Database operation monitoring and grading method based on JAVA byte code instrumentation

Abstract

The invention discloses a database operation monitoring and grading method based on JAVA bytecode instrumentation, which automatically captures and analyzes the sensitivity of data called by an API (Application Program Interface) by non-invasively monitoring the connection, table operation and field access of an application program to a database before running, so as to realize refined data grading management. And a corresponding protection strategy is provided according to a hierarchical management result. Through the process, a scientific basis is provided for the formulation of a data protection strategy, which not only helps enterprises to better comply with data protection laws and regulations, but also can significantly improve the efficiency and security of data processing, and reduce potential risks caused by data leakage or abuse.

Description

Technical Field

[0001] The present invention relates to a database operation monitoring and grading method, and in particular to a database operation monitoring and grading method based on JAVA bytecode plugging. Background Art

[0002] With the widespread application of cloud computing and big data technologies, data has become one of the most valuable assets of enterprises. However, the risk of data leakage and abuse has also increased. Traditional data protection methods often rely on static code review or network traffic monitoring, which makes it difficult to accurately capture dynamic data operation behaviors during application runtime. Therefore, a technical means is needed to monitor and classify the data involved in API operations in real time and accurately.

[0003] For example, the patented bytecode instrumentation method, system and bytecode instrumentation plug-in framework (publication number CN113885879A) discloses a bytecode instrumentation method, including: responding to the compilation instruction of the project file, running the instrumentation plug-in, the instrumentation plug-in includes a basic configuration file, the basic configuration file includes the instrumentation processing rules configured according to the bytecode instrumentation requirements; parsing the basic configuration file and obtaining the instrumentation processing rules; obtaining the class to be instrumented through a specified interface; and processing the class to be instrumented according to the instrumentation processing rules to achieve the bytecode instrumentation requirements. It can be seen from the comparative documents that the instrumentation technology is mature, and the comparative documents provide the form of forming bytecode instrumentation, but the comparative documents do not provide guidance on how to use it in actual applications, and only adopt the form of bytecode instrumentation. The comparative documents are not precedents. Specifically, in order to be able to be applied to specific actual operations, we need to further develop the application method and scope of bytecode instrumentation. Summary of the invention

[0004] Purpose of the invention: The purpose of the present invention is to provide a database operation monitoring and grading method based on JAVA bytecode instrumentation, which can apply the technical means of bytecode instrumentation in practice, so that the non-invasive effect of the technical means of bytecode instrumentation can be retained; the present invention also has a purpose. After monitoring and obtaining monitoring data, we need to apply different strategies to different monitoring results. Therefore, this application provides a new operation grading method, so that the system protection has levels, does not form system redundancy, and does not waste system resources.

[0005] Technical solution: A database operation monitoring and grading method based on JAVA bytecode instrumentation is implemented in a computer according to the following steps:

[0006] 1) Design bytecode instrumentation tool based on Javassist library;

[0007] 2) Before the application is executed, the monitoring code is inserted through the Javassist API;

[0008] 3) The monitoring code automatically captures SQL statements;

[0009] 4) Parse the captured SQL statements;

[0010] 5) Based on the parsed result of step 4) and the pre-imported API operation data classification standard, the captured SQL statements are classified;

[0011] 6) Based on the data classification result completed in step 5), the SQL statement is protected using the corresponding application protection standard;

[0012] 7) Generate database operation monitoring report.

[0013] In actual applications, it is important to know where to insert the monitoring code. This application creatively proposes to implement monitoring and analysis before the application is executed, so that this application is no longer a means but a strategy aimed at curbing the crisis in the bud.

[0014] If we monitor after the application is executed, there will be a lag in the operation and we will not be able to eliminate the system crisis in real time. At the same time, the strategy focuses more on prevention. Therefore, this application introduces protection strategies to cope with different classification situations. Through repeated protection, we can complete the simple vulnerability improvement and major vulnerability detection of the system before the crisis occurs.

[0015] Furthermore, in the step 1), the bytecode instrumentation tool is based on the Javassist library, and the monitoring code is inserted into a specified position in the compiled bytecode through the bytecode operation library.

[0016] It is emphasized that the environment corresponding to this application is a compilation environment, and it is emphasized that what is inserted is into the compiled bytecode.

[0017] Furthermore, the step 1) also includes pre-importing API operation data classification standards, which are in the form of a table, and define different classifications for different operation types in SQL statements and provide corresponding protection strategies.

[0018] Different database operation statements correspond to different sensitivity levels. For example, UPDATE and DELETE statements have higher sensitivity levels than SELECT statements because UPDATE and DELETE statements change field data and are more likely to have serious consequences. Therefore, the corresponding monitoring strategies need to focus more on them.

[0019] Furthermore, in the step 2), the monitoring code is selected to be inserted into the prepareStatement method of the java.sql.Connection class.

[0020] Furthermore, in the step 2), before the prepareStatement method is executed, monitoring code is inserted through the Javassist API to ensure that the required data is obtained before the SQL statement is executed.

[0021] Provides the specific location before the specific application is executed, corresponding to the actual operation.

[0022] Furthermore, in step 3), the captured SQL statement is initialized, comments and invalid symbols are removed, so that the SQL statement can be recognized, and at least the string, call stack information, database type, address, port and user name in the SQL statement are retained.

[0023] Specifically, the initialization operations include: deleting comments in SQL statements; unifying the case of SQL statements; removing redundant semicolons, brackets, and meaningless characters; standardizing SQL keywords and symbols, including keyword alignment and symbol alignment; and verifying the integrity of SQL statements to ensure that they are executable. The ultimate goal of these operations is to improve recognition accuracy and prevent misoperation.

[0024] Furthermore, in the step 4), the database name, table name, field name and operation type of the operation are extracted from the captured and initialized SQL statement.

[0025] Furthermore, in step 6), for the API operation data that has been classified, an early warning is provided after reaching a specific sensitivity level.

[0026] Furthermore, in step 7), the database operation monitoring report at least includes operation details, data level and classification results.

[0027] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0028] 1. The present invention provides the ability to classify API data, and can automatically identify and distinguish sensitive data from non-sensitive data. This classification not only helps to manage data access rights more finely, but also ensures that sensitive data is protected at a higher level, reducing the risk of data leakage.

[0029] 2. Through API data grading and classification, the present invention can implement stricter data access control and encryption measures to ensure that only authorized users can access sensitive data, greatly enhancing data security and privacy protection, and meeting the strict requirements of enterprises and organizations for data protection.

[0030] 3. With the increasingly stringent data protection regulations, such as GDPR, HIPAA, etc., enterprises need to ensure that their data processing activities comply with relevant regulatory requirements. The present invention helps organizations more easily identify sensitive data through API data classification and take corresponding security measures to ensure compliance, thereby avoiding legal risks and fines. DETAILED DESCRIPTION

[0031] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments.

[0032] Example

[0033] A database operation monitoring and grading method based on JAVA bytecode instrumentation is implemented in a computer according to the following steps:

[0034] 1) Design bytecode instrumentation tool based on Javassist library;

[0035] The bytecode instrumentation tool is based on the Javassist library. In the compiled bytecode, the monitoring code is inserted into the specified location through the bytecode operation library.

[0036] Pre-import API operation data classification standards, which are in table form, and define different classifications for different operation types in SQL statements and provide corresponding protection strategies.

[0037] The following is a table for reference:

[0038] Table 1 API operation data classification and protection comparison table

[0039]

[0040]

[0041] As shown in the table above, API operations that operate public or non-sensitive data, such as DETECT, correspond to the L1 level protection strategy, which is a low-level risk. Corresponding operations that require modification to system code, such as UPDATE and DELETE statements, are high-level risks and can be summarized as L4. For API operations that exceed the L2 level, early warnings can be issued, thus forming an overall and complete protection strategy.

[0042] 2) Before the application is executed, the monitoring code is inserted through the Javassist API;

[0043] Choose to insert the monitoring code in the prepareStatement method of the java.sql.Connection class. Specifically, before the prepareStatement method is executed, insert the monitoring code through the Javassist API to ensure that the required data is obtained before the SQL statement is executed.

[0044] Sample code:

[0045] / / Javassist library instrumentation example code

[0046] ClassPool pool=ClassPool.getDefault();

[0047] CtClass cc=pool.get("java.sql.Connection");

[0048] / / Get the prepareStatement method

[0049] CtMethod m=cc.getDeclaredMethod("prepareStatement");

[0050] / / Insert code before the method to ensure that relevant information is captured before the SQL statement is executed

[0051] m.insertBefore("{"+

[0052] "System.out.println(\"SQL:\"+$1);"+

[0053] "String user=System.getProperty(\"user.name\");"+

[0054] "System.out.println(\"User:\"+user);"+

[0055] "captureDatabaseDetails($0);"+ / / Assume there is a method to capture database connection details

[0056] 3) The monitoring code automatically captures SQL statements;

[0057] In step 3), the captured SQL statement is initialized (initialization is a conventional technical means, no code is provided), comments and invalid symbols are removed, so that the SQL statement can be recognized, and at least the string, call stack information, database type, address, port and user name in the SQL statement are retained.

[0058] Sample code:

[0059] / / Capture call stack information

[0060] "captureStackTrace(Thread.currentThread().getStackTrace());"+

[0061] 4) Parse the captured SQL statements;

[0062] Extract the database name, table name, field name and operation type of the operation from the captured and initialized SQL statement.

[0063] Sample code:

[0064] / / Data capture and classification code

[0065] public void captureDatabaseDetails(Connection conn){

[0066] / / Logic is used to capture database connection details, such as URL, table name, etc.

[0067] System.out.println("Database URL:"+conn.getMetaData().getURL());

[0068] / / Other detailed information capture logic

[0069] }

[0070] public void captureStackTrace(StackTraceElement[]stackTrace){

[0071] / / Logic used to capture and process call stack information

[0072] for(StackTraceElement element:stackTrace){

[0073] System.out.println("at"+element);

[0074] }

[0075] }

[0076] 5) Based on the parsed result of step 4) and the pre-imported API operation data classification standard, the captured SQL statements are classified;

[0077] opublic int classifyData(String sql){

[0078] / / Logic is used to classify and grade data in SQL statements

[0079] / / Example: Determine the sensitivity level based on the table name or field of the SQL operation

[0080] if(sql.contains("highly_sensitive_table")){

[0081] return 4; / / Return to the highest sensitivity level L4

[0082] }else if(sql.contains("sensitive_table")){

[0083] return 3; / / Return to higher sensitivity level L3

[0084] }else if(sql.contains("moderate_table")){

[0085] return 2; / / Return to medium sensitivity level L2

[0086] }

[0087] return 1; / / Return to the lowest sensitivity level L1

[0088] }

[0089] 6) Based on the data classification result completed in step 5), the SQL statement is protected using the corresponding application protection standard;

[0090] opublic void triggerAlert(int level,String sql){

[0091] / / Logic used to trigger the warning

[0092] System.out.println("Alert triggered for SQL:"+sql+"with sensitivitylevel:L"+level);

[0093] }

[0094] Or for API operation data that has been graded, provide an early warning when it reaches a certain sensitivity level. The sample code is as follows:

[0095] "if(sensitivityLevel>=2){"+ / / If the level is L2 or above, trigger an alert

[0096] "triggerAlert(sensitivityLevel,$1);"+ / / trigger alert

[0097] "}"+

[0098] "}");

[0099] 7) Generate database operation monitoring report, including operation details, data level and classification results.

[0100] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A database operation monitoring and grading method based on JAVA bytecode instrumentation, characterized in that: On your computer, follow these steps: 1) Design bytecode instrumentation tool based on Javassist library; 2) Before the application is executed, the monitoring code is inserted through the Javassist API; 3) The monitoring code automatically captures SQL statements; 4) Parse the captured SQL statements; 5) Based on the parsed result of step 4) and the pre-imported API operation data classification standard, the captured SQL statements are classified; 6) Based on the data classification result completed in step 5), the SQL statement is protected using the corresponding application protection standard; 7) Generate database operation monitoring report.

2. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 1), the bytecode plugging tool is based on the Javassist library, and the monitoring code is inserted into the specified position in the compiled bytecode through the bytecode operation library.

3. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: The step 1) also includes pre-importing the API operation data classification standard, which is in the form of a table, and defines different classifications for different operation types in SQL statements and provides corresponding protection strategies.

4. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 2), choose to insert the monitoring code into the prepareStatement method of the java.sql.Connection class.

5. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 2 is characterized in that: In the step 2), before the prepareStatement method is executed, the monitoring code is inserted through the Javassist API to ensure that the required data is obtained before the SQL statement is executed.

6. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 3), the captured SQL statement is initialized, comments and invalid symbols are removed, so that the SQL statement can be recognized, and at least the character string, call stack information, database type, address, port and user name in the SQL statement are retained.

7. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 4), the database name, table name, field name and operation type of the operation are extracted from the captured and initialized SQL statement.

8. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 6), for the API operation data that has been classified, an early warning is provided after reaching a specific sensitivity level.

9. The database operation monitoring and grading method based on JAVA bytecode instrumentation according to claim 1, characterized in that: In the step 7), the database operation monitoring report at least includes operation details, data level and classification results.

Images