: Semantically encoding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic encoding feature vectors and user behavior rule semantic encoding feature vectors, including: The SQL statement access event and each user behavior rule in the set of user behavior rules are respectively input into a semantic encoder based on the Transformer architecture to obtain a set of semantic encoding feature vectors of the SQL statement access event and a set of semantic encoding feature vectors of the user behavior rules.

3. The database security audit method according to claim 2 is characterized in that: Extracting significant semantic features of the set of semantic encoding feature vectors of the user behavior rules as a prompt template includes: Constructing a key matrix based on a set of semantically encoded feature vectors of user behavior rules; The maximum value of each key vector in the key matrix is ​​extracted to obtain a global significant semantic feature vector of the user behavior rule as the prompt template.

4. The database security audit method according to claim 3 is characterized in that: Constructing a key matrix based on the set of semantically encoded feature vectors of the user behavior rules, including: Using a key embedding matrix, linear embedding coding is performed on each user behavior rule semantic encoding feature vector in the set of user behavior rule semantic encoding feature vectors to obtain a set of user behavior rule semantic encoding feature vectors after linear transformation; The linearly transformed semantically encoded feature vector of the user behavior rule is used as the key vector, and the set of the linearly transformed semantically encoded feature vectors of the user behavior rule is arranged in a matrix to obtain the key matrix.

5. The database security audit method according to claim 4 is characterized in that: Inputting the query vector, the value vector, the user behavior rule semantic encoding feature vector after each linear transformation in the key matrix and the prompt template into the heterogeneous converter structure based on template prompt optimization to obtain a set of access event-behavior rule cross-domain optimization query feature vectors, including: Multiplying the query vector by the transposed vector of the key vector and dividing by the two-norm of the prompt template to obtain an attention score matrix; The attention score matrix is ​​multiplied by the prompt template after passing it through a softmax function to obtain a template prompt optimized attention weight vector; The template prompt optimized attention weight vector and the value vector are multiplied by the position point to obtain the access event-behavior rule cross-domain optimized query feature vector.

6. The database security audit method according to claim 5, characterized in that: Performing query feature aggregation on the set of the access event-behavior rule cross-domain optimization query feature vectors to obtain the access event-behavior rule query response encoding vector includes: The position-wise mean vector of the set of the access event-behavior rule cross-domain optimization query feature vectors is calculated to obtain the access event-behavior rule query response encoding vector.

7. The database security audit method according to claim 6, characterized in that: Determining an audit result of the SQL statement access event based on the access event-behavior rule query response encoding vector includes: The access event-behavior rule query response encoding vector is input into a classifier-based database audit module to obtain the audit result, which is a danger level label of the SQL statement access event.

8. A database security audit system, used to execute the database security audit method according to claim 1, characterized in that: include: A log data acquisition module, used to acquire DPI database log data and extract SQL statement access events from the DPI database log data; A user behavior rule extraction module is used to extract a set of user behavior rules from a preset user behavior rule library; A semantic coding module, used for semantically coding the SQL statement access event and each user behavior rule in the set of user behavior rules to obtain a set of SQL statement access event semantic coding feature vectors and user behavior rule semantic coding feature vectors; A query response encoding module, used for performing query response encoding on the set of the SQL statement access event semantic encoding feature vector and the user behavior rule semantic encoding feature vector to obtain an access event-behavior rule query response encoding vector; The audit decision module is used to determine the audit result of the SQL statement access event based on the access event-behavior rule query response coding vector.

Images